ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(guardduty): add new check guardduty_rds_protection_enabled (#5100)

Browse Source
This commit is contained in:
Hugo Pereira Brito
2024-09-19 19:52:17 +02:00
committed by GitHub
parent 8f0bf5e896
commit 7db0746416
6 changed files with 210 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/providers/aws/services/guardduty/guardduty_rds_protection_enabled/guardduty_rds_protection_enabled_test.py
+139
View File
@@ -0,0 +1,139 @@
from unittest import mock
from prowler.providers.aws.services.guardduty.guardduty_service import Detector
from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_US_EAST_1
class Test_guardduty_rds_protection_enabled:
def test_no_detectors(self):
guardduty_client = mock.MagicMock()
guardduty_client.detectors = []
with mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_service.GuardDuty",
new=guardduty_client,
), mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled.guardduty_client",
new=guardduty_client,
):
from prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled import (
guardduty_rds_protection_enabled,
)
check = guardduty_rds_protection_enabled()
result = check.execute()
assert len(result) == 0
def test_detector_disabled(self):
guardduty_client = mock.MagicMock()
detector_arn = f"arn:aws:guardduty:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:detector/1234567890"
guardduty_client.detectors = [
Detector(
id="1234567890",
arn=detector_arn,
region=AWS_REGION_US_EAST_1,
tags=[],
enabled_in_account=False,
rds_protection=False,
)
]
with mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_service.GuardDuty",
new=guardduty_client,
), mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled.guardduty_client",
new=guardduty_client,
):
from prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled import (
guardduty_rds_protection_enabled,
)
check = guardduty_rds_protection_enabled()
result = check.execute()
assert len(result) == 0
def test_detector_enabled_rds_protection_disabled(self):
guardduty_client = mock.MagicMock()
detector_arn = f"arn:aws:guardduty:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:detector/1234567890"
guardduty_client.detectors = [
Detector(
id="1234567890",
arn=detector_arn,
region=AWS_REGION_US_EAST_1,
tags=[],
enabled_in_account=True,
rds_protection=False,
status=True,
)
]
with mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_service.GuardDuty",
new=guardduty_client,
), mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled.guardduty_client",
new=guardduty_client,
):
from prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled import (
guardduty_rds_protection_enabled,
)
check = guardduty_rds_protection_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "GuardDuty detector does not have RDS Protection enabled."
)
assert result[0].resource_id == "1234567890"
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_arn == detector_arn
assert result[0].resource_tags == []
def test_detector_enabled_rds_protection_enabled(self):
guardduty_client = mock.MagicMock()
detector_arn = f"arn:aws:guardduty:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:detector/1234567890"
guardduty_client.detectors = [
Detector(
id="1234567890",
arn=detector_arn,
region=AWS_REGION_US_EAST_1,
tags=[],
enabled_in_account=True,
rds_protection=True,
status=True,
)
]
with mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_service.GuardDuty",
new=guardduty_client,
), mock.patch(
"prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled.guardduty_client",
new=guardduty_client,
):
from prowler.providers.aws.services.guardduty.guardduty_rds_protection_enabled.guardduty_rds_protection_enabled import (
guardduty_rds_protection_enabled,
)
check = guardduty_rds_protection_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "GuardDuty detector has RDS Protection enabled."
)
assert result[0].resource_id == "1234567890"
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_arn == detector_arn
assert result[0].resource_tags == []
tests/providers/aws/services/guardduty/guardduty_service_test.py
+6 -1
View File
@@ -109,7 +109,10 @@ class Test_GuardDuty_Service:
# Test GuardDuty session
def test_get_detector(self):
guardduty_client = client("guardduty", region_name=AWS_REGION_EU_WEST_1)
response = guardduty_client.create_detector(Enable=True)
response = guardduty_client.create_detector(
Enable=True,
DataSources={"S3Logs": {"Enable": True}},
)
aws_provider = set_mocked_aws_provider()
guardduty = GuardDuty(aws_provider)
@@ -124,6 +127,8 @@ class Test_GuardDuty_Service:
assert len(guardduty.detectors[0].findings) == 1
assert guardduty.detectors[0].member_accounts == ["123456789012"]
assert guardduty.detectors[0].administrator_account == "123456789013"
assert guardduty.detectors[0].s3_protection
assert not guardduty.detectors[0].rds_protection
assert guardduty.detectors[0].region == AWS_REGION_EU_WEST_1
assert guardduty.detectors[0].tags == [{"test": "test"}]