ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(aws_mutelist): Add more Control Tower resources and tests (#4900)

Browse Source
This commit is contained in:
Pepe Fagoaga
2024-08-30 10:13:00 +02:00
committed by GitHub
parent 285eb45673
commit 80c4802b36
2 changed files with 134 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/config/aws_mutelist.yaml
+5 -2
View File
@@ -19,8 +19,11 @@ Mutelist:
- "StackSet-AWSControlTowerSecurityResources-*"
- "StackSet-AWSControlTowerLoggingResources-*"
- "StackSet-AWSControlTowerExecutionRole-*"
- "AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER"
- "AWSControlTowerBP-BASELINE-CONFIG-MASTER"
- "AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER*"
- "AWSControlTowerBP-BASELINE-CONFIG-MASTER*"
- "StackSet-AWSControlTower*"
- "CLOUDTRAIL-ENABLED-ON-SHARED-ACCOUNTS-*"
- "AFT-Backend*"
"cloudtrail_*":
Regions:
- "*"
tests/providers/aws/lib/mutelist/aws_mutelist_test.py
+129
View File
@@ -1,5 +1,6 @@
import io
from json import dumps
from os import path
import botocore
import yaml
@@ -843,6 +844,134 @@ class TestAWSMutelist:
"",
)
def test_is_muted_aws_default_mutelist(
self,
):
mutelist = AWSMutelist(
mutelist_path=f"{path.dirname(path.realpath(__file__))}/../../../../../prowler/config/aws_mutelist.yaml"
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerBP-BASELINE-CONFIG-AAAAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerBP-BASELINE-CLOUDWATCH-AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED-AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerGuardrailAWS-GR-DETECT",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"CLOUDTRAIL-ENABLED-ON-SHARED-ACCOUNTS-AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerBP-BASELINE-SERVICE-LINKED-ROLE-AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerBP-BASELINE-ROLES-AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerBP-SECURITY-TOPICS-AAAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerBP-BASELINE-SERVICE-ROLES-AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerSecurityResources-AAAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED-AAAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"AFT-Backend/AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"AWSControlTowerBP-BASELINE-CONFIG-MASTER/AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"AWSControlTowerBP-BASELINE-CLOUDTRAIL-MASTER/AAA",
"",
)
assert mutelist.is_muted(
AWS_ACCOUNT_NUMBER,
"cloudformation_stacks_termination_protection_enabled",
AWS_REGION_EU_WEST_1,
"StackSet-AWSControlTowerBP-VPC-ACCOUNT-FACTORY-V1-AAA",
"",
)
def test_is_muted_single_account(self):
# Mutelist
mutelist_content = {