diff --git a/prowler/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured.metadata.json b/prowler/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured.metadata.json index 9bf10d290a..92c8f2da69 100644 --- a/prowler/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured.metadata.json +++ b/prowler/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured.metadata.json @@ -5,23 +5,25 @@ "CheckType": [], "ServiceName": "functiongraph", "SubServiceName": "", - "ResourceIdTemplate": "function/{function_id}", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "FunctionGraphFunction", "ResourceGroup": "serverless", - "Description": "Ensure FunctionGraph functions are associated with a VPC to restrict network access", - "Risk": "Functions not associated with a VPC have direct internet access without network restrictions, increasing the attack surface", + "Description": "Ensure FunctionGraph functions are attached to a VPC so workloads that require private connectivity can use VPC network controls.", + "Risk": "Functions without a VPC attachment cannot privately access VPC resources such as databases or internal services. They may depend on public service endpoints, reducing network isolation and increasing exposure to public-network paths.", "RelatedUrl": "", - "AdditionalURLs": [], + "AdditionalURLs": [ + "https://support.huaweicloud.com/intl/en-us/api-functiongraph/functiongraph_06_0111.html" + ], "Remediation": { "Code": { "CLI": "", "NativeIaC": "", - "Other": "", + "Other": "In the FunctionGraph console, open the function, edit its network configuration, select the required VPC, subnet, and security groups, and save the configuration.", "Terraform": "" }, "Recommendation": { - "Text": "Associate the FunctionGraph function with a VPC to restrict network access", + "Text": "Attach functions that require private resource access to an appropriate VPC, subnet, and least-privilege security groups.", "Url": "https://hub.prowler.com/check/functiongraph_function_vpc_configured" } }, diff --git a/tests/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured_test.py b/tests/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured_test.py index d3f3ceea3f..c62896d7aa 100644 --- a/tests/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured_test.py +++ b/tests/providers/huaweicloud/services/functiongraph/functiongraph_function_vpc_configured/functiongraph_function_vpc_configured_test.py @@ -1,11 +1,26 @@ from unittest import mock +from prowler.lib.check.models import CheckMetadata from tests.providers.huaweicloud.huaweicloud_fixtures import ( set_mocked_huaweicloud_provider, ) class Test_functiongraph_function_vpc_configured: + def test_metadata_describes_vpc_attachment_accurately(self): + metadata = CheckMetadata.parse_file( + "prowler/providers/huaweicloud/services/functiongraph/" + "functiongraph_function_vpc_configured/" + "functiongraph_function_vpc_configured.metadata.json" + ) + + assert metadata.ResourceIdTemplate == "" + assert "direct internet access" not in metadata.Risk + assert metadata.AdditionalURLs == [ + "https://support.huaweicloud.com/intl/en-us/api-functiongraph/functiongraph_06_0111.html" + ] + assert metadata.Remediation.Code.Other + def test_functiongraph_vpc_configured_pass(self): functiongraph_client = mock.MagicMock()