diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 74e9332e34..b953610fa1 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,6 +1,28 @@ +# SDK /* @prowler-cloud/sdk -/.github/ @prowler-cloud/sdk -prowler @prowler-cloud/sdk @prowler-cloud/detection-and-remediation -tests @prowler-cloud/sdk @prowler-cloud/detection-and-remediation -api @prowler-cloud/api -ui @prowler-cloud/ui \ No newline at end of file +/prowler/ @prowler-cloud/sdk @prowler-cloud/detection-and-remediation +/tests/ @prowler-cloud/sdk @prowler-cloud/detection-and-remediation +/dashboard/ @prowler-cloud/sdk +/docs/ @prowler-cloud/sdk +/examples/ @prowler-cloud/sdk +/util/ @prowler-cloud/sdk +/contrib/ @prowler-cloud/sdk +/permissions/ @prowler-cloud/sdk +/codecov.yml @prowler-cloud/sdk @prowler-cloud/api + +# API +/api/ @prowler-cloud/api + +# UI +/ui/ @prowler-cloud/ui + +# AI +/mcp_server/ @prowler-cloud/ai + +# Platform +/.github/ @prowler-cloud/platform +/Makefile @prowler-cloud/platform +/kubernetes/ @prowler-cloud/platform +**/Dockerfile* @prowler-cloud/platform +**/docker-compose*.yml @prowler-cloud/platform +**/docker-compose*.yaml @prowler-cloud/platform diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index fa4c805d85..fcba29ca1f 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -3,6 +3,41 @@ description: Create a report to help us improve labels: ["bug", "status/needs-triage"] body: + - type: checkboxes + id: search + attributes: + label: Issue search + options: + - label: I have searched the existing issues and this bug has not been reported yet + required: true + - type: dropdown + id: component + attributes: + label: Which component is affected? + multiple: true + options: + - Prowler CLI/SDK + - Prowler API + - Prowler UI + - Prowler Dashboard + - Prowler MCP Server + - Documentation + - Other + validations: + required: true + - type: dropdown + id: provider + attributes: + label: Cloud Provider (if applicable) + multiple: true + options: + - AWS + - Azure + - GCP + - Kubernetes + - GitHub + - Microsoft 365 + - Not applicable - type: textarea id: reproduce attributes: @@ -78,6 +113,15 @@ body: prowler --version validations: required: true + - type: input + id: python-version + attributes: + label: Python version + description: Which Python version are you using? + placeholder: |- + python --version + validations: + required: true - type: input id: pip-version attributes: diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 3ba13e0cec..6e7c21013b 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1 +1,11 @@ blank_issues_enabled: false +contact_links: + - name: 📖 Documentation + url: https://docs.prowler.com + about: Check our comprehensive documentation for guides and tutorials + - name: đŸ’Ŧ GitHub Discussions + url: https://github.com/prowler-cloud/prowler/discussions + about: Ask questions and discuss with the community + - name: 🌟 Prowler Community + url: https://goto.prowler.com/slack + about: Join our community for support and updates diff --git a/.github/ISSUE_TEMPLATE/feature-request.yml b/.github/ISSUE_TEMPLATE/feature-request.yml index 528723b717..3e3510496f 100644 --- a/.github/ISSUE_TEMPLATE/feature-request.yml +++ b/.github/ISSUE_TEMPLATE/feature-request.yml @@ -3,6 +3,42 @@ description: Suggest an idea for this project labels: ["feature-request", "status/needs-triage"] body: + - type: checkboxes + id: search + attributes: + label: Feature search + options: + - label: I have searched the existing issues and this feature has not been requested yet or is already in our [Public Roadmap](https://roadmap.prowler.com/roadmap) + required: true + - type: dropdown + id: component + attributes: + label: Which component would this feature affect? + multiple: true + options: + - Prowler CLI/SDK + - Prowler API + - Prowler UI + - Prowler Dashboard + - Prowler MCP Server + - Documentation + - New component/Integration + validations: + required: true + - type: dropdown + id: provider + attributes: + label: Related to specific cloud provider? + multiple: true + options: + - AWS + - Azure + - GCP + - Kubernetes + - GitHub + - Microsoft 365 + - All providers + - Not provider-specific - type: textarea id: Problem attributes: @@ -19,6 +55,14 @@ body: description: A clear and concise description of what you want to happen. validations: required: true + - type: textarea + id: use-case + attributes: + label: Use case and benefits + description: Who would benefit from this feature and how? + placeholder: This would help security teams by... + validations: + required: true - type: textarea id: Alternatives attributes: diff --git a/.github/actions/setup-python-poetry/action.yml b/.github/actions/setup-python-poetry/action.yml new file mode 100644 index 0000000000..3b774262f9 --- /dev/null +++ b/.github/actions/setup-python-poetry/action.yml @@ -0,0 +1,71 @@ +name: 'Setup Python with Poetry' +description: 'Setup Python environment with Poetry and install dependencies' +author: 'Prowler' + +inputs: + python-version: + description: 'Python version to use' + required: true + working-directory: + description: 'Working directory for Poetry' + required: false + default: '.' + poetry-version: + description: 'Poetry version to install' + required: false + default: '2.1.1' + install-dependencies: + description: 'Install Python dependencies with Poetry' + required: false + default: 'true' + +runs: + using: 'composite' + steps: + - name: Replace @master with current branch in pyproject.toml + if: github.event_name == 'pull_request' && github.base_ref == 'master' + shell: bash + working-directory: ${{ inputs.working-directory }} + run: | + BRANCH_NAME="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}" + echo "Using branch: $BRANCH_NAME" + sed -i "s|@master|@$BRANCH_NAME|g" pyproject.toml + + - name: Install poetry + shell: bash + run: | + python -m pip install --upgrade pip + pipx install poetry==${{ inputs.poetry-version }} + + - name: Update SDK resolved_reference to latest commit + if: github.event_name == 'push' && github.ref == 'refs/heads/master' + shell: bash + working-directory: ${{ inputs.working-directory }} + run: | + LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha') + echo "Latest commit hash: $LATEST_COMMIT" + sed -i '/url = "https:\/\/github\.com\/prowler-cloud\/prowler\.git"/,/resolved_reference = / { + s/resolved_reference = "[a-f0-9]\{40\}"/resolved_reference = "'"$LATEST_COMMIT"'"/ + }' poetry.lock + echo "Updated resolved_reference:" + grep -A2 -B2 "resolved_reference" poetry.lock + + - name: Update poetry.lock + shell: bash + working-directory: ${{ inputs.working-directory }} + run: poetry lock + + - name: Set up Python ${{ inputs.python-version }} + uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 + with: + python-version: ${{ inputs.python-version }} + cache: 'poetry' + cache-dependency-path: ${{ inputs.working-directory }}/poetry.lock + + - name: Install Python dependencies + if: inputs.install-dependencies == 'true' + shell: bash + working-directory: ${{ inputs.working-directory }} + run: | + poetry install --no-root + poetry run pip list diff --git a/.github/actions/trivy-scan/action.yml b/.github/actions/trivy-scan/action.yml new file mode 100644 index 0000000000..91c4c4d332 --- /dev/null +++ b/.github/actions/trivy-scan/action.yml @@ -0,0 +1,152 @@ +name: 'Container Security Scan with Trivy' +description: 'Scans container images for vulnerabilities using Trivy and reports results' +author: 'Prowler' + +inputs: + image-name: + description: 'Container image name to scan' + required: true + image-tag: + description: 'Container image tag to scan' + required: true + default: ${{ github.sha }} + severity: + description: 'Severities to scan for (comma-separated)' + required: false + default: 'CRITICAL,HIGH,MEDIUM,LOW' + fail-on-critical: + description: 'Fail the build if critical vulnerabilities are found' + required: false + default: 'false' + upload-sarif: + description: 'Upload results to GitHub Security tab' + required: false + default: 'true' + create-pr-comment: + description: 'Create a comment on the PR with scan results' + required: false + default: 'true' + artifact-retention-days: + description: 'Days to retain the Trivy report artifact' + required: false + default: '2' + +outputs: + critical-count: + description: 'Number of critical vulnerabilities found' + value: ${{ steps.security-check.outputs.critical }} + high-count: + description: 'Number of high vulnerabilities found' + value: ${{ steps.security-check.outputs.high }} + total-count: + description: 'Total number of vulnerabilities found' + value: ${{ steps.security-check.outputs.total }} + +runs: + using: 'composite' + steps: + - name: Run Trivy vulnerability scan (SARIF) + if: inputs.upload-sarif == 'true' + uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1 + with: + image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }} + format: 'sarif' + output: 'trivy-results.sarif' + severity: 'CRITICAL,HIGH' + exit-code: '0' + + - name: Upload Trivy results to GitHub Security tab + if: inputs.upload-sarif == 'true' + uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 + with: + sarif_file: 'trivy-results.sarif' + category: 'trivy-container' + + - name: Run Trivy vulnerability scan (JSON) + uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1 + with: + image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }} + format: 'json' + output: 'trivy-report.json' + severity: ${{ inputs.severity }} + exit-code: '0' + + - name: Upload Trivy report artifact + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + if: always() + with: + name: trivy-scan-report-${{ inputs.image-name }} + path: trivy-report.json + retention-days: ${{ inputs.artifact-retention-days }} + + - name: Generate security summary + id: security-check + shell: bash + run: | + CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' trivy-report.json) + HIGH=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="HIGH")] | length' trivy-report.json) + TOTAL=$(jq '[.Results[]?.Vulnerabilities[]?] | length' trivy-report.json) + + echo "critical=$CRITICAL" >> $GITHUB_OUTPUT + echo "high=$HIGH" >> $GITHUB_OUTPUT + echo "total=$TOTAL" >> $GITHUB_OUTPUT + + echo "### 🔒 Container Security Scan" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "**Image:** \`${{ inputs.image-name }}:${{ inputs.image-tag }}\`" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "- 🔴 Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY + echo "- 🟠 High: $HIGH" >> $GITHUB_STEP_SUMMARY + echo "- **Total**: $TOTAL" >> $GITHUB_STEP_SUMMARY + + - name: Comment scan results on PR + if: inputs.create-pr-comment == 'true' && github.event_name == 'pull_request' + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + env: + IMAGE_NAME: ${{ inputs.image-name }} + GITHUB_SHA: ${{ inputs.image-tag }} + SEVERITY: ${{ inputs.severity }} + with: + script: | + const comment = require('./.github/scripts/trivy-pr-comment.js'); + + // Unique identifier to find our comment + const marker = ''; + const body = marker + '\n' + comment; + + // Find existing comment + const { data: comments } = await github.rest.issues.listComments({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + }); + + const existingComment = comments.find(c => c.body?.includes(marker)); + + if (existingComment) { + // Update existing comment + await github.rest.issues.updateComment({ + owner: context.repo.owner, + repo: context.repo.repo, + comment_id: existingComment.id, + body: body + }); + console.log('✅ Updated existing Trivy scan comment'); + } else { + // Create new comment + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + body: body + }); + console.log('✅ Created new Trivy scan comment'); + } + + - name: Check for critical vulnerabilities + if: inputs.fail-on-critical == 'true' && steps.security-check.outputs.critical != '0' + shell: bash + run: | + echo "::error::Found ${{ steps.security-check.outputs.critical }} critical vulnerabilities" + echo "::warning::Please update packages or use a different base image" + exit 1 diff --git a/.github/codeql/api-codeql-config.yml b/.github/codeql/api-codeql-config.yml index 9ce26a3651..0925ea4a33 100644 --- a/.github/codeql/api-codeql-config.yml +++ b/.github/codeql/api-codeql-config.yml @@ -1,3 +1,12 @@ -name: "API - CodeQL Config" +name: 'API: CodeQL Config' paths: - - "api/" + - 'api/' + +paths-ignore: + - 'api/tests/**' + - 'api/**/__pycache__/**' + - 'api/**/migrations/**' + - 'api/**/*.md' + +queries: + - uses: security-and-quality diff --git a/.github/codeql/sdk-codeql-config.yml b/.github/codeql/sdk-codeql-config.yml index 7982398f42..4c933ecbda 100644 --- a/.github/codeql/sdk-codeql-config.yml +++ b/.github/codeql/sdk-codeql-config.yml @@ -1,4 +1,18 @@ -name: "SDK - CodeQL Config" +name: 'SDK: CodeQL Config' +paths: + - 'prowler/' + paths-ignore: - - "api/" - - "ui/" + - 'api/' + - 'ui/' + - 'dashboard/' + - 'mcp_server/' + - 'tests/**' + - 'util/**' + - 'contrib/**' + - 'examples/**' + - 'prowler/**/__pycache__/**' + - 'prowler/**/*.md' + +queries: + - uses: security-and-quality diff --git a/.github/codeql/ui-codeql-config.yml b/.github/codeql/ui-codeql-config.yml index fa4f80cae5..2eb4eebe87 100644 --- a/.github/codeql/ui-codeql-config.yml +++ b/.github/codeql/ui-codeql-config.yml @@ -1,3 +1,17 @@ -name: "UI - CodeQL Config" +name: 'UI: CodeQL Config' paths: - - "ui/" + - 'ui/' + +paths-ignore: + - 'ui/node_modules/**' + - 'ui/.next/**' + - 'ui/out/**' + - 'ui/tests/**' + - 'ui/**/*.test.ts' + - 'ui/**/*.test.tsx' + - 'ui/**/*.spec.ts' + - 'ui/**/*.spec.tsx' + - 'ui/**/*.md' + +queries: + - uses: security-and-quality diff --git a/.github/scripts/trivy-pr-comment.js b/.github/scripts/trivy-pr-comment.js new file mode 100644 index 0000000000..eb725b1af1 --- /dev/null +++ b/.github/scripts/trivy-pr-comment.js @@ -0,0 +1,102 @@ +const fs = require('fs'); + +// Configuration from environment variables +const REPORT_FILE = process.env.TRIVY_REPORT_FILE || 'trivy-report.json'; +const IMAGE_NAME = process.env.IMAGE_NAME || 'container-image'; +const GITHUB_SHA = process.env.GITHUB_SHA || 'unknown'; +const GITHUB_REPOSITORY = process.env.GITHUB_REPOSITORY || ''; +const GITHUB_RUN_ID = process.env.GITHUB_RUN_ID || ''; +const SEVERITY = process.env.SEVERITY || 'CRITICAL,HIGH,MEDIUM,LOW'; + +// Parse severities to scan +const scannedSeverities = SEVERITY.split(',').map(s => s.trim()); + +// Read and parse the Trivy report +const report = JSON.parse(fs.readFileSync(REPORT_FILE, 'utf-8')); + +let vulnCount = 0; +let vulnsByType = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 }; +let affectedPackages = new Set(); + +if (report.Results && Array.isArray(report.Results)) { + for (const result of report.Results) { + if (result.Vulnerabilities && Array.isArray(result.Vulnerabilities)) { + for (const vuln of result.Vulnerabilities) { + vulnCount++; + if (vulnsByType[vuln.Severity] !== undefined) { + vulnsByType[vuln.Severity]++; + } + if (vuln.PkgName) { + affectedPackages.add(vuln.PkgName); + } + } + } + } +} + +const shortSha = GITHUB_SHA.substring(0, 7); +const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19) + ' UTC'; + +// Severity icons and labels +const severityConfig = { + CRITICAL: { icon: '🔴', label: 'Critical' }, + HIGH: { icon: '🟠', label: 'High' }, + MEDIUM: { icon: '🟡', label: 'Medium' }, + LOW: { icon: 'đŸ”ĩ', label: 'Low' } +}; + +let comment = '## 🔒 Container Security Scan\n\n'; +comment += `**Image:** \`${IMAGE_NAME}:${shortSha}\`\n`; +comment += `**Last scan:** ${timestamp}\n\n`; + +if (vulnCount === 0) { + comment += '### ✅ No Vulnerabilities Detected\n\n'; + comment += 'The container image passed all security checks. No known CVEs were found.\n'; +} else { + comment += '### 📊 Vulnerability Summary\n\n'; + comment += '| Severity | Count |\n'; + comment += '|----------|-------|\n'; + + // Only show severities that were scanned + for (const severity of scannedSeverities) { + const config = severityConfig[severity]; + const count = vulnsByType[severity] || 0; + const isBold = (severity === 'CRITICAL' || severity === 'HIGH') && count > 0; + const countDisplay = isBold ? `**${count}**` : count; + comment += `| ${config.icon} ${config.label} | ${countDisplay} |\n`; + } + + comment += `| **Total** | **${vulnCount}** |\n\n`; + + if (affectedPackages.size > 0) { + comment += `**${affectedPackages.size}** package(s) affected\n\n`; + } + + if (vulnsByType.CRITICAL > 0) { + comment += '### ⚠ī¸ Action Required\n\n'; + comment += '**Critical severity vulnerabilities detected.** These should be addressed before merging:\n'; + comment += '- Review the detailed scan results\n'; + comment += '- Update affected packages to patched versions\n'; + comment += '- Consider using a different base image if updates are unavailable\n\n'; + } else if (vulnsByType.HIGH > 0) { + comment += '### ⚠ī¸ Attention Needed\n\n'; + comment += '**High severity vulnerabilities found.** Please review and plan remediation:\n'; + comment += '- Assess the risk and exploitability\n'; + comment += '- Prioritize updates in the next maintenance cycle\n\n'; + } else { + comment += '### ℹī¸ Review Recommended\n\n'; + comment += 'Medium/Low severity vulnerabilities found. Consider addressing during regular maintenance.\n\n'; + } +} + +comment += '---\n'; +comment += '📋 **Resources:**\n'; + +if (GITHUB_REPOSITORY && GITHUB_RUN_ID) { + comment += `- [Download full report](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) (see artifacts)\n`; +} + +comment += '- [View in Security tab](https://github.com/' + (GITHUB_REPOSITORY || 'repository') + '/security/code-scanning)\n'; +comment += '- Scanned with [Trivy](https://github.com/aquasecurity/trivy)\n'; + +module.exports = comment; diff --git a/.github/workflows/api-codeql.yml b/.github/workflows/api-codeql.yml index d0211c4caa..e9af830156 100644 --- a/.github/workflows/api-codeql.yml +++ b/.github/workflows/api-codeql.yml @@ -1,36 +1,34 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: API - CodeQL +name: 'API: CodeQL' on: push: branches: - - "master" - - "v5.*" + - 'master' + - 'v5.*' paths: - - "api/**" + - 'api/**' + - '.github/workflows/api-codeql.yml' + - '.github/codeql/api-codeql-config.yml' pull_request: branches: - - "master" - - "v5.*" + - 'master' + - 'v5.*' paths: - - "api/**" + - 'api/**' + - '.github/workflows/api-codeql.yml' + - '.github/codeql/api-codeql-config.yml' schedule: - cron: '00 12 * * *' +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: analyze: - name: Analyze + name: CodeQL Security Analysis runs-on: ubuntu-latest + timeout-minutes: 30 permissions: actions: read contents: read @@ -39,21 +37,20 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'python' ] - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + language: + - 'python' steps: - - name: Checkout repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 - with: - languages: ${{ matrix.language }} - config-file: ./.github/codeql/api-codeql-config.yml + - name: Initialize CodeQL + uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 + with: + languages: ${{ matrix.language }} + config-file: ./.github/codeql/api-codeql-config.yml - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 - with: - category: "/language:${{matrix.language}}" + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 + with: + category: '/language:${{ matrix.language }}' diff --git a/.github/workflows/api-pull-request.yml b/.github/workflows/api-pull-request.yml index e899af8f32..1266ce78c9 100644 --- a/.github/workflows/api-pull-request.yml +++ b/.github/workflows/api-pull-request.yml @@ -1,20 +1,30 @@ -name: API - Pull Request +name: 'API: Pull Request' on: push: branches: - - "master" - - "v5.*" + - 'master' + - 'v5.*' paths: - - ".github/workflows/api-pull-request.yml" - - "api/**" + - '.github/workflows/api-pull-request.yml' + - 'api/**' + - '!api/docs/**' + - '!api/README.md' + - '!api/CHANGELOG.md' pull_request: branches: - - "master" - - "v5.*" + - 'master' + - 'v5.*' paths: - - ".github/workflows/api-pull-request.yml" - - "api/**" + - '.github/workflows/api-pull-request.yml' + - 'api/**' + - '!api/docs/**' + - '!api/README.md' + - '!api/CHANGELOG.md' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true env: POSTGRES_HOST: localhost @@ -29,21 +39,94 @@ env: VALKEY_DB: 0 API_WORKING_DIR: ./api IMAGE_NAME: prowler-api - IGNORE_FILES: | - api/docs/** - api/README.md - api/CHANGELOG.md jobs: - test: + code-quality: + if: github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read strategy: matrix: - python-version: ["3.12"] + python-version: + - '3.12' + defaults: + run: + working-directory: ./api + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Setup Python with Poetry + uses: ./.github/actions/setup-python-poetry + with: + python-version: ${{ matrix.python-version }} + working-directory: ./api + + - name: Poetry check + run: poetry check --lock + + - name: Ruff lint + run: poetry run ruff check . --exclude contrib + + - name: Ruff format + run: poetry run ruff format --check . --exclude contrib + + - name: Pylint + run: poetry run pylint --disable=W,C,R,E -j 0 -rn -sn src/ + + security-scans: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + strategy: + matrix: + python-version: + - '3.12' + defaults: + run: + working-directory: ./api + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Setup Python with Poetry + uses: ./.github/actions/setup-python-poetry + with: + python-version: ${{ matrix.python-version }} + working-directory: ./api + + - name: Bandit + run: poetry run bandit -q -lll -x '*_test.py,./contrib/' -r . + + - name: Safety + # 76352, 76353, 77323 come from SDK, but they cannot upgrade it yet. It does not affect API + # TODO: Botocore needs urllib3 1.X so we need to ignore these vulnerabilities 77744,77745. Remove this once we upgrade to urllib3 2.X + run: poetry run safety check --ignore 70612,66963,74429,76352,76353,77323,77744,77745 + + - name: Vulture + run: poetry run vulture --exclude "contrib,tests,conftest.py" --min-confidence 100 . + + tests: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + strategy: + matrix: + python-version: + - '3.12' + defaults: + run: + working-directory: ./api - # Service containers to run with `test` services: - # Label used to access the service container postgres: image: postgres env: @@ -52,7 +135,6 @@ jobs: POSTGRES_USER: ${{ env.POSTGRES_USER }} POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }} POSTGRES_DB: ${{ env.POSTGRES_DB }} - # Set health checks to wait until postgres has started ports: - 5432:5432 options: >- @@ -66,7 +148,6 @@ jobs: VALKEY_HOST: ${{ env.VALKEY_HOST }} VALKEY_PORT: ${{ env.VALKEY_PORT }} VALKEY_DB: ${{ env.VALKEY_DB }} - # Set health checks to wait until postgres has started ports: - 6379:6379 options: >- @@ -76,158 +157,72 @@ jobs: --health-retries 5 steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - name: Test if changes are in not ignored paths - id: are-non-ignored-files-changed - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 - with: - files: | - api/** - .github/workflows/api-pull-request.yml - files_ignore: ${{ env.IGNORE_FILES }} - - - name: Replace @master with current branch in pyproject.toml - Only for pull requests to `master` - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' && github.event_name == 'pull_request' && github.base_ref == 'master' - run: | - BRANCH_NAME="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}" - echo "Using branch: $BRANCH_NAME" - sed -i "s|@master|@$BRANCH_NAME|g" pyproject.toml - - - name: Install poetry - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - python -m pip install --upgrade pip - pipx install poetry==2.1.1 - - - name: Update SDK's poetry.lock resolved_reference to latest commit - Only for push events to `master` - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master' - run: | - # Get the latest commit hash from the prowler-cloud/prowler repository - LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha') - echo "Latest commit hash: $LATEST_COMMIT" - - # Update the resolved_reference specifically for prowler-cloud/prowler repository - sed -i '/url = "https:\/\/github\.com\/prowler-cloud\/prowler\.git"/,/resolved_reference = / { - s/resolved_reference = "[a-f0-9]\{40\}"/resolved_reference = "'"$LATEST_COMMIT"'"/ - }' poetry.lock - - # Verify the change was made - echo "Updated resolved_reference:" - grep -A2 -B2 "resolved_reference" poetry.lock - - - name: Update poetry.lock - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry lock - - - name: Set up Python ${{ matrix.python-version }} - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 + - name: Setup Python with Poetry + uses: ./.github/actions/setup-python-poetry with: python-version: ${{ matrix.python-version }} - cache: "poetry" + working-directory: ./api - - name: Install dependencies - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry install --no-root - poetry run pip list - VERSION=$(curl --silent "https://api.github.com/repos/hadolint/hadolint/releases/latest" | \ - grep '"tag_name":' | \ - sed -E 's/.*"v([^"]+)".*/\1/' \ - ) && curl -L -o /tmp/hadolint "https://github.com/hadolint/hadolint/releases/download/v${VERSION}/hadolint-Linux-x86_64" \ - && chmod +x /tmp/hadolint - - - name: Poetry check - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry check --lock - - - name: Lint with ruff - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry run ruff check . --exclude contrib - - - name: Check Format with ruff - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry run ruff format --check . --exclude contrib - - - name: Lint with pylint - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry run pylint --disable=W,C,R,E -j 0 -rn -sn src/ - - - name: Bandit - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry run bandit -q -lll -x '*_test.py,./contrib/' -r . - - - name: Safety - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - # 76352, 76353, 77323 come from SDK, but they cannot upgrade it yet. It does not affect API - # TODO: Botocore needs urllib3 1.X so we need to ignore these vulnerabilities 77744,77745. Remove this once we upgrade to urllib3 2.X - run: | - poetry run safety check --ignore 70612,66963,74429,76352,76353,77323,77744,77745 - - - name: Vulture - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry run vulture --exclude "contrib,tests,conftest.py" --min-confidence 100 . - - - name: Hadolint - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - /tmp/hadolint Dockerfile --ignore=DL3013 - - - name: Test with pytest - working-directory: ./api - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - run: | - poetry run pytest --cov=./src/backend --cov-report=xml src/backend + - name: Run tests with pytest + run: poetry run pytest --cov=./src/backend --cov-report=xml src/backend - name: Upload coverage reports to Codecov - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: flags: api - test-container-build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - name: Test if changes are in not ignored paths - id: are-non-ignored-files-changed - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + dockerfile-lint: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Lint Dockerfile with Hadolint + uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 with: - files: api/** - files_ignore: ${{ env.IGNORE_FILES }} + dockerfile: api/Dockerfile + ignore: DL3013 + + container-build-and-scan: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + security-events: write + pull-requests: write + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - name: Set up Docker Buildx - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - - name: Build Container - if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' + + - name: Build container uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: context: ${{ env.API_WORKING_DIR }} push: false - tags: ${{ env.IMAGE_NAME }}:latest - outputs: type=docker + load: true + tags: ${{ env.IMAGE_NAME }}:${{ github.sha }} cache-from: type=gha cache-to: type=gha,mode=max + + - name: Scan container with Trivy + uses: ./.github/actions/trivy-scan + with: + image-name: ${{ env.IMAGE_NAME }} + image-tag: ${{ github.sha }} + fail-on-critical: 'false' + severity: 'CRITICAL' diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 2aa0a49c09..4fd1347f44 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -1,28 +1,35 @@ -name: Prowler - Automatic Backport +name: 'Tools: Backport' on: pull_request_target: - branches: ['master'] - types: ['labeled', 'closed'] + branches: + - 'master' + types: + - 'labeled' + - 'closed' + paths: + - '.github/workflows/backport.yml' + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: false env: - # The prefix of the label that triggers the backport must not contain the branch name - # so, for example, if the branch is 'master', the label should be 'backport-to-' BACKPORT_LABEL_PREFIX: backport-to- BACKPORT_LABEL_IGNORE: was-backported jobs: backport: - name: Backport PR if: github.event.pull_request.merged == true && !(contains(github.event.pull_request.labels.*.name, 'backport')) && !(contains(github.event.pull_request.labels.*.name, 'was-backported')) runs-on: ubuntu-latest + timeout-minutes: 15 permissions: - id-token: write - pull-requests: write contents: write + pull-requests: write + steps: - name: Check labels - id: preview_label_check + id: label_check uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65 with: allow_failure: true @@ -31,17 +38,17 @@ jobs: none_of: ${{ env.BACKPORT_LABEL_IGNORE }} repo_token: ${{ secrets.GITHUB_TOKEN }} - - name: Backport Action - if: steps.preview_label_check.outputs.label_check == 'success' + - name: Backport PR + if: steps.label_check.outputs.label_check == 'success' uses: sorenlouv/backport-github-action@ad888e978060bc1b2798690dd9d03c4036560947 # v9.5.1 with: github_token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} auto_backport_label_prefix: ${{ env.BACKPORT_LABEL_PREFIX }} - - name: Info log - if: ${{ success() && steps.preview_label_check.outputs.label_check == 'success' }} + - name: Display backport info log + if: success() && steps.label_check.outputs.label_check == 'success' run: cat ~/.backport/backport.info.log - - name: Debug log - if: ${{ failure() && steps.preview_label_check.outputs.label_check == 'success' }} + - name: Display backport debug log + if: failure() && steps.label_check.outputs.label_check == 'success' run: cat ~/.backport/backport.debug.log diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml index ecaf651c34..c5ba446edf 100644 --- a/.github/workflows/conventional-commit.yml +++ b/.github/workflows/conventional-commit.yml @@ -1,24 +1,31 @@ -name: Prowler - Conventional Commit +name: 'Tools: Conventional Commit' on: pull_request: - types: - - "opened" - - "edited" - - "synchronize" branches: - - "master" - - "v3" - - "v4.*" - - "v5.*" + - 'master' + - 'v3' + - 'v4.*' + - 'v5.*' + types: + - 'opened' + - 'edited' + - 'synchronize' + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true jobs: conventional-commit-check: runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + pull-requests: read + steps: - - name: conventional-commit-check - id: conventional-commit-check + - name: Check PR title format uses: agenthunt/conventional-commit-checker-action@9e552d650d0e205553ec7792d447929fc78e012b # v2.0.0 with: - pr-title-regex: '^(feat|fix|docs|style|refactor|perf|test|chore|build|ci|revert)(\([^)]+\))?!?: .+' - \ No newline at end of file + pr-title-regex: '^(feat|fix|docs|style|refactor|perf|test|chore|build|ci|revert)(\([^)]+\))?!?: .+' diff --git a/.github/workflows/create-backport-label.yml b/.github/workflows/create-backport-label.yml index 3b485ec513..b4308156c7 100644 --- a/.github/workflows/create-backport-label.yml +++ b/.github/workflows/create-backport-label.yml @@ -1,67 +1,70 @@ -name: Prowler - Create Backport Label +name: 'Tools: Backport Label' on: release: - types: [published] + types: + - 'published' + +concurrency: + group: ${{ github.workflow }}-${{ github.event.release.tag_name }} + cancel-in-progress: false + +env: + BACKPORT_LABEL_PREFIX: backport-to- + BACKPORT_LABEL_COLOR: B60205 jobs: - create_label: + create-label: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: - contents: write + contents: read issues: write + steps: - - name: Create backport label + - name: Create backport label for minor releases env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - RELEASE_TAG: ${{ github.event.release.tag_name }} - OWNER_REPO: ${{ github.repository }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - VERSION_ONLY=${RELEASE_TAG#v} # Remove 'v' prefix if present (e.g., v3.2.0 -> 3.2.0) + RELEASE_TAG="${{ github.event.release.tag_name }}" + + if [ -z "$RELEASE_TAG" ]; then + echo "Error: No release tag provided" + exit 1 + fi + + echo "Processing release tag: $RELEASE_TAG" + + # Remove 'v' prefix if present (e.g., v3.2.0 -> 3.2.0) + VERSION_ONLY="${RELEASE_TAG#v}" # Check if it's a minor version (X.Y.0) - if [[ "$VERSION_ONLY" =~ ^[0-9]+\.[0-9]+\.0$ ]]; then - echo "Release ${RELEASE_TAG} (version ${VERSION_ONLY}) is a minor version. Proceeding to create backport label." + if [[ "$VERSION_ONLY" =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then + echo "Release $RELEASE_TAG (version $VERSION_ONLY) is a minor version. Proceeding to create backport label." - TWO_DIGIT_VERSION=${VERSION_ONLY%.0} # Extract X.Y from X.Y.0 (e.g., 5.6 from 5.6.0) + # Extract X.Y from X.Y.0 (e.g., 5.6 from 5.6.0) + MAJOR="${BASH_REMATCH[1]}" + MINOR="${BASH_REMATCH[2]}" + TWO_DIGIT_VERSION="${MAJOR}.${MINOR}" - FINAL_LABEL_NAME="backport-to-v${TWO_DIGIT_VERSION}" - FINAL_DESCRIPTION="Backport PR to the v${TWO_DIGIT_VERSION} branch" + LABEL_NAME="${BACKPORT_LABEL_PREFIX}v${TWO_DIGIT_VERSION}" + LABEL_DESC="Backport PR to the v${TWO_DIGIT_VERSION} branch" + LABEL_COLOR="$BACKPORT_LABEL_COLOR" - echo "Effective label name will be: ${FINAL_LABEL_NAME}" - echo "Effective description will be: ${FINAL_DESCRIPTION}" + echo "Label name: $LABEL_NAME" + echo "Label description: $LABEL_DESC" - # Check if the label already exists - STATUS_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token ${GITHUB_TOKEN}" "https://api.github.com/repos/${OWNER_REPO}/labels/${FINAL_LABEL_NAME}") - - if [ "${STATUS_CODE}" -eq 200 ]; then - echo "Label '${FINAL_LABEL_NAME}' already exists." - elif [ "${STATUS_CODE}" -eq 404 ]; then - echo "Label '${FINAL_LABEL_NAME}' does not exist. Creating it..." - # Prepare JSON data payload - JSON_DATA=$(printf '{"name":"%s","description":"%s","color":"B60205"}' "${FINAL_LABEL_NAME}" "${FINAL_DESCRIPTION}") - - CREATE_STATUS_CODE=$(curl -s -o /tmp/curl_create_response.json -w "%{http_code}" -X POST \ - -H "Accept: application/vnd.github.v3+json" \ - -H "Authorization: token ${GITHUB_TOKEN}" \ - --data "${JSON_DATA}" \ - "https://api.github.com/repos/${OWNER_REPO}/labels") - - CREATE_RESPONSE_BODY=$(cat /tmp/curl_create_response.json) - rm -f /tmp/curl_create_response.json - - if [ "$CREATE_STATUS_CODE" -eq 201 ]; then - echo "Label '${FINAL_LABEL_NAME}' created successfully." - else - echo "Error creating label '${FINAL_LABEL_NAME}'. Status: $CREATE_STATUS_CODE" - echo "Response: $CREATE_RESPONSE_BODY" - exit 1 - fi + # Check if label already exists + if gh label list --repo ${{ github.repository }} --limit 1000 | grep -q "^${LABEL_NAME}[[:space:]]"; then + echo "Label '$LABEL_NAME' already exists." else - echo "Error checking for label '${FINAL_LABEL_NAME}'. HTTP Status: ${STATUS_CODE}" - exit 1 + echo "Label '$LABEL_NAME' does not exist. Creating it..." + gh label create "$LABEL_NAME" \ + --description "$LABEL_DESC" \ + --color "$LABEL_COLOR" \ + --repo ${{ github.repository }} + echo "Label '$LABEL_NAME' created successfully." fi else - echo "Release ${RELEASE_TAG} (version ${VERSION_ONLY}) is not a minor version. Skipping backport label creation." - exit 0 + echo "Release $RELEASE_TAG (version $VERSION_ONLY) is not a minor version. Skipping backport label creation." fi diff --git a/.github/workflows/find-secrets.yml b/.github/workflows/find-secrets.yml index e7feaea43a..6428cf8f08 100644 --- a/.github/workflows/find-secrets.yml +++ b/.github/workflows/find-secrets.yml @@ -1,19 +1,33 @@ -name: Prowler - Find secrets +name: 'Tools: TruffleHog' -on: pull_request +on: + push: + branches: + - 'master' + - 'v5.*' + pull_request: + branches: + - 'master' + - 'v5.*' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true jobs: - trufflehog: + scan-secrets: runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + steps: - - name: Checkout + - name: Checkout repository uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: fetch-depth: 0 - - name: TruffleHog OSS - uses: trufflesecurity/trufflehog@466da5b0bb161144f6afca9afe5d57975828c410 # v3.90.8 + + - name: Scan for secrets with TruffleHog + uses: trufflesecurity/trufflehog@ad6fc8fb446b8fafbf7ea8193d2d6bfd42f45690 # v3.90.11 with: - path: ./ - base: ${{ github.event.repository.default_branch }} - head: HEAD - extra_args: --only-verified + extra_args: '--results=verified,unknown' diff --git a/.github/workflows/labeler-community.yml b/.github/workflows/labeler-community.yml new file mode 100644 index 0000000000..be64a0c397 --- /dev/null +++ b/.github/workflows/labeler-community.yml @@ -0,0 +1,34 @@ +name: Label Community Contributors PRs + +on: + pull_request: + types: [opened] + +jobs: + add-community-label: + runs-on: ubuntu-latest + permissions: + issues: write + pull-requests: write + + steps: + - name: Label community contributors + env: + GH_TOKEN: ${{ github.token }} + run: | + # Fetch fresh PR data to get current author_association + ASSOCIATION=$(gh api /repos/${{ github.repository }}/pulls/${{ github.event.number }} --jq '.author_association') + AUTHOR=$(gh api /repos/${{ github.repository }}/pulls/${{ github.event.number }} --jq '.user.login') + + echo "Author: $AUTHOR, Association: $ASSOCIATION" + + # Members have associations like: OWNER, MEMBER, COLLABORATOR + # Non-members have: CONTRIBUTOR, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER, NONE + if [[ "$ASSOCIATION" != "OWNER" && "$ASSOCIATION" != "MEMBER" && "$ASSOCIATION" != "COLLABORATOR" ]]; then + gh api /repos/${{ github.repository }}/issues/${{ github.event.number }}/labels \ + -X POST \ + -f labels[]='community' + echo "Added 'community' label for $ASSOCIATION contributor" + else + echo "Skipped labeling for $ASSOCIATION" + fi diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 9dfa8993a1..fad94177f7 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -1,17 +1,29 @@ -name: Prowler - PR Labeler +name: 'Tools: PR Labeler' on: - pull_request_target: - branches: - - "master" - - "v3" - - "v4.*" + pull_request_target: + branches: + - 'master' + - 'v5.*' + types: + - 'opened' + - 'reopened' + - 'synchronize' + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true jobs: labeler: + runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read pull-requests: write - runs-on: ubuntu-latest + steps: - - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1 + - name: Apply labels to PR + uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1 + with: + sync-labels: true diff --git a/.github/workflows/mcp-container-build-push.yml b/.github/workflows/mcp-container-build-push.yml index fa4f5be578..aecec30592 100644 --- a/.github/workflows/mcp-container-build-push.yml +++ b/.github/workflows/mcp-container-build-push.yml @@ -3,21 +3,13 @@ name: 'MCP: Container Build and Push' on: push: branches: - - "master" + - 'master' paths: - - "mcp_server/**" - - ".github/workflows/mcp-container-build-push.yml" - - # Uncomment to test this workflow on PRs - # pull_request: - # branches: - # - "master" - # paths: - # - "mcp_server/**" - # - ".github/workflows/mcp-container-build-push.yml" - + - 'mcp_server/**' + - '.github/workflows/mcp-container-build-push.yml' release: - types: [published] + types: + - 'published' permissions: contents: read @@ -41,6 +33,7 @@ jobs: setup: if: github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest + timeout-minutes: 5 outputs: short-sha: ${{ steps.set-short-sha.outputs.short-sha }} steps: @@ -51,8 +44,12 @@ jobs: container-build-push: needs: setup runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + packages: write steps: - - name: Checkout + - name: Checkout repository uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Login to DockerHub @@ -64,7 +61,7 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - - name: Build and push container (latest) + - name: Build and push MCP container (latest) if: github.event_name == 'push' uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: @@ -83,7 +80,7 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max - - name: Build and push container (release) + - name: Build and push MCP container (release) if: github.event_name == 'release' uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: @@ -103,7 +100,7 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max - - name: Trigger deployment + - name: Trigger MCP deployment if: github.event_name == 'push' uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0 with: diff --git a/.github/workflows/mcp-pull-request.yml b/.github/workflows/mcp-pull-request.yml new file mode 100644 index 0000000000..31b4934c35 --- /dev/null +++ b/.github/workflows/mcp-pull-request.yml @@ -0,0 +1,80 @@ +name: 'MCP: Pull Request' + +on: + push: + branches: + - 'master' + - 'v5.*' + paths: + - '.github/workflows/mcp-pull-request.yml' + - 'mcp_server/**' + - '!mcp_server/README.md' + - '!mcp_server/CHANGELOG.md' + pull_request: + branches: + - 'master' + - 'v5.*' + paths: + - '.github/workflows/mcp-pull-request.yml' + - 'mcp_server/**' + - '!mcp_server/README.md' + - '!mcp_server/CHANGELOG.md' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + MCP_WORKING_DIR: ./mcp_server + IMAGE_NAME: prowler-mcp + +jobs: + dockerfile-lint: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Lint Dockerfile with Hadolint + uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 + with: + dockerfile: mcp_server/Dockerfile + + container-build-and-scan: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + security-events: write + pull-requests: write + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + + - name: Build MCP container + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + with: + context: ${{ env.MCP_WORKING_DIR }} + push: false + load: true + tags: ${{ env.IMAGE_NAME }}:${{ github.sha }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Scan MCP container with Trivy + uses: ./.github/actions/trivy-scan + with: + image-name: ${{ env.IMAGE_NAME }} + image-tag: ${{ github.sha }} + fail-on-critical: 'false' + severity: 'CRITICAL' diff --git a/.github/workflows/pr-check-changelog.yml b/.github/workflows/pr-check-changelog.yml new file mode 100644 index 0000000000..f8de212e2a --- /dev/null +++ b/.github/workflows/pr-check-changelog.yml @@ -0,0 +1,103 @@ +name: 'Tools: Check Changelog' + +on: + pull_request: + types: + - 'opened' + - 'synchronize' + - 'reopened' + - 'labeled' + - 'unlabeled' + branches: + - 'master' + - 'v5.*' + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + check-changelog: + if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + pull-requests: write + env: + MONITORED_FOLDERS: 'api ui prowler mcp_server' + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + fetch-depth: 0 + + - name: Get changed files + id: changed-files + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + with: + files: | + api/** + ui/** + prowler/** + mcp_server/** + + - name: Check for folder changes and changelog presence + id: check-folders + run: | + missing_changelogs="" + + # Check api folder + if [[ "${{ steps.changed-files.outputs.any_changed }}" == "true" ]]; then + for folder in $MONITORED_FOLDERS; do + # Get files changed in this folder + changed_in_folder=$(echo "${{ steps.changed-files.outputs.all_changed_files }}" | tr ' ' '\n' | grep "^${folder}/" || true) + + if [ -n "$changed_in_folder" ]; then + echo "Detected changes in ${folder}/" + + # Check if CHANGELOG.md was updated + if ! echo "$changed_in_folder" | grep -q "^${folder}/CHANGELOG.md$"; then + echo "No changelog update found for ${folder}/" + missing_changelogs="${missing_changelogs}- \`${folder}\`"$'\n' + fi + fi + done + fi + + { + echo "missing_changelogs<> $GITHUB_OUTPUT + + - name: Find existing changelog comment + if: github.event.pull_request.head.repo.full_name == github.repository + id: find-comment + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 + with: + issue-number: ${{ github.event.pull_request.number }} + comment-author: 'github-actions[bot]' + body-includes: '' + + - name: Update PR comment with changelog status + if: github.event.pull_request.head.repo.full_name == github.repository + uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + with: + issue-number: ${{ github.event.pull_request.number }} + comment-id: ${{ steps.find-comment.outputs.comment-id }} + edit-mode: replace + body: | + + ${{ steps.check-folders.outputs.missing_changelogs != '' && format('⚠ī¸ **Changes detected in the following folders without a corresponding update to the `CHANGELOG.md`:** + + {0} + + Please add an entry to the corresponding `CHANGELOG.md` file to maintain a clear history of changes.', steps.check-folders.outputs.missing_changelogs) || '✅ All necessary `CHANGELOG.md` files have been updated.' }} + + - name: Fail if changelog is missing + if: steps.check-folders.outputs.missing_changelogs != '' + run: | + echo "::error::Missing changelog updates in some folders" + exit 1 diff --git a/.github/workflows/pr-conflict-checker.yml b/.github/workflows/pr-conflict-checker.yml index 77280d5136..3761d252a3 100644 --- a/.github/workflows/pr-conflict-checker.yml +++ b/.github/workflows/pr-conflict-checker.yml @@ -1,42 +1,40 @@ -name: Prowler - PR Conflict Checker +name: 'Tools: PR Conflict Checker' on: - pull_request: + pull_request_target: types: - - opened - - synchronize - - reopened + - 'opened' + - 'synchronize' + - 'reopened' branches: - - "master" - - "v5.*" - # Leaving this commented until we find a way to run it for forks but in Prowler's context - # pull_request_target: - # types: - # - opened - # - synchronize - # - reopened - # branches: - # - "master" - # - "v5.*" + - 'master' + - 'v5.*' + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true jobs: - conflict-checker: + check-conflicts: runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read pull-requests: write issues: write steps: - - name: Checkout repository + - name: Checkout PR head uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 - name: Get changed files id: changed-files uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 with: - files: | - ** + files: '**' - name: Check for conflict markers id: conflict-check @@ -51,10 +49,10 @@ jobs: if [ -f "$file" ]; then echo "Checking file: $file" - # Look for conflict markers - if grep -l "^<<<<<<<\|^=======\|^>>>>>>>" "$file" 2>/dev/null; then + # Look for conflict markers (more precise regex) + if grep -qE '^(<<<<<<<|=======|>>>>>>>)' "$file" 2>/dev/null; then echo "Conflict markers found in: $file" - CONFLICT_FILES="$CONFLICT_FILES$file " + CONFLICT_FILES="${CONFLICT_FILES}- \`${file}\`"$'\n' HAS_CONFLICTS=true fi fi @@ -62,114 +60,64 @@ jobs: if [ "$HAS_CONFLICTS" = true ]; then echo "has_conflicts=true" >> $GITHUB_OUTPUT - echo "conflict_files=$CONFLICT_FILES" >> $GITHUB_OUTPUT - echo "Conflict markers detected in files: $CONFLICT_FILES" + { + echo "conflict_files<> $GITHUB_OUTPUT + echo "Conflict markers detected" else echo "has_conflicts=false" >> $GITHUB_OUTPUT echo "No conflict markers found in changed files" fi - - name: Add conflict label - if: steps.conflict-check.outputs.has_conflicts == 'true' - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - github-token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} - script: | - const { data: labels } = await github.rest.issues.listLabelsOnIssue({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - }); + - name: Manage conflict label + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + HAS_CONFLICTS: ${{ steps.conflict-check.outputs.has_conflicts }} + run: | + LABEL_NAME="has-conflicts" - const hasConflictLabel = labels.some(label => label.name === 'has-conflicts'); + # Add or remove label based on conflict status + if [ "$HAS_CONFLICTS" = "true" ]; then + echo "Adding conflict label to PR #${PR_NUMBER}..." + gh pr edit "$PR_NUMBER" --add-label "$LABEL_NAME" --repo ${{ github.repository }} || true + else + echo "Removing conflict label from PR #${PR_NUMBER}..." + gh pr edit "$PR_NUMBER" --remove-label "$LABEL_NAME" --repo ${{ github.repository }} || true + fi - if (!hasConflictLabel) { - await github.rest.issues.addLabels({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - labels: ['has-conflicts'] - }); - console.log('Added has-conflicts label'); - } else { - console.log('has-conflicts label already exists'); - } - - - name: Remove conflict label - if: steps.conflict-check.outputs.has_conflicts == 'false' - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - github-token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} - script: | - try { - await github.rest.issues.removeLabel({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - name: 'has-conflicts' - }); - console.log('Removed has-conflicts label'); - } catch (error) { - if (error.status === 404) { - console.log('has-conflicts label was not present'); - } else { - throw error; - } - } - - - name: Find existing conflict comment - if: steps.conflict-check.outputs.has_conflicts == 'true' + - name: Find existing comment uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 id: find-comment with: issue-number: ${{ github.event.pull_request.number }} comment-author: 'github-actions[bot]' - body-regex: '(⚠ī¸ \*\*Conflict Markers Detected\*\*|✅ \*\*Conflict Markers Resolved\*\*)' + body-includes: '' - - name: Create or update conflict comment - if: steps.conflict-check.outputs.has_conflicts == 'true' + - name: Create or update comment uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 with: comment-id: ${{ steps.find-comment.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} edit-mode: replace body: | - ⚠ī¸ **Conflict Markers Detected** + + ${{ steps.conflict-check.outputs.has_conflicts == 'true' && '⚠ī¸ **Conflict Markers Detected**' || '✅ **Conflict Markers Resolved**' }} - This pull request contains unresolved conflict markers in the following files: - ``` - ${{ steps.conflict-check.outputs.conflict_files }} - ``` + ${{ steps.conflict-check.outputs.has_conflicts == 'true' && format('This pull request contains unresolved conflict markers in the following files: + + {0} Please resolve these conflicts by: 1. Locating the conflict markers: `<<<<<<<`, `=======`, and `>>>>>>>` 2. Manually editing the files to resolve the conflicts 3. Removing all conflict markers - 4. Committing and pushing the changes - - - name: Find existing conflict comment when resolved - if: steps.conflict-check.outputs.has_conflicts == 'false' - uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 - id: find-resolved-comment - with: - issue-number: ${{ github.event.pull_request.number }} - comment-author: 'github-actions[bot]' - body-regex: '(⚠ī¸ \*\*Conflict Markers Detected\*\*|✅ \*\*Conflict Markers Resolved\*\*)' - - - name: Update comment when conflicts resolved - if: steps.conflict-check.outputs.has_conflicts == 'false' && steps.find-resolved-comment.outputs.comment-id != '' - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 - with: - comment-id: ${{ steps.find-resolved-comment.outputs.comment-id }} - issue-number: ${{ github.event.pull_request.number }} - edit-mode: replace - body: | - ✅ **Conflict Markers Resolved** - - All conflict markers have been successfully resolved in this pull request. + 4. Committing and pushing the changes', steps.conflict-check.outputs.conflict_files) || 'All conflict markers have been successfully resolved in this pull request.' }} - name: Fail workflow if conflicts detected if: steps.conflict-check.outputs.has_conflicts == 'true' run: | - echo "::error::Workflow failed due to conflict markers in files: ${{ steps.conflict-check.outputs.conflict_files }}" + echo "::error::Workflow failed due to conflict markers detected in the PR" exit 1 diff --git a/.github/workflows/pull-request-merged.yml b/.github/workflows/pr-merged.yml similarity index 55% rename from .github/workflows/pull-request-merged.yml rename to .github/workflows/pr-merged.yml index 4b5a93aabd..d8255026e6 100644 --- a/.github/workflows/pull-request-merged.yml +++ b/.github/workflows/pr-merged.yml @@ -1,27 +1,31 @@ -name: Prowler - Merged Pull Request +name: 'Tools: PR Merged' on: pull_request_target: - branches: ['master'] - types: ['closed'] + branches: + - 'master' + types: + - 'closed' + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: false jobs: trigger-cloud-pull-request: - name: Trigger Cloud Pull Request if: github.event.pull_request.merged == true && github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - ref: ${{ github.event.pull_request.merge_commit_sha }} - - - name: Set short git commit SHA + - name: Calculate short commit SHA id: vars run: | - shortSha=$(git rev-parse --short ${{ github.event.pull_request.merge_commit_sha }}) - echo "SHORT_SHA=${shortSha}" >> $GITHUB_ENV + SHORT_SHA="${{ github.event.pull_request.merge_commit_sha }}" + echo "SHORT_SHA=${SHORT_SHA::7}" >> $GITHUB_ENV - - name: Trigger pull request + - name: Trigger Cloud repository pull request uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0 with: token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -31,8 +35,12 @@ jobs: { "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}", "PROWLER_COMMIT_SHORT_SHA": "${{ env.SHORT_SHA }}", + "PROWLER_PR_NUMBER": "${{ github.event.pull_request.number }}", "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }}, "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }}, "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }}, - "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }} + "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }}, + "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}", + "PROWLER_PR_BASE_BRANCH": "${{ github.event.pull_request.base.ref }}", + "PROWLER_PR_HEAD_BRANCH": "${{ github.event.pull_request.head.ref }}" } diff --git a/.github/workflows/prowler-release-preparation.yml b/.github/workflows/prepare-release.yml similarity index 89% rename from .github/workflows/prowler-release-preparation.yml rename to .github/workflows/prepare-release.yml index 7ecd937554..55b7d2e441 100644 --- a/.github/workflows/prowler-release-preparation.yml +++ b/.github/workflows/prepare-release.yml @@ -1,6 +1,6 @@ -name: Prowler - Release Preparation +name: 'Tools: Prepare Release' -run-name: Prowler Release Preparation for ${{ inputs.prowler_version }} +run-name: 'Prepare Release for Prowler ${{ inputs.prowler_version }}' on: workflow_dispatch: @@ -10,18 +10,23 @@ on: required: true type: string +concurrency: + group: ${{ github.workflow }}-${{ inputs.prowler_version }} + cancel-in-progress: false + env: - PROWLER_VERSION: ${{ github.event.inputs.prowler_version }} + PROWLER_VERSION: ${{ inputs.prowler_version }} jobs: prepare-release: - if: github.repository == 'prowler-cloud/prowler' + if: github.event_name == 'workflow_dispatch' && github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: write pull-requests: write steps: - - name: Checkout code + - name: Checkout repository uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: fetch-depth: 0 @@ -34,15 +39,15 @@ jobs: - name: Install Poetry run: | - python3 -m pip install --user poetry + python3 -m pip install --user poetry==2.1.1 echo "$HOME/.local/bin" >> $GITHUB_PATH - name: Configure Git run: | - git config --global user.name "prowler-bot" - git config --global user.email "179230569+prowler-bot@users.noreply.github.com" + git config --global user.name 'prowler-bot' + git config --global user.email '179230569+prowler-bot@users.noreply.github.com' - - name: Parse version and determine branch + - name: Parse version and read changelogs run: | # Validate version format (reusing pattern from sdk-bump-version.yml) if [[ $PROWLER_VERSION =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then @@ -119,7 +124,7 @@ jobs: exit 1 fi - - name: Extract changelog entries + - name: Extract and combine changelog entries run: | set -e @@ -145,8 +150,8 @@ jobs: # Remove --- separators sed -i '/^---$/d' "$output_file" - # Remove trailing empty lines - sed -i '/^$/d' "$output_file" + # Remove only trailing empty lines (not all empty lines) + sed -i -e :a -e '/^\s*$/d;N;ba' "$output_file" } # Calculate expected versions for this release @@ -242,10 +247,15 @@ jobs: echo "" >> combined_changelog.md fi + # Add fallback message if no changelogs were added + if [ ! -s combined_changelog.md ]; then + echo "No component changes detected for this release." >> combined_changelog.md + fi + echo "Combined changelog preview:" cat combined_changelog.md - - name: Checkout existing branch for patch release + - name: Checkout release branch for patch release if: ${{ env.PATCH_VERSION != '0' }} run: | echo "Patch release detected, checking out existing branch $BRANCH_NAME..." @@ -260,7 +270,7 @@ jobs: exit 1 fi - - name: Verify version in pyproject.toml + - name: Verify SDK version in pyproject.toml run: | CURRENT_VERSION=$(grep '^version = ' pyproject.toml | sed -E 's/version = "([^"]+)"/\1/' | tr -d '[:space:]') PROWLER_VERSION_TRIMMED=$(echo "$PROWLER_VERSION" | tr -d '[:space:]') @@ -270,7 +280,7 @@ jobs: fi echo "✓ pyproject.toml version: $CURRENT_VERSION" - - name: Verify version in prowler/config/config.py + - name: Verify SDK version in prowler/config/config.py run: | CURRENT_VERSION=$(grep '^prowler_version = ' prowler/config/config.py | sed -E 's/prowler_version = "([^"]+)"/\1/' | tr -d '[:space:]') PROWLER_VERSION_TRIMMED=$(echo "$PROWLER_VERSION" | tr -d '[:space:]') @@ -280,7 +290,7 @@ jobs: fi echo "✓ prowler/config/config.py version: $CURRENT_VERSION" - - name: Verify version in api/pyproject.toml + - name: Verify API version in api/pyproject.toml if: ${{ env.HAS_API_CHANGES == 'true' }} run: | CURRENT_API_VERSION=$(grep '^version = ' api/pyproject.toml | sed -E 's/version = "([^"]+)"/\1/' | tr -d '[:space:]') @@ -291,7 +301,7 @@ jobs: fi echo "✓ api/pyproject.toml version: $CURRENT_API_VERSION" - - name: Verify prowler dependency in api/pyproject.toml + - name: Verify API prowler dependency in api/pyproject.toml if: ${{ env.PATCH_VERSION != '0' && env.HAS_API_CHANGES == 'true' }} run: | CURRENT_PROWLER_REF=$(grep 'prowler @ git+https://github.com/prowler-cloud/prowler.git@' api/pyproject.toml | sed -E 's/.*@([^"]+)".*/\1/' | tr -d '[:space:]') @@ -302,7 +312,7 @@ jobs: fi echo "✓ api/pyproject.toml prowler dependency: $CURRENT_PROWLER_REF" - - name: Verify version in api/src/backend/api/v1/views.py + - name: Verify API version in api/src/backend/api/v1/views.py if: ${{ env.HAS_API_CHANGES == 'true' }} run: | CURRENT_API_VERSION=$(grep 'spectacular_settings.VERSION = ' api/src/backend/api/v1/views.py | sed -E 's/.*spectacular_settings.VERSION = "([^"]+)".*/\1/' | tr -d '[:space:]') @@ -313,7 +323,7 @@ jobs: fi echo "✓ api/src/backend/api/v1/views.py version: $CURRENT_API_VERSION" - - name: Checkout existing release branch for minor release + - name: Checkout release branch for minor release if: ${{ env.PATCH_VERSION == '0' }} run: | echo "Minor release detected (patch = 0), checking out existing branch $BRANCH_NAME..." @@ -325,19 +335,12 @@ jobs: exit 1 fi - - name: Prepare prowler dependency update for minor release + - name: Update API prowler dependency for minor release if: ${{ env.PATCH_VERSION == '0' }} run: | CURRENT_PROWLER_REF=$(grep 'prowler @ git+https://github.com/prowler-cloud/prowler.git@' api/pyproject.toml | sed -E 's/.*@([^"]+)".*/\1/' | tr -d '[:space:]') BRANCH_NAME_TRIMMED=$(echo "$BRANCH_NAME" | tr -d '[:space:]') - # Create a temporary branch for the PR from the minor version branch - TEMP_BRANCH="update-api-dependency-$BRANCH_NAME_TRIMMED-$(date +%s)" - echo "TEMP_BRANCH=$TEMP_BRANCH" >> $GITHUB_ENV - - # Create temp branch from the current minor version branch - git checkout -b "$TEMP_BRANCH" - # Minor release: update the dependency to use the release branch echo "Updating prowler dependency from '$CURRENT_PROWLER_REF' to '$BRANCH_NAME_TRIMMED'" sed -i "s|prowler @ git+https://github.com/prowler-cloud/prowler.git@[^\"]*\"|prowler @ git+https://github.com/prowler-cloud/prowler.git@$BRANCH_NAME_TRIMMED\"|" api/pyproject.toml @@ -355,20 +358,19 @@ jobs: poetry lock cd .. - # Commit and push the temporary branch - git add api/pyproject.toml api/poetry.lock - git commit -m "chore(api): update prowler dependency to $BRANCH_NAME_TRIMMED for release $PROWLER_VERSION" - git push origin "$TEMP_BRANCH" - echo "✓ Prepared prowler dependency update to: $UPDATED_PROWLER_REF" - - name: Create Pull Request against release branch + - name: Create PR for API dependency update if: ${{ env.PATCH_VERSION == '0' }} uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 with: token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} - branch: ${{ env.TEMP_BRANCH }} + commit-message: 'chore(api): update prowler dependency to ${{ env.BRANCH_NAME }} for release ${{ env.PROWLER_VERSION }}' + branch: update-api-dependency-${{ env.BRANCH_NAME }}-${{ github.run_number }} base: ${{ env.BRANCH_NAME }} + add-paths: | + api/pyproject.toml + api/poetry.lock title: "chore(api): Update prowler dependency to ${{ env.BRANCH_NAME }} for release ${{ env.PROWLER_VERSION }}" body: | ### Description @@ -401,5 +403,6 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Clean up temporary files + if: always() run: | rm -f prowler_changelog.md api_changelog.md ui_changelog.md mcp_changelog.md combined_changelog.md diff --git a/.github/workflows/pull-request-check-changelog.yml b/.github/workflows/pull-request-check-changelog.yml deleted file mode 100644 index 3b96e6d499..0000000000 --- a/.github/workflows/pull-request-check-changelog.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Prowler - Check Changelog - -on: - pull_request: - types: [opened, synchronize, reopened, labeled, unlabeled] - -jobs: - check-changelog: - if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false - runs-on: ubuntu-latest - permissions: - id-token: write - contents: read - pull-requests: write - env: - MONITORED_FOLDERS: "api ui prowler mcp_server" - - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - fetch-depth: 0 - - - name: Get list of changed files - id: changed_files - run: | - git fetch origin ${{ github.base_ref }} - git diff --name-only origin/${{ github.base_ref }}...HEAD > changed_files.txt - cat changed_files.txt - - - name: Check for folder changes and changelog presence - id: check_folders - run: | - missing_changelogs="" - - for folder in $MONITORED_FOLDERS; do - if grep -q "^${folder}/" changed_files.txt; then - echo "Detected changes in ${folder}/" - if ! grep -q "^${folder}/CHANGELOG.md$" changed_files.txt; then - echo "No changelog update found for ${folder}/" - missing_changelogs="${missing_changelogs}- \`${folder}\`\n" - fi - fi - done - - echo "missing_changelogs<> $GITHUB_OUTPUT - echo -e "${missing_changelogs}" >> $GITHUB_OUTPUT - echo "EOF" >> $GITHUB_OUTPUT - - - name: Find existing changelog comment - if: github.event.pull_request.head.repo.full_name == github.repository - id: find_comment - uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad #v4.0.0 - with: - issue-number: ${{ github.event.pull_request.number }} - comment-author: 'github-actions[bot]' - body-includes: '' - - - name: Update PR comment with changelog status - if: github.event.pull_request.head.repo.full_name == github.repository - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 - with: - issue-number: ${{ github.event.pull_request.number }} - comment-id: ${{ steps.find_comment.outputs.comment-id }} - edit-mode: replace - body: | - - ${{ steps.check_folders.outputs.missing_changelogs != '' && format('⚠ī¸ **Changes detected in the following folders without a corresponding update to the `CHANGELOG.md`:** - - {0} - - Please add an entry to the corresponding `CHANGELOG.md` file to maintain a clear history of changes.', steps.check_folders.outputs.missing_changelogs) || '✅ All necessary `CHANGELOG.md` files have been updated. Great job! 🎉' }} - - - name: Fail if changelog is missing - if: steps.check_folders.outputs.missing_changelogs != '' - run: | - echo "ERROR: Missing changelog updates in some folders." - exit 1 diff --git a/.github/workflows/sdk-codeql.yml b/.github/workflows/sdk-codeql.yml index 302f73c0ca..ee9ba9c396 100644 --- a/.github/workflows/sdk-codeql.yml +++ b/.github/workflows/sdk-codeql.yml @@ -1,44 +1,40 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: SDK - CodeQL +name: 'SDK: CodeQL' on: push: branches: - - "master" - - "v3" - - "v4.*" - - "v5.*" - paths-ignore: - - 'ui/**' - - 'api/**' - - '.github/**' + - 'master' + - 'v5.*' + paths: + - 'prowler/**' + - 'tests/**' + - 'pyproject.toml' + - '.github/workflows/sdk-codeql.yml' + - '.github/codeql/sdk-codeql-config.yml' + - '!prowler/CHANGELOG.md' pull_request: branches: - - "master" - - "v3" - - "v4.*" - - "v5.*" - paths-ignore: - - 'ui/**' - - 'api/**' - - '.github/**' + - 'master' + - 'v5.*' + paths: + - 'prowler/**' + - 'tests/**' + - 'pyproject.toml' + - '.github/workflows/sdk-codeql.yml' + - '.github/codeql/sdk-codeql-config.yml' + - '!prowler/CHANGELOG.md' schedule: - cron: '00 12 * * *' +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: analyze: - name: Analyze + name: CodeQL Security Analysis runs-on: ubuntu-latest + timeout-minutes: 30 permissions: actions: read contents: read @@ -47,21 +43,20 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'python' ] - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + language: + - 'python' steps: - - name: Checkout repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 - with: - languages: ${{ matrix.language }} - config-file: ./.github/codeql/sdk-codeql-config.yml + - name: Initialize CodeQL + uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 + with: + languages: ${{ matrix.language }} + config-file: ./.github/codeql/sdk-codeql-config.yml - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 - with: - category: "/language:${{matrix.language}}" + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 + with: + category: '/language:${{ matrix.language }}' diff --git a/.github/workflows/ui-codeql.yml b/.github/workflows/ui-codeql.yml index 05ab6e6123..d51b904959 100644 --- a/.github/workflows/ui-codeql.yml +++ b/.github/workflows/ui-codeql.yml @@ -1,36 +1,36 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: UI - CodeQL +name: 'UI: CodeQL' on: push: branches: - - "master" - - "v5.*" + - 'master' + - 'v5.*' paths: - - "ui/**" + - 'ui/**' + - '.github/workflows/ui-codeql.yml' + - '.github/codeql/ui-codeql-config.yml' + - '!ui/CHANGELOG.md' pull_request: branches: - - "master" - - "v5.*" + - 'master' + - 'v5.*' paths: - - "ui/**" + - 'ui/**' + - '.github/workflows/ui-codeql.yml' + - '.github/codeql/ui-codeql-config.yml' + - '!ui/CHANGELOG.md' schedule: - - cron: "00 12 * * *" + - cron: '00 12 * * *' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true jobs: analyze: - name: Analyze + name: CodeQL Security Analysis runs-on: ubuntu-latest + timeout-minutes: 30 permissions: actions: read contents: read @@ -39,14 +39,13 @@ jobs: strategy: fail-fast: false matrix: - language: ["javascript"] - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + language: + - 'javascript-typescript' steps: - name: Checkout repository uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 with: @@ -56,4 +55,4 @@ jobs: - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5 with: - category: "/language:${{matrix.language}}" + category: '/language:${{ matrix.language }}' diff --git a/.gitignore b/.gitignore index 4b39b18b83..bc8c66d39b 100644 --- a/.gitignore +++ b/.gitignore @@ -39,6 +39,12 @@ secrets-*/ # JUnit Reports junit-reports/ +# Test and coverage artifacts +*_coverage.xml +pytest_*.xml +.coverage +htmlcov/ + # VSCode files .vscode/ @@ -83,3 +89,6 @@ CLAUDE.md # MCP Server mcp_server/prowler_mcp_server/prowler_app/server.py mcp_server/prowler_mcp_server/prowler_app/utils/schema.yaml + +# Compliance report +*.pdf diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2dc954e9d9..f530feb99a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,4 +10,4 @@ Want some swag as appreciation for your contribution? # Prowler Developer Guide -https://docs.prowler.com/projects/prowler-open-source/en/latest/developer-guide/introduction/ +https://goto.prowler.com/devguide diff --git a/Makefile b/Makefile index 368bb885bd..861c9cf7fe 100644 --- a/Makefile +++ b/Makefile @@ -46,6 +46,14 @@ help: ## Show this help. @echo "Prowler Makefile" @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) +##@ Build no cache +build-no-cache-dev: + docker compose -f docker-compose-dev.yml build --no-cache api-dev worker-dev worker-beat + ##@ Development Environment run-api-dev: ## Start development environment with API, PostgreSQL, Valkey, and workers - docker compose -f docker-compose-dev.yml up api-dev postgres valkey worker-dev worker-beat --build + docker compose -f docker-compose-dev.yml up api-dev postgres valkey worker-dev worker-beat + +##@ Development Environment +build-and-run-api-dev: build-no-cache-dev run-api-dev + diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 13749d8b9e..6c43a2e582 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -2,7 +2,12 @@ All notable changes to the **Prowler API** are documented in this file. -## [1.14.0] (Prowler UNRELEASED) +## [1.15.0] (Prowler UNRELEASED) + +### Added +- Support for configuring multiple LLM providers [(#8772)](https://github.com/prowler-cloud/prowler/pull/8772) + +## [1.14.0] (Prowler 5.13.0) ### Added - Default JWT keys are generated and stored if they are missing from configuration [(#8655)](https://github.com/prowler-cloud/prowler/pull/8655) @@ -12,8 +17,10 @@ All notable changes to the **Prowler API** are documented in this file. - API Key support [(#8805)](https://github.com/prowler-cloud/prowler/pull/8805) - SAML role mapping protection for single-admin tenants to prevent accidental lockout [(#8882)](https://github.com/prowler-cloud/prowler/pull/8882) - Support for `passed_findings` and `total_findings` fields in compliance requirement overview for accurate Prowler ThreatScore calculation [(#8582)](https://github.com/prowler-cloud/prowler/pull/8582) +- PDF reporting for Prowler ThreatScore [(#8867)](https://github.com/prowler-cloud/prowler/pull/8867) - Database read replica support [(#8869)](https://github.com/prowler-cloud/prowler/pull/8869) - Support Common Cloud Controls for AWS, Azure and GCP [(#8000)](https://github.com/prowler-cloud/prowler/pull/8000) +- Add `provider_id__in` filter support to findings and findings severity overview endpoints [(#8951)](https://github.com/prowler-cloud/prowler/pull/8951) ### Changed - Now the MANAGE_ACCOUNT permission is required to modify or read user permissions instead of MANAGE_USERS [(#8281)](https://github.com/prowler-cloud/prowler/pull/8281) diff --git a/api/poetry.lock b/api/poetry.lock index 61929f3bdc..40313d9fa5 100644 --- a/api/poetry.lock +++ b/api/poetry.lock @@ -1256,6 +1256,98 @@ files = [ {file = "contextlib2-21.6.0.tar.gz", hash = "sha256:ab1e2bfe1d01d968e1b7e8d9023bc51ef3509bba217bb730cee3827e1ee82869"}, ] +[[package]] +name = "contourpy" +version = "1.3.3" +description = "Python library for calculating contours of 2D quadrilateral grids" +optional = false +python-versions = ">=3.11" +groups = ["main"] +files = [ + {file = "contourpy-1.3.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:709a48ef9a690e1343202916450bc48b9e51c049b089c7f79a267b46cffcdaa1"}, + {file = "contourpy-1.3.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:23416f38bfd74d5d28ab8429cc4d63fa67d5068bd711a85edb1c3fb0c3e2f381"}, + {file = "contourpy-1.3.3-cp311-cp311-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:929ddf8c4c7f348e4c0a5a3a714b5c8542ffaa8c22954862a46ca1813b667ee7"}, + {file = "contourpy-1.3.3-cp311-cp311-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9e999574eddae35f1312c2b4b717b7885d4edd6cb46700e04f7f02db454e67c1"}, + {file = "contourpy-1.3.3-cp311-cp311-manylinux_2_26_s390x.manylinux_2_28_s390x.whl", hash = "sha256:0bf67e0e3f482cb69779dd3061b534eb35ac9b17f163d851e2a547d56dba0a3a"}, + {file = "contourpy-1.3.3-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:51e79c1f7470158e838808d4a996fa9bac72c498e93d8ebe5119bc1e6becb0db"}, + {file = "contourpy-1.3.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:598c3aaece21c503615fd59c92a3598b428b2f01bfb4b8ca9c4edeecc2438620"}, + {file = "contourpy-1.3.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:322ab1c99b008dad206d406bb61d014cf0174df491ae9d9d0fac6a6fda4f977f"}, + {file = "contourpy-1.3.3-cp311-cp311-win32.whl", hash = "sha256:fd907ae12cd483cd83e414b12941c632a969171bf90fc937d0c9f268a31cafff"}, + {file = "contourpy-1.3.3-cp311-cp311-win_amd64.whl", hash = "sha256:3519428f6be58431c56581f1694ba8e50626f2dd550af225f82fb5f5814d2a42"}, + {file = "contourpy-1.3.3-cp311-cp311-win_arm64.whl", hash = "sha256:15ff10bfada4bf92ec8b31c62bf7c1834c244019b4a33095a68000d7075df470"}, + {file = "contourpy-1.3.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:b08a32ea2f8e42cf1d4be3169a98dd4be32bafe4f22b6c4cb4ba810fa9e5d2cb"}, + {file = "contourpy-1.3.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:556dba8fb6f5d8742f2923fe9457dbdd51e1049c4a43fd3986a0b14a1d815fc6"}, + {file = "contourpy-1.3.3-cp312-cp312-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:92d9abc807cf7d0e047b95ca5d957cf4792fcd04e920ca70d48add15c1a90ea7"}, + {file = "contourpy-1.3.3-cp312-cp312-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:b2e8faa0ed68cb29af51edd8e24798bb661eac3bd9f65420c1887b6ca89987c8"}, + {file = "contourpy-1.3.3-cp312-cp312-manylinux_2_26_s390x.manylinux_2_28_s390x.whl", hash = "sha256:626d60935cf668e70a5ce6ff184fd713e9683fb458898e4249b63be9e28286ea"}, + {file = "contourpy-1.3.3-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4d00e655fcef08aba35ec9610536bfe90267d7ab5ba944f7032549c55a146da1"}, + {file = "contourpy-1.3.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:451e71b5a7d597379ef572de31eeb909a87246974d960049a9848c3bc6c41bf7"}, + {file = "contourpy-1.3.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:459c1f020cd59fcfe6650180678a9993932d80d44ccde1fa1868977438f0b411"}, + {file = "contourpy-1.3.3-cp312-cp312-win32.whl", hash = "sha256:023b44101dfe49d7d53932be418477dba359649246075c996866106da069af69"}, + {file = "contourpy-1.3.3-cp312-cp312-win_amd64.whl", hash = "sha256:8153b8bfc11e1e4d75bcb0bff1db232f9e10b274e0929de9d608027e0d34ff8b"}, + {file = "contourpy-1.3.3-cp312-cp312-win_arm64.whl", hash = "sha256:07ce5ed73ecdc4a03ffe3e1b3e3c1166db35ae7584be76f65dbbe28a7791b0cc"}, + {file = "contourpy-1.3.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:177fb367556747a686509d6fef71d221a4b198a3905fe824430e5ea0fda54eb5"}, + {file = "contourpy-1.3.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d002b6f00d73d69333dac9d0b8d5e84d9724ff9ef044fd63c5986e62b7c9e1b1"}, + {file = "contourpy-1.3.3-cp313-cp313-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:348ac1f5d4f1d66d3322420f01d42e43122f43616e0f194fc1c9f5d830c5b286"}, + {file = "contourpy-1.3.3-cp313-cp313-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:655456777ff65c2c548b7c454af9c6f33f16c8884f11083244b5819cc214f1b5"}, + {file = "contourpy-1.3.3-cp313-cp313-manylinux_2_26_s390x.manylinux_2_28_s390x.whl", hash = "sha256:644a6853d15b2512d67881586bd03f462c7ab755db95f16f14d7e238f2852c67"}, + {file = "contourpy-1.3.3-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4debd64f124ca62069f313a9cb86656ff087786016d76927ae2cf37846b006c9"}, + {file = "contourpy-1.3.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a15459b0f4615b00bbd1e91f1b9e19b7e63aea7483d03d804186f278c0af2659"}, + {file = "contourpy-1.3.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ca0fdcd73925568ca027e0b17ab07aad764be4706d0a925b89227e447d9737b7"}, + {file = "contourpy-1.3.3-cp313-cp313-win32.whl", hash = "sha256:b20c7c9a3bf701366556e1b1984ed2d0cedf999903c51311417cf5f591d8c78d"}, + {file = "contourpy-1.3.3-cp313-cp313-win_amd64.whl", hash = "sha256:1cadd8b8969f060ba45ed7c1b714fe69185812ab43bd6b86a9123fe8f99c3263"}, + {file = "contourpy-1.3.3-cp313-cp313-win_arm64.whl", hash = "sha256:fd914713266421b7536de2bfa8181aa8c699432b6763a0ea64195ebe28bff6a9"}, + {file = "contourpy-1.3.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:88df9880d507169449d434c293467418b9f6cbe82edd19284aa0409e7fdb933d"}, + {file = "contourpy-1.3.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:d06bb1f751ba5d417047db62bca3c8fde202b8c11fb50742ab3ab962c81e8216"}, + {file = "contourpy-1.3.3-cp313-cp313t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e4e6b05a45525357e382909a4c1600444e2a45b4795163d3b22669285591c1ae"}, + {file = "contourpy-1.3.3-cp313-cp313t-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ab3074b48c4e2cf1a960e6bbeb7f04566bf36b1861d5c9d4d8ac04b82e38ba20"}, + {file = "contourpy-1.3.3-cp313-cp313t-manylinux_2_26_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6c3d53c796f8647d6deb1abe867daeb66dcc8a97e8455efa729516b997b8ed99"}, + {file = "contourpy-1.3.3-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:50ed930df7289ff2a8d7afeb9603f8289e5704755c7e5c3bbd929c90c817164b"}, + {file = "contourpy-1.3.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:4feffb6537d64b84877da813a5c30f1422ea5739566abf0bd18065ac040e120a"}, + {file = "contourpy-1.3.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:2b7e9480ffe2b0cd2e787e4df64270e3a0440d9db8dc823312e2c940c167df7e"}, + {file = "contourpy-1.3.3-cp313-cp313t-win32.whl", hash = "sha256:283edd842a01e3dcd435b1c5116798d661378d83d36d337b8dde1d16a5fc9ba3"}, + {file = "contourpy-1.3.3-cp313-cp313t-win_amd64.whl", hash = "sha256:87acf5963fc2b34825e5b6b048f40e3635dd547f590b04d2ab317c2619ef7ae8"}, + {file = "contourpy-1.3.3-cp313-cp313t-win_arm64.whl", hash = "sha256:3c30273eb2a55024ff31ba7d052dde990d7d8e5450f4bbb6e913558b3d6c2301"}, + {file = "contourpy-1.3.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fde6c716d51c04b1c25d0b90364d0be954624a0ee9d60e23e850e8d48353d07a"}, + {file = "contourpy-1.3.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:cbedb772ed74ff5be440fa8eee9bd49f64f6e3fc09436d9c7d8f1c287b121d77"}, + {file = "contourpy-1.3.3-cp314-cp314-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:22e9b1bd7a9b1d652cd77388465dc358dafcd2e217d35552424aa4f996f524f5"}, + {file = "contourpy-1.3.3-cp314-cp314-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a22738912262aa3e254e4f3cb079a95a67132fc5a063890e224393596902f5a4"}, + {file = "contourpy-1.3.3-cp314-cp314-manylinux_2_26_s390x.manylinux_2_28_s390x.whl", hash = "sha256:afe5a512f31ee6bd7d0dda52ec9864c984ca3d66664444f2d72e0dc4eb832e36"}, + {file = "contourpy-1.3.3-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f64836de09927cba6f79dcd00fdd7d5329f3fccc633468507079c829ca4db4e3"}, + {file = "contourpy-1.3.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:1fd43c3be4c8e5fd6e4f2baeae35ae18176cf2e5cced681cca908addf1cdd53b"}, + {file = "contourpy-1.3.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:6afc576f7b33cf00996e5c1102dc2a8f7cc89e39c0b55df93a0b78c1bd992b36"}, + {file = "contourpy-1.3.3-cp314-cp314-win32.whl", hash = "sha256:66c8a43a4f7b8df8b71ee1840e4211a3c8d93b214b213f590e18a1beca458f7d"}, + {file = "contourpy-1.3.3-cp314-cp314-win_amd64.whl", hash = "sha256:cf9022ef053f2694e31d630feaacb21ea24224be1c3ad0520b13d844274614fd"}, + {file = "contourpy-1.3.3-cp314-cp314-win_arm64.whl", hash = "sha256:95b181891b4c71de4bb404c6621e7e2390745f887f2a026b2d99e92c17892339"}, + {file = "contourpy-1.3.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:33c82d0138c0a062380332c861387650c82e4cf1747aaa6938b9b6516762e772"}, + {file = "contourpy-1.3.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ea37e7b45949df430fe649e5de8351c423430046a2af20b1c1961cae3afcda77"}, + {file = "contourpy-1.3.3-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d304906ecc71672e9c89e87c4675dc5c2645e1f4269a5063b99b0bb29f232d13"}, + {file = "contourpy-1.3.3-cp314-cp314t-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ca658cd1a680a5c9ea96dc61cdbae1e85c8f25849843aa799dfd3cb370ad4fbe"}, + {file = "contourpy-1.3.3-cp314-cp314t-manylinux_2_26_s390x.manylinux_2_28_s390x.whl", hash = "sha256:ab2fd90904c503739a75b7c8c5c01160130ba67944a7b77bbf36ef8054576e7f"}, + {file = "contourpy-1.3.3-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b7301b89040075c30e5768810bc96a8e8d78085b47d8be6e4c3f5a0b4ed478a0"}, + {file = "contourpy-1.3.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:2a2a8b627d5cc6b7c41a4beff6c5ad5eb848c88255fda4a8745f7e901b32d8e4"}, + {file = "contourpy-1.3.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:fd6ec6be509c787f1caf6b247f0b1ca598bef13f4ddeaa126b7658215529ba0f"}, + {file = "contourpy-1.3.3-cp314-cp314t-win32.whl", hash = "sha256:e74a9a0f5e3fff48fb5a7f2fd2b9b70a3fe014a67522f79b7cca4c0c7e43c9ae"}, + {file = "contourpy-1.3.3-cp314-cp314t-win_amd64.whl", hash = "sha256:13b68d6a62db8eafaebb8039218921399baf6e47bf85006fd8529f2a08ef33fc"}, + {file = "contourpy-1.3.3-cp314-cp314t-win_arm64.whl", hash = "sha256:b7448cb5a725bb1e35ce88771b86fba35ef418952474492cf7c764059933ff8b"}, + {file = "contourpy-1.3.3-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:cd5dfcaeb10f7b7f9dc8941717c6c2ade08f587be2226222c12b25f0483ed497"}, + {file = "contourpy-1.3.3-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:0c1fc238306b35f246d61a1d416a627348b5cf0648648a031e14bb8705fcdfe8"}, + {file = "contourpy-1.3.3-pp311-pypy311_pp73-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:70f9aad7de812d6541d29d2bbf8feb22ff7e1c299523db288004e3157ff4674e"}, + {file = "contourpy-1.3.3-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5ed3657edf08512fc3fe81b510e35c2012fbd3081d2e26160f27ca28affec989"}, + {file = "contourpy-1.3.3-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:3d1a3799d62d45c18bafd41c5fa05120b96a28079f2393af559b843d1a966a77"}, + {file = "contourpy-1.3.3.tar.gz", hash = "sha256:083e12155b210502d0bca491432bb04d56dc3432f95a979b429f2848c3dbe880"}, +] + +[package.dependencies] +numpy = ">=1.25" + +[package.extras] +bokeh = ["bokeh", "selenium"] +docs = ["furo", "sphinx (>=7.2)", "sphinx-copybutton"] +mypy = ["bokeh", "contourpy[bokeh,docs]", "docutils-stubs", "mypy (==1.17.0)", "types-Pillow"] +test = ["Pillow", "contourpy[test-no-images]", "matplotlib"] +test-no-images = ["pytest", "pytest-cov", "pytest-rerunfailures", "pytest-xdist", "wurlitzer"] + [[package]] name = "coverage" version = "7.5.4" @@ -1390,6 +1482,22 @@ ssh = ["bcrypt (>=3.1.5)"] test = ["certifi (>=2024)", "cryptography-vectors (==44.0.1)", "pretend (>=0.7)", "pytest (>=7.4.0)", "pytest-benchmark (>=4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"] test-randomorder = ["pytest-randomly"] +[[package]] +name = "cycler" +version = "0.12.1" +description = "Composable style cycles" +optional = false +python-versions = ">=3.8" +groups = ["main"] +files = [ + {file = "cycler-0.12.1-py3-none-any.whl", hash = "sha256:85cef7cff222d8644161529808465972e51340599459b8ac3ccbac5a854e0d30"}, + {file = "cycler-0.12.1.tar.gz", hash = "sha256:88bb128f02ba341da8ef447245a9e138fae777f6a23943da4540077d3601eb1c"}, +] + +[package.extras] +docs = ["ipython", "matplotlib", "numpydoc", "sphinx"] +tests = ["pytest", "pytest-cov", "pytest-xdist"] + [[package]] name = "dash" version = "3.1.1" @@ -2120,6 +2228,87 @@ werkzeug = ">=3.1.0" async = ["asgiref (>=3.2)"] dotenv = ["python-dotenv"] +[[package]] +name = "fonttools" +version = "4.60.1" +description = "Tools to manipulate font files" +optional = false +python-versions = ">=3.9" +groups = ["main"] +files = [ + {file = "fonttools-4.60.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:9a52f254ce051e196b8fe2af4634c2d2f02c981756c6464dc192f1b6050b4e28"}, + {file = "fonttools-4.60.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:c7420a2696a44650120cdd269a5d2e56a477e2bfa9d95e86229059beb1c19e15"}, + {file = "fonttools-4.60.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee0c0b3b35b34f782afc673d503167157094a16f442ace7c6c5e0ca80b08f50c"}, + {file = "fonttools-4.60.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:282dafa55f9659e8999110bd8ed422ebe1c8aecd0dc396550b038e6c9a08b8ea"}, + {file = "fonttools-4.60.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:4ba4bd646e86de16160f0fb72e31c3b9b7d0721c3e5b26b9fa2fc931dfdb2652"}, + {file = "fonttools-4.60.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:0b0835ed15dd5b40d726bb61c846a688f5b4ce2208ec68779bc81860adb5851a"}, + {file = "fonttools-4.60.1-cp310-cp310-win32.whl", hash = "sha256:1525796c3ffe27bb6268ed2a1bb0dcf214d561dfaf04728abf01489eb5339dce"}, + {file = "fonttools-4.60.1-cp310-cp310-win_amd64.whl", hash = "sha256:268ecda8ca6cb5c4f044b1fb9b3b376e8cd1b361cef275082429dc4174907038"}, + {file = "fonttools-4.60.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7b4c32e232a71f63a5d00259ca3d88345ce2a43295bb049d21061f338124246f"}, + {file = "fonttools-4.60.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:3630e86c484263eaac71d117085d509cbcf7b18f677906824e4bace598fb70d2"}, + {file = "fonttools-4.60.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5c1015318e4fec75dd4943ad5f6a206d9727adf97410d58b7e32ab644a807914"}, + {file = "fonttools-4.60.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:e6c58beb17380f7c2ea181ea11e7db8c0ceb474c9dd45f48e71e2cb577d146a1"}, + {file = "fonttools-4.60.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:ec3681a0cb34c255d76dd9d865a55f260164adb9fa02628415cdc2d43ee2c05d"}, + {file = "fonttools-4.60.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f4b5c37a5f40e4d733d3bbaaef082149bee5a5ea3156a785ff64d949bd1353fa"}, + {file = "fonttools-4.60.1-cp311-cp311-win32.whl", hash = "sha256:398447f3d8c0c786cbf1209711e79080a40761eb44b27cdafffb48f52bcec258"}, + {file = "fonttools-4.60.1-cp311-cp311-win_amd64.whl", hash = "sha256:d066ea419f719ed87bc2c99a4a4bfd77c2e5949cb724588b9dd58f3fd90b92bf"}, + {file = "fonttools-4.60.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:7b0c6d57ab00dae9529f3faf187f2254ea0aa1e04215cf2f1a8ec277c96661bc"}, + {file = "fonttools-4.60.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:839565cbf14645952d933853e8ade66a463684ed6ed6c9345d0faf1f0e868877"}, + {file = "fonttools-4.60.1-cp312-cp312-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:8177ec9676ea6e1793c8a084a90b65a9f778771998eb919d05db6d4b1c0b114c"}, + {file = "fonttools-4.60.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:996a4d1834524adbb423385d5a629b868ef9d774670856c63c9a0408a3063401"}, + {file = "fonttools-4.60.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a46b2f450bc79e06ef3b6394f0c68660529ed51692606ad7f953fc2e448bc903"}, + {file = "fonttools-4.60.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6ec722ee589e89a89f5b7574f5c45604030aa6ae24cb2c751e2707193b466fed"}, + {file = "fonttools-4.60.1-cp312-cp312-win32.whl", hash = "sha256:b2cf105cee600d2de04ca3cfa1f74f1127f8455b71dbad02b9da6ec266e116d6"}, + {file = "fonttools-4.60.1-cp312-cp312-win_amd64.whl", hash = "sha256:992775c9fbe2cf794786fa0ffca7f09f564ba3499b8fe9f2f80bd7197db60383"}, + {file = "fonttools-4.60.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:6f68576bb4bbf6060c7ab047b1574a1ebe5c50a17de62830079967b211059ebb"}, + {file = "fonttools-4.60.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:eedacb5c5d22b7097482fa834bda0dafa3d914a4e829ec83cdea2a01f8c813c4"}, + {file = "fonttools-4.60.1-cp313-cp313-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:b33a7884fabd72bdf5f910d0cf46be50dce86a0362a65cfc746a4168c67eb96c"}, + {file = "fonttools-4.60.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2409d5fb7b55fd70f715e6d34e7a6e4f7511b8ad29a49d6df225ee76da76dd77"}, + {file = "fonttools-4.60.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:c8651e0d4b3bdeda6602b85fdc2abbefc1b41e573ecb37b6779c4ca50753a199"}, + {file = "fonttools-4.60.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:145daa14bf24824b677b9357c5e44fd8895c2a8f53596e1b9ea3496081dc692c"}, + {file = "fonttools-4.60.1-cp313-cp313-win32.whl", hash = "sha256:2299df884c11162617a66b7c316957d74a18e3758c0274762d2cc87df7bc0272"}, + {file = "fonttools-4.60.1-cp313-cp313-win_amd64.whl", hash = "sha256:a3db56f153bd4c5c2b619ab02c5db5192e222150ce5a1bc10f16164714bc39ac"}, + {file = "fonttools-4.60.1-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:a884aef09d45ba1206712c7dbda5829562d3fea7726935d3289d343232ecb0d3"}, + {file = "fonttools-4.60.1-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:8a44788d9d91df72d1a5eac49b31aeb887a5f4aab761b4cffc4196c74907ea85"}, + {file = "fonttools-4.60.1-cp314-cp314-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:e852d9dda9f93ad3651ae1e3bb770eac544ec93c3807888798eccddf84596537"}, + {file = "fonttools-4.60.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:154cb6ee417e417bf5f7c42fe25858c9140c26f647c7347c06f0cc2d47eff003"}, + {file = "fonttools-4.60.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:5664fd1a9ea7f244487ac8f10340c4e37664675e8667d6fee420766e0fb3cf08"}, + {file = "fonttools-4.60.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:583b7f8e3c49486e4d489ad1deacfb8d5be54a8ef34d6df824f6a171f8511d99"}, + {file = "fonttools-4.60.1-cp314-cp314-win32.whl", hash = "sha256:66929e2ea2810c6533a5184f938502cfdaea4bc3efb7130d8cc02e1c1b4108d6"}, + {file = "fonttools-4.60.1-cp314-cp314-win_amd64.whl", hash = "sha256:f3d5be054c461d6a2268831f04091dc82753176f6ea06dc6047a5e168265a987"}, + {file = "fonttools-4.60.1-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:b6379e7546ba4ae4b18f8ae2b9bc5960936007a1c0e30b342f662577e8bc3299"}, + {file = "fonttools-4.60.1-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9d0ced62b59e0430b3690dbc5373df1c2aa7585e9a8ce38eff87f0fd993c5b01"}, + {file = "fonttools-4.60.1-cp314-cp314t-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:875cb7764708b3132637f6c5fb385b16eeba0f7ac9fa45a69d35e09b47045801"}, + {file = "fonttools-4.60.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a184b2ea57b13680ab6d5fbde99ccef152c95c06746cb7718c583abd8f945ccc"}, + {file = "fonttools-4.60.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:026290e4ec76583881763fac284aca67365e0be9f13a7fb137257096114cb3bc"}, + {file = "fonttools-4.60.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f0e8817c7d1a0c2eedebf57ef9a9896f3ea23324769a9a2061a80fe8852705ed"}, + {file = "fonttools-4.60.1-cp314-cp314t-win32.whl", hash = "sha256:1410155d0e764a4615774e5c2c6fc516259fe3eca5882f034eb9bfdbee056259"}, + {file = "fonttools-4.60.1-cp314-cp314t-win_amd64.whl", hash = "sha256:022beaea4b73a70295b688f817ddc24ed3e3418b5036ffcd5658141184ef0d0c"}, + {file = "fonttools-4.60.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:122e1a8ada290423c493491d002f622b1992b1ab0b488c68e31c413390dc7eb2"}, + {file = "fonttools-4.60.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:a140761c4ff63d0cb9256ac752f230460ee225ccef4ad8f68affc723c88e2036"}, + {file = "fonttools-4.60.1-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0eae96373e4b7c9e45d099d7a523444e3554360927225c1cdae221a58a45b856"}, + {file = "fonttools-4.60.1-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:596ecaca36367027d525b3b426d8a8208169d09edcf8c7506aceb3a38bfb55c7"}, + {file = "fonttools-4.60.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:2ee06fc57512144d8b0445194c2da9f190f61ad51e230f14836286470c99f854"}, + {file = "fonttools-4.60.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:b42d86938e8dda1cd9a1a87a6d82f1818eaf933348429653559a458d027446da"}, + {file = "fonttools-4.60.1-cp39-cp39-win32.whl", hash = "sha256:8b4eb332f9501cb1cd3d4d099374a1e1306783ff95489a1026bde9eb02ccc34a"}, + {file = "fonttools-4.60.1-cp39-cp39-win_amd64.whl", hash = "sha256:7473a8ed9ed09aeaa191301244a5a9dbe46fe0bf54f9d6cd21d83044c3321217"}, + {file = "fonttools-4.60.1-py3-none-any.whl", hash = "sha256:906306ac7afe2156fcf0042173d6ebbb05416af70f6b370967b47f8f00103bbb"}, + {file = "fonttools-4.60.1.tar.gz", hash = "sha256:ef00af0439ebfee806b25f24c8f92109157ff3fac5731dc7867957812e87b8d9"}, +] + +[package.extras] +all = ["brotli (>=1.0.1) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\"", "lxml (>=4.0)", "lz4 (>=1.7.4.2)", "matplotlib", "munkres ; platform_python_implementation == \"PyPy\"", "pycairo", "scipy ; platform_python_implementation != \"PyPy\"", "skia-pathops (>=0.5.0)", "sympy", "uharfbuzz (>=0.23.0)", "unicodedata2 (>=15.1.0) ; python_version <= \"3.12\"", "xattr ; sys_platform == \"darwin\"", "zopfli (>=0.1.4)"] +graphite = ["lz4 (>=1.7.4.2)"] +interpolatable = ["munkres ; platform_python_implementation == \"PyPy\"", "pycairo", "scipy ; platform_python_implementation != \"PyPy\""] +lxml = ["lxml (>=4.0)"] +pathops = ["skia-pathops (>=0.5.0)"] +plot = ["matplotlib"] +repacker = ["uharfbuzz (>=0.23.0)"] +symfont = ["sympy"] +type1 = ["xattr ; sys_platform == \"darwin\""] +unicode = ["unicodedata2 (>=15.1.0) ; python_version <= \"3.12\""] +woff = ["brotli (>=1.0.1) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\"", "zopfli (>=0.1.4)"] + [[package]] name = "freezegun" version = "1.5.1" @@ -2787,6 +2976,117 @@ files = [ [package.dependencies] referencing = ">=0.31.0" +[[package]] +name = "kiwisolver" +version = "1.4.9" +description = "A fast implementation of the Cassowary constraint solver" +optional = false +python-versions = ">=3.10" +groups = ["main"] +files = [ + {file = "kiwisolver-1.4.9-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:b4b4d74bda2b8ebf4da5bd42af11d02d04428b2c32846e4c2c93219df8a7987b"}, + {file = "kiwisolver-1.4.9-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:fb3b8132019ea572f4611d770991000d7f58127560c4889729248eb5852a102f"}, + {file = "kiwisolver-1.4.9-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:84fd60810829c27ae375114cd379da1fa65e6918e1da405f356a775d49a62bcf"}, + {file = "kiwisolver-1.4.9-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl", hash = "sha256:b78efa4c6e804ecdf727e580dbb9cba85624d2e1c6b5cb059c66290063bd99a9"}, + {file = "kiwisolver-1.4.9-cp310-cp310-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d4efec7bcf21671db6a3294ff301d2fc861c31faa3c8740d1a94689234d1b415"}, + {file = "kiwisolver-1.4.9-cp310-cp310-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:90f47e70293fc3688b71271100a1a5453aa9944a81d27ff779c108372cf5567b"}, + {file = "kiwisolver-1.4.9-cp310-cp310-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8fdca1def57a2e88ef339de1737a1449d6dbf5fab184c54a1fca01d541317154"}, + {file = "kiwisolver-1.4.9-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:9cf554f21be770f5111a1690d42313e140355e687e05cf82cb23d0a721a64a48"}, + {file = "kiwisolver-1.4.9-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:fc1795ac5cd0510207482c3d1d3ed781143383b8cfd36f5c645f3897ce066220"}, + {file = "kiwisolver-1.4.9-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:ccd09f20ccdbbd341b21a67ab50a119b64a403b09288c27481575105283c1586"}, + {file = "kiwisolver-1.4.9-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:540c7c72324d864406a009d72f5d6856f49693db95d1fbb46cf86febef873634"}, + {file = "kiwisolver-1.4.9-cp310-cp310-win_amd64.whl", hash = "sha256:ede8c6d533bc6601a47ad4046080d36b8fc99f81e6f1c17b0ac3c2dc91ac7611"}, + {file = "kiwisolver-1.4.9-cp310-cp310-win_arm64.whl", hash = "sha256:7b4da0d01ac866a57dd61ac258c5607b4cd677f63abaec7b148354d2b2cdd536"}, + {file = "kiwisolver-1.4.9-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:eb14a5da6dc7642b0f3a18f13654847cd8b7a2550e2645a5bda677862b03ba16"}, + {file = "kiwisolver-1.4.9-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:39a219e1c81ae3b103643d2aedb90f1ef22650deb266ff12a19e7773f3e5f089"}, + {file = "kiwisolver-1.4.9-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2405a7d98604b87f3fc28b1716783534b1b4b8510d8142adca34ee0bc3c87543"}, + {file = "kiwisolver-1.4.9-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:dc1ae486f9abcef254b5618dfb4113dd49f94c68e3e027d03cf0143f3f772b61"}, + {file = "kiwisolver-1.4.9-cp311-cp311-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8a1f570ce4d62d718dce3f179ee78dac3b545ac16c0c04bb363b7607a949c0d1"}, + {file = "kiwisolver-1.4.9-cp311-cp311-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:cb27e7b78d716c591e88e0a09a2139c6577865d7f2e152488c2cc6257f460872"}, + {file = "kiwisolver-1.4.9-cp311-cp311-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:15163165efc2f627eb9687ea5f3a28137217d217ac4024893d753f46bce9de26"}, + {file = "kiwisolver-1.4.9-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bdee92c56a71d2b24c33a7d4c2856bd6419d017e08caa7802d2963870e315028"}, + {file = "kiwisolver-1.4.9-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:412f287c55a6f54b0650bd9b6dce5aceddb95864a1a90c87af16979d37c89771"}, + {file = "kiwisolver-1.4.9-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:2c93f00dcba2eea70af2be5f11a830a742fe6b579a1d4e00f47760ef13be247a"}, + {file = "kiwisolver-1.4.9-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f117e1a089d9411663a3207ba874f31be9ac8eaa5b533787024dc07aeb74f464"}, + {file = "kiwisolver-1.4.9-cp311-cp311-win_amd64.whl", hash = "sha256:be6a04e6c79819c9a8c2373317d19a96048e5a3f90bec587787e86a1153883c2"}, + {file = "kiwisolver-1.4.9-cp311-cp311-win_arm64.whl", hash = "sha256:0ae37737256ba2de764ddc12aed4956460277f00c4996d51a197e72f62f5eec7"}, + {file = "kiwisolver-1.4.9-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:ac5a486ac389dddcc5bef4f365b6ae3ffff2c433324fb38dd35e3fab7c957999"}, + {file = "kiwisolver-1.4.9-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:f2ba92255faa7309d06fe44c3a4a97efe1c8d640c2a79a5ef728b685762a6fd2"}, + {file = "kiwisolver-1.4.9-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:4a2899935e724dd1074cb568ce7ac0dce28b2cd6ab539c8e001a8578eb106d14"}, + {file = "kiwisolver-1.4.9-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f6008a4919fdbc0b0097089f67a1eb55d950ed7e90ce2cc3e640abadd2757a04"}, + {file = "kiwisolver-1.4.9-cp312-cp312-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:67bb8b474b4181770f926f7b7d2f8c0248cbcb78b660fdd41a47054b28d2a752"}, + {file = "kiwisolver-1.4.9-cp312-cp312-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2327a4a30d3ee07d2fbe2e7933e8a37c591663b96ce42a00bc67461a87d7df77"}, + {file = "kiwisolver-1.4.9-cp312-cp312-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:7a08b491ec91b1d5053ac177afe5290adacf1f0f6307d771ccac5de30592d198"}, + {file = "kiwisolver-1.4.9-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:d8fc5c867c22b828001b6a38d2eaeb88160bf5783c6cb4a5e440efc981ce286d"}, + {file = "kiwisolver-1.4.9-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:3b3115b2581ea35bb6d1f24a4c90af37e5d9b49dcff267eeed14c3893c5b86ab"}, + {file = "kiwisolver-1.4.9-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:858e4c22fb075920b96a291928cb7dea5644e94c0ee4fcd5af7e865655e4ccf2"}, + {file = "kiwisolver-1.4.9-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:ed0fecd28cc62c54b262e3736f8bb2512d8dcfdc2bcf08be5f47f96bf405b145"}, + {file = "kiwisolver-1.4.9-cp312-cp312-win_amd64.whl", hash = "sha256:f68208a520c3d86ea51acf688a3e3002615a7f0238002cccc17affecc86a8a54"}, + {file = "kiwisolver-1.4.9-cp312-cp312-win_arm64.whl", hash = "sha256:2c1a4f57df73965f3f14df20b80ee29e6a7930a57d2d9e8491a25f676e197c60"}, + {file = "kiwisolver-1.4.9-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:a5d0432ccf1c7ab14f9949eec60c5d1f924f17c037e9f8b33352fa05799359b8"}, + {file = "kiwisolver-1.4.9-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:efb3a45b35622bb6c16dbfab491a8f5a391fe0e9d45ef32f4df85658232ca0e2"}, + {file = "kiwisolver-1.4.9-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:1a12cf6398e8a0a001a059747a1cbf24705e18fe413bc22de7b3d15c67cffe3f"}, + {file = "kiwisolver-1.4.9-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:b67e6efbf68e077dd71d1a6b37e43e1a99d0bff1a3d51867d45ee8908b931098"}, + {file = "kiwisolver-1.4.9-cp313-cp313-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5656aa670507437af0207645273ccdfee4f14bacd7f7c67a4306d0dcaeaf6eed"}, + {file = "kiwisolver-1.4.9-cp313-cp313-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:bfc08add558155345129c7803b3671cf195e6a56e7a12f3dde7c57d9b417f525"}, + {file = "kiwisolver-1.4.9-cp313-cp313-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:40092754720b174e6ccf9e845d0d8c7d8e12c3d71e7fc35f55f3813e96376f78"}, + {file = "kiwisolver-1.4.9-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:497d05f29a1300d14e02e6441cf0f5ee81c1ff5a304b0d9fb77423974684e08b"}, + {file = "kiwisolver-1.4.9-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:bdd1a81a1860476eb41ac4bc1e07b3f07259e6d55bbf739b79c8aaedcf512799"}, + {file = "kiwisolver-1.4.9-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:e6b93f13371d341afee3be9f7c5964e3fe61d5fa30f6a30eb49856935dfe4fc3"}, + {file = "kiwisolver-1.4.9-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:d75aa530ccfaa593da12834b86a0724f58bff12706659baa9227c2ccaa06264c"}, + {file = "kiwisolver-1.4.9-cp313-cp313-win_amd64.whl", hash = "sha256:dd0a578400839256df88c16abddf9ba14813ec5f21362e1fe65022e00c883d4d"}, + {file = "kiwisolver-1.4.9-cp313-cp313-win_arm64.whl", hash = "sha256:d4188e73af84ca82468f09cadc5ac4db578109e52acb4518d8154698d3a87ca2"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:5a0f2724dfd4e3b3ac5a82436a8e6fd16baa7d507117e4279b660fe8ca38a3a1"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:1b11d6a633e4ed84fc0ddafd4ebfd8ea49b3f25082c04ad12b8315c11d504dc1"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:61874cdb0a36016354853593cffc38e56fc9ca5aa97d2c05d3dcf6922cd55a11"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:60c439763a969a6af93b4881db0eed8fadf93ee98e18cbc35bc8da868d0c4f0c"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:92a2f997387a1b79a75e7803aa7ded2cfbe2823852ccf1ba3bcf613b62ae3197"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a31d512c812daea6d8b3be3b2bfcbeb091dbb09177706569bcfc6240dcf8b41c"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:52a15b0f35dad39862d376df10c5230155243a2c1a436e39eb55623ccbd68185"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:a30fd6fdef1430fd9e1ba7b3398b5ee4e2887783917a687d86ba69985fb08748"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:cc9617b46837c6468197b5945e196ee9ca43057bb7d9d1ae688101e4e1dddf64"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:0ab74e19f6a2b027ea4f845a78827969af45ce790e6cb3e1ebab71bdf9f215ff"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dba5ee5d3981160c28d5490f0d1b7ed730c22470ff7f6cc26cfcfaacb9896a07"}, + {file = "kiwisolver-1.4.9-cp313-cp313t-win_arm64.whl", hash = "sha256:0749fd8f4218ad2e851e11cc4dc05c7cbc0cbc4267bdfdb31782e65aace4ee9c"}, + {file = "kiwisolver-1.4.9-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:9928fe1eb816d11ae170885a74d074f57af3a0d65777ca47e9aeb854a1fba386"}, + {file = "kiwisolver-1.4.9-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:d0005b053977e7b43388ddec89fa567f43d4f6d5c2c0affe57de5ebf290dc552"}, + {file = "kiwisolver-1.4.9-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:2635d352d67458b66fd0667c14cb1d4145e9560d503219034a18a87e971ce4f3"}, + {file = "kiwisolver-1.4.9-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:767c23ad1c58c9e827b649a9ab7809fd5fd9db266a9cf02b0e926ddc2c680d58"}, + {file = "kiwisolver-1.4.9-cp314-cp314-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:72d0eb9fba308b8311685c2268cf7d0a0639a6cd027d8128659f72bdd8a024b4"}, + {file = "kiwisolver-1.4.9-cp314-cp314-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f68e4f3eeca8fb22cc3d731f9715a13b652795ef657a13df1ad0c7dc0e9731df"}, + {file = "kiwisolver-1.4.9-cp314-cp314-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d84cd4061ae292d8ac367b2c3fa3aad11cb8625a95d135fe93f286f914f3f5a6"}, + {file = "kiwisolver-1.4.9-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:a60ea74330b91bd22a29638940d115df9dc00af5035a9a2a6ad9399ffb4ceca5"}, + {file = "kiwisolver-1.4.9-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:ce6a3a4e106cf35c2d9c4fa17c05ce0b180db622736845d4315519397a77beaf"}, + {file = "kiwisolver-1.4.9-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:77937e5e2a38a7b48eef0585114fe7930346993a88060d0bf886086d2aa49ef5"}, + {file = "kiwisolver-1.4.9-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:24c175051354f4a28c5d6a31c93906dc653e2bf234e8a4bbfb964892078898ce"}, + {file = "kiwisolver-1.4.9-cp314-cp314-win_amd64.whl", hash = "sha256:0763515d4df10edf6d06a3c19734e2566368980d21ebec439f33f9eb936c07b7"}, + {file = "kiwisolver-1.4.9-cp314-cp314-win_arm64.whl", hash = "sha256:0e4e2bf29574a6a7b7f6cb5fa69293b9f96c928949ac4a53ba3f525dffb87f9c"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:d976bbb382b202f71c67f77b0ac11244021cfa3f7dfd9e562eefcea2df711548"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:2489e4e5d7ef9a1c300a5e0196e43d9c739f066ef23270607d45aba368b91f2d"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:e2ea9f7ab7fbf18fffb1b5434ce7c69a07582f7acc7717720f1d69f3e806f90c"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:b34e51affded8faee0dfdb705416153819d8ea9250bbbf7ea1b249bdeb5f1122"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d8aacd3d4b33b772542b2e01beb50187536967b514b00003bdda7589722d2a64"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7cf974dd4e35fa315563ac99d6287a1024e4dc2077b8a7d7cd3d2fb65d283134"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:85bd218b5ecfbee8c8a82e121802dcb519a86044c9c3b2e4aef02fa05c6da370"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:0856e241c2d3df4efef7c04a1e46b1936b6120c9bcf36dd216e3acd84bc4fb21"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:9af39d6551f97d31a4deebeac6f45b156f9755ddc59c07b402c148f5dbb6482a"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:bb4ae2b57fc1d8cbd1cf7b1d9913803681ffa903e7488012be5b76dedf49297f"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:aedff62918805fb62d43a4aa2ecd4482c380dc76cd31bd7c8878588a61bd0369"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-win_amd64.whl", hash = "sha256:1fa333e8b2ce4d9660f2cda9c0e1b6bafcfb2457a9d259faa82289e73ec24891"}, + {file = "kiwisolver-1.4.9-cp314-cp314t-win_arm64.whl", hash = "sha256:4a48a2ce79d65d363597ef7b567ce3d14d68783d2b2263d98db3d9477805ba32"}, + {file = "kiwisolver-1.4.9-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:4d1d9e582ad4d63062d34077a9a1e9f3c34088a2ec5135b1f7190c07cf366527"}, + {file = "kiwisolver-1.4.9-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:deed0c7258ceb4c44ad5ec7d9918f9f14fd05b2be86378d86cf50e63d1e7b771"}, + {file = "kiwisolver-1.4.9-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0a590506f303f512dff6b7f75fd2fd18e16943efee932008fe7140e5fa91d80e"}, + {file = "kiwisolver-1.4.9-pp310-pypy310_pp73-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e09c2279a4d01f099f52d5c4b3d9e208e91edcbd1a175c9662a8b16e000fece9"}, + {file = "kiwisolver-1.4.9-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:c9e7cdf45d594ee04d5be1b24dd9d49f3d1590959b2271fb30b5ca2b262c00fb"}, + {file = "kiwisolver-1.4.9-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:720e05574713db64c356e86732c0f3c5252818d05f9df320f0ad8380641acea5"}, + {file = "kiwisolver-1.4.9-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:17680d737d5335b552994a2008fab4c851bcd7de33094a82067ef3a576ff02fa"}, + {file = "kiwisolver-1.4.9-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:85b5352f94e490c028926ea567fc569c52ec79ce131dadb968d3853e809518c2"}, + {file = "kiwisolver-1.4.9-pp311-pypy311_pp73-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:464415881e4801295659462c49461a24fb107c140de781d55518c4b80cb6790f"}, + {file = "kiwisolver-1.4.9-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:fb940820c63a9590d31d88b815e7a3aa5915cad3ce735ab45f0c730b39547de1"}, + {file = "kiwisolver-1.4.9.tar.gz", hash = "sha256:c3b22c26c6fd6811b0ae8363b95ca8ce4ea3c202d3d0975b2914310ceb1bcc4d"}, +] + [[package]] name = "kombu" version = "5.5.4" @@ -3137,6 +3437,85 @@ dev = ["marshmallow[tests]", "pre-commit (>=3.5,<5.0)", "tox"] docs = ["autodocsumm (==0.2.14)", "furo (==2024.8.6)", "sphinx (==8.1.3)", "sphinx-copybutton (==0.5.2)", "sphinx-issues (==5.0.0)", "sphinxext-opengraph (==0.9.1)"] tests = ["pytest", "simplejson"] +[[package]] +name = "matplotlib" +version = "3.10.6" +description = "Python plotting package" +optional = false +python-versions = ">=3.10" +groups = ["main"] +files = [ + {file = "matplotlib-3.10.6-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:bc7316c306d97463a9866b89d5cc217824e799fa0de346c8f68f4f3d27c8693d"}, + {file = "matplotlib-3.10.6-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:d00932b0d160ef03f59f9c0e16d1e3ac89646f7785165ce6ad40c842db16cc2e"}, + {file = "matplotlib-3.10.6-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8fa4c43d6bfdbfec09c733bca8667de11bfa4970e8324c471f3a3632a0301c15"}, + {file = "matplotlib-3.10.6-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ea117a9c1627acaa04dbf36265691921b999cbf515a015298e54e1a12c3af837"}, + {file = "matplotlib-3.10.6-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:08fc803293b4e1694ee325896030de97f74c141ccff0be886bb5915269247676"}, + {file = "matplotlib-3.10.6-cp310-cp310-win_amd64.whl", hash = "sha256:2adf92d9b7527fbfb8818e050260f0ebaa460f79d61546374ce73506c9421d09"}, + {file = "matplotlib-3.10.6-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:905b60d1cb0ee604ce65b297b61cf8be9f4e6cfecf95a3fe1c388b5266bc8f4f"}, + {file = "matplotlib-3.10.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:7bac38d816637343e53d7185d0c66677ff30ffb131044a81898b5792c956ba76"}, + {file = "matplotlib-3.10.6-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:942a8de2b5bfff1de31d95722f702e2966b8a7e31f4e68f7cd963c7cd8861cf6"}, + {file = "matplotlib-3.10.6-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a3276c85370bc0dfca051ec65c5817d1e0f8f5ce1b7787528ec8ed2d524bbc2f"}, + {file = "matplotlib-3.10.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9df5851b219225731f564e4b9e7f2ac1e13c9e6481f941b5631a0f8e2d9387ce"}, + {file = "matplotlib-3.10.6-cp311-cp311-win_amd64.whl", hash = "sha256:abb5d9478625dd9c9eb51a06d39aae71eda749ae9b3138afb23eb38824026c7e"}, + {file = "matplotlib-3.10.6-cp311-cp311-win_arm64.whl", hash = "sha256:886f989ccfae63659183173bb3fced7fd65e9eb793c3cc21c273add368536951"}, + {file = "matplotlib-3.10.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:31ca662df6a80bd426f871105fdd69db7543e28e73a9f2afe80de7e531eb2347"}, + {file = "matplotlib-3.10.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1678bb61d897bb4ac4757b5ecfb02bfb3fddf7f808000fb81e09c510712fda75"}, + {file = "matplotlib-3.10.6-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:56cd2d20842f58c03d2d6e6c1f1cf5548ad6f66b91e1e48f814e4fb5abd1cb95"}, + {file = "matplotlib-3.10.6-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:662df55604a2f9a45435566d6e2660e41efe83cd94f4288dfbf1e6d1eae4b0bb"}, + {file = "matplotlib-3.10.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:08f141d55148cd1fc870c3387d70ca4df16dee10e909b3b038782bd4bda6ea07"}, + {file = "matplotlib-3.10.6-cp312-cp312-win_amd64.whl", hash = "sha256:590f5925c2d650b5c9d813c5b3b5fc53f2929c3f8ef463e4ecfa7e052044fb2b"}, + {file = "matplotlib-3.10.6-cp312-cp312-win_arm64.whl", hash = "sha256:f44c8d264a71609c79a78d50349e724f5d5fc3684ead7c2a473665ee63d868aa"}, + {file = "matplotlib-3.10.6-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:819e409653c1106c8deaf62e6de6b8611449c2cd9939acb0d7d4e57a3d95cc7a"}, + {file = "matplotlib-3.10.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:59c8ac8382fefb9cb71308dde16a7c487432f5255d8f1fd32473523abecfecdf"}, + {file = "matplotlib-3.10.6-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:84e82d9e0fd70c70bc55739defbd8055c54300750cbacf4740c9673a24d6933a"}, + {file = "matplotlib-3.10.6-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:25f7a3eb42d6c1c56e89eacd495661fc815ffc08d9da750bca766771c0fd9110"}, + {file = "matplotlib-3.10.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:f9c862d91ec0b7842920a4cfdaaec29662195301914ea54c33e01f1a28d014b2"}, + {file = "matplotlib-3.10.6-cp313-cp313-win_amd64.whl", hash = "sha256:1b53bd6337eba483e2e7d29c5ab10eee644bc3a2491ec67cc55f7b44583ffb18"}, + {file = "matplotlib-3.10.6-cp313-cp313-win_arm64.whl", hash = "sha256:cbd5eb50b7058b2892ce45c2f4e92557f395c9991f5c886d1bb74a1582e70fd6"}, + {file = "matplotlib-3.10.6-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:acc86dd6e0e695c095001a7fccff158c49e45e0758fdf5dcdbb0103318b59c9f"}, + {file = "matplotlib-3.10.6-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e228cd2ffb8f88b7d0b29e37f68ca9aaf83e33821f24a5ccc4f082dd8396bc27"}, + {file = "matplotlib-3.10.6-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:658bc91894adeab669cf4bb4a186d049948262987e80f0857216387d7435d833"}, + {file = "matplotlib-3.10.6-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8913b7474f6dd83ac444c9459c91f7f0f2859e839f41d642691b104e0af056aa"}, + {file = "matplotlib-3.10.6-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:091cea22e059b89f6d7d1a18e2c33a7376c26eee60e401d92a4d6726c4e12706"}, + {file = "matplotlib-3.10.6-cp313-cp313t-win_amd64.whl", hash = "sha256:491e25e02a23d7207629d942c666924a6b61e007a48177fdd231a0097b7f507e"}, + {file = "matplotlib-3.10.6-cp313-cp313t-win_arm64.whl", hash = "sha256:3d80d60d4e54cda462e2cd9a086d85cd9f20943ead92f575ce86885a43a565d5"}, + {file = "matplotlib-3.10.6-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:70aaf890ce1d0efd482df969b28a5b30ea0b891224bb315810a3940f67182899"}, + {file = "matplotlib-3.10.6-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1565aae810ab79cb72e402b22facfa6501365e73ebab70a0fdfb98488d2c3c0c"}, + {file = "matplotlib-3.10.6-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f3b23315a01981689aa4e1a179dbf6ef9fbd17143c3eea77548c2ecfb0499438"}, + {file = "matplotlib-3.10.6-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:30fdd37edf41a4e6785f9b37969de57aea770696cb637d9946eb37470c94a453"}, + {file = "matplotlib-3.10.6-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:bc31e693da1c08012c764b053e702c1855378e04102238e6a5ee6a7117c53a47"}, + {file = "matplotlib-3.10.6-cp314-cp314-win_amd64.whl", hash = "sha256:05be9bdaa8b242bc6ff96330d18c52f1fc59c6fb3a4dd411d953d67e7e1baf98"}, + {file = "matplotlib-3.10.6-cp314-cp314-win_arm64.whl", hash = "sha256:f56a0d1ab05d34c628592435781d185cd99630bdfd76822cd686fb5a0aecd43a"}, + {file = "matplotlib-3.10.6-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:94f0b4cacb23763b64b5dace50d5b7bfe98710fed5f0cef5c08135a03399d98b"}, + {file = "matplotlib-3.10.6-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:cc332891306b9fb39462673d8225d1b824c89783fee82840a709f96714f17a5c"}, + {file = "matplotlib-3.10.6-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee1d607b3fb1590deb04b69f02ea1d53ed0b0bf75b2b1a5745f269afcbd3cdd3"}, + {file = "matplotlib-3.10.6-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:376a624a218116461696b27b2bbf7a8945053e6d799f6502fc03226d077807bf"}, + {file = "matplotlib-3.10.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:83847b47f6524c34b4f2d3ce726bb0541c48c8e7692729865c3df75bfa0f495a"}, + {file = "matplotlib-3.10.6-cp314-cp314t-win_amd64.whl", hash = "sha256:c7e0518e0d223683532a07f4b512e2e0729b62674f1b3a1a69869f98e6b1c7e3"}, + {file = "matplotlib-3.10.6-cp314-cp314t-win_arm64.whl", hash = "sha256:4dd83e029f5b4801eeb87c64efd80e732452781c16a9cf7415b7b63ec8f374d7"}, + {file = "matplotlib-3.10.6-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:13fcd07ccf17e354398358e0307a1f53f5325dca22982556ddb9c52837b5af41"}, + {file = "matplotlib-3.10.6-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:470fc846d59d1406e34fa4c32ba371039cd12c2fe86801159a965956f2575bd1"}, + {file = "matplotlib-3.10.6-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f7173f8551b88f4ef810a94adae3128c2530e0d07529f7141be7f8d8c365f051"}, + {file = "matplotlib-3.10.6-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:f2d684c3204fa62421bbf770ddfebc6b50130f9cad65531eeba19236d73bb488"}, + {file = "matplotlib-3.10.6-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:6f4a69196e663a41d12a728fab8751177215357906436804217d6d9cf0d4d6cf"}, + {file = "matplotlib-3.10.6-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:4d6ca6ef03dfd269f4ead566ec6f3fb9becf8dab146fb999022ed85ee9f6b3eb"}, + {file = "matplotlib-3.10.6.tar.gz", hash = "sha256:ec01b645840dd1996df21ee37f208cd8ba57644779fa20464010638013d3203c"}, +] + +[package.dependencies] +contourpy = ">=1.0.1" +cycler = ">=0.10" +fonttools = ">=4.22.0" +kiwisolver = ">=1.3.1" +numpy = ">=1.23" +packaging = ">=20.0" +pillow = ">=8" +pyparsing = ">=2.3.1" +python-dateutil = ">=2.7" + +[package.extras] +dev = ["meson-python (>=0.13.1,<0.17.0)", "pybind11 (>=2.13.2,!=2.13.3)", "setuptools (>=64)", "setuptools_scm (>=7)"] + [[package]] name = "mccabe" version = "0.7.0" @@ -3857,6 +4236,131 @@ files = [ [package.dependencies] setuptools = "*" +[[package]] +name = "pillow" +version = "11.3.0" +description = "Python Imaging Library (Fork)" +optional = false +python-versions = ">=3.9" +groups = ["main"] +files = [ + {file = "pillow-11.3.0-cp310-cp310-macosx_10_10_x86_64.whl", hash = "sha256:1b9c17fd4ace828b3003dfd1e30bff24863e0eb59b535e8f80194d9cc7ecf860"}, + {file = "pillow-11.3.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:65dc69160114cdd0ca0f35cb434633c75e8e7fad4cf855177a05bf38678f73ad"}, + {file = "pillow-11.3.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7107195ddc914f656c7fc8e4a5e1c25f32e9236ea3ea860f257b0436011fddd0"}, + {file = "pillow-11.3.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cc3e831b563b3114baac7ec2ee86819eb03caa1a2cef0b481a5675b59c4fe23b"}, + {file = "pillow-11.3.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f1f182ebd2303acf8c380a54f615ec883322593320a9b00438eb842c1f37ae50"}, + {file = "pillow-11.3.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4445fa62e15936a028672fd48c4c11a66d641d2c05726c7ec1f8ba6a572036ae"}, + {file = "pillow-11.3.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:71f511f6b3b91dd543282477be45a033e4845a40278fa8dcdbfdb07109bf18f9"}, + {file = "pillow-11.3.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:040a5b691b0713e1f6cbe222e0f4f74cd233421e105850ae3b3c0ceda520f42e"}, + {file = "pillow-11.3.0-cp310-cp310-win32.whl", hash = "sha256:89bd777bc6624fe4115e9fac3352c79ed60f3bb18651420635f26e643e3dd1f6"}, + {file = "pillow-11.3.0-cp310-cp310-win_amd64.whl", hash = "sha256:19d2ff547c75b8e3ff46f4d9ef969a06c30ab2d4263a9e287733aa8b2429ce8f"}, + {file = "pillow-11.3.0-cp310-cp310-win_arm64.whl", hash = "sha256:819931d25e57b513242859ce1876c58c59dc31587847bf74cfe06b2e0cb22d2f"}, + {file = "pillow-11.3.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:1cd110edf822773368b396281a2293aeb91c90a2db00d78ea43e7e861631b722"}, + {file = "pillow-11.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9c412fddd1b77a75aa904615ebaa6001f169b26fd467b4be93aded278266b288"}, + {file = "pillow-11.3.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7d1aa4de119a0ecac0a34a9c8bde33f34022e2e8f99104e47a3ca392fd60e37d"}, + {file = "pillow-11.3.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:91da1d88226663594e3f6b4b8c3c8d85bd504117d043740a8e0ec449087cc494"}, + {file = "pillow-11.3.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:643f189248837533073c405ec2f0bb250ba54598cf80e8c1e043381a60632f58"}, + {file = "pillow-11.3.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:106064daa23a745510dabce1d84f29137a37224831d88eb4ce94bb187b1d7e5f"}, + {file = "pillow-11.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:cd8ff254faf15591e724dc7c4ddb6bf4793efcbe13802a4ae3e863cd300b493e"}, + {file = "pillow-11.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:932c754c2d51ad2b2271fd01c3d121daaa35e27efae2a616f77bf164bc0b3e94"}, + {file = "pillow-11.3.0-cp311-cp311-win32.whl", hash = "sha256:b4b8f3efc8d530a1544e5962bd6b403d5f7fe8b9e08227c6b255f98ad82b4ba0"}, + {file = "pillow-11.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:1a992e86b0dd7aeb1f053cd506508c0999d710a8f07b4c791c63843fc6a807ac"}, + {file = "pillow-11.3.0-cp311-cp311-win_arm64.whl", hash = "sha256:30807c931ff7c095620fe04448e2c2fc673fcbb1ffe2a7da3fb39613489b1ddd"}, + {file = "pillow-11.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:fdae223722da47b024b867c1ea0be64e0df702c5e0a60e27daad39bf960dd1e4"}, + {file = "pillow-11.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:921bd305b10e82b4d1f5e802b6850677f965d8394203d182f078873851dada69"}, + {file = "pillow-11.3.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:eb76541cba2f958032d79d143b98a3a6b3ea87f0959bbe256c0b5e416599fd5d"}, + {file = "pillow-11.3.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:67172f2944ebba3d4a7b54f2e95c786a3a50c21b88456329314caaa28cda70f6"}, + {file = "pillow-11.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:97f07ed9f56a3b9b5f49d3661dc9607484e85c67e27f3e8be2c7d28ca032fec7"}, + {file = "pillow-11.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:676b2815362456b5b3216b4fd5bd89d362100dc6f4945154ff172e206a22c024"}, + {file = "pillow-11.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3e184b2f26ff146363dd07bde8b711833d7b0202e27d13540bfe2e35a323a809"}, + {file = "pillow-11.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6be31e3fc9a621e071bc17bb7de63b85cbe0bfae91bb0363c893cbe67247780d"}, + {file = "pillow-11.3.0-cp312-cp312-win32.whl", hash = "sha256:7b161756381f0918e05e7cb8a371fff367e807770f8fe92ecb20d905d0e1c149"}, + {file = "pillow-11.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a6444696fce635783440b7f7a9fc24b3ad10a9ea3f0ab66c5905be1c19ccf17d"}, + {file = "pillow-11.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:2aceea54f957dd4448264f9bf40875da0415c83eb85f55069d89c0ed436e3542"}, + {file = "pillow-11.3.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:1c627742b539bba4309df89171356fcb3cc5a9178355b2727d1b74a6cf155fbd"}, + {file = "pillow-11.3.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:30b7c02f3899d10f13d7a48163c8969e4e653f8b43416d23d13d1bbfdc93b9f8"}, + {file = "pillow-11.3.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:7859a4cc7c9295f5838015d8cc0a9c215b77e43d07a25e460f35cf516df8626f"}, + {file = "pillow-11.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ec1ee50470b0d050984394423d96325b744d55c701a439d2bd66089bff963d3c"}, + {file = "pillow-11.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:7db51d222548ccfd274e4572fdbf3e810a5e66b00608862f947b163e613b67dd"}, + {file = "pillow-11.3.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:2d6fcc902a24ac74495df63faad1884282239265c6839a0a6416d33faedfae7e"}, + {file = "pillow-11.3.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0f5d8f4a08090c6d6d578351a2b91acf519a54986c055af27e7a93feae6d3f1"}, + {file = "pillow-11.3.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c37d8ba9411d6003bba9e518db0db0c58a680ab9fe5179f040b0463644bc9805"}, + {file = "pillow-11.3.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:13f87d581e71d9189ab21fe0efb5a23e9f28552d5be6979e84001d3b8505abe8"}, + {file = "pillow-11.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:023f6d2d11784a465f09fd09a34b150ea4672e85fb3d05931d89f373ab14abb2"}, + {file = "pillow-11.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:45dfc51ac5975b938e9809451c51734124e73b04d0f0ac621649821a63852e7b"}, + {file = "pillow-11.3.0-cp313-cp313-win32.whl", hash = "sha256:a4d336baed65d50d37b88ca5b60c0fa9d81e3a87d4a7930d3880d1624d5b31f3"}, + {file = "pillow-11.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:0bce5c4fd0921f99d2e858dc4d4d64193407e1b99478bc5cacecba2311abde51"}, + {file = "pillow-11.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:1904e1264881f682f02b7f8167935cce37bc97db457f8e7849dc3a6a52b99580"}, + {file = "pillow-11.3.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:4c834a3921375c48ee6b9624061076bc0a32a60b5532b322cc0ea64e639dd50e"}, + {file = "pillow-11.3.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:5e05688ccef30ea69b9317a9ead994b93975104a677a36a8ed8106be9260aa6d"}, + {file = "pillow-11.3.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1019b04af07fc0163e2810167918cb5add8d74674b6267616021ab558dc98ced"}, + {file = "pillow-11.3.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f944255db153ebb2b19c51fe85dd99ef0ce494123f21b9db4877ffdfc5590c7c"}, + {file = "pillow-11.3.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1f85acb69adf2aaee8b7da124efebbdb959a104db34d3a2cb0f3793dbae422a8"}, + {file = "pillow-11.3.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:05f6ecbeff5005399bb48d198f098a9b4b6bdf27b8487c7f38ca16eeb070cd59"}, + {file = "pillow-11.3.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:a7bc6e6fd0395bc052f16b1a8670859964dbd7003bd0af2ff08342eb6e442cfe"}, + {file = "pillow-11.3.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:83e1b0161c9d148125083a35c1c5a89db5b7054834fd4387499e06552035236c"}, + {file = "pillow-11.3.0-cp313-cp313t-win32.whl", hash = "sha256:2a3117c06b8fb646639dce83694f2f9eac405472713fcb1ae887469c0d4f6788"}, + {file = "pillow-11.3.0-cp313-cp313t-win_amd64.whl", hash = "sha256:857844335c95bea93fb39e0fa2726b4d9d758850b34075a7e3ff4f4fa3aa3b31"}, + {file = "pillow-11.3.0-cp313-cp313t-win_arm64.whl", hash = "sha256:8797edc41f3e8536ae4b10897ee2f637235c94f27404cac7297f7b607dd0716e"}, + {file = "pillow-11.3.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:d9da3df5f9ea2a89b81bb6087177fb1f4d1c7146d583a3fe5c672c0d94e55e12"}, + {file = "pillow-11.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:0b275ff9b04df7b640c59ec5a3cb113eefd3795a8df80bac69646ef699c6981a"}, + {file = "pillow-11.3.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0743841cabd3dba6a83f38a92672cccbd69af56e3e91777b0ee7f4dba4385632"}, + {file = "pillow-11.3.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2465a69cf967b8b49ee1b96d76718cd98c4e925414ead59fdf75cf0fd07df673"}, + {file = "pillow-11.3.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:41742638139424703b4d01665b807c6468e23e699e8e90cffefe291c5832b027"}, + {file = "pillow-11.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:93efb0b4de7e340d99057415c749175e24c8864302369e05914682ba642e5d77"}, + {file = "pillow-11.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7966e38dcd0fa11ca390aed7c6f20454443581d758242023cf36fcb319b1a874"}, + {file = "pillow-11.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:98a9afa7b9007c67ed84c57c9e0ad86a6000da96eaa638e4f8abe5b65ff83f0a"}, + {file = "pillow-11.3.0-cp314-cp314-win32.whl", hash = "sha256:02a723e6bf909e7cea0dac1b0e0310be9d7650cd66222a5f1c571455c0a45214"}, + {file = "pillow-11.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:a418486160228f64dd9e9efcd132679b7a02a5f22c982c78b6fc7dab3fefb635"}, + {file = "pillow-11.3.0-cp314-cp314-win_arm64.whl", hash = "sha256:155658efb5e044669c08896c0c44231c5e9abcaadbc5cd3648df2f7c0b96b9a6"}, + {file = "pillow-11.3.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:59a03cdf019efbfeeed910bf79c7c93255c3d54bc45898ac2a4140071b02b4ae"}, + {file = "pillow-11.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f8a5827f84d973d8636e9dc5764af4f0cf2318d26744b3d902931701b0d46653"}, + {file = "pillow-11.3.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ee92f2fd10f4adc4b43d07ec5e779932b4eb3dbfbc34790ada5a6669bc095aa6"}, + {file = "pillow-11.3.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c96d333dcf42d01f47b37e0979b6bd73ec91eae18614864622d9b87bbd5bbf36"}, + {file = "pillow-11.3.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4c96f993ab8c98460cd0c001447bff6194403e8b1d7e149ade5f00594918128b"}, + {file = "pillow-11.3.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:41342b64afeba938edb034d122b2dda5db2139b9a4af999729ba8818e0056477"}, + {file = "pillow-11.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:068d9c39a2d1b358eb9f245ce7ab1b5c3246c7c8c7d9ba58cfa5b43146c06e50"}, + {file = "pillow-11.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a1bc6ba083b145187f648b667e05a2534ecc4b9f2784c2cbe3089e44868f2b9b"}, + {file = "pillow-11.3.0-cp314-cp314t-win32.whl", hash = "sha256:118ca10c0d60b06d006be10a501fd6bbdfef559251ed31b794668ed569c87e12"}, + {file = "pillow-11.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:8924748b688aa210d79883357d102cd64690e56b923a186f35a82cbc10f997db"}, + {file = "pillow-11.3.0-cp314-cp314t-win_arm64.whl", hash = "sha256:79ea0d14d3ebad43ec77ad5272e6ff9bba5b679ef73375ea760261207fa8e0aa"}, + {file = "pillow-11.3.0-cp39-cp39-macosx_10_10_x86_64.whl", hash = "sha256:48d254f8a4c776de343051023eb61ffe818299eeac478da55227d96e241de53f"}, + {file = "pillow-11.3.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:7aee118e30a4cf54fdd873bd3a29de51e29105ab11f9aad8c32123f58c8f8081"}, + {file = "pillow-11.3.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:23cff760a9049c502721bdb743a7cb3e03365fafcdfc2ef9784610714166e5a4"}, + {file = "pillow-11.3.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:6359a3bc43f57d5b375d1ad54a0074318a0844d11b76abccf478c37c986d3cfc"}, + {file = "pillow-11.3.0-cp39-cp39-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:092c80c76635f5ecb10f3f83d76716165c96f5229addbd1ec2bdbbda7d496e06"}, + {file = "pillow-11.3.0-cp39-cp39-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cadc9e0ea0a2431124cde7e1697106471fc4c1da01530e679b2391c37d3fbb3a"}, + {file = "pillow-11.3.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:6a418691000f2a418c9135a7cf0d797c1bb7d9a485e61fe8e7722845b95ef978"}, + {file = "pillow-11.3.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:97afb3a00b65cc0804d1c7abddbf090a81eaac02768af58cbdcaaa0a931e0b6d"}, + {file = "pillow-11.3.0-cp39-cp39-win32.whl", hash = "sha256:ea944117a7974ae78059fcc1800e5d3295172bb97035c0c1d9345fca1419da71"}, + {file = "pillow-11.3.0-cp39-cp39-win_amd64.whl", hash = "sha256:e5c5858ad8ec655450a7c7df532e9842cf8df7cc349df7225c60d5d348c8aada"}, + {file = "pillow-11.3.0-cp39-cp39-win_arm64.whl", hash = "sha256:6abdbfd3aea42be05702a8dd98832329c167ee84400a1d1f61ab11437f1717eb"}, + {file = "pillow-11.3.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:3cee80663f29e3843b68199b9d6f4f54bd1d4a6b59bdd91bceefc51238bcb967"}, + {file = "pillow-11.3.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:b5f56c3f344f2ccaf0dd875d3e180f631dc60a51b314295a3e681fe8cf851fbe"}, + {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e67d793d180c9df62f1f40aee3accca4829d3794c95098887edc18af4b8b780c"}, + {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d000f46e2917c705e9fb93a3606ee4a819d1e3aa7a9b442f6444f07e77cf5e25"}, + {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:527b37216b6ac3a12d7838dc3bd75208ec57c1c6d11ef01902266a5a0c14fc27"}, + {file = "pillow-11.3.0-pp310-pypy310_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:be5463ac478b623b9dd3937afd7fb7ab3d79dd290a28e2b6df292dc75063eb8a"}, + {file = "pillow-11.3.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:8dc70ca24c110503e16918a658b869019126ecfe03109b754c402daff12b3d9f"}, + {file = "pillow-11.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:7c8ec7a017ad1bd562f93dbd8505763e688d388cde6e4a010ae1486916e713e6"}, + {file = "pillow-11.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:9ab6ae226de48019caa8074894544af5b53a117ccb9d3b3dcb2871464c829438"}, + {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fe27fb049cdcca11f11a7bfda64043c37b30e6b91f10cb5bab275806c32f6ab3"}, + {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:465b9e8844e3c3519a983d58b80be3f668e2a7a5db97f2784e7079fbc9f9822c"}, + {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5418b53c0d59b3824d05e029669efa023bbef0f3e92e75ec8428f3799487f361"}, + {file = "pillow-11.3.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:504b6f59505f08ae014f724b6207ff6222662aab5cc9542577fb084ed0676ac7"}, + {file = "pillow-11.3.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:c84d689db21a1c397d001aa08241044aa2069e7587b398c8cc63020390b1c1b8"}, + {file = "pillow-11.3.0.tar.gz", hash = "sha256:3828ee7586cd0b2091b6209e5ad53e20d0649bbe87164a459d0676e035e8f523"}, +] + +[package.extras] +docs = ["furo", "olefile", "sphinx (>=8.2)", "sphinx-autobuild", "sphinx-copybutton", "sphinx-inline-tabs", "sphinxext-opengraph"] +fpx = ["olefile"] +mic = ["olefile"] +test-arrow = ["pyarrow"] +tests = ["check-manifest", "coverage (>=7.4.2)", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout", "pytest-xdist", "trove-classifiers (>=2024.10.12)"] +typing = ["typing-extensions ; python_version < \"3.10\""] +xmp = ["defusedxml"] + [[package]] name = "platformdirs" version = "4.3.8" @@ -5016,6 +5520,29 @@ attrs = ">=22.2.0" rpds-py = ">=0.7.0" typing-extensions = {version = ">=4.4.0", markers = "python_version < \"3.13\""} +[[package]] +name = "reportlab" +version = "4.4.4" +description = "The Reportlab Toolkit" +optional = false +python-versions = "<4,>=3.9" +groups = ["main"] +files = [ + {file = "reportlab-4.4.4-py3-none-any.whl", hash = "sha256:299b3b0534e7202bb94ed2ddcd7179b818dcda7de9d8518a57c85a58a1ebaadb"}, + {file = "reportlab-4.4.4.tar.gz", hash = "sha256:cb2f658b7f4a15be2cc68f7203aa67faef67213edd4f2d4bdd3eb20dab75a80d"}, +] + +[package.dependencies] +charset-normalizer = "*" +pillow = ">=9.0.0" + +[package.extras] +accel = ["rl_accel (>=0.9.0,<1.1)"] +bidi = ["rlbidi"] +pycairo = ["freetype-py (>=2.3.0,<2.4)", "rlPyCairo (>=0.2.0,<1)"] +renderpm = ["rl_renderPM (>=4.0.3,<4.1)"] +shaping = ["uharfbuzz"] + [[package]] name = "requests" version = "2.32.5" @@ -6259,4 +6786,4 @@ type = ["pytest-mypy"] [metadata] lock-version = "2.1" python-versions = ">=3.11,<3.13" -content-hash = "03442fd4673006c5a74374f90f53621fd1c9d117279fe6cc0355ef833eb7f9bb" +content-hash = "3c9164d668d37d6373eb5200bbe768232ead934d9312b9c68046b1df922789f3" diff --git a/api/pyproject.toml b/api/pyproject.toml index d7ef074e36..22ae14e6a1 100644 --- a/api/pyproject.toml +++ b/api/pyproject.toml @@ -33,7 +33,9 @@ dependencies = [ "xmlsec==1.3.14", "h2 (==4.3.0)", "markdown (>=3.9,<4.0)", - "drf-simple-apikey (==2.2.1)" + "drf-simple-apikey (==2.2.1)", + "matplotlib (>=3.10.6,<4.0.0)", + "reportlab (>=4.4.4,<5.0.0)" ] description = "Prowler's API (Django/DRF)" license = "Apache-2.0" @@ -41,7 +43,7 @@ name = "prowler-api" package-mode = false # Needed for the SDK compatibility requires-python = ">=3.11,<3.13" -version = "1.14.0" +version = "1.15.0" [project.scripts] celery = "src.backend.config.settings.celery" diff --git a/api/src/backend/api/filters.py b/api/src/backend/api/filters.py index ed706006e9..26e5baa782 100644 --- a/api/src/backend/api/filters.py +++ b/api/src/backend/api/filters.py @@ -27,6 +27,8 @@ from api.models import ( Finding, Integration, Invitation, + LighthouseProviderConfiguration, + LighthouseProviderModels, Membership, OverviewStatusChoices, PermissionChoices, @@ -765,6 +767,7 @@ class ComplianceOverviewFilter(FilterSet): class ScanSummaryFilter(FilterSet): inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date") provider_id = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") + provider_id__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") provider_type = ChoiceFilter( field_name="scan__provider__provider", choices=Provider.ProviderChoices.choices ) @@ -927,3 +930,45 @@ class TenantApiKeyFilter(FilterSet): "revoked": ["exact"], "name": ["exact", "icontains"], } + + +class LighthouseProviderConfigFilter(FilterSet): + provider_type = ChoiceFilter( + choices=LighthouseProviderConfiguration.LLMProviderChoices.choices + ) + provider_type__in = ChoiceInFilter( + choices=LighthouseProviderConfiguration.LLMProviderChoices.choices, + field_name="provider_type", + lookup_expr="in", + ) + is_active = BooleanFilter() + + class Meta: + model = LighthouseProviderConfiguration + fields = { + "provider_type": ["exact", "in"], + "is_active": ["exact"], + } + + +class LighthouseProviderModelsFilter(FilterSet): + provider_type = ChoiceFilter( + choices=LighthouseProviderConfiguration.LLMProviderChoices.choices, + field_name="provider_configuration__provider_type", + ) + provider_type__in = ChoiceInFilter( + choices=LighthouseProviderConfiguration.LLMProviderChoices.choices, + field_name="provider_configuration__provider_type", + lookup_expr="in", + ) + + # Allow filtering by model id + model_id = CharFilter(field_name="model_id", lookup_expr="exact") + model_id__icontains = CharFilter(field_name="model_id", lookup_expr="icontains") + model_id__in = CharInFilter(field_name="model_id", lookup_expr="in") + + class Meta: + model = LighthouseProviderModels + fields = { + "model_id": ["exact", "icontains", "in"], + } diff --git a/api/src/backend/api/migrations/0048_api_key.py b/api/src/backend/api/migrations/0048_api_key.py index 32b7fe144d..c3142ecda1 100644 --- a/api/src/backend/api/migrations/0048_api_key.py +++ b/api/src/backend/api/migrations/0048_api_key.py @@ -24,7 +24,7 @@ class Migration(migrations.Migration): ( "name", models.CharField( - max_length=255, + max_length=100, validators=[django.core.validators.MinLengthValidator(3)], ), ), diff --git a/api/src/backend/api/migrations/0050_lighthouse_multi_llm.py b/api/src/backend/api/migrations/0050_lighthouse_multi_llm.py new file mode 100644 index 0000000000..99a9353327 --- /dev/null +++ b/api/src/backend/api/migrations/0050_lighthouse_multi_llm.py @@ -0,0 +1,266 @@ +# Generated by Django 5.1.12 on 2025-10-09 07:50 + +import json +import logging +import uuid + +import django.db.models.deletion +from config.custom_logging import BackendLogger +from cryptography.fernet import Fernet +from django.conf import settings +from django.db import migrations, models + +import api.rls +from api.db_router import MainRouter + +logger = logging.getLogger(BackendLogger.API) + + +def migrate_lighthouse_configs_forward(apps, schema_editor): + """ + Migrate data from old LighthouseConfiguration to new multi-provider models. + Old system: one LighthouseConfiguration per tenant (always OpenAI). + """ + LighthouseConfiguration = apps.get_model("api", "LighthouseConfiguration") + LighthouseProviderConfiguration = apps.get_model( + "api", "LighthouseProviderConfiguration" + ) + LighthouseTenantConfiguration = apps.get_model( + "api", "LighthouseTenantConfiguration" + ) + LighthouseProviderModels = apps.get_model("api", "LighthouseProviderModels") + + fernet = Fernet(settings.SECRETS_ENCRYPTION_KEY.encode()) + + # Migrate only tenants that actually have a LighthouseConfiguration + for old_config in ( + LighthouseConfiguration.objects.using(MainRouter.admin_db) + .select_related("tenant") + .all() + ): + tenant = old_config.tenant + tenant_id = str(tenant.id) + + try: + # Create OpenAI provider configuration for this tenant + api_key_decrypted = fernet.decrypt(bytes(old_config.api_key)).decode() + credentials_encrypted = fernet.encrypt( + json.dumps({"api_key": api_key_decrypted}).encode() + ) + provider_config = LighthouseProviderConfiguration.objects.using( + MainRouter.admin_db + ).create( + tenant=tenant, + provider_type="openai", + credentials=credentials_encrypted, + is_active=old_config.is_active, + ) + + # Create tenant configuration from old values + LighthouseTenantConfiguration.objects.using(MainRouter.admin_db).create( + tenant=tenant, + business_context=old_config.business_context or "", + default_provider="openai", + default_models={"openai": old_config.model}, + ) + + # Create initial provider model record + LighthouseProviderModels.objects.using(MainRouter.admin_db).create( + tenant=tenant, + provider_configuration=provider_config, + model_id=old_config.model, + model_name=old_config.model, + default_parameters={}, + ) + + except Exception: + logger.exception( + "Failed to migrate lighthouse config for tenant %s", tenant_id + ) + continue + + +class Migration(migrations.Migration): + dependencies = [ + ("api", "0049_compliancerequirementoverview_passed_failed_findings"), + ] + + operations = [ + migrations.CreateModel( + name="LighthouseProviderConfiguration", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ("inserted_at", models.DateTimeField(auto_now_add=True)), + ("updated_at", models.DateTimeField(auto_now=True)), + ( + "provider_type", + models.CharField( + choices=[("openai", "OpenAI")], + help_text="LLM provider name", + max_length=50, + ), + ), + ("base_url", models.URLField(blank=True, null=True)), + ( + "credentials", + models.BinaryField( + help_text="Encrypted JSON credentials for the provider" + ), + ), + ("is_active", models.BooleanField(default=True)), + ], + options={ + "db_table": "lighthouse_provider_configurations", + "abstract": False, + }, + ), + migrations.CreateModel( + name="LighthouseProviderModels", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ("inserted_at", models.DateTimeField(auto_now_add=True)), + ("updated_at", models.DateTimeField(auto_now=True)), + ("model_id", models.CharField(max_length=100)), + ("model_name", models.CharField(max_length=100)), + ("default_parameters", models.JSONField(blank=True, default=dict)), + ], + options={ + "db_table": "lighthouse_provider_models", + "abstract": False, + }, + ), + migrations.CreateModel( + name="LighthouseTenantConfiguration", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ("inserted_at", models.DateTimeField(auto_now_add=True)), + ("updated_at", models.DateTimeField(auto_now=True)), + ("business_context", models.TextField(blank=True, default="")), + ("default_provider", models.CharField(blank=True, max_length=50)), + ("default_models", models.JSONField(blank=True, default=dict)), + ], + options={ + "db_table": "lighthouse_tenant_config", + "abstract": False, + }, + ), + migrations.AddField( + model_name="lighthouseproviderconfiguration", + name="tenant", + field=models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, to="api.tenant" + ), + ), + migrations.AddField( + model_name="lighthouseprovidermodels", + name="provider_configuration", + field=models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + related_name="available_models", + to="api.lighthouseproviderconfiguration", + ), + ), + migrations.AddField( + model_name="lighthouseprovidermodels", + name="tenant", + field=models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, to="api.tenant" + ), + ), + migrations.AddField( + model_name="lighthousetenantconfiguration", + name="tenant", + field=models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, to="api.tenant" + ), + ), + migrations.AddIndex( + model_name="lighthouseproviderconfiguration", + index=models.Index( + fields=["tenant_id", "provider_type"], name="lh_pc_tenant_type_idx" + ), + ), + migrations.AddConstraint( + model_name="lighthouseproviderconfiguration", + constraint=api.rls.RowLevelSecurityConstraint( + "tenant_id", + name="rls_on_lighthouseproviderconfiguration", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + ), + migrations.AddConstraint( + model_name="lighthouseproviderconfiguration", + constraint=models.UniqueConstraint( + fields=("tenant_id", "provider_type"), + name="unique_provider_config_per_tenant", + ), + ), + migrations.AddIndex( + model_name="lighthouseprovidermodels", + index=models.Index( + fields=["tenant_id", "provider_configuration"], + name="lh_prov_models_cfg_idx", + ), + ), + migrations.AddConstraint( + model_name="lighthouseprovidermodels", + constraint=api.rls.RowLevelSecurityConstraint( + "tenant_id", + name="rls_on_lighthouseprovidermodels", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + ), + migrations.AddConstraint( + model_name="lighthouseprovidermodels", + constraint=models.UniqueConstraint( + fields=("tenant_id", "provider_configuration", "model_id"), + name="unique_provider_model_per_configuration", + ), + ), + migrations.AddConstraint( + model_name="lighthousetenantconfiguration", + constraint=api.rls.RowLevelSecurityConstraint( + "tenant_id", + name="rls_on_lighthousetenantconfiguration", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + ), + migrations.AddConstraint( + model_name="lighthousetenantconfiguration", + constraint=models.UniqueConstraint( + fields=("tenant_id",), name="unique_tenant_lighthouse_config" + ), + ), + # Migrate data from old LighthouseConfiguration to new tables + # This runs after all tables, indexes, and constraints are created + # The old Lighthouse configuration table is not removed, so reverse_code is noop + # During rollbacks, the old Lighthouse configuration remains intact while the new tables are removed + migrations.RunPython( + migrate_lighthouse_configs_forward, + reverse_code=migrations.RunPython.noop, + ), + ] diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py index a83bb4c585..c2c0dbcb47 100644 --- a/api/src/backend/api/models.py +++ b/api/src/backend/api/models.py @@ -1873,22 +1873,6 @@ class LighthouseConfiguration(RowLevelSecurityProtectedModel): def clean(self): super().clean() - # Validate temperature - if not 0 <= self.temperature <= 1: - raise ModelValidationError( - detail="Temperature must be between 0 and 1", - code="invalid_temperature", - pointer="/data/attributes/temperature", - ) - - # Validate max_tokens - if not 500 <= self.max_tokens <= 5000: - raise ModelValidationError( - detail="Max tokens must be between 500 and 5000", - code="invalid_max_tokens", - pointer="/data/attributes/max_tokens", - ) - @property def api_key_decoded(self): """Return the decrypted API key, or None if unavailable or invalid.""" @@ -1913,15 +1897,6 @@ class LighthouseConfiguration(RowLevelSecurityProtectedModel): code="invalid_api_key", pointer="/data/attributes/api_key", ) - - # Validate OpenAI API key format - openai_key_pattern = r"^sk-[\w-]+T3BlbkFJ[\w-]+$" - if not re.match(openai_key_pattern, value): - raise ModelValidationError( - detail="Invalid OpenAI API key format.", - code="invalid_api_key", - pointer="/data/attributes/api_key", - ) self.api_key = fernet.encrypt(value.encode()) def save(self, *args, **kwargs): @@ -1984,3 +1959,184 @@ class Processor(RowLevelSecurityProtectedModel): class JSONAPIMeta: resource_name = "processors" + + +class LighthouseProviderConfiguration(RowLevelSecurityProtectedModel): + """ + Per-tenant configuration for an LLM provider (credentials, base URL, activation). + + One configuration per provider type per tenant. + """ + + class LLMProviderChoices(models.TextChoices): + OPENAI = "openai", _("OpenAI") + + id = models.UUIDField(primary_key=True, default=uuid4, editable=False) + inserted_at = models.DateTimeField(auto_now_add=True, editable=False) + updated_at = models.DateTimeField(auto_now=True, editable=False) + + provider_type = models.CharField( + max_length=50, + choices=LLMProviderChoices.choices, + help_text="LLM provider name", + ) + + # For OpenAI-compatible providers + base_url = models.URLField(blank=True, null=True) + + # Encrypted JSON for provider-specific auth + credentials = models.BinaryField( + blank=False, null=False, help_text="Encrypted JSON credentials for the provider" + ) + + is_active = models.BooleanField(default=True) + + def __str__(self): + return f"{self.get_provider_type_display()} ({self.tenant_id})" + + def clean(self): + super().clean() + + @property + def credentials_decoded(self): + if not self.credentials: + return None + try: + decrypted_data = fernet.decrypt(bytes(self.credentials)) + return json.loads(decrypted_data.decode()) + except (InvalidToken, json.JSONDecodeError) as e: + logger.warning("Failed to decrypt provider credentials: %s", e) + return None + except Exception as e: + logger.exception( + "Unexpected error while decrypting provider credentials: %s", e + ) + return None + + @credentials_decoded.setter + def credentials_decoded(self, value): + """ + Set and encrypt credentials (assumes serializer performed validation). + """ + if not value: + raise ModelValidationError( + detail="Credentials are required", + code="invalid_credentials", + pointer="/data/attributes/credentials", + ) + self.credentials = fernet.encrypt(json.dumps(value).encode()) + + class Meta(RowLevelSecurityProtectedModel.Meta): + db_table = "lighthouse_provider_configurations" + + constraints = [ + RowLevelSecurityConstraint( + field="tenant_id", + name="rls_on_%(class)s", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + models.UniqueConstraint( + fields=["tenant_id", "provider_type"], + name="unique_provider_config_per_tenant", + ), + ] + + indexes = [ + models.Index( + fields=["tenant_id", "provider_type"], + name="lh_pc_tenant_type_idx", + ), + ] + + class JSONAPIMeta: + resource_name = "lighthouse-providers" + + +class LighthouseTenantConfiguration(RowLevelSecurityProtectedModel): + """ + Tenant-level Lighthouse settings (business context and defaults). + One record per tenant. + """ + + id = models.UUIDField(primary_key=True, default=uuid4, editable=False) + inserted_at = models.DateTimeField(auto_now_add=True, editable=False) + updated_at = models.DateTimeField(auto_now=True, editable=False) + + business_context = models.TextField(blank=True, default="") + + # Preferred provider key (e.g., "openai", "bedrock", "openai_compatible") + default_provider = models.CharField(max_length=50, blank=True) + + # Mapping of provider -> model id, e.g., {"openai": "gpt-4o", "bedrock": "anthropic.claude-v2"} + default_models = models.JSONField(default=dict, blank=True) + + def __str__(self): + return f"Lighthouse Tenant Config for {self.tenant_id}" + + def clean(self): + super().clean() + + class Meta(RowLevelSecurityProtectedModel.Meta): + db_table = "lighthouse_tenant_config" + + constraints = [ + RowLevelSecurityConstraint( + field="tenant_id", + name="rls_on_%(class)s", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + models.UniqueConstraint( + fields=["tenant_id"], name="unique_tenant_lighthouse_config" + ), + ] + + class JSONAPIMeta: + resource_name = "lighthouse-config" + + +class LighthouseProviderModels(RowLevelSecurityProtectedModel): + """ + Per-tenant, per-provider configuration list of available LLM models. + RLS-protected; populated via provider API using tenant-scoped credentials. + """ + + id = models.UUIDField(primary_key=True, default=uuid4, editable=False) + inserted_at = models.DateTimeField(auto_now_add=True, editable=False) + updated_at = models.DateTimeField(auto_now=True, editable=False) + + # Scope to a specific provider configuration within a tenant + provider_configuration = models.ForeignKey( + LighthouseProviderConfiguration, + on_delete=models.CASCADE, + related_name="available_models", + ) + model_id = models.CharField(max_length=100) + + # Human-friendly model name + model_name = models.CharField(max_length=100) + + # Model-specific default parameters (e.g., temperature, max_tokens) + default_parameters = models.JSONField(default=dict, blank=True) + + def __str__(self): + return f"{self.provider_configuration.provider_type}:{self.model_id} ({self.tenant_id})" + + class Meta(RowLevelSecurityProtectedModel.Meta): + db_table = "lighthouse_provider_models" + constraints = [ + RowLevelSecurityConstraint( + field="tenant_id", + name="rls_on_%(class)s", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + models.UniqueConstraint( + fields=["tenant_id", "provider_configuration", "model_id"], + name="unique_provider_model_per_configuration", + ), + ] + indexes = [ + models.Index( + fields=["tenant_id", "provider_configuration"], + name="lh_prov_models_cfg_idx", + ), + ] diff --git a/api/src/backend/api/signals.py b/api/src/backend/api/signals.py index aac89ea33e..d449144bf4 100644 --- a/api/src/backend/api/signals.py +++ b/api/src/backend/api/signals.py @@ -6,7 +6,14 @@ from django.dispatch import receiver from django_celery_results.backends.database import DatabaseBackend from api.db_utils import delete_related_daily_task -from api.models import Membership, Provider, TenantAPIKey, User +from api.models import ( + LighthouseProviderConfiguration, + LighthouseTenantConfiguration, + Membership, + Provider, + TenantAPIKey, + User, +) def create_task_result_on_publish(sender=None, headers=None, **kwargs): # noqa: F841 @@ -56,3 +63,33 @@ def revoke_membership_api_keys(sender, instance, **kwargs): # noqa: F841 TenantAPIKey.objects.filter( entity=instance.user, tenant_id=instance.tenant.id ).update(revoked=True) + + +@receiver(pre_delete, sender=LighthouseProviderConfiguration) +def cleanup_lighthouse_defaults_before_delete(sender, instance, **kwargs): # noqa: F841 + """ + Ensure tenant Lighthouse defaults do not reference a soon-to-be-deleted provider. + + This runs for both per-instance deletes and queryset (bulk) deletes. + """ + try: + tenant_cfg = LighthouseTenantConfiguration.objects.get( + tenant_id=instance.tenant_id + ) + except LighthouseTenantConfiguration.DoesNotExist: + return + + updated = False + defaults = tenant_cfg.default_models or {} + + if instance.provider_type in defaults: + defaults.pop(instance.provider_type, None) + tenant_cfg.default_models = defaults + updated = True + + if tenant_cfg.default_provider == instance.provider_type: + tenant_cfg.default_provider = "" + updated = True + + if updated: + tenant_cfg.save() diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml index 3f0005726b..d3f68719a1 100644 --- a/api/src/backend/api/specs/v1.yaml +++ b/api/src/backend/api/specs/v1.yaml @@ -1,7 +1,7 @@ openapi: 3.0.3 info: title: Prowler API - version: 1.14.0 + version: 1.15.0 description: |- Prowler API specification. @@ -3429,6 +3429,7 @@ paths: - Lighthouse AI security: - JWT or API Key: [] + deprecated: true responses: '200': content: @@ -3456,6 +3457,7 @@ paths: required: true security: - JWT or API Key: [] + deprecated: true responses: '201': content: @@ -3490,6 +3492,7 @@ paths: required: true security: - JWT or API Key: [] + deprecated: true responses: '200': content: @@ -3511,6 +3514,7 @@ paths: - Lighthouse AI security: - JWT or API Key: [] + deprecated: true responses: '204': description: No response body @@ -3530,6 +3534,587 @@ paths: - Lighthouse AI security: - JWT or API Key: [] + deprecated: true + responses: + '202': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/TaskResponse' + examples: + Task queued: + summary: Task queued + value: + data: + type: tasks + id: 497f6eca-6276-4993-bfeb-53cbbbba6f08 + attributes: + inserted_at: '2019-08-24T14:15:22Z' + completed_at: '2019-08-24T14:15:22Z' + name: string + state: available + result: null + task_args: null + metadata: null + description: '' + /api/v1/lighthouse/configuration: + get: + operationId: lighthouse_configuration_list + description: Retrieve current tenant-level Lighthouse AI settings. Returns a + single configuration object. + summary: Get Lighthouse AI Tenant config + parameters: + - in: query + name: fields[lighthouse-config] + schema: + type: array + items: + type: string + enum: + - inserted_at + - updated_at + - business_context + - default_provider + - default_models + - url + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + - name: filter[search] + required: false + in: query + description: A search term. + schema: + type: string + - name: page[number] + required: false + in: query + description: A page number within the paginated result set. + schema: + type: integer + - name: page[size] + required: false + in: query + description: Number of results to return per page. + schema: + type: integer + - name: sort + required: false + in: query + description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)' + schema: + type: array + items: + type: string + enum: + - id + - -id + - inserted_at + - -inserted_at + - updated_at + - -updated_at + - business_context + - -business_context + - default_provider + - -default_provider + - default_models + - -default_models + - url + - -url + explode: false + tags: + - Lighthouse AI + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/PaginatedLighthouseTenantConfigList' + description: '' + patch: + operationId: lighthouse_configuration_partial_update + description: Update tenant-level settings. Validates that the default provider + is configured and active and that default model IDs exist for the chosen providers. + Auto-creates configuration if it doesn't exist. + summary: Update Lighthouse AI Tenant config + tags: + - Lighthouse AI + requestBody: + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/PatchedLighthouseTenantConfigUpdateRequest' + application/x-www-form-urlencoded: + schema: + $ref: '#/components/schemas/PatchedLighthouseTenantConfigUpdateRequest' + multipart/form-data: + schema: + $ref: '#/components/schemas/PatchedLighthouseTenantConfigUpdateRequest' + required: true + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/LighthouseTenantConfigUpdateResponse' + description: '' + /api/v1/lighthouse/models: + get: + operationId: lighthouse_models_list + description: List available LLM models per configured provider for the current + tenant. + summary: List all LLM models + parameters: + - in: query + name: fields[LighthouseProviderModels] + schema: + type: array + items: + type: string + enum: + - inserted_at + - updated_at + - provider_configuration + - model_id + - model_name + - default_parameters + - url + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + - in: query + name: filter[model_id] + schema: + type: string + - in: query + name: filter[model_id__icontains] + schema: + type: string + - in: query + name: filter[model_id__in] + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: filter[provider_type] + schema: + type: string + x-spec-enum-id: 80350f3ab09becd9 + enum: + - openai + description: |- + LLM provider name + + * `openai` - OpenAI + - in: query + name: filter[provider_type__in] + schema: + type: array + items: + type: string + x-spec-enum-id: 80350f3ab09becd9 + enum: + - openai + description: |- + Multiple values may be separated by commas. + + * `openai` - OpenAI + explode: false + style: form + - name: filter[search] + required: false + in: query + description: A search term. + schema: + type: string + - name: page[number] + required: false + in: query + description: A page number within the paginated result set. + schema: + type: integer + - name: page[size] + required: false + in: query + description: Number of results to return per page. + schema: + type: integer + - name: sort + required: false + in: query + description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)' + schema: + type: array + items: + type: string + enum: + - id + - -id + - inserted_at + - -inserted_at + - updated_at + - -updated_at + - provider_configuration + - -provider_configuration + - model_id + - -model_id + - model_name + - -model_name + - default_parameters + - -default_parameters + - url + - -url + explode: false + tags: + - Lighthouse AI + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/PaginatedLighthouseProviderModelsList' + description: '' + /api/v1/lighthouse/models/{id}: + get: + operationId: lighthouse_models_retrieve + description: Get details for a specific LLM model. + summary: Retrieve LLM model details + parameters: + - in: query + name: fields[LighthouseProviderModels] + schema: + type: array + items: + type: string + enum: + - inserted_at + - updated_at + - provider_configuration + - model_id + - model_name + - default_parameters + - url + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lighthouse provider models. + required: true + tags: + - Lighthouse AI + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/LighthouseProviderModelsResponse' + description: '' + /api/v1/lighthouse/providers: + get: + operationId: lighthouse_providers_list + description: Retrieve all LLM provider configurations for the current tenant + summary: List all LLM provider configs + parameters: + - in: query + name: fields[lighthouse-providers] + schema: + type: array + items: + type: string + enum: + - inserted_at + - updated_at + - provider_type + - base_url + - is_active + - credentials + - url + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + - in: query + name: filter[is_active] + schema: + type: boolean + - in: query + name: filter[provider_type] + schema: + type: string + x-spec-enum-id: 80350f3ab09becd9 + enum: + - openai + description: |- + LLM provider name + + * `openai` - OpenAI + - in: query + name: filter[provider_type__in] + schema: + type: array + items: + type: string + x-spec-enum-id: 80350f3ab09becd9 + enum: + - openai + description: |- + Multiple values may be separated by commas. + + * `openai` - OpenAI + explode: false + style: form + - name: filter[search] + required: false + in: query + description: A search term. + schema: + type: string + - name: page[number] + required: false + in: query + description: A page number within the paginated result set. + schema: + type: integer + - name: page[size] + required: false + in: query + description: Number of results to return per page. + schema: + type: integer + - name: sort + required: false + in: query + description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)' + schema: + type: array + items: + type: string + enum: + - id + - -id + - inserted_at + - -inserted_at + - updated_at + - -updated_at + - provider_type + - -provider_type + - base_url + - -base_url + - is_active + - -is_active + - credentials + - -credentials + - url + - -url + explode: false + tags: + - Lighthouse AI + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/PaginatedLighthouseProviderConfigList' + description: '' + post: + operationId: lighthouse_providers_create + description: Create a per-tenant configuration for an LLM provider. Only one + configuration per provider type is allowed per tenant. + summary: Create LLM provider config + tags: + - Lighthouse AI + requestBody: + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/LighthouseProviderConfigCreateRequest' + application/x-www-form-urlencoded: + schema: + $ref: '#/components/schemas/LighthouseProviderConfigCreateRequest' + multipart/form-data: + schema: + $ref: '#/components/schemas/LighthouseProviderConfigCreateRequest' + required: true + security: + - JWT or API Key: [] + responses: + '201': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/LighthouseProviderConfigCreateResponse' + description: '' + /api/v1/lighthouse/providers/{id}: + get: + operationId: lighthouse_providers_retrieve + description: Get details for a specific provider configuration in the current + tenant. + summary: Retrieve LLM provider config + parameters: + - in: query + name: fields[lighthouse-providers] + schema: + type: array + items: + type: string + enum: + - inserted_at + - updated_at + - provider_type + - base_url + - is_active + - credentials + - url + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lighthouse provider configuration. + required: true + tags: + - Lighthouse AI + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/LighthouseProviderConfigResponse' + description: '' + patch: + operationId: lighthouse_providers_partial_update + description: Partially update a provider configuration (e.g., base_url, is_active). + summary: Update LLM provider config + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lighthouse provider configuration. + required: true + tags: + - Lighthouse AI + requestBody: + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/PatchedLighthouseProviderConfigUpdateRequest' + application/x-www-form-urlencoded: + schema: + $ref: '#/components/schemas/PatchedLighthouseProviderConfigUpdateRequest' + multipart/form-data: + schema: + $ref: '#/components/schemas/PatchedLighthouseProviderConfigUpdateRequest' + required: true + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/LighthouseProviderConfigUpdateResponse' + description: '' + delete: + operationId: lighthouse_providers_destroy + description: Delete a provider configuration. Any tenant defaults that reference + this provider are cleared during deletion. + summary: Delete LLM provider config + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lighthouse provider configuration. + required: true + tags: + - Lighthouse AI + security: + - JWT or API Key: [] + responses: + '204': + description: No response body + /api/v1/lighthouse/providers/{id}/connection: + post: + operationId: lighthouse_providers_connection_create + description: Validate provider credentials asynchronously and toggle is_active. + summary: Check LLM provider connection + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lighthouse provider configuration. + required: true + tags: + - Lighthouse AI + security: + - JWT or API Key: [] + responses: + '202': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/TaskResponse' + examples: + Task queued: + summary: Task queued + value: + data: + type: tasks + id: 497f6eca-6276-4993-bfeb-53cbbbba6f08 + attributes: + inserted_at: '2019-08-24T14:15:22Z' + completed_at: '2019-08-24T14:15:22Z' + name: string + state: available + result: null + task_args: null + metadata: null + description: '' + /api/v1/lighthouse/providers/{id}/refresh-models: + post: + operationId: lighthouse_providers_refresh_models_create + description: Fetch available models for this provider configuration and upsert + into catalog. + summary: Refresh LLM models catalog + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lighthouse provider configuration. + required: true + tags: + - Lighthouse AI + security: + - JWT or API Key: [] responses: '202': content: @@ -3611,6 +4196,16 @@ paths: schema: type: string format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: @@ -3778,6 +4373,16 @@ paths: schema: type: string format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: @@ -3980,6 +4585,16 @@ paths: schema: type: string format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: @@ -10823,6 +11438,337 @@ components: $ref: '#/components/schemas/LighthouseConfigUpdate' required: - data + LighthouseProviderConfig: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-providers + id: + type: string + format: uuid + attributes: + type: object + properties: + inserted_at: + type: string + format: date-time + readOnly: true + updated_at: + type: string + format: date-time + readOnly: true + provider_type: + enum: + - openai + type: string + x-spec-enum-id: 80350f3ab09becd9 + description: |- + LLM provider name + + * `openai` - OpenAI + base_url: + type: string + format: uri + nullable: true + maxLength: 200 + is_active: + type: boolean + readOnly: true + credentials: + readOnly: true + required: + - provider_type + LighthouseProviderConfigCreate: + type: object + required: + - type + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-providers + attributes: + type: object + properties: + provider_type: + enum: + - openai + type: string + x-spec-enum-id: 80350f3ab09becd9 + description: |- + LLM provider name + + * `openai` - OpenAI + base_url: + type: string + format: uri + nullable: true + maxLength: 200 + credentials: + writeOnly: true + is_active: + type: boolean + required: + - provider_type + - credentials + LighthouseProviderConfigCreateRequest: + type: object + properties: + data: + type: object + required: + - type + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-providers + attributes: + type: object + properties: + provider_type: + enum: + - openai + type: string + x-spec-enum-id: 80350f3ab09becd9 + description: |- + LLM provider name + + * `openai` - OpenAI + base_url: + type: string + format: uri + nullable: true + maxLength: 200 + credentials: + writeOnly: true + is_active: + type: boolean + required: + - provider_type + - credentials + required: + - data + LighthouseProviderConfigCreateResponse: + type: object + properties: + data: + $ref: '#/components/schemas/LighthouseProviderConfigCreate' + required: + - data + LighthouseProviderConfigResponse: + type: object + properties: + data: + $ref: '#/components/schemas/LighthouseProviderConfig' + required: + - data + LighthouseProviderConfigUpdate: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-providers + id: + type: string + format: uuid + attributes: + type: object + properties: + provider_type: + enum: + - openai + type: string + x-spec-enum-id: 80350f3ab09becd9 + readOnly: true + description: |- + LLM provider name + + * `openai` - OpenAI + base_url: + type: string + format: uri + nullable: true + maxLength: 200 + credentials: + writeOnly: true + is_active: + type: boolean + LighthouseProviderConfigUpdateResponse: + type: object + properties: + data: + $ref: '#/components/schemas/LighthouseProviderConfigUpdate' + required: + - data + LighthouseProviderModels: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - LighthouseProviderModels + id: + type: string + format: uuid + attributes: + type: object + properties: + inserted_at: + type: string + format: date-time + readOnly: true + updated_at: + type: string + format: date-time + readOnly: true + model_id: + type: string + maxLength: 100 + model_name: + type: string + maxLength: 100 + default_parameters: {} + required: + - model_id + - model_name + relationships: + type: object + properties: + provider_configuration: + type: object + properties: + data: + type: object + properties: + id: + type: string + format: uuid + type: + type: string + enum: + - lighthouse-providers + title: Resource Type Name + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common + attributes and relationships. + required: + - id + - type + required: + - data + description: The identifier of the related object. + title: Resource Identifier + readOnly: true + LighthouseProviderModelsResponse: + type: object + properties: + data: + $ref: '#/components/schemas/LighthouseProviderModels' + required: + - data + LighthouseTenantConfig: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-config + id: + type: string + format: uuid + attributes: + type: object + properties: + inserted_at: + type: string + format: date-time + readOnly: true + updated_at: + type: string + format: date-time + readOnly: true + business_context: + type: string + default_provider: + type: string + maxLength: 50 + default_models: {} + url: + type: string + readOnly: true + LighthouseTenantConfigUpdate: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-config + id: + type: string + format: uuid + attributes: + type: object + properties: + business_context: + type: string + default_provider: + type: string + maxLength: 50 + default_models: {} + LighthouseTenantConfigUpdateResponse: + type: object + properties: + data: + $ref: '#/components/schemas/LighthouseTenantConfigUpdate' + required: + - data Membership: type: object required: @@ -11184,6 +12130,33 @@ components: $ref: '#/components/schemas/LighthouseConfig' required: - data + PaginatedLighthouseProviderConfigList: + type: object + properties: + data: + type: array + items: + $ref: '#/components/schemas/LighthouseProviderConfig' + required: + - data + PaginatedLighthouseProviderModelsList: + type: object + properties: + data: + type: array + items: + $ref: '#/components/schemas/LighthouseProviderModels' + required: + - data + PaginatedLighthouseTenantConfigList: + type: object + properties: + data: + type: array + items: + $ref: '#/components/schemas/LighthouseTenantConfig' + required: + - data PaginatedMembershipList: type: object properties: @@ -11645,6 +12618,81 @@ components: readOnly: true required: - data + PatchedLighthouseProviderConfigUpdateRequest: + type: object + properties: + data: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-providers + id: + type: string + format: uuid + attributes: + type: object + properties: + provider_type: + enum: + - openai + type: string + x-spec-enum-id: 80350f3ab09becd9 + readOnly: true + description: |- + LLM provider name + + * `openai` - OpenAI + base_url: + type: string + format: uri + nullable: true + maxLength: 200 + credentials: + writeOnly: true + is_active: + type: boolean + required: + - data + PatchedLighthouseTenantConfigUpdateRequest: + type: object + properties: + data: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - lighthouse-config + id: + type: string + format: uuid + attributes: + type: object + properties: + business_context: + type: string + default_provider: + type: string + maxLength: 50 + default_models: {} + required: + - data PatchedProcessorUpdateRequest: type: object properties: diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py index 1b1783cc5a..94ce2d0ed2 100644 --- a/api/src/backend/api/tests/test_views.py +++ b/api/src/backend/api/tests/test_views.py @@ -35,6 +35,9 @@ from api.db_router import MainRouter from api.models import ( Integration, Invitation, + LighthouseProviderConfiguration, + LighthouseProviderModels, + LighthouseTenantConfiguration, Membership, Processor, Provider, @@ -46,6 +49,7 @@ from api.models import ( SAMLConfiguration, SAMLToken, Scan, + ScanSummary, StateChoices, Task, TenantAPIKey, @@ -2688,6 +2692,55 @@ class TestScanViewSet: == "There is a problem with credentials." ) + @patch("api.v1.views.ScanViewSet._get_task_status") + @patch("api.v1.views.get_s3_client") + @patch("api.v1.views.env.str") + def test_threatscore_s3_wildcard( + self, + mock_env_str, + mock_get_s3_client, + mock_get_task_status, + authenticated_client, + scans_fixture, + ): + """ + When the threatscore endpoint is called with an S3 output_location, + the view should list objects in S3 using wildcard pattern matching, + retrieve the matching PDF file, and return it with HTTP 200 and proper headers. + """ + scan = scans_fixture[0] + scan.state = StateChoices.COMPLETED + bucket = "test-bucket" + zip_key = "tenant-id/scan-id/prowler-output-foo.zip" + scan.output_location = f"s3://{bucket}/{zip_key}" + scan.save() + + pdf_key = os.path.join( + os.path.dirname(zip_key), + "threatscore", + "prowler-output-123_threatscore_report.pdf", + ) + + mock_s3_client = Mock() + mock_s3_client.list_objects_v2.return_value = {"Contents": [{"Key": pdf_key}]} + mock_s3_client.get_object.return_value = {"Body": io.BytesIO(b"pdf-bytes")} + + mock_env_str.return_value = bucket + mock_get_s3_client.return_value = mock_s3_client + mock_get_task_status.return_value = None + + url = reverse("scan-threatscore", kwargs={"pk": scan.id}) + response = authenticated_client.get(url) + + assert response.status_code == status.HTTP_200_OK + assert response["Content-Type"] == "application/pdf" + assert response["Content-Disposition"].endswith( + '"prowler-output-123_threatscore_report.pdf"' + ) + assert response.content == b"pdf-bytes" + mock_s3_client.list_objects_v2.assert_called_once() + mock_s3_client.get_object.assert_called_once_with(Bucket=bucket, Key=pdf_key) + def test_report_s3_success(self, authenticated_client, scans_fixture, monkeypatch): """ When output_location is an S3 URL and the S3 client returns the file successfully, @@ -5766,6 +5819,171 @@ class TestOverviewViewSet: assert service1_data["attributes"]["muted"] == 1 assert service2_data["attributes"]["muted"] == 0 + def test_overview_findings_provider_id_in_filter( + self, authenticated_client, tenants_fixture, providers_fixture + ): + tenant = tenants_fixture[0] + provider1, provider2, *_ = providers_fixture + + scan1 = Scan.objects.create( + name="scan-one", + provider=provider1, + trigger=Scan.TriggerChoices.MANUAL, + state=StateChoices.COMPLETED, + tenant=tenant, + ) + scan2 = Scan.objects.create( + name="scan-two", + provider=provider2, + trigger=Scan.TriggerChoices.MANUAL, + state=StateChoices.COMPLETED, + tenant=tenant, + ) + + ScanSummary.objects.create( + tenant=tenant, + scan=scan1, + check_id="check-provider-one", + service="service-a", + severity="high", + region="region-a", + _pass=5, + fail=1, + muted=2, + total=8, + new=5, + changed=2, + unchanged=1, + fail_new=1, + fail_changed=0, + pass_new=3, + pass_changed=2, + muted_new=1, + muted_changed=1, + ) + + ScanSummary.objects.create( + tenant=tenant, + scan=scan2, + check_id="check-provider-two", + service="service-b", + severity="medium", + region="region-b", + _pass=2, + fail=3, + muted=1, + total=6, + new=3, + changed=2, + unchanged=1, + fail_new=2, + fail_changed=1, + pass_new=1, + pass_changed=1, + muted_new=1, + muted_changed=0, + ) + + single_response = authenticated_client.get( + reverse("overview-findings"), + {"filter[provider_id__in]": str(provider1.id)}, + ) + assert single_response.status_code == status.HTTP_200_OK + single_attributes = single_response.json()["data"]["attributes"] + assert single_attributes["pass"] == 5 + assert single_attributes["fail"] == 1 + assert single_attributes["muted"] == 2 + assert single_attributes["total"] == 8 + + combined_response = authenticated_client.get( + reverse("overview-findings"), + {"filter[provider_id__in]": f"{provider1.id},{provider2.id}"}, + ) + assert combined_response.status_code == status.HTTP_200_OK + combined_attributes = combined_response.json()["data"]["attributes"] + assert combined_attributes["pass"] == 7 + assert combined_attributes["fail"] == 4 + assert combined_attributes["muted"] == 3 + assert combined_attributes["total"] == 14 + + def test_overview_findings_severity_provider_id_in_filter( + self, authenticated_client, tenants_fixture, providers_fixture + ): + tenant = tenants_fixture[0] + provider1, provider2, *_ = providers_fixture + + scan1 = Scan.objects.create( + name="severity-scan-one", + provider=provider1, + trigger=Scan.TriggerChoices.MANUAL, + state=StateChoices.COMPLETED, + tenant=tenant, + ) + scan2 = Scan.objects.create( + name="severity-scan-two", + provider=provider2, + trigger=Scan.TriggerChoices.MANUAL, + state=StateChoices.COMPLETED, + tenant=tenant, + ) + + ScanSummary.objects.create( + tenant=tenant, + scan=scan1, + check_id="severity-check-one", + service="service-a", + severity="high", + region="region-a", + _pass=4, + fail=4, + muted=0, + total=8, + ) + ScanSummary.objects.create( + tenant=tenant, + scan=scan1, + check_id="severity-check-two", + service="service-a", + severity="medium", + region="region-b", + _pass=2, + fail=2, + muted=0, + total=4, + ) + ScanSummary.objects.create( + tenant=tenant, + scan=scan2, + check_id="severity-check-three", + service="service-b", + severity="critical", + region="region-c", + _pass=1, + fail=2, + muted=0, + total=3, + ) + + single_response = authenticated_client.get( + reverse("overview-findings_severity"), + {"filter[provider_id__in]": str(provider1.id)}, + ) + assert single_response.status_code == status.HTTP_200_OK + single_attributes = single_response.json()["data"]["attributes"] + assert single_attributes["high"] == 8 + assert single_attributes["medium"] == 4 + assert single_attributes["critical"] == 0 + + combined_response = authenticated_client.get( + reverse("overview-findings_severity"), + {"filter[provider_id__in]": f"{provider1.id},{provider2.id}"}, + ) + assert combined_response.status_code == status.HTTP_200_OK + combined_attributes = combined_response.json()["data"]["attributes"] + assert combined_attributes["high"] == 8 + assert combined_attributes["medium"] == 4 + assert combined_attributes["critical"] == 3 + @pytest.mark.django_db class TestScheduleViewSet: @@ -8488,3 +8706,483 @@ class TestTenantApiKeyViewSet: # Verify error object structure error = response_data["errors"][0] assert "detail" in error or "title" in error + + +@pytest.mark.django_db +class TestLighthouseTenantConfigViewSet: + """Test Lighthouse tenant configuration endpoint (singleton pattern)""" + + def test_lighthouse_tenant_config_create_via_patch(self, authenticated_client): + """Test creating a tenant config successfully via PATCH (upsert)""" + payload = { + "data": { + "type": "lighthouse-config", + "attributes": { + "business_context": "Test business context for security analysis", + "default_provider": "", + "default_models": {}, + }, + } + } + response = authenticated_client.patch( + reverse("lighthouse-config"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert response.status_code == status.HTTP_200_OK + data = response.json()["data"] + assert ( + data["attributes"]["business_context"] + == "Test business context for security analysis" + ) + assert data["attributes"]["default_provider"] == "" + assert data["attributes"]["default_models"] == {} + + def test_lighthouse_tenant_config_upsert_behavior(self, authenticated_client): + """Test that PATCH creates config if not exists and updates if exists (upsert)""" + payload = { + "data": { + "type": "lighthouse-config", + "attributes": { + "business_context": "First config", + }, + } + } + + # First PATCH creates the config + response = authenticated_client.patch( + reverse("lighthouse-config"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert response.status_code == status.HTTP_200_OK + first_data = response.json()["data"] + assert first_data["attributes"]["business_context"] == "First config" + + # Second PATCH updates the same config (not creating a duplicate) + payload["data"]["attributes"]["business_context"] = "Updated config" + response = authenticated_client.patch( + reverse("lighthouse-config"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert response.status_code == status.HTTP_200_OK + second_data = response.json()["data"] + assert second_data["attributes"]["business_context"] == "Updated config" + # Verify it's the same config (same ID) + assert first_data["id"] == second_data["id"] + + @patch("openai.OpenAI") + def test_lighthouse_tenant_config_retrieve( + self, mock_openai_client, authenticated_client, tenants_fixture + ): + """Test retrieving the singleton tenant config with proper provider and model validation""" + + # Mock OpenAI client and models response + mock_models_response = Mock() + mock_models_response.data = [ + Mock(id="gpt-4o"), + Mock(id="gpt-4o-mini"), + Mock(id="gpt-5"), + ] + mock_openai_client.return_value.models.list.return_value = mock_models_response + + # Create OpenAI provider configuration + provider_config = LighthouseProviderConfiguration.objects.create( + tenant_id=tenants_fixture[0].id, + provider_type="openai", + credentials=b'{"api_key": "sk-test1234567890T3BlbkFJtest1234567890"}', + is_active=True, + ) + + # Create provider models (simulating refresh) + LighthouseProviderModels.objects.create( + tenant_id=tenants_fixture[0].id, + provider_configuration=provider_config, + model_id="gpt-4o", + default_parameters={}, + ) + LighthouseProviderModels.objects.create( + tenant_id=tenants_fixture[0].id, + provider_configuration=provider_config, + model_id="gpt-4o-mini", + default_parameters={}, + ) + + # Create tenant configuration with valid provider and model + config = LighthouseTenantConfiguration.objects.create( + tenant_id=tenants_fixture[0].id, + business_context="Test context", + default_provider="openai", + default_models={"openai": "gpt-4o"}, + ) + + # Retrieve and verify the configuration + response = authenticated_client.get(reverse("lighthouse-config")) + assert response.status_code == status.HTTP_200_OK + data = response.json()["data"] + assert data["id"] == str(config.id) + assert data["attributes"]["business_context"] == "Test context" + assert data["attributes"]["default_provider"] == "openai" + assert data["attributes"]["default_models"] == {"openai": "gpt-4o"} + + def test_lighthouse_tenant_config_retrieve_not_found(self, authenticated_client): + """Test GET when config doesn't exist returns 404""" + response = authenticated_client.get(reverse("lighthouse-config")) + assert response.status_code == status.HTTP_404_NOT_FOUND + assert "not found" in response.json()["errors"][0]["detail"].lower() + + def test_lighthouse_tenant_config_partial_update( + self, authenticated_client, tenants_fixture + ): + """Test updating tenant config fields""" + from api.models import LighthouseTenantConfiguration + + # Create config first + config = LighthouseTenantConfiguration.objects.create( + tenant_id=tenants_fixture[0].id, + business_context="Original context", + default_provider="", + default_models={}, + ) + + # Update it + payload = { + "data": { + "type": "lighthouse-config", + "attributes": { + "business_context": "Updated context for cloud security", + }, + } + } + response = authenticated_client.patch( + reverse("lighthouse-config"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert response.status_code == status.HTTP_200_OK + + # Verify update + config.refresh_from_db() + assert config.business_context == "Updated context for cloud security" + + def test_lighthouse_tenant_config_update_invalid_provider( + self, authenticated_client, tenants_fixture + ): + """Test validation fails when default_provider is not configured and active""" + from api.models import LighthouseTenantConfiguration + + # Create config first + LighthouseTenantConfiguration.objects.create( + tenant_id=tenants_fixture[0].id, + business_context="Test", + ) + + # Try to set invalid provider + payload = { + "data": { + "type": "lighthouse-config", + "attributes": { + "default_provider": "nonexistent-provider", + }, + } + } + response = authenticated_client.patch( + reverse("lighthouse-config"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert response.status_code == status.HTTP_400_BAD_REQUEST + assert "provider" in response.json()["errors"][0]["detail"].lower() + + def test_lighthouse_tenant_config_update_invalid_json_format( + self, authenticated_client, tenants_fixture + ): + """Test that invalid JSON payload is rejected""" + from api.models import LighthouseTenantConfiguration + + # Create config first + LighthouseTenantConfiguration.objects.create( + tenant_id=tenants_fixture[0].id, + business_context="Test", + ) + + # Send invalid JSON + response = authenticated_client.patch( + reverse("lighthouse-config"), + data="invalid json", + content_type=API_JSON_CONTENT_TYPE, + ) + assert response.status_code == status.HTTP_400_BAD_REQUEST + + +@pytest.mark.django_db +class TestLighthouseProviderConfigViewSet: + """Tests for LighthouseProviderConfiguration create validations""" + + def test_invalid_provider_type(self, authenticated_client): + """Add invalid provider (testprovider) should error""" + payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "testprovider", + "credentials": {"api_key": "sk-testT3BlbkFJkey"}, + }, + } + } + resp = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert resp.status_code == status.HTTP_400_BAD_REQUEST + + def test_openai_missing_credentials(self, authenticated_client): + """OpenAI provider without credentials should error""" + payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "openai", + }, + } + } + resp = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert resp.status_code == status.HTTP_400_BAD_REQUEST + + @pytest.mark.parametrize( + "credentials", + [ + {}, # empty credentials + {"token": "sk-testT3BlbkFJkey"}, # wrong key name + {"api_key": "ks-invalid-format"}, # wrong format + ], + ) + def test_openai_invalid_credentials(self, authenticated_client, credentials): + """OpenAI provider with invalid credentials should error""" + payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "openai", + "credentials": credentials, + }, + } + } + resp = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert resp.status_code == status.HTTP_400_BAD_REQUEST + + def test_openai_valid_credentials_success(self, authenticated_client): + """OpenAI provider with valid sk-xxx format should succeed""" + valid_key = "sk-abc123T3BlbkFJxyz456" + payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "openai", + "credentials": {"api_key": valid_key}, + }, + } + } + resp = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert resp.status_code == status.HTTP_201_CREATED + data = resp.json()["data"] + + masked_creds = data["attributes"].get("credentials") + assert masked_creds is not None + assert "api_key" in masked_creds + assert masked_creds["api_key"] == ("*" * len(valid_key)) + + def test_openai_provider_duplicate_per_tenant(self, authenticated_client): + """If an OpenAI provider exists for tenant, creating again should error""" + valid_key = "sk-dup123T3BlbkFJdup456" + payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "openai", + "credentials": {"api_key": valid_key}, + }, + } + } + # First creation succeeds + resp1 = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert resp1.status_code == status.HTTP_201_CREATED + + # Second creation should fail with validation error + resp2 = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert resp2.status_code == status.HTTP_400_BAD_REQUEST + assert "already exists" in str(resp2.json()).lower() + + def test_openai_patch_base_url_and_is_active(self, authenticated_client): + """After creating, should be able to patch base_url and is_active""" + valid_key = "sk-patch123T3BlbkFJpatch456" + create_payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "openai", + "credentials": {"api_key": valid_key}, + }, + } + } + create_resp = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=create_payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert create_resp.status_code == status.HTTP_201_CREATED + provider_id = create_resp.json()["data"]["id"] + + patch_payload = { + "data": { + "type": "lighthouse-providers", + "id": provider_id, + "attributes": { + "base_url": "https://api.example.com/v1", + "is_active": False, + }, + } + } + patch_resp = authenticated_client.patch( + reverse("lighthouse-providers-detail", kwargs={"pk": provider_id}), + data=patch_payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert patch_resp.status_code == status.HTTP_200_OK + updated = patch_resp.json()["data"]["attributes"] + assert updated["base_url"] == "https://api.example.com/v1" + assert updated["is_active"] is False + + def test_openai_patch_invalid_credentials(self, authenticated_client): + """PATCH with invalid credentials.api_key should error (400)""" + valid_key = "sk-ok123T3BlbkFJok456" + create_payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "openai", + "credentials": {"api_key": valid_key}, + }, + } + } + create_resp = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=create_payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert create_resp.status_code == status.HTTP_201_CREATED + provider_id = create_resp.json()["data"]["id"] + + # Try patch with invalid api_key format + patch_payload = { + "data": { + "type": "lighthouse-providers", + "id": provider_id, + "attributes": { + "credentials": {"api_key": "ks-invalid-format"}, + }, + } + } + patch_resp = authenticated_client.patch( + reverse("lighthouse-providers-detail", kwargs={"pk": provider_id}), + data=patch_payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert patch_resp.status_code == status.HTTP_400_BAD_REQUEST + + def test_openai_get_masking_and_fields_filter(self, authenticated_client): + valid_key = "sk-get123T3BlbkFJget456" + create_payload = { + "data": { + "type": "lighthouse-providers", + "attributes": { + "provider_type": "openai", + "credentials": {"api_key": valid_key}, + }, + } + } + create_resp = authenticated_client.post( + reverse("lighthouse-providers-list"), + data=create_payload, + content_type=API_JSON_CONTENT_TYPE, + ) + assert create_resp.status_code == status.HTTP_201_CREATED + provider_id = create_resp.json()["data"]["id"] + + # Default GET should return masked credentials + get_resp = authenticated_client.get( + reverse("lighthouse-providers-detail", kwargs={"pk": provider_id}) + ) + assert get_resp.status_code == status.HTTP_200_OK + masked = get_resp.json()["data"]["attributes"]["credentials"]["api_key"] + assert masked == ("*" * len(valid_key)) + + # Fields filter should return decrypted credentials structure + get_full = authenticated_client.get( + reverse("lighthouse-providers-detail", kwargs={"pk": provider_id}) + + "?fields[lighthouse-providers]=credentials" + ) + assert get_full.status_code == status.HTTP_200_OK + creds = get_full.json()["data"]["attributes"]["credentials"] + assert creds["api_key"] == valid_key + + def test_delete_provider_updates_tenant_defaults( + self, authenticated_client, tenants_fixture + ): + """Deleting a provider config should clear tenant default_provider and its default_model entry.""" + + tenant = tenants_fixture[0] + + # Create provider configuration to delete + provider = LighthouseProviderConfiguration.objects.create( + tenant_id=tenant.id, + provider_type="openai", + credentials=b'{"api_key":"sk-test123T3BlbkFJ"}', + is_active=True, + ) + + # Seed tenant defaults referencing the provider we will delete + cfg = LighthouseTenantConfiguration.objects.create( + tenant_id=tenant.id, + business_context="Test", + default_provider="openai", + default_models={"openai": "gpt-4o", "other": "model-x"}, + ) + + # Delete via API and validate response + url = reverse("lighthouse-providers-detail", kwargs={"pk": str(provider.id)}) + resp = authenticated_client.delete(url) + assert resp.status_code in ( + status.HTTP_204_NO_CONTENT, + status.HTTP_200_OK, + ) + + # Tenant defaults should be updated + cfg.refresh_from_db() + assert cfg.default_provider == "" + assert "openai" not in cfg.default_models + + # Unrelated entries should remain untouched + assert cfg.default_models.get("other") == "model-x" diff --git a/api/src/backend/api/v1/serializer_utils/lighthouse.py b/api/src/backend/api/v1/serializer_utils/lighthouse.py new file mode 100644 index 0000000000..f7ecef32cc --- /dev/null +++ b/api/src/backend/api/v1/serializer_utils/lighthouse.py @@ -0,0 +1,13 @@ +import re + +from rest_framework_json_api import serializers + + +class OpenAICredentialsSerializer(serializers.Serializer): + api_key = serializers.CharField() + + def validate_api_key(self, value: str) -> str: + pattern = r"^sk-[\w-]+$" + if not re.match(pattern, value or ""): + raise serializers.ValidationError("Invalid OpenAI API key format.") + return value diff --git a/api/src/backend/api/v1/serializers.py b/api/src/backend/api/v1/serializers.py index 8456c5a081..511b1f89e4 100644 --- a/api/src/backend/api/v1/serializers.py +++ b/api/src/backend/api/v1/serializers.py @@ -6,8 +6,10 @@ from django.conf import settings from django.contrib.auth import authenticate from django.contrib.auth.models import update_last_login from django.contrib.auth.password_validation import validate_password +from django.db import IntegrityError from drf_spectacular.utils import extend_schema_field from jwt.exceptions import InvalidKeyError +from rest_framework.reverse import reverse from rest_framework.validators import UniqueTogetherValidator from rest_framework_json_api import serializers from rest_framework_json_api.relations import SerializerMethodResourceRelatedField @@ -25,6 +27,9 @@ from api.models import ( Invitation, InvitationRoleRelationship, LighthouseConfiguration, + LighthouseProviderConfiguration, + LighthouseProviderModels, + LighthouseTenantConfiguration, Membership, Processor, Provider, @@ -54,6 +59,7 @@ from api.v1.serializer_utils.integrations import ( S3ConfigSerializer, SecurityHubConfigSerializer, ) +from api.v1.serializer_utils.lighthouse import OpenAICredentialsSerializer from api.v1.serializer_utils.processors import ProcessorConfigField from api.v1.serializer_utils.providers import ProviderSecretField from prowler.lib.mutelist.mutelist import Mutelist @@ -2750,6 +2756,16 @@ class LighthouseConfigCreateSerializer(RLSSerializer, BaseWriteSerializer): "updated_at": {"read_only": True}, } + def validate_temperature(self, value): + if not 0 <= value <= 1: + raise ValidationError("Temperature must be between 0 and 1.") + return value + + def validate_max_tokens(self, value): + if not 500 <= value <= 5000: + raise ValidationError("Max tokens must be between 500 and 5000.") + return value + def validate(self, attrs): tenant_id = self.context.get("request").tenant_id if LighthouseConfiguration.objects.filter(tenant_id=tenant_id).exists(): @@ -2758,6 +2774,11 @@ class LighthouseConfigCreateSerializer(RLSSerializer, BaseWriteSerializer): "tenant_id": "Lighthouse configuration already exists for this tenant." } ) + api_key = attrs.get("api_key") + if api_key is not None: + OpenAICredentialsSerializer(data={"api_key": api_key}).is_valid( + raise_exception=True + ) return super().validate(attrs) def create(self, validated_data): @@ -2802,6 +2823,24 @@ class LighthouseConfigUpdateSerializer(BaseWriteSerializer): "max_tokens": {"required": False}, } + def validate_temperature(self, value): + if not 0 <= value <= 1: + raise ValidationError("Temperature must be between 0 and 1.") + return value + + def validate_max_tokens(self, value): + if not 500 <= value <= 5000: + raise ValidationError("Max tokens must be between 500 and 5000.") + return value + + def validate(self, attrs): + api_key = attrs.get("api_key", None) + if api_key is not None: + OpenAICredentialsSerializer(data={"api_key": api_key}).is_valid( + raise_exception=True + ) + return super().validate(attrs) + def update(self, instance, validated_data): api_key = validated_data.pop("api_key", None) instance = super().update(instance, validated_data) @@ -2931,3 +2970,352 @@ class TenantApiKeyUpdateSerializer(RLSSerializer, BaseWriteSerializer): ): raise ValidationError("An API key with this name already exists.") return value + + +# Lighthouse: Provider configurations + + +class LighthouseProviderConfigSerializer(RLSSerializer): + """ + Read serializer for LighthouseProviderConfiguration. + """ + + # Decrypted credentials are only returned in to_representation when requested + credentials = serializers.JSONField(required=False, read_only=True) + + class Meta: + model = LighthouseProviderConfiguration + fields = [ + "id", + "inserted_at", + "updated_at", + "provider_type", + "base_url", + "is_active", + "credentials", + "url", + ] + extra_kwargs = { + "id": {"read_only": True}, + "inserted_at": {"read_only": True}, + "updated_at": {"read_only": True}, + "is_active": {"read_only": True}, + "url": {"read_only": True, "view_name": "lighthouse-providers-detail"}, + } + + class JSONAPIMeta: + resource_name = "lighthouse-providers" + + def to_representation(self, instance): + data = super().to_representation(instance) + # Support JSON:API fields filter: fields[lighthouse-providers]=credentials,base_url + fields_param = self.context.get("request", None) and self.context[ + "request" + ].query_params.get("fields[lighthouse-providers]", "") + + creds = instance.credentials_decoded + + requested_fields = ( + [f.strip() for f in fields_param.split(",")] if fields_param else [] + ) + + if "credentials" in requested_fields: + # Return full decrypted credentials JSON + data["credentials"] = creds + else: + # Return masked credentials by default + def mask_value(value): + if isinstance(value, str): + return "*" * len(value) + if isinstance(value, dict): + return {k: mask_value(v) for k, v in value.items()} + if isinstance(value, list): + return [mask_value(v) for v in value] + return value + + # Always return masked credentials, even if creds is None + if creds is not None: + data["credentials"] = mask_value(creds) + else: + # If credentials_decoded returns None, return None for credentials field + data["credentials"] = None + + return data + + +class LighthouseProviderConfigCreateSerializer(RLSSerializer, BaseWriteSerializer): + """ + Create serializer for LighthouseProviderConfiguration. + Accepts credentials as JSON; stored encrypted via credentials_decoded. + """ + + credentials = serializers.JSONField(write_only=True, required=True) + + class Meta: + model = LighthouseProviderConfiguration + fields = [ + "provider_type", + "base_url", + "credentials", + "is_active", + ] + extra_kwargs = { + "is_active": {"required": False}, + "base_url": {"required": False, "allow_null": True}, + } + + def create(self, validated_data): + credentials = validated_data.pop("credentials") + + instance = LighthouseProviderConfiguration(**validated_data) + instance.tenant_id = self.context.get("tenant_id") + instance.credentials_decoded = credentials + + try: + instance.save() + return instance + except IntegrityError: + raise ValidationError( + { + "provider_type": "Configuration for this provider already exists for the tenant." + } + ) + + def validate(self, attrs): + provider_type = attrs.get("provider_type") + credentials = attrs.get("credentials") or {} + + if provider_type == LighthouseProviderConfiguration.LLMProviderChoices.OPENAI: + try: + OpenAICredentialsSerializer(data=credentials).is_valid( + raise_exception=True + ) + except ValidationError as e: + details = e.detail.copy() + for key, value in details.items(): + e.detail[f"credentials/{key}"] = value + del e.detail[key] + raise e + + return super().validate(attrs) + + +class LighthouseProviderConfigUpdateSerializer(BaseWriteSerializer): + """ + Update serializer for LighthouseProviderConfiguration. + """ + + credentials = serializers.JSONField(write_only=True, required=False) + + class Meta: + model = LighthouseProviderConfiguration + fields = [ + "id", + "provider_type", + "base_url", + "credentials", + "is_active", + ] + extra_kwargs = { + "id": {"read_only": True}, + "provider_type": {"read_only": True}, + "base_url": {"required": False, "allow_null": True}, + "is_active": {"required": False}, + } + + def update(self, instance, validated_data): + credentials = validated_data.pop("credentials", None) + + for attr, value in validated_data.items(): + setattr(instance, attr, value) + + if credentials is not None: + instance.credentials_decoded = credentials + + instance.save() + return instance + + def validate(self, attrs): + provider_type = getattr(self.instance, "provider_type", None) + credentials = attrs.get("credentials", None) + + if ( + credentials is not None + and provider_type + == LighthouseProviderConfiguration.LLMProviderChoices.OPENAI + ): + try: + OpenAICredentialsSerializer(data=credentials).is_valid( + raise_exception=True + ) + except ValidationError as e: + details = e.detail.copy() + for key, value in details.items(): + e.detail[f"credentials/{key}"] = value + del e.detail[key] + raise e + + return super().validate(attrs) + + +# Lighthouse: Tenant configuration + + +class LighthouseTenantConfigSerializer(RLSSerializer): + """ + Read serializer for LighthouseTenantConfiguration. + """ + + # Build singleton URL without pk + url = serializers.SerializerMethodField() + + def get_url(self, obj): + request = self.context.get("request") + return reverse("lighthouse-config", request=request) + + class Meta: + model = LighthouseTenantConfiguration + fields = [ + "id", + "inserted_at", + "updated_at", + "business_context", + "default_provider", + "default_models", + "url", + ] + extra_kwargs = { + "id": {"read_only": True}, + "inserted_at": {"read_only": True}, + "updated_at": {"read_only": True}, + "url": {"read_only": True}, + } + + +class LighthouseTenantConfigUpdateSerializer(BaseWriteSerializer): + class Meta: + model = LighthouseTenantConfiguration + fields = [ + "id", + "business_context", + "default_provider", + "default_models", + ] + extra_kwargs = { + "id": {"read_only": True}, + } + + def validate(self, attrs): + request = self.context.get("request") + tenant_id = self.context.get("tenant_id") or ( + getattr(request, "tenant_id", None) if request else None + ) + + default_provider = attrs.get( + "default_provider", getattr(self.instance, "default_provider", "") + ) + default_models = attrs.get( + "default_models", getattr(self.instance, "default_models", {}) + ) + + if default_provider: + supported = set(LighthouseProviderConfiguration.LLMProviderChoices.values) + if default_provider not in supported: + raise ValidationError( + {"default_provider": f"Unsupported provider '{default_provider}'."} + ) + if not LighthouseProviderConfiguration.objects.filter( + tenant_id=tenant_id, provider_type=default_provider, is_active=True + ).exists(): + raise ValidationError( + { + "default_provider": f"No active configuration found for '{default_provider}'." + } + ) + + if default_models is not None and not isinstance(default_models, dict): + raise ValidationError( + {"default_models": "Must be an object mapping provider -> model_id."} + ) + + for provider_type, model_id in (default_models or {}).items(): + provider_cfg = LighthouseProviderConfiguration.objects.filter( + tenant_id=tenant_id, provider_type=provider_type, is_active=True + ).first() + if not provider_cfg: + raise ValidationError( + { + "default_models": f"No active configuration for provider '{provider_type}'." + } + ) + if not LighthouseProviderModels.objects.filter( + tenant_id=tenant_id, + provider_configuration=provider_cfg, + model_id=model_id, + ).exists(): + raise ValidationError( + { + "default_models": f"Invalid model '{model_id}' for provider '{provider_type}'." + } + ) + + return super().validate(attrs) + + +# Lighthouse: Provider models + + +class LighthouseProviderModelsSerializer(RLSSerializer): + """ + Read serializer for LighthouseProviderModels. + """ + + provider_configuration = serializers.ResourceRelatedField(read_only=True) + + class Meta: + model = LighthouseProviderModels + fields = [ + "id", + "inserted_at", + "updated_at", + "provider_configuration", + "model_id", + "model_name", + "default_parameters", + "url", + ] + extra_kwargs = { + "id": {"read_only": True}, + "inserted_at": {"read_only": True}, + "updated_at": {"read_only": True}, + "url": {"read_only": True, "view_name": "lighthouse-models-detail"}, + } + + +class LighthouseProviderModelsCreateSerializer(RLSSerializer, BaseWriteSerializer): + provider_configuration = serializers.ResourceRelatedField( + queryset=LighthouseProviderConfiguration.objects.all() + ) + + class Meta: + model = LighthouseProviderModels + fields = [ + "provider_configuration", + "model_id", + "default_parameters", + ] + extra_kwargs = { + "default_parameters": {"required": False}, + } + + +class LighthouseProviderModelsUpdateSerializer(BaseWriteSerializer): + class Meta: + model = LighthouseProviderModels + fields = [ + "id", + "default_parameters", + ] + extra_kwargs = { + "id": {"read_only": True}, + } diff --git a/api/src/backend/api/v1/urls.py b/api/src/backend/api/v1/urls.py index 1e8694ef23..87f55556be 100644 --- a/api/src/backend/api/v1/urls.py +++ b/api/src/backend/api/v1/urls.py @@ -17,6 +17,9 @@ from api.v1.views import ( InvitationAcceptViewSet, InvitationViewSet, LighthouseConfigViewSet, + LighthouseProviderConfigViewSet, + LighthouseProviderModelsViewSet, + LighthouseTenantConfigViewSet, MembershipViewSet, OverviewViewSet, ProcessorViewSet, @@ -34,12 +37,12 @@ from api.v1.views import ( ScheduleViewSet, SchemaView, TaskViewSet, + TenantApiKeyViewSet, TenantFinishACSView, TenantMembersViewSet, TenantViewSet, UserRoleRelationshipView, UserViewSet, - TenantApiKeyViewSet, ) router = routers.DefaultRouter(trailing_slash=False) @@ -67,6 +70,16 @@ router.register( basename="lighthouseconfiguration", ) router.register(r"api-keys", TenantApiKeyViewSet, basename="api-key") +router.register( + r"lighthouse/providers", + LighthouseProviderConfigViewSet, + basename="lighthouse-providers", +) +router.register( + r"lighthouse/models", + LighthouseProviderModelsViewSet, + basename="lighthouse-models", +) tenants_router = routers.NestedSimpleRouter(router, r"tenants", lookup="tenant") tenants_router.register( @@ -137,6 +150,14 @@ urlpatterns = [ ), name="provider_group-providers-relationship", ), + # Lighthouse tenant config as singleton endpoint + path( + "lighthouse/configuration", + LighthouseTenantConfigViewSet.as_view( + {"get": "list", "patch": "partial_update"} + ), + name="lighthouse-config", + ), # API endpoint to start SAML SSO flow path( "auth/saml/initiate/", SAMLInitiateAPIView.as_view(), name="api_saml_initiate" diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py index 6e561ff969..2e8a78207e 100644 --- a/api/src/backend/api/v1/views.py +++ b/api/src/backend/api/v1/views.py @@ -1,4 +1,6 @@ +import fnmatch import glob +import json import logging import os from datetime import datetime, timedelta, timezone @@ -59,11 +61,13 @@ from tasks.tasks import ( backfill_scan_resource_summaries_task, check_integration_connection_task, check_lighthouse_connection_task, + check_lighthouse_provider_connection_task, check_provider_connection_task, delete_provider_task, delete_tenant_task, jira_integration_task, perform_scan_task, + refresh_lighthouse_provider_models_task, ) from api.base_views import BaseRLSViewSet, BaseTenantViewset, BaseUserViewset @@ -83,6 +87,8 @@ from api.filters import ( InvitationFilter, LatestFindingFilter, LatestResourceFilter, + LighthouseProviderConfigFilter, + LighthouseProviderModelsFilter, MembershipFilter, ProcessorFilter, ProviderFilter, @@ -105,6 +111,9 @@ from api.models import ( Integration, Invitation, LighthouseConfiguration, + LighthouseProviderConfiguration, + LighthouseProviderModels, + LighthouseTenantConfiguration, Membership, Processor, Provider, @@ -159,6 +168,12 @@ from api.v1.serializers import ( LighthouseConfigCreateSerializer, LighthouseConfigSerializer, LighthouseConfigUpdateSerializer, + LighthouseProviderConfigCreateSerializer, + LighthouseProviderConfigSerializer, + LighthouseProviderConfigUpdateSerializer, + LighthouseProviderModelsSerializer, + LighthouseTenantConfigSerializer, + LighthouseTenantConfigUpdateSerializer, MembershipSerializer, OverviewFindingSerializer, OverviewProviderSerializer, @@ -306,7 +321,7 @@ class SchemaView(SpectacularAPIView): def get(self, request, *args, **kwargs): spectacular_settings.TITLE = "Prowler API" - spectacular_settings.VERSION = "1.14.0" + spectacular_settings.VERSION = "1.15.0" spectacular_settings.DESCRIPTION = ( "Prowler API specification.\n\nThis file is auto-generated." ) @@ -1593,6 +1608,25 @@ class ProviderViewSet(BaseRLSViewSet): }, request=None, ), + threatscore=extend_schema( + tags=["Scan"], + summary="Retrieve threatscore report", + description="Download a specific threatscore report (e.g., 'prowler_threatscore_aws') as a PDF file.", + request=None, + responses={ + 200: OpenApiResponse( + description="PDF file containing the threatscore report" + ), + 202: OpenApiResponse(description="The task is in progress"), + 401: OpenApiResponse( + description="API key missing or user not Authenticated" + ), + 403: OpenApiResponse(description="There is a problem with credentials"), + 404: OpenApiResponse( + description="The scan has no threatscore reports, or the threatscore report generation task has not started yet" + ), + }, + ), ) @method_decorator(CACHE_DECORATOR, name="list") @method_decorator(CACHE_DECORATOR, name="retrieve") @@ -1649,6 +1683,9 @@ class ScanViewSet(BaseRLSViewSet): if hasattr(self, "response_serializer_class"): return self.response_serializer_class return ScanComplianceReportSerializer + elif self.action == "threatscore": + if hasattr(self, "response_serializer_class"): + return self.response_serializer_class return super().get_serializer_class() def partial_update(self, request, *args, **kwargs): @@ -1753,7 +1790,18 @@ class ScanViewSet(BaseRLSViewSet): status=status.HTTP_502_BAD_GATEWAY, ) contents = resp.get("Contents", []) - keys = [obj["Key"] for obj in contents if obj["Key"].endswith(suffix)] + keys = [] + for obj in contents: + key = obj["Key"] + key_basename = os.path.basename(key) + if any(ch in suffix for ch in ("*", "?", "[")): + if fnmatch.fnmatch(key_basename, suffix): + keys.append(key) + elif key_basename == suffix: + keys.append(key) + elif key.endswith(suffix): + # Backward compatibility if suffix already includes directories + keys.append(key) if not keys: return Response( { @@ -1880,6 +1928,45 @@ class ScanViewSet(BaseRLSViewSet): content, filename = loader return self._serve_file(content, filename, "text/csv") + @action( + detail=True, + methods=["get"], + url_name="threatscore", + ) + def threatscore(self, request, pk=None): + scan = self.get_object() + running_resp = self._get_task_status(scan) + if running_resp: + return running_resp + + if not scan.output_location: + return Response( + { + "detail": "The scan has no reports, or the threatscore report generation task has not started yet." + }, + status=status.HTTP_404_NOT_FOUND, + ) + + if scan.output_location.startswith("s3://"): + bucket = env.str("DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET", "") + key_prefix = scan.output_location.removeprefix(f"s3://{bucket}/") + prefix = os.path.join( + os.path.dirname(key_prefix), + "threatscore", + "*_threatscore_report.pdf", + ) + loader = self._load_file(prefix, s3=True, bucket=bucket, list_objects=True) + else: + base = os.path.dirname(scan.output_location) + pattern = os.path.join(base, "threatscore", "*_threatscore_report.pdf") + loader = self._load_file(pattern, s3=False) + + if isinstance(loader, Response): + return loader + + content, filename = loader + return self._serve_file(content, filename, "application/pdf") + def create(self, request, *args, **kwargs): input_serializer = self.get_serializer(data=request.data) input_serializer.is_valid(raise_exception=True) @@ -4104,21 +4191,25 @@ class IntegrationJiraViewSet(BaseRLSViewSet): tags=["Lighthouse AI"], summary="List all Lighthouse AI configurations", description="Retrieve a list of all Lighthouse AI configurations.", + deprecated=True, ), create=extend_schema( tags=["Lighthouse AI"], summary="Create a new Lighthouse AI configuration", description="Create a new Lighthouse AI configuration with the specified details.", + deprecated=True, ), partial_update=extend_schema( tags=["Lighthouse AI"], summary="Partially update a Lighthouse AI configuration", description="Update certain fields of an existing Lighthouse AI configuration.", + deprecated=True, ), destroy=extend_schema( tags=["Lighthouse AI"], summary="Delete a Lighthouse AI configuration", description="Remove a Lighthouse AI configuration by its ID.", + deprecated=True, ), connection=extend_schema( tags=["Lighthouse AI"], @@ -4126,6 +4217,7 @@ class IntegrationJiraViewSet(BaseRLSViewSet): description="Verify the connection to the OpenAI API for a specific Lighthouse AI configuration.", request=None, responses={202: OpenApiResponse(response=TaskSerializer)}, + deprecated=True, ), ) class LighthouseConfigViewSet(BaseRLSViewSet): @@ -4176,6 +4268,273 @@ class LighthouseConfigViewSet(BaseRLSViewSet): ) +@extend_schema_view( + list=extend_schema( + tags=["Lighthouse AI"], + summary="List all LLM provider configs", + description="Retrieve all LLM provider configurations for the current tenant", + ), + retrieve=extend_schema( + tags=["Lighthouse AI"], + summary="Retrieve LLM provider config", + description="Get details for a specific provider configuration in the current tenant.", + ), + create=extend_schema( + tags=["Lighthouse AI"], + summary="Create LLM provider config", + description="Create a per-tenant configuration for an LLM provider. Only one configuration per provider type is allowed per tenant.", + ), + partial_update=extend_schema( + tags=["Lighthouse AI"], + summary="Update LLM provider config", + description="Partially update a provider configuration (e.g., base_url, is_active).", + ), + destroy=extend_schema( + tags=["Lighthouse AI"], + summary="Delete LLM provider config", + description="Delete a provider configuration. Any tenant defaults that reference this provider are cleared during deletion.", + ), +) +class LighthouseProviderConfigViewSet(BaseRLSViewSet): + queryset = LighthouseProviderConfiguration.objects.all() + serializer_class = LighthouseProviderConfigSerializer + http_method_names = ["get", "post", "patch", "delete"] + filterset_class = LighthouseProviderConfigFilter + + def get_queryset(self): + if getattr(self, "swagger_fake_view", False): + return LighthouseProviderConfiguration.objects.none() + return LighthouseProviderConfiguration.objects.filter( + tenant_id=self.request.tenant_id + ) + + def get_serializer_class(self): + if self.action == "create": + return LighthouseProviderConfigCreateSerializer + elif self.action == "partial_update": + return LighthouseProviderConfigUpdateSerializer + elif self.action in ["connection", "refresh_models"]: + return TaskSerializer + return super().get_serializer_class() + + def create(self, request, *args, **kwargs): + serializer = self.get_serializer(data=request.data) + serializer.is_valid(raise_exception=True) + instance = serializer.save() + + read_serializer = LighthouseProviderConfigSerializer( + instance, context=self.get_serializer_context() + ) + headers = self.get_success_headers(read_serializer.data) + return Response( + data=read_serializer.data, + status=status.HTTP_201_CREATED, + headers=headers, + ) + + def partial_update(self, request, *args, **kwargs): + instance = self.get_object() + serializer = self.get_serializer( + instance, + data=request.data, + partial=True, + context=self.get_serializer_context(), + ) + serializer.is_valid(raise_exception=True) + serializer.save() + read_serializer = LighthouseProviderConfigSerializer( + instance, context=self.get_serializer_context() + ) + return Response(data=read_serializer.data, status=status.HTTP_200_OK) + + @extend_schema( + tags=["Lighthouse AI"], + summary="Check LLM provider connection", + description="Validate provider credentials asynchronously and toggle is_active.", + request=None, + responses={202: OpenApiResponse(response=TaskSerializer)}, + ) + @action(detail=True, methods=["post"], url_name="connection") + def connection(self, request, pk=None): + instance = self.get_object() + if ( + instance.provider_type + != LighthouseProviderConfiguration.LLMProviderChoices.OPENAI + ): + return Response( + data={ + "errors": [{"detail": "Only 'openai' provider supported in MVP"}] + }, + status=status.HTTP_400_BAD_REQUEST, + ) + + with transaction.atomic(): + task = check_lighthouse_provider_connection_task.delay( + provider_config_id=str(instance.id), tenant_id=self.request.tenant_id + ) + + prowler_task = Task.objects.get(id=task.id) + serializer = TaskSerializer(prowler_task) + return Response( + data=serializer.data, + status=status.HTTP_202_ACCEPTED, + headers={ + "Content-Location": reverse( + "task-detail", kwargs={"pk": prowler_task.id} + ) + }, + ) + + @extend_schema( + tags=["Lighthouse AI"], + summary="Refresh LLM models catalog", + description="Fetch available models for this provider configuration and upsert into catalog.", + request=None, + responses={202: OpenApiResponse(response=TaskSerializer)}, + ) + @action( + detail=True, + methods=["post"], + url_path="refresh-models", + url_name="refresh-models", + ) + def refresh_models(self, request, pk=None): + instance = self.get_object() + if ( + instance.provider_type + != LighthouseProviderConfiguration.LLMProviderChoices.OPENAI + ): + return Response( + data={ + "errors": [{"detail": "Only 'openai' provider supported in MVP"}] + }, + status=status.HTTP_400_BAD_REQUEST, + ) + + with transaction.atomic(): + task = refresh_lighthouse_provider_models_task.delay( + provider_config_id=str(instance.id), tenant_id=self.request.tenant_id + ) + + prowler_task = Task.objects.get(id=task.id) + serializer = TaskSerializer(prowler_task) + return Response( + data=serializer.data, + status=status.HTTP_202_ACCEPTED, + headers={ + "Content-Location": reverse( + "task-detail", kwargs={"pk": prowler_task.id} + ) + }, + ) + + +@extend_schema_view( + list=extend_schema( + tags=["Lighthouse AI"], + summary="Get Lighthouse AI Tenant config", + description="Retrieve current tenant-level Lighthouse AI settings. Returns a single configuration object.", + ), + partial_update=extend_schema( + tags=["Lighthouse AI"], + summary="Update Lighthouse AI Tenant config", + description="Update tenant-level settings. Validates that the default provider is configured and active and that default model IDs exist for the chosen providers. Auto-creates configuration if it doesn't exist.", + ), +) +class LighthouseTenantConfigViewSet(BaseRLSViewSet): + """ + Singleton endpoint for tenant-level Lighthouse AI configuration. + + This viewset implements a true singleton pattern: + - GET returns the single configuration object (or 404 if not found) + - PATCH updates/creates the configuration (upsert semantics) + - No ID is required in the URL + """ + + queryset = LighthouseTenantConfiguration.objects.all() + serializer_class = LighthouseTenantConfigSerializer + http_method_names = ["get", "patch"] + + def get_queryset(self): + if getattr(self, "swagger_fake_view", False): + return LighthouseTenantConfiguration.objects.none() + return LighthouseTenantConfiguration.objects.filter( + tenant_id=self.request.tenant_id + ) + + def get_serializer_class(self): + if self.action == "partial_update": + return LighthouseTenantConfigUpdateSerializer + return super().get_serializer_class() + + def get_object(self): + """Retrieve the singleton instance for the current tenant.""" + obj = LighthouseTenantConfiguration.objects.filter( + tenant_id=self.request.tenant_id + ).first() + if obj is None: + raise NotFound("Tenant Lighthouse configuration not found") + self.check_object_permissions(self.request, obj) + return obj + + def list(self, request, *args, **kwargs): + """GET endpoint for singleton - returns single object, not an array.""" + instance = self.get_object() + serializer = self.get_serializer(instance) + return Response(serializer.data) + + def partial_update(self, request, *args, **kwargs): + """PATCH endpoint for singleton - no pk required. Auto-creates if not exists.""" + # Auto-create tenant config if it doesn't exist (upsert semantics) + instance, created = LighthouseTenantConfiguration.objects.get_or_create( + tenant_id=self.request.tenant_id, + defaults={}, + ) + + # Extract attributes from JSON:API payload + try: + payload = json.loads(request.body) + attributes = payload.get("data", {}).get("attributes", {}) + except (json.JSONDecodeError, AttributeError): + raise ValidationError("Invalid JSON:API payload") + + serializer = self.get_serializer(instance, data=attributes, partial=True) + serializer.is_valid(raise_exception=True) + serializer.save() + read_serializer = LighthouseTenantConfigSerializer( + instance, context=self.get_serializer_context() + ) + return Response(read_serializer.data, status=status.HTTP_200_OK) + + +@extend_schema_view( + list=extend_schema( + tags=["Lighthouse AI"], + summary="List all LLM models", + description="List available LLM models per configured provider for the current tenant.", + ), + retrieve=extend_schema( + tags=["Lighthouse AI"], + summary="Retrieve LLM model details", + description="Get details for a specific LLM model.", + ), +) +class LighthouseProviderModelsViewSet(BaseRLSViewSet): + queryset = LighthouseProviderModels.objects.all() + serializer_class = LighthouseProviderModelsSerializer + filterset_class = LighthouseProviderModelsFilter + # Expose as read-only catalog collection + http_method_names = ["get"] + + def get_queryset(self): + if getattr(self, "swagger_fake_view", False): + return LighthouseProviderModels.objects.none() + return LighthouseProviderModels.objects.filter(tenant_id=self.request.tenant_id) + + def get_serializer_class(self): + return super().get_serializer_class() + + @extend_schema_view( list=extend_schema( tags=["Processor"], diff --git a/api/src/backend/tasks/assets/fonts/FiraCode-Regular.ttf b/api/src/backend/tasks/assets/fonts/FiraCode-Regular.ttf new file mode 100644 index 0000000000..3a57209a97 Binary files /dev/null and b/api/src/backend/tasks/assets/fonts/FiraCode-Regular.ttf differ diff --git a/api/src/backend/tasks/assets/fonts/PlusJakartaSans-Regular.ttf b/api/src/backend/tasks/assets/fonts/PlusJakartaSans-Regular.ttf new file mode 100644 index 0000000000..f43b5f4356 Binary files /dev/null and b/api/src/backend/tasks/assets/fonts/PlusJakartaSans-Regular.ttf differ diff --git a/api/src/backend/tasks/assets/img/prowler_logo.png b/api/src/backend/tasks/assets/img/prowler_logo.png new file mode 100644 index 0000000000..b9bdc4c088 Binary files /dev/null and b/api/src/backend/tasks/assets/img/prowler_logo.png differ diff --git a/api/src/backend/tasks/jobs/export.py b/api/src/backend/tasks/jobs/export.py index 782e06e2b9..2b45c75094 100644 --- a/api/src/backend/tasks/jobs/export.py +++ b/api/src/backend/tasks/jobs/export.py @@ -20,10 +20,10 @@ from prowler.lib.outputs.asff.asff import ASFF from prowler.lib.outputs.compliance.aws_well_architected.aws_well_architected import ( AWSWellArchitected, ) +from prowler.lib.outputs.compliance.c5.c5_aws import AWSC5 from prowler.lib.outputs.compliance.ccc.ccc_aws import CCC_AWS from prowler.lib.outputs.compliance.ccc.ccc_azure import CCC_Azure from prowler.lib.outputs.compliance.ccc.ccc_gcp import CCC_GCP -from prowler.lib.outputs.compliance.c5.c5_aws import AWSC5 from prowler.lib.outputs.compliance.cis.cis_aws import AWSCIS from prowler.lib.outputs.compliance.cis.cis_azure import AzureCIS from prowler.lib.outputs.compliance.cis.cis_gcp import GCPCIS @@ -183,18 +183,21 @@ def get_s3_client(): return s3_client -def _upload_to_s3(tenant_id: str, zip_path: str, scan_id: str) -> str | None: +def _upload_to_s3( + tenant_id: str, scan_id: str, local_path: str, relative_key: str +) -> str | None: """ - Upload the specified ZIP file to an S3 bucket. - If the S3 bucket environment variables are not configured, - the function returns None without performing an upload. + Upload a local artifact to an S3 bucket under the tenant/scan prefix. + Args: - tenant_id (str): The tenant identifier, used as part of the S3 key prefix. - zip_path (str): The local file system path to the ZIP file to be uploaded. - scan_id (str): The scan identifier, used as part of the S3 key prefix. + tenant_id (str): The tenant identifier used as the first segment of the S3 key. + scan_id (str): The scan identifier used as the second segment of the S3 key. + local_path (str): Filesystem path to the artifact to upload. + relative_key (str): Object key relative to `//`. + Returns: - str: The S3 URI of the uploaded file (e.g., "s3:///") if successful. - None: If the required environment variables for the S3 bucket are not set. + str | None: S3 URI of the uploaded artifact, or None if the upload is skipped. + Raises: botocore.exceptions.ClientError: If the upload attempt to S3 fails for any reason. """ @@ -202,34 +205,26 @@ def _upload_to_s3(tenant_id: str, zip_path: str, scan_id: str) -> str | None: if not bucket: return + if not relative_key: + return + + if not os.path.isfile(local_path): + return + try: s3 = get_s3_client() - # Upload the ZIP file (outputs) to the S3 bucket - zip_key = f"{tenant_id}/{scan_id}/{os.path.basename(zip_path)}" - s3.upload_file( - Filename=zip_path, - Bucket=bucket, - Key=zip_key, - ) + s3_key = f"{tenant_id}/{scan_id}/{relative_key}" + s3.upload_file(Filename=local_path, Bucket=bucket, Key=s3_key) - # Upload the compliance directory to the S3 bucket - compliance_dir = os.path.join(os.path.dirname(zip_path), "compliance") - for filename in os.listdir(compliance_dir): - local_path = os.path.join(compliance_dir, filename) - if not os.path.isfile(local_path): - continue - file_key = f"{tenant_id}/{scan_id}/compliance/{filename}" - s3.upload_file(Filename=local_path, Bucket=bucket, Key=file_key) - - return f"s3://{base.DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET}/{zip_key}" + return f"s3://{base.DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET}/{s3_key}" except (ClientError, NoCredentialsError, ParamValidationError, ValueError) as e: logger.error(f"S3 upload failed: {str(e)}") def _generate_output_directory( output_directory, prowler_provider: object, tenant_id: str, scan_id: str -) -> tuple[str, str]: +) -> tuple[str, str, str]: """ Generate a file system path for the output directory of a prowler scan. @@ -256,6 +251,7 @@ def _generate_output_directory( >>> _generate_output_directory("/tmp", "aws", "tenant-1234", "scan-5678") '/tmp/tenant-1234/aws/scan-5678/prowler-output-2023-02-15T12:34:56', '/tmp/tenant-1234/aws/scan-5678/compliance/prowler-output-2023-02-15T12:34:56' + '/tmp/tenant-1234/aws/scan-5678/threatscore/prowler-output-2023-02-15T12:34:56' """ # Sanitize the prowler provider name to ensure it is a valid directory name prowler_provider_sanitized = re.sub(r"[^\w\-]", "-", prowler_provider) @@ -276,4 +272,10 @@ def _generate_output_directory( ) os.makedirs("/".join(compliance_path.split("/")[:-1]), exist_ok=True) - return path, compliance_path + threatscore_path = ( + f"{output_directory}/{tenant_id}/{scan_id}/threatscore/prowler-output-" + f"{prowler_provider_sanitized}-{timestamp}" + ) + os.makedirs("/".join(threatscore_path.split("/")[:-1]), exist_ok=True) + + return path, compliance_path, threatscore_path diff --git a/api/src/backend/tasks/jobs/lighthouse_providers.py b/api/src/backend/tasks/jobs/lighthouse_providers.py new file mode 100644 index 0000000000..1a68a5c1e2 --- /dev/null +++ b/api/src/backend/tasks/jobs/lighthouse_providers.py @@ -0,0 +1,163 @@ +from typing import Dict, Set + +import openai +from celery.utils.log import get_task_logger + +from api.models import LighthouseProviderConfiguration, LighthouseProviderModels + +logger = get_task_logger(__name__) + + +def _extract_openai_api_key( + provider_cfg: LighthouseProviderConfiguration, +) -> str | None: + """ + Safely extract the OpenAI API key from a provider configuration. + + Args: + provider_cfg (LighthouseProviderConfiguration): The provider configuration instance + containing the credentials. + + Returns: + str | None: The API key string if present and valid, otherwise None. + """ + creds = provider_cfg.credentials_decoded + if not isinstance(creds, dict): + return None + api_key = creds.get("api_key") + if not isinstance(api_key, str) or not api_key: + return None + return api_key + + +def check_lighthouse_provider_connection(provider_config_id: str) -> Dict: + """ + Validate a Lighthouse provider configuration by calling the provider API and + toggle its active state accordingly. + + Currently supports the OpenAI provider by invoking `models.list` to verify that + the provided credentials are valid. + + Args: + provider_config_id (str): The primary key of the `LighthouseProviderConfiguration` + to validate. + + Returns: + dict: A result dictionary with the following keys: + - "connected" (bool): Whether the provider credentials are valid. + - "error" (str | None): The error message when not connected, otherwise None. + + Side Effects: + - Updates and persists `is_active` on the `LighthouseProviderConfiguration`. + + Raises: + LighthouseProviderConfiguration.DoesNotExist: If no configuration exists with the given ID. + """ + provider_cfg = LighthouseProviderConfiguration.objects.get(pk=provider_config_id) + + # TODO: Add support for other providers + if ( + provider_cfg.provider_type + != LighthouseProviderConfiguration.LLMProviderChoices.OPENAI + ): + return {"connected": False, "error": "Unsupported provider type"} + + api_key = _extract_openai_api_key(provider_cfg) + if not api_key: + provider_cfg.is_active = False + provider_cfg.save() + return {"connected": False, "error": "API key is invalid or missing"} + + try: + client = openai.OpenAI(api_key=api_key) + _ = client.models.list() + provider_cfg.is_active = True + provider_cfg.save() + return {"connected": True, "error": None} + except Exception as e: + logger.warning("OpenAI connection check failed: %s", str(e)) + provider_cfg.is_active = False + provider_cfg.save() + return {"connected": False, "error": str(e)} + + +def refresh_lighthouse_provider_models(provider_config_id: str) -> Dict: + """ + Refresh the catalog of models for a Lighthouse provider configuration. + + For the OpenAI provider, this fetches the current list of models, upserts entries + into `LighthouseProviderModels`, and deletes stale entries no longer returned by + the provider. + + Args: + provider_config_id (str): The primary key of the `LighthouseProviderConfiguration` + whose models should be refreshed. + + Returns: + dict: A result dictionary with the following keys on success: + - "created" (int): Number of new model rows created. + - "updated" (int): Number of existing model rows updated. + - "deleted" (int): Number of stale model rows removed. + If an error occurs, the dictionary will contain an "error" (str) field instead. + + Raises: + LighthouseProviderConfiguration.DoesNotExist: If no configuration exists with the given ID. + """ + provider_cfg = LighthouseProviderConfiguration.objects.get(pk=provider_config_id) + + if ( + provider_cfg.provider_type + != LighthouseProviderConfiguration.LLMProviderChoices.OPENAI + ): + return { + "created": 0, + "updated": 0, + "deleted": 0, + "error": "Unsupported provider type", + } + + api_key = _extract_openai_api_key(provider_cfg) + if not api_key: + return { + "created": 0, + "updated": 0, + "deleted": 0, + "error": "API key is invalid or missing", + } + + try: + client = openai.OpenAI(api_key=api_key) + models = client.models.list() + fetched_ids: Set[str] = {m.id for m in getattr(models, "data", [])} + except Exception as e: # noqa: BLE001 + logger.warning("OpenAI models refresh failed: %s", str(e)) + return {"created": 0, "updated": 0, "deleted": 0, "error": str(e)} + + created = 0 + updated = 0 + + for model_id in fetched_ids: + obj, was_created = LighthouseProviderModels.objects.update_or_create( + tenant_id=provider_cfg.tenant_id, + provider_configuration=provider_cfg, + model_id=model_id, + defaults={ + "model_name": model_id, # OpenAI doesn't return a separate display name + "default_parameters": {}, + }, + ) + if was_created: + created += 1 + else: + updated += 1 + + # Delete stale models not present anymore + deleted, _ = ( + LighthouseProviderModels.objects.filter( + tenant_id=provider_cfg.tenant_id, provider_configuration=provider_cfg + ) + .exclude(model_id__in=fetched_ids) + .delete() + ) + + return {"created": created, "updated": updated, "deleted": deleted} diff --git a/api/src/backend/tasks/jobs/report.py b/api/src/backend/tasks/jobs/report.py new file mode 100644 index 0000000000..641fa5757a --- /dev/null +++ b/api/src/backend/tasks/jobs/report.py @@ -0,0 +1,1337 @@ +import io +import os +from collections import defaultdict +from pathlib import Path +from shutil import rmtree + +import matplotlib.pyplot as plt +from celery.utils.log import get_task_logger +from config.django.base import DJANGO_FINDINGS_BATCH_SIZE, DJANGO_TMP_OUTPUT_DIRECTORY +from django.db.models import Count, Q +from reportlab.lib import colors +from reportlab.lib.enums import TA_CENTER +from reportlab.lib.pagesizes import letter +from reportlab.lib.styles import ParagraphStyle, getSampleStyleSheet +from reportlab.lib.units import inch +from reportlab.pdfbase import pdfmetrics +from reportlab.pdfbase.ttfonts import TTFont +from reportlab.pdfgen import canvas +from reportlab.platypus import ( + Image, + PageBreak, + Paragraph, + SimpleDocTemplate, + Spacer, + Table, + TableStyle, +) +from tasks.jobs.export import _generate_output_directory, _upload_to_s3 +from tasks.utils import batched + +from api.db_router import READ_REPLICA_ALIAS +from api.db_utils import rls_transaction +from api.models import Finding, Provider, ScanSummary, StatusChoices +from api.utils import initialize_prowler_provider +from prowler.lib.check.compliance_models import Compliance +from prowler.lib.outputs.finding import Finding as FindingOutput + +pdfmetrics.registerFont( + TTFont( + "PlusJakartaSans", + os.path.join( + os.path.dirname(__file__), "../assets/fonts/PlusJakartaSans-Regular.ttf" + ), + ) +) + +pdfmetrics.registerFont( + TTFont( + "FiraCode", + os.path.join(os.path.dirname(__file__), "../assets/fonts/FiraCode-Regular.ttf"), + ) +) + +logger = get_task_logger(__name__) + + +def _create_pdf_styles() -> dict[str, ParagraphStyle]: + """ + Create and return PDF paragraph styles used throughout the report. + + Returns: + dict[str, ParagraphStyle]: A dictionary containing the following styles: + - 'title': Title style with prowler green color + - 'h1': Heading 1 style with blue color and background + - 'h2': Heading 2 style with light blue color + - 'h3': Heading 3 style for sub-headings + - 'normal': Normal text style with left indent + - 'normal_center': Normal text style without indent + """ + styles = getSampleStyleSheet() + prowler_dark_green = colors.Color(0.1, 0.5, 0.2) + + title_style = ParagraphStyle( + "CustomTitle", + parent=styles["Title"], + fontSize=24, + textColor=prowler_dark_green, + spaceAfter=20, + fontName="PlusJakartaSans", + alignment=TA_CENTER, + ) + + h1 = ParagraphStyle( + "CustomH1", + parent=styles["Heading1"], + fontSize=18, + textColor=colors.Color(0.2, 0.4, 0.6), + spaceBefore=20, + spaceAfter=12, + fontName="PlusJakartaSans", + leftIndent=0, + borderWidth=2, + borderColor=colors.Color(0.2, 0.4, 0.6), + borderPadding=8, + backColor=colors.Color(0.95, 0.97, 1.0), + ) + + h2 = ParagraphStyle( + "CustomH2", + parent=styles["Heading2"], + fontSize=14, + textColor=colors.Color(0.3, 0.5, 0.7), + spaceBefore=15, + spaceAfter=8, + fontName="PlusJakartaSans", + leftIndent=10, + borderWidth=1, + borderColor=colors.Color(0.7, 0.8, 0.9), + borderPadding=5, + backColor=colors.Color(0.98, 0.99, 1.0), + ) + + h3 = ParagraphStyle( + "CustomH3", + parent=styles["Heading3"], + fontSize=12, + textColor=colors.Color(0.4, 0.6, 0.8), + spaceBefore=10, + spaceAfter=6, + fontName="PlusJakartaSans", + leftIndent=20, + ) + + normal = ParagraphStyle( + "CustomNormal", + parent=styles["Normal"], + fontSize=10, + textColor=colors.Color(0.2, 0.2, 0.2), + spaceBefore=4, + spaceAfter=4, + leftIndent=30, + fontName="PlusJakartaSans", + ) + + normal_center = ParagraphStyle( + "CustomNormalCenter", + parent=styles["Normal"], + fontSize=10, + textColor=colors.Color(0.2, 0.2, 0.2), + fontName="PlusJakartaSans", + ) + + return { + "title": title_style, + "h1": h1, + "h2": h2, + "h3": h3, + "normal": normal, + "normal_center": normal_center, + } + + +def _create_risk_component(risk_level: int, weight: int, score: int = 0) -> Table: + """ + Create a visual risk component table for the PDF report. + + Args: + risk_level (int): The risk level (0-5), where higher values indicate higher risk. + weight (int): The weight of the risk component. + score (int): The calculated score. Defaults to 0. + + Returns: + Table: A ReportLab Table object with colored cells representing risk, weight, and score. + """ + if risk_level >= 4: + risk_color = colors.Color(0.8, 0.2, 0.2) + elif risk_level >= 3: + risk_color = colors.Color(0.9, 0.6, 0.2) + elif risk_level >= 2: + risk_color = colors.Color(0.9, 0.9, 0.2) + else: + risk_color = colors.Color(0.2, 0.8, 0.2) + + if weight <= 50: + weight_color = colors.Color(0.2, 0.8, 0.2) + elif weight <= 100: + weight_color = colors.Color(0.9, 0.9, 0.2) + else: + weight_color = colors.Color(0.8, 0.2, 0.2) + + score_color = colors.Color(0.4, 0.4, 0.4) + + data = [ + [ + "Risk Level:", + str(risk_level), + "Weight:", + str(weight), + "Score:", + str(score), + ] + ] + + table = Table( + data, + colWidths=[ + 0.8 * inch, + 0.4 * inch, + 0.6 * inch, + 0.4 * inch, + 0.5 * inch, + 0.4 * inch, + ], + ) + + table.setStyle( + TableStyle( + [ + ("BACKGROUND", (0, 0), (0, 0), colors.Color(0.9, 0.9, 0.9)), + ("BACKGROUND", (1, 0), (1, 0), risk_color), + ("TEXTCOLOR", (1, 0), (1, 0), colors.white), + ("FONTNAME", (1, 0), (1, 0), "FiraCode"), + ("BACKGROUND", (2, 0), (2, 0), colors.Color(0.9, 0.9, 0.9)), + ("BACKGROUND", (3, 0), (3, 0), weight_color), + ("TEXTCOLOR", (3, 0), (3, 0), colors.white), + ("FONTNAME", (3, 0), (3, 0), "FiraCode"), + ("BACKGROUND", (4, 0), (4, 0), colors.Color(0.9, 0.9, 0.9)), + ("BACKGROUND", (5, 0), (5, 0), score_color), + ("TEXTCOLOR", (5, 0), (5, 0), colors.white), + ("FONTNAME", (5, 0), (5, 0), "FiraCode"), + ("ALIGN", (0, 0), (-1, -1), "CENTER"), + ("VALIGN", (0, 0), (-1, -1), "MIDDLE"), + ("FONTSIZE", (0, 0), (-1, -1), 10), + ("GRID", (0, 0), (-1, -1), 0.5, colors.black), + ("LEFTPADDING", (0, 0), (-1, -1), 6), + ("RIGHTPADDING", (0, 0), (-1, -1), 6), + ("TOPPADDING", (0, 0), (-1, -1), 8), + ("BOTTOMPADDING", (0, 0), (-1, -1), 8), + ] + ) + ) + + return table + + +def _create_status_component(status: str) -> Table: + """ + Create a visual status component with colored background. + + Args: + status (str): The status value (e.g., "PASS", "FAIL", "MANUAL"). + + Returns: + Table: A ReportLab Table object displaying the status with appropriate color coding. + """ + if status.upper() == "PASS": + status_color = colors.Color(0.2, 0.8, 0.2) + elif status.upper() == "FAIL": + status_color = colors.Color(0.8, 0.2, 0.2) + else: + status_color = colors.Color(0.4, 0.4, 0.4) + + data = [["State:", status.upper()]] + + table = Table(data, colWidths=[0.6 * inch, 0.8 * inch]) + + table.setStyle( + TableStyle( + [ + ("BACKGROUND", (0, 0), (0, 0), colors.Color(0.9, 0.9, 0.9)), + ("FONTNAME", (0, 0), (0, 0), "PlusJakartaSans"), + ("BACKGROUND", (1, 0), (1, 0), status_color), + ("TEXTCOLOR", (1, 0), (1, 0), colors.white), + ("FONTNAME", (1, 0), (1, 0), "FiraCode"), + ("ALIGN", (0, 0), (-1, -1), "CENTER"), + ("VALIGN", (0, 0), (-1, -1), "MIDDLE"), + ("FONTSIZE", (0, 0), (-1, -1), 12), + ("GRID", (0, 0), (-1, -1), 0.5, colors.black), + ("LEFTPADDING", (0, 0), (-1, -1), 8), + ("RIGHTPADDING", (0, 0), (-1, -1), 8), + ("TOPPADDING", (0, 0), (-1, -1), 10), + ("BOTTOMPADDING", (0, 0), (-1, -1), 10), + ] + ) + ) + + return table + + +def _create_section_score_chart( + requirements_list: list[dict], attributes_by_requirement_id: dict +) -> io.BytesIO: + """ + Create a bar chart showing compliance score by section using ThreatScore formula. + + Args: + requirements_list (list[dict]): List of requirement dictionaries with status and findings data. + attributes_by_requirement_id (dict): Mapping of requirement IDs to their attributes including risk level and weight. + + Returns: + io.BytesIO: A BytesIO buffer containing the chart image in PNG format. + """ + # Define expected sections + expected_sections = [ + "1. IAM", + "2. Attack Surface", + "3. Logging and Monitoring", + "4. Encryption", + ] + + # Initialize all expected sections with default values + sections_data = { + section: { + "numerator": 0, + "denominator": 0, + "has_findings": False, + } + for section in expected_sections + } + + # Collect data from requirements + for requirement in requirements_list: + requirement_id = requirement["id"] + requirement_attributes = attributes_by_requirement_id.get(requirement_id, {}) + + metadata = requirement_attributes.get("attributes", {}).get( + "req_attributes", [] + ) + if metadata: + m = metadata[0] + section = getattr(m, "Section", "Unknown") + + # Add section if not in expected list (for flexibility) + if section not in sections_data: + sections_data[section] = { + "numerator": 0, + "denominator": 0, + "has_findings": False, + } + + # Get findings data + passed_findings = requirement["attributes"].get("passed_findings", 0) + total_findings = requirement["attributes"].get("total_findings", 0) + + if total_findings > 0: + sections_data[section]["has_findings"] = True + risk_level = getattr(m, "LevelOfRisk", 0) + weight = getattr(m, "Weight", 0) + + # Calculate using ThreatScore formula from UI + rate_i = passed_findings / total_findings + rfac_i = 1 + 0.25 * risk_level + + sections_data[section]["numerator"] += ( + rate_i * total_findings * weight * rfac_i + ) + sections_data[section]["denominator"] += ( + total_findings * weight * rfac_i + ) + + section_names = [] + compliance_percentages = [] + + for section, data in sections_data.items(): + if data["has_findings"] and data["denominator"] > 0: + compliance_percentage = (data["numerator"] / data["denominator"]) * 100 + else: + compliance_percentage = 100 # No findings = 100% (PASS) + + section_names.append(section) + compliance_percentages.append(compliance_percentage) + + # Sort alphabetically by section name + sorted_data = sorted( + zip(section_names, compliance_percentages), + key=lambda x: x[0], + ) + section_names, compliance_percentages = ( + zip(*sorted_data) if sorted_data else ([], []) + ) + + fig, ax = plt.subplots(figsize=(12, 8)) + + colors_list = [] + for percentage in compliance_percentages: + if percentage >= 80: + color = "#4CAF50" + elif percentage >= 60: + color = "#8BC34A" + elif percentage >= 40: + color = "#FFEB3B" + elif percentage >= 20: + color = "#FF9800" + else: + color = "#F44336" + colors_list.append(color) + + bars = ax.bar(section_names, compliance_percentages, color=colors_list) + + ax.set_ylabel("Compliance Score (%)", fontsize=12) + ax.set_xlabel("Section", fontsize=12) + ax.set_ylim(0, 100) + + for bar, percentage in zip(bars, compliance_percentages): + height = bar.get_height() + ax.text( + bar.get_x() + bar.get_width() / 2.0, + height + 1, + f"{percentage:.1f}%", + ha="center", + va="bottom", + fontweight="bold", + ) + + plt.xticks(rotation=45, ha="right") + + ax.grid(True, alpha=0.3, axis="y") + + plt.tight_layout() + + buffer = io.BytesIO() + plt.savefig(buffer, format="png", dpi=300, bbox_inches="tight") + buffer.seek(0) + plt.close() + + return buffer + + +def _add_pdf_footer(canvas_obj: canvas.Canvas, doc: SimpleDocTemplate) -> None: + """ + Add footer with page number and branding to each page of the PDF. + + Args: + canvas_obj (canvas.Canvas): The ReportLab canvas object for drawing. + doc (SimpleDocTemplate): The document template containing page information. + """ + width, height = doc.pagesize + page_num_text = f"Page {doc.page}" + canvas_obj.setFont("PlusJakartaSans", 9) + canvas_obj.setFillColorRGB(0.4, 0.4, 0.4) + canvas_obj.drawString(30, 20, page_num_text) + powered_text = "Powered by Prowler" + text_width = canvas_obj.stringWidth(powered_text, "PlusJakartaSans", 9) + canvas_obj.drawString(width - text_width - 30, 20, powered_text) + + +def _aggregate_requirement_statistics_from_database( + tenant_id: str, scan_id: str +) -> dict[str, dict[str, int]]: + """ + Aggregate finding statistics by check_id using database aggregation. + + This function uses Django ORM aggregation to calculate pass/fail statistics + entirely in the database, avoiding the need to load findings into memory. + + Args: + tenant_id (str): The tenant ID for Row-Level Security context. + scan_id (str): The ID of the scan to retrieve findings for. + + Returns: + dict[str, dict[str, int]]: Dictionary mapping check_id to statistics: + - 'passed' (int): Number of passed findings for this check + - 'total' (int): Total number of findings for this check + + Example: + { + 'aws_iam_user_mfa_enabled': {'passed': 10, 'total': 15}, + 'aws_s3_bucket_public_access': {'passed': 0, 'total': 5} + } + """ + requirement_statistics_by_check_id = {} + + with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS): + # Use database aggregation to calculate stats without loading findings into memory + aggregated_statistics_queryset = ( + Finding.all_objects.filter(tenant_id=tenant_id, scan_id=scan_id) + .values("check_id") + .annotate( + total_findings=Count("id"), + passed_findings=Count("id", filter=Q(status=StatusChoices.PASS)), + ) + ) + + for aggregated_stat in aggregated_statistics_queryset: + check_id = aggregated_stat["check_id"] + requirement_statistics_by_check_id[check_id] = { + "passed": aggregated_stat["passed_findings"], + "total": aggregated_stat["total_findings"], + } + + logger.info( + f"Aggregated statistics for {len(requirement_statistics_by_check_id)} unique checks" + ) + return requirement_statistics_by_check_id + + +def _load_findings_for_requirement_checks( + tenant_id: str, scan_id: str, check_ids: list[str], prowler_provider +) -> dict[str, list[FindingOutput]]: + """ + Load findings for specific check IDs on-demand. + + This function loads only the findings needed for a specific set of checks, + minimizing memory usage by avoiding loading all findings at once. This is used + when generating detailed findings tables for specific requirements in the PDF. + + Args: + tenant_id (str): The tenant ID for Row-Level Security context. + scan_id (str): The ID of the scan to retrieve findings for. + check_ids (list[str]): List of check IDs to load findings for. + prowler_provider: The initialized Prowler provider instance. + + Returns: + dict[str, list[FindingOutput]]: Dictionary mapping check_id to list of FindingOutput objects. + + Example: + { + 'aws_iam_user_mfa_enabled': [FindingOutput(...), FindingOutput(...)], + 'aws_s3_bucket_public_access': [FindingOutput(...)] + } + """ + findings_by_check_id = defaultdict(list) + + if not check_ids: + return dict(findings_by_check_id) + + logger.info(f"Loading findings for {len(check_ids)} checks on-demand") + + findings_queryset = ( + Finding.all_objects.filter( + tenant_id=tenant_id, scan_id=scan_id, check_id__in=check_ids + ) + .order_by("uid") + .iterator() + ) + + with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS): + for batch, is_last_batch in batched( + findings_queryset, DJANGO_FINDINGS_BATCH_SIZE + ): + for finding_model in batch: + finding_output = FindingOutput.transform_api_finding( + finding_model, prowler_provider + ) + findings_by_check_id[finding_output.check_id].append(finding_output) + + total_findings_loaded = sum( + len(findings) for findings in findings_by_check_id.values() + ) + logger.info( + f"Loaded {total_findings_loaded} findings for {len(findings_by_check_id)} checks" + ) + + return dict(findings_by_check_id) + + +def _calculate_requirements_data_from_statistics( + compliance_obj, requirement_statistics_by_check_id: dict[str, dict[str, int]] +) -> tuple[dict[str, dict], list[dict]]: + """ + Calculate requirement status and statistics using pre-aggregated database statistics. + + This function uses O(n) lookups with pre-aggregated statistics from the database, + avoiding the need to iterate over all findings for each requirement. + + Args: + compliance_obj: The compliance framework object containing requirements. + requirement_statistics_by_check_id (dict[str, dict[str, int]]): Pre-aggregated statistics + mapping check_id to {'passed': int, 'total': int} counts. + + Returns: + tuple[dict[str, dict], list[dict]]: A tuple containing: + - attributes_by_requirement_id: Dictionary mapping requirement IDs to their attributes. + - requirements_list: List of requirement dictionaries with status and statistics. + """ + attributes_by_requirement_id = {} + requirements_list = [] + + compliance_framework = getattr(compliance_obj, "Framework", "N/A") + compliance_version = getattr(compliance_obj, "Version", "N/A") + + for requirement in compliance_obj.Requirements: + requirement_id = requirement.Id + requirement_description = getattr(requirement, "Description", "") + requirement_checks = getattr(requirement, "Checks", []) + requirement_attributes = getattr(requirement, "Attributes", []) + + # Store requirement metadata for later use + attributes_by_requirement_id[requirement_id] = { + "attributes": { + "req_attributes": requirement_attributes, + "checks": requirement_checks, + }, + "description": requirement_description, + } + + # Calculate aggregated passed and total findings for this requirement + total_passed_findings = 0 + total_findings_count = 0 + + for check_id in requirement_checks: + if check_id in requirement_statistics_by_check_id: + check_statistics = requirement_statistics_by_check_id[check_id] + total_findings_count += check_statistics["total"] + total_passed_findings += check_statistics["passed"] + + # Determine overall requirement status based on findings + if total_findings_count > 0: + if total_passed_findings == total_findings_count: + requirement_status = StatusChoices.PASS + else: + # Partial pass or complete fail both count as FAIL + requirement_status = StatusChoices.FAIL + else: + # No findings means manual review required + requirement_status = StatusChoices.MANUAL + + requirements_list.append( + { + "id": requirement_id, + "attributes": { + "framework": compliance_framework, + "version": compliance_version, + "status": requirement_status, + "description": requirement_description, + "passed_findings": total_passed_findings, + "total_findings": total_findings_count, + }, + } + ) + + return attributes_by_requirement_id, requirements_list + + +def generate_threatscore_report( + tenant_id: str, + scan_id: str, + compliance_id: str, + output_path: str, + provider_id: str, + only_failed: bool = True, + min_risk_level: int = 4, +) -> None: + """ + Generate a PDF compliance report based on Prowler ThreatScore framework. + + This function creates a comprehensive PDF report containing: + - Compliance overview and metadata + - Section-by-section compliance scores with charts + - Overall ThreatScore calculation + - Critical failed requirements + - Detailed findings for each requirement + + Args: + tenant_id (str): The tenant ID for Row-Level Security context. + scan_id (str): ID of the scan executed by Prowler. + compliance_id (str): ID of the compliance framework (e.g., "prowler_threatscore_aws"). + output_path (str): Output PDF file path (e.g., "/tmp/threatscore_report.pdf"). + provider_id (str): Provider ID for the scan. + only_failed (bool): If True, only requirements with status "FAIL" will be included + in the detailed requirements section. Defaults to True. + min_risk_level (int): Minimum risk level for critical failed requirements. Defaults to 4. + + Raises: + Exception: If any error occurs during PDF generation, it will be logged and re-raised. + """ + logger.info( + f"Generating the report for the scan {scan_id} with provider {provider_id}" + ) + try: + # Get PDF styles + pdf_styles = _create_pdf_styles() + title_style = pdf_styles["title"] + h1 = pdf_styles["h1"] + h2 = pdf_styles["h2"] + h3 = pdf_styles["h3"] + normal = pdf_styles["normal"] + normal_center = pdf_styles["normal_center"] + + # Get compliance and provider information + with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS): + provider_obj = Provider.objects.get(id=provider_id) + prowler_provider = initialize_prowler_provider(provider_obj) + provider_type = provider_obj.provider + + frameworks_bulk = Compliance.get_bulk(provider_type) + compliance_obj = frameworks_bulk[compliance_id] + compliance_framework = getattr(compliance_obj, "Framework", "N/A") + compliance_version = getattr(compliance_obj, "Version", "N/A") + compliance_name = getattr(compliance_obj, "Name", "N/A") + compliance_description = getattr(compliance_obj, "Description", "") + + # Aggregate requirement statistics from database (memory-efficient) + logger.info(f"Aggregating requirement statistics for scan {scan_id}") + requirement_statistics_by_check_id = ( + _aggregate_requirement_statistics_from_database(tenant_id, scan_id) + ) + + # Calculate requirements data using aggregated statistics + attributes_by_requirement_id, requirements_list = ( + _calculate_requirements_data_from_statistics( + compliance_obj, requirement_statistics_by_check_id + ) + ) + + # Initialize PDF document + doc = SimpleDocTemplate( + output_path, + pagesize=letter, + title=f"Prowler ThreatScore Report - {compliance_framework}", + author="Prowler", + subject=f"Compliance Report for {compliance_framework}", + creator="Prowler Engineering Team", + keywords=f"compliance,{compliance_framework},security,framework,prowler", + ) + + elements = [] + + # Add logo + img_path = os.path.join( + os.path.dirname(__file__), "../assets/img/prowler_logo.png" + ) + logo = Image( + img_path, + width=5 * inch, + height=1 * inch, + ) + elements.append(logo) + + elements.append(Spacer(1, 0.5 * inch)) + elements.append(Paragraph("Prowler ThreatScore Report", title_style)) + elements.append(Spacer(1, 0.5 * inch)) + + # Add compliance information table + info_data = [ + ["Framework:", compliance_framework], + ["ID:", compliance_id], + ["Name:", Paragraph(compliance_name, normal_center)], + ["Version:", compliance_version], + ["Scan ID:", scan_id], + ["Description:", Paragraph(compliance_description, normal_center)], + ] + info_table = Table(info_data, colWidths=[2 * inch, 4 * inch]) + info_table.setStyle( + TableStyle( + [ + ("BACKGROUND", (0, 0), (0, 5), colors.Color(0.2, 0.4, 0.6)), + ("TEXTCOLOR", (0, 0), (0, 5), colors.white), + ("FONTNAME", (0, 0), (0, 5), "FiraCode"), + ("BACKGROUND", (1, 0), (1, 5), colors.Color(0.95, 0.97, 1.0)), + ("TEXTCOLOR", (1, 0), (1, 5), colors.Color(0.2, 0.2, 0.2)), + ("FONTNAME", (1, 0), (1, 5), "PlusJakartaSans"), + ("ALIGN", (0, 0), (-1, -1), "LEFT"), + ("VALIGN", (0, 0), (-1, -1), "TOP"), + ("FONTSIZE", (0, 0), (-1, -1), 11), + ("GRID", (0, 0), (-1, -1), 1, colors.Color(0.7, 0.8, 0.9)), + ("LEFTPADDING", (0, 0), (-1, -1), 10), + ("RIGHTPADDING", (0, 0), (-1, -1), 10), + ("TOPPADDING", (0, 0), (-1, -1), 8), + ("BOTTOMPADDING", (0, 0), (-1, -1), 8), + ] + ) + ) + + elements.append(info_table) + elements.append(PageBreak()) + + # Add compliance score chart + elements.append(Paragraph("Compliance Score by Sections", h1)) + elements.append(Spacer(1, 0.2 * inch)) + + chart_buffer = _create_section_score_chart( + requirements_list, attributes_by_requirement_id + ) + chart_image = Image(chart_buffer, width=7 * inch, height=5.5 * inch) + elements.append(chart_image) + + # Calculate overall ThreatScore using the same formula as the UI + numerator = 0 + denominator = 0 + has_findings = False + + for requirement in requirements_list: + requirement_id = requirement["id"] + requirement_attributes = attributes_by_requirement_id.get( + requirement_id, {} + ) + + # Get findings data + passed_findings = requirement["attributes"].get("passed_findings", 0) + total_findings = requirement["attributes"].get("total_findings", 0) + + # Skip if no findings (avoid division by zero) + if total_findings == 0: + continue + + has_findings = True + metadata = requirement_attributes.get("attributes", {}).get( + "req_attributes", [] + ) + if metadata and len(metadata) > 0: + m = metadata[0] + risk_level = getattr(m, "LevelOfRisk", 0) + weight = getattr(m, "Weight", 0) + + # Calculate using ThreatScore formula from UI + rate_i = passed_findings / total_findings + rfac_i = 1 + 0.25 * risk_level + + numerator += rate_i * total_findings * weight * rfac_i + denominator += total_findings * weight * rfac_i + + # Calculate ThreatScore (percentualScore) + # If no findings exist, consider it 100% (PASS) + if not has_findings: + overall_compliance = 100 + elif denominator > 0: + overall_compliance = (numerator / denominator) * 100 + else: + overall_compliance = 0 + + elements.append(Spacer(1, 0.3 * inch)) + + summary_data = [ + ["ThreatScore:", f"{overall_compliance:.2f}%"], + ] + + if overall_compliance >= 80: + compliance_color = colors.Color(0.2, 0.8, 0.2) + elif overall_compliance >= 60: + compliance_color = colors.Color(0.8, 0.8, 0.2) + else: + compliance_color = colors.Color(0.8, 0.2, 0.2) + + summary_table = Table(summary_data, colWidths=[2.5 * inch, 2 * inch]) + summary_table.setStyle( + TableStyle( + [ + ("BACKGROUND", (0, 0), (0, 0), colors.Color(0.1, 0.3, 0.5)), + ("TEXTCOLOR", (0, 0), (0, 0), colors.white), + ("FONTNAME", (0, 0), (0, 0), "FiraCode"), + ("FONTSIZE", (0, 0), (0, 0), 12), + ("BACKGROUND", (1, 0), (1, 0), compliance_color), + ("TEXTCOLOR", (1, 0), (1, 0), colors.white), + ("FONTNAME", (1, 0), (1, 0), "FiraCode"), + ("FONTSIZE", (1, 0), (1, 0), 16), + ("ALIGN", (0, 0), (-1, -1), "CENTER"), + ("VALIGN", (0, 0), (-1, -1), "MIDDLE"), + ("GRID", (0, 0), (-1, -1), 1.5, colors.Color(0.5, 0.6, 0.7)), + ("LEFTPADDING", (0, 0), (-1, -1), 12), + ("RIGHTPADDING", (0, 0), (-1, -1), 12), + ("TOPPADDING", (0, 0), (-1, -1), 10), + ("BOTTOMPADDING", (0, 0), (-1, -1), 10), + ] + ) + ) + + elements.append(summary_table) + elements.append(PageBreak()) + + # Add requirements index + elements.append(Paragraph("Requirements Index", h1)) + + sections = {} + for ( + requirement_id, + requirement_attributes, + ) in attributes_by_requirement_id.items(): + meta = requirement_attributes["attributes"]["req_attributes"][0] + section = getattr(meta, "Section", "N/A") + subsection = getattr(meta, "SubSection", "N/A") + title = getattr(meta, "Title", "N/A") + + if section not in sections: + sections[section] = {} + if subsection not in sections[section]: + sections[section][subsection] = [] + + sections[section][subsection].append({"id": requirement_id, "title": title}) + + section_num = 1 + for section_name, subsections in sections.items(): + elements.append(Paragraph(f"{section_num}. {section_name}", h2)) + + subsection_num = 1 + for subsection_name, requirements in subsections.items(): + elements.append(Paragraph(f"{subsection_name}", h3)) + + req_num = 1 + for req in requirements: + elements.append(Paragraph(f"{req['id']} - {req['title']}", normal)) + req_num += 1 + + subsection_num += 1 + + section_num += 1 + elements.append(Spacer(1, 0.1 * inch)) + + elements.append(PageBreak()) + + # Add critical failed requirements section + elements.append(Paragraph("Top Requirements by Level of Risk", h1)) + elements.append(Spacer(1, 0.1 * inch)) + elements.append( + Paragraph( + f"Critical Failed Requirements (Risk Level â‰Ĩ {min_risk_level})", h2 + ) + ) + elements.append(Spacer(1, 0.2 * inch)) + + critical_failed_requirements = [] + for requirement in requirements_list: + requirement_status = requirement["attributes"]["status"] + if requirement_status == StatusChoices.FAIL: + requirement_id = requirement["id"] + metadata = ( + attributes_by_requirement_id.get(requirement_id, {}) + .get("attributes", {}) + .get("req_attributes", [{}])[0] + ) + if metadata: + risk_level = getattr(metadata, "LevelOfRisk", 0) + weight = getattr(metadata, "Weight", 0) + + if risk_level >= min_risk_level: + critical_failed_requirements.append( + { + "requirement": requirement, + "attributes": attributes_by_requirement_id[ + requirement_id + ], + "risk_level": risk_level, + "weight": weight, + "metadata": metadata, + } + ) + + critical_failed_requirements.sort( + key=lambda x: (x["risk_level"], x["weight"]), reverse=True + ) + + if not critical_failed_requirements: + elements.append( + Paragraph( + "✅ No critical failed requirements found. Great job!", normal + ) + ) + else: + elements.append( + Paragraph( + f"Found {len(critical_failed_requirements)} critical failed requirements that require immediate attention:", + normal, + ) + ) + elements.append(Spacer(1, 0.5 * inch)) + + table_data = [["Risk", "Weight", "Requirement ID", "Title", "Section"]] + + for idx, critical_failed_requirement in enumerate( + critical_failed_requirements + ): + requirement_id = critical_failed_requirement["requirement"]["id"] + risk_level = critical_failed_requirement["risk_level"] + weight = critical_failed_requirement["weight"] + title = getattr(critical_failed_requirement["metadata"], "Title", "N/A") + section = getattr( + critical_failed_requirement["metadata"], "Section", "N/A" + ) + + if len(title) > 50: + title = title[:47] + "..." + + table_data.append( + [str(risk_level), str(weight), requirement_id, title, section] + ) + + critical_table = Table( + table_data, + colWidths=[0.7 * inch, 0.9 * inch, 1.3 * inch, 3.1 * inch, 1.5 * inch], + ) + + critical_table.setStyle( + TableStyle( + [ + ("BACKGROUND", (0, 0), (-1, 0), colors.Color(0.8, 0.2, 0.2)), + ("TEXTCOLOR", (0, 0), (-1, 0), colors.white), + ("FONTNAME", (0, 0), (-1, 0), "FiraCode"), + ("FONTSIZE", (0, 0), (-1, 0), 10), + ("BACKGROUND", (0, 1), (0, -1), colors.Color(0.8, 0.2, 0.2)), + ("TEXTCOLOR", (0, 1), (0, -1), colors.white), + ("FONTNAME", (0, 1), (0, -1), "FiraCode"), + ("ALIGN", (0, 1), (0, -1), "CENTER"), + ("FONTSIZE", (0, 1), (0, -1), 12), + ("ALIGN", (1, 1), (1, -1), "CENTER"), + ("FONTNAME", (1, 1), (1, -1), "FiraCode"), + ("FONTNAME", (2, 1), (2, -1), "FiraCode"), + ("FONTSIZE", (2, 1), (2, -1), 9), + ("FONTNAME", (3, 1), (-1, -1), "PlusJakartaSans"), + ("FONTSIZE", (3, 1), (-1, -1), 8), + ("VALIGN", (0, 0), (-1, -1), "MIDDLE"), + ("GRID", (0, 0), (-1, -1), 1, colors.Color(0.7, 0.7, 0.7)), + ("LEFTPADDING", (0, 0), (-1, -1), 6), + ("RIGHTPADDING", (0, 0), (-1, -1), 6), + ("TOPPADDING", (0, 0), (-1, -1), 8), + ("BOTTOMPADDING", (0, 0), (-1, -1), 8), + ( + "BACKGROUND", + (1, 1), + (-1, -1), + colors.Color(0.98, 0.98, 0.98), + ), + ] + ) + ) + + for idx, critical_failed_requirement in enumerate( + critical_failed_requirements + ): + row_idx = idx + 1 + weight = critical_failed_requirement["weight"] + + if weight >= 150: + weight_color = colors.Color(0.8, 0.2, 0.2) + elif weight >= 100: + weight_color = colors.Color(0.9, 0.6, 0.2) + else: + weight_color = colors.Color(0.9, 0.9, 0.2) + + critical_table.setStyle( + TableStyle( + [ + ("BACKGROUND", (1, row_idx), (1, row_idx), weight_color), + ("TEXTCOLOR", (1, row_idx), (1, row_idx), colors.white), + ] + ) + ) + + elements.append(critical_table) + elements.append(Spacer(1, 0.2 * inch)) + + # Get styles for warning + styles = getSampleStyleSheet() + warning_text = """ + IMMEDIATE ACTION REQUIRED:
+ These requirements have the highest risk levels and have failed compliance checks. + Please prioritize addressing these issues to improve your security posture. + """ + + warning_style = ParagraphStyle( + "Warning", + parent=styles["Normal"], + fontSize=11, + textColor=colors.Color(0.8, 0.2, 0.2), + spaceBefore=10, + spaceAfter=10, + leftIndent=20, + rightIndent=20, + fontName="PlusJakartaSans", + backColor=colors.Color(1.0, 0.95, 0.95), + borderWidth=2, + borderColor=colors.Color(0.8, 0.2, 0.2), + borderPadding=10, + ) + + elements.append(Paragraph(warning_text, warning_style)) + + elements.append(PageBreak()) + + # Add detailed requirements section + def get_weight_for_requirement(requirement_dict): + requirement_id = requirement_dict["id"] + requirement_attributes = attributes_by_requirement_id.get( + requirement_id, {} + ) + metadata = requirement_attributes.get("attributes", {}).get( + "req_attributes", [] + ) + if metadata: + return getattr(metadata[0], "Weight", 0) + return 0 + + sorted_requirements = sorted( + requirements_list, key=get_weight_for_requirement, reverse=True + ) + + if only_failed: + sorted_requirements = [ + requirement + for requirement in sorted_requirements + if requirement["attributes"]["status"] == StatusChoices.FAIL + ] + + # Collect all check IDs for requirements that will be displayed + # This allows us to load only the findings we actually need (memory optimization) + check_ids_to_load = [] + for requirement in sorted_requirements: + requirement_id = requirement["id"] + requirement_attributes = attributes_by_requirement_id.get( + requirement_id, {} + ) + check_ids = requirement_attributes.get("attributes", {}).get("checks", []) + check_ids_to_load.extend(check_ids) + + # Load findings on-demand only for the checks that will be displayed + logger.info( + f"Loading findings on-demand for {len(sorted_requirements)} requirements" + ) + findings_by_check_id = _load_findings_for_requirement_checks( + tenant_id, scan_id, check_ids_to_load, prowler_provider + ) + + for requirement in sorted_requirements: + requirement_id = requirement["id"] + requirement_attributes = attributes_by_requirement_id.get( + requirement_id, {} + ) + requirement_description = requirement["attributes"]["description"] + requirement_status = requirement["attributes"]["status"] + + elements.append( + Paragraph( + f"{requirement_id}: {requirement_attributes.get('description', requirement_description)}", + h1, + ) + ) + + status_component = _create_status_component(requirement_status) + elements.append(status_component) + elements.append(Spacer(1, 0.1 * inch)) + + metadata = requirement_attributes.get("attributes", {}).get( + "req_attributes", [] + ) + if metadata and len(metadata) > 0: + m = metadata[0] + elements.append(Paragraph("Title: ", h3)) + elements.append(Paragraph(f"{getattr(m, 'Title', 'N/A')}", normal)) + elements.append(Paragraph("Section: ", h3)) + elements.append(Paragraph(f"{getattr(m, 'Section', 'N/A')}", normal)) + elements.append(Paragraph("SubSection: ", h3)) + elements.append(Paragraph(f"{getattr(m, 'SubSection', 'N/A')}", normal)) + elements.append(Paragraph("Description: ", h3)) + elements.append( + Paragraph(f"{getattr(m, 'AttributeDescription', 'N/A')}", normal) + ) + elements.append(Paragraph("Additional Information: ", h3)) + elements.append( + Paragraph(f"{getattr(m, 'AdditionalInformation', 'N/A')}", normal) + ) + elements.append(Spacer(1, 0.1 * inch)) + + risk_level = getattr(m, "LevelOfRisk", 0) + weight = getattr(m, "Weight", 0) + + if requirement_status == StatusChoices.PASS: + score = risk_level * weight + else: + score = 0 + + risk_component = _create_risk_component(risk_level, weight, score) + elements.append(risk_component) + elements.append(Spacer(1, 0.1 * inch)) + + # Get findings for this requirement's checks (loaded on-demand earlier) + requirement_check_ids = requirement_attributes.get("attributes", {}).get( + "checks", [] + ) + for check_id in requirement_check_ids: + elements.append(Paragraph(f"Check: {check_id}", h2)) + elements.append(Spacer(1, 0.1 * inch)) + + # Get findings for this check (already loaded on-demand) + check_findings = findings_by_check_id.get(check_id, []) + + if not check_findings: + elements.append( + Paragraph("- No information for this finding currently", normal) + ) + else: + findings_table_data = [ + [ + "Finding", + "Resource name", + "Severity", + "Status", + "Region", + ] + ] + for finding_output in check_findings: + check_metadata = getattr(finding_output, "metadata", {}) + finding_title = getattr( + check_metadata, + "CheckTitle", + getattr(finding_output, "check_id", ""), + ) + resource_name = getattr(finding_output, "resource_name", "") + if not resource_name: + resource_name = getattr(finding_output, "resource_uid", "") + severity = getattr(check_metadata, "Severity", "").capitalize() + finding_status = getattr(finding_output, "status", "").upper() + region = getattr(finding_output, "region", "global") + + findings_table_data.append( + [ + Paragraph(finding_title, normal_center), + Paragraph(resource_name, normal_center), + Paragraph(severity, normal_center), + Paragraph(finding_status, normal_center), + Paragraph(region, normal_center), + ] + ) + findings_table = Table( + findings_table_data, + colWidths=[ + 2.5 * inch, + 3 * inch, + 0.9 * inch, + 0.9 * inch, + 0.9 * inch, + ], + ) + findings_table.setStyle( + TableStyle( + [ + ( + "BACKGROUND", + (0, 0), + (-1, 0), + colors.Color(0.2, 0.4, 0.6), + ), + ("TEXTCOLOR", (0, 0), (-1, 0), colors.white), + ("FONTNAME", (0, 0), (-1, 0), "FiraCode"), + ("ALIGN", (0, 0), (0, 0), "CENTER"), + ("VALIGN", (0, 0), (-1, -1), "MIDDLE"), + ("FONTSIZE", (0, 0), (-1, -1), 9), + ( + "GRID", + (0, 0), + (-1, -1), + 0.1, + colors.Color(0.7, 0.8, 0.9), + ), + ("LEFTPADDING", (0, 0), (0, 0), 0), + ("RIGHTPADDING", (0, 0), (0, 0), 0), + ("TOPPADDING", (0, 0), (-1, -1), 4), + ("BOTTOMPADDING", (0, 0), (-1, -1), 4), + ] + ) + ) + elements.append(findings_table) + elements.append(Spacer(1, 0.1 * inch)) + + elements.append(PageBreak()) + + # Build the PDF + doc.build(elements, onFirstPage=_add_pdf_footer, onLaterPages=_add_pdf_footer) + except Exception as e: + logger.info( + f"Error building the document, line {e.__traceback__.tb_lineno} -- {e}" + ) + raise e + + +def generate_threatscore_report_job( + tenant_id: str, scan_id: str, provider_id: str +) -> dict[str, bool | str]: + """ + Job function to generate a threatscore report and upload it to S3. + + This function orchestrates the complete report generation workflow: + 1. Validates that the scan has findings + 2. Checks provider type compatibility + 3. Generates the output directory + 4. Calls generate_threatscore_report to create the PDF + 5. Uploads the PDF to S3 + 6. Cleans up temporary files + + Args: + tenant_id (str): The tenant ID for Row-Level Security context. + scan_id (str): The ID of the scan to generate a report for. + provider_id (str): The ID of the provider used in the scan. + + Returns: + dict[str, bool | str]: A dictionary containing: + - 'upload' (bool): True if the report was successfully uploaded to S3, False otherwise. + - 'error' (str): Error message if an exception occurred (only present on error). + """ + # Check if the scan has findings and get provider info + with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS): + if not ScanSummary.objects.filter(scan_id=scan_id).exists(): + logger.info(f"No findings found for scan {scan_id}") + return {"upload": False} + + provider_obj = Provider.objects.get(id=provider_id) + provider_uid = provider_obj.uid + provider_type = provider_obj.provider + + if provider_type not in ["aws", "azure", "gcp", "m365"]: + logger.info( + f"Provider {provider_id} is not supported for threatscore report" + ) + return {"upload": False} + + # This compliance is hardcoded because is the only one that is available for the threatscore report + compliance_id = f"prowler_threatscore_{provider_type}" + logger.info( + f"Generating threatscore report for scan {scan_id} with compliance {compliance_id} inside the job" + ) + try: + logger.info("Generating the output directory") + out_dir, _, threatscore_path = _generate_output_directory( + DJANGO_TMP_OUTPUT_DIRECTORY, provider_uid, tenant_id, scan_id + ) + except Exception as e: + logger.error(f"Error generating output directory: {e}") + return {"error": str(e)} + + pdf_path = f"{threatscore_path}_threatscore_report.pdf" + logger.info(f"The path for the threatscore report is {pdf_path}") + generate_threatscore_report( + tenant_id=tenant_id, + scan_id=scan_id, + compliance_id=compliance_id, + output_path=pdf_path, + provider_id=provider_id, + only_failed=True, + min_risk_level=4, + ) + + upload_uri = _upload_to_s3( + tenant_id, + scan_id, + pdf_path, + f"threatscore/{Path(pdf_path).name}", + ) + if upload_uri: + try: + rmtree(Path(pdf_path).parent, ignore_errors=True) + except Exception as e: + logger.error(f"Error deleting output files: {e}") + final_location, did_upload = upload_uri, True + else: + final_location, did_upload = out_dir, False + + logger.info(f"Threatscore report outputs at {final_location}") + + return {"upload": did_upload} diff --git a/api/src/backend/tasks/tasks.py b/api/src/backend/tasks/tasks.py index fd4874eb6c..97b320b71d 100644 --- a/api/src/backend/tasks/tasks.py +++ b/api/src/backend/tasks/tasks.py @@ -1,3 +1,4 @@ +import os from datetime import datetime, timedelta, timezone from pathlib import Path from shutil import rmtree @@ -26,6 +27,11 @@ from tasks.jobs.integrations import ( upload_s3_integration, upload_security_hub_integration, ) +from tasks.jobs.lighthouse_providers import ( + check_lighthouse_provider_connection, + refresh_lighthouse_provider_models, +) +from tasks.jobs.report import generate_threatscore_report_job from tasks.jobs.scan import ( aggregate_findings, create_compliance_requirements, @@ -64,10 +70,15 @@ def _perform_scan_complete_tasks(tenant_id: str, scan_id: str, provider_id: str) generate_outputs_task.si( scan_id=scan_id, provider_id=provider_id, tenant_id=tenant_id ), - check_integrations_task.si( - tenant_id=tenant_id, - provider_id=provider_id, - scan_id=scan_id, + group( + generate_threatscore_report_task.si( + tenant_id=tenant_id, scan_id=scan_id, provider_id=provider_id + ), + check_integrations_task.si( + tenant_id=tenant_id, + provider_id=provider_id, + scan_id=scan_id, + ), ), ).apply_async() @@ -304,7 +315,7 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str): frameworks_bulk = Compliance.get_bulk(provider_type) frameworks_avail = get_compliance_frameworks(provider_type) - out_dir, comp_dir = _generate_output_directory( + out_dir, comp_dir, _ = _generate_output_directory( DJANGO_TMP_OUTPUT_DIRECTORY, provider_uid, tenant_id, scan_id ) @@ -407,7 +418,24 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str): writer._data.clear() compressed = _compress_output_files(out_dir) - upload_uri = _upload_to_s3(tenant_id, compressed, scan_id) + + upload_uri = _upload_to_s3( + tenant_id, + scan_id, + compressed, + os.path.basename(compressed), + ) + + compliance_dir_path = Path(comp_dir).parent + if compliance_dir_path.exists(): + for artifact_path in sorted(compliance_dir_path.iterdir()): + if artifact_path.is_file(): + _upload_to_s3( + tenant_id, + scan_id, + str(artifact_path), + f"compliance/{artifact_path.name}", + ) # S3 integrations (need output_directory) with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS): @@ -500,6 +528,24 @@ def check_lighthouse_connection_task(lighthouse_config_id: str, tenant_id: str = return check_lighthouse_connection(lighthouse_config_id=lighthouse_config_id) +@shared_task(base=RLSTask, name="lighthouse-provider-connection-check") +@set_tenant +def check_lighthouse_provider_connection_task( + provider_config_id: str, tenant_id: str | None = None +) -> dict: + """Task wrapper to validate provider credentials and set is_active.""" + return check_lighthouse_provider_connection(provider_config_id=provider_config_id) + + +@shared_task(base=RLSTask, name="lighthouse-provider-models-refresh") +@set_tenant +def refresh_lighthouse_provider_models_task( + provider_config_id: str, tenant_id: str | None = None +) -> dict: + """Task wrapper to refresh provider models catalog for the given configuration.""" + return refresh_lighthouse_provider_models(provider_config_id=provider_config_id) + + @shared_task(name="integration-check") def check_integrations_task(tenant_id: str, provider_id: str, scan_id: str = None): """ @@ -617,3 +663,21 @@ def jira_integration_task( return send_findings_to_jira( tenant_id, integration_id, project_key, issue_type, finding_ids ) + + +@shared_task( + base=RLSTask, + name="scan-threatscore-report", + queue="scan-reports", +) +def generate_threatscore_report_task(tenant_id: str, scan_id: str, provider_id: str): + """ + Task to generate a threatscore report for a given scan. + Args: + tenant_id (str): The tenant identifier. + scan_id (str): The scan identifier. + provider_id (str): The provider identifier. + """ + return generate_threatscore_report_job( + tenant_id=tenant_id, scan_id=scan_id, provider_id=provider_id + ) diff --git a/api/src/backend/tasks/tests/test_export.py b/api/src/backend/tasks/tests/test_export.py index c10f20774b..f1e7120989 100644 --- a/api/src/backend/tasks/tests/test_export.py +++ b/api/src/backend/tasks/tests/test_export.py @@ -72,17 +72,26 @@ class TestOutputs: client_mock = MagicMock() mock_get_client.return_value = client_mock - result = _upload_to_s3("tenant-id", str(zip_path), "scan-id") + result = _upload_to_s3( + "tenant-id", + "scan-id", + str(zip_path), + "outputs.zip", + ) expected_uri = "s3://test-bucket/tenant-id/scan-id/outputs.zip" assert result == expected_uri - assert client_mock.upload_file.call_count == 2 + client_mock.upload_file.assert_called_once_with( + Filename=str(zip_path), + Bucket="test-bucket", + Key="tenant-id/scan-id/outputs.zip", + ) @patch("tasks.jobs.export.get_s3_client") @patch("tasks.jobs.export.base") def test_upload_to_s3_missing_bucket(self, mock_base, mock_get_client): mock_base.DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET = "" - result = _upload_to_s3("tenant", "/tmp/fake.zip", "scan") + result = _upload_to_s3("tenant", "scan", "/tmp/fake.zip", "fake.zip") assert result is None @patch("tasks.jobs.export.get_s3_client") @@ -101,11 +110,15 @@ class TestOutputs: client_mock = MagicMock() mock_get_client.return_value = client_mock - result = _upload_to_s3("tenant", str(zip_path), "scan") + result = _upload_to_s3( + "tenant", + "scan", + str(compliance_dir / "subdir"), + "compliance/subdir", + ) - expected_uri = "s3://test-bucket/tenant/scan/results.zip" - assert result == expected_uri - client_mock.upload_file.assert_called_once() + assert result is None + client_mock.upload_file.assert_not_called() @patch( "tasks.jobs.export.get_s3_client", @@ -126,7 +139,12 @@ class TestOutputs: compliance_dir.mkdir() (compliance_dir / "report.csv").write_text("csv") - _upload_to_s3("tenant", str(zip_path), "scan") + _upload_to_s3( + "tenant", + "scan", + str(zip_path), + "zipfile.zip", + ) mock_logger.assert_called() @patch("tasks.jobs.export.rls_transaction") @@ -150,15 +168,17 @@ class TestOutputs: provider = "aws" expected_timestamp = "20230615103045" - path, compliance = _generate_output_directory( + path, compliance, threatscore = _generate_output_directory( base_dir, provider, tenant_id, scan_id ) assert os.path.isdir(os.path.dirname(path)) assert os.path.isdir(os.path.dirname(compliance)) + assert os.path.isdir(os.path.dirname(threatscore)) assert path.endswith(f"{provider}-{expected_timestamp}") assert compliance.endswith(f"{provider}-{expected_timestamp}") + assert threatscore.endswith(f"{provider}-{expected_timestamp}") @patch("tasks.jobs.export.rls_transaction") @patch("tasks.jobs.export.Scan") @@ -181,12 +201,14 @@ class TestOutputs: provider = "aws/test@check" expected_timestamp = "20230615103045" - path, compliance = _generate_output_directory( + path, compliance, threatscore = _generate_output_directory( base_dir, provider, tenant_id, scan_id ) assert os.path.isdir(os.path.dirname(path)) assert os.path.isdir(os.path.dirname(compliance)) + assert os.path.isdir(os.path.dirname(threatscore)) assert path.endswith(f"aws-test-check-{expected_timestamp}") assert compliance.endswith(f"aws-test-check-{expected_timestamp}") + assert threatscore.endswith(f"aws-test-check-{expected_timestamp}") diff --git a/api/src/backend/tasks/tests/test_report.py b/api/src/backend/tasks/tests/test_report.py new file mode 100644 index 0000000000..a472067b2d --- /dev/null +++ b/api/src/backend/tasks/tests/test_report.py @@ -0,0 +1,963 @@ +import uuid +from pathlib import Path +from unittest.mock import MagicMock, patch + +import matplotlib +import pytest +from tasks.jobs.report import ( + _aggregate_requirement_statistics_from_database, + _calculate_requirements_data_from_statistics, + _load_findings_for_requirement_checks, + generate_threatscore_report, + generate_threatscore_report_job, +) +from tasks.tasks import generate_threatscore_report_task + +from api.models import Finding, StatusChoices +from prowler.lib.check.models import Severity + +matplotlib.use("Agg") # Use non-interactive backend for tests + + +@pytest.mark.django_db +class TestGenerateThreatscoreReport: + def setup_method(self): + self.scan_id = str(uuid.uuid4()) + self.provider_id = str(uuid.uuid4()) + self.tenant_id = str(uuid.uuid4()) + + def test_no_findings_returns_early(self): + with patch("tasks.jobs.report.ScanSummary.objects.filter") as mock_filter: + mock_filter.return_value.exists.return_value = False + + result = generate_threatscore_report_job( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) + + assert result == {"upload": False} + mock_filter.assert_called_once_with(scan_id=self.scan_id) + + @patch("tasks.jobs.report.rmtree") + @patch("tasks.jobs.report._upload_to_s3") + @patch("tasks.jobs.report.generate_threatscore_report") + @patch("tasks.jobs.report._generate_output_directory") + @patch("tasks.jobs.report.Provider.objects.get") + @patch("tasks.jobs.report.ScanSummary.objects.filter") + def test_generate_threatscore_report_happy_path( + self, + mock_scan_summary_filter, + mock_provider_get, + mock_generate_output_directory, + mock_generate_report, + mock_upload, + mock_rmtree, + ): + mock_scan_summary_filter.return_value.exists.return_value = True + + mock_provider = MagicMock() + mock_provider.uid = "provider-uid" + mock_provider.provider = "aws" + mock_provider_get.return_value = mock_provider + + mock_generate_output_directory.return_value = ( + "/tmp/output", + "/tmp/compressed", + "/tmp/threatscore_path", + ) + + mock_upload.return_value = "s3://bucket/threatscore_report.pdf" + + result = generate_threatscore_report_job( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) + + assert result == {"upload": True} + mock_generate_report.assert_called_once_with( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + compliance_id="prowler_threatscore_aws", + output_path="/tmp/threatscore_path_threatscore_report.pdf", + provider_id=self.provider_id, + only_failed=True, + min_risk_level=4, + ) + mock_upload.assert_called_once_with( + self.tenant_id, + self.scan_id, + "/tmp/threatscore_path_threatscore_report.pdf", + "threatscore/threatscore_path_threatscore_report.pdf", + ) + mock_rmtree.assert_called_once_with( + Path("/tmp/threatscore_path_threatscore_report.pdf").parent, + ignore_errors=True, + ) + + def test_generate_threatscore_report_fails_upload(self): + with ( + patch("tasks.jobs.report.ScanSummary.objects.filter") as mock_filter, + patch("tasks.jobs.report.Provider.objects.get") as mock_provider_get, + patch("tasks.jobs.report._generate_output_directory") as mock_gen_dir, + patch("tasks.jobs.report.generate_threatscore_report"), + patch("tasks.jobs.report._upload_to_s3", return_value=None), + ): + mock_filter.return_value.exists.return_value = True + + # Mock provider + mock_provider = MagicMock() + mock_provider.uid = "aws-provider-uid" + mock_provider.provider = "aws" + mock_provider_get.return_value = mock_provider + + mock_gen_dir.return_value = ( + "/tmp/output", + "/tmp/compressed", + "/tmp/threatscore_path", + ) + + result = generate_threatscore_report_job( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) + + assert result == {"upload": False} + + def test_generate_threatscore_report_logs_rmtree_exception(self, caplog): + with ( + patch("tasks.jobs.report.ScanSummary.objects.filter") as mock_filter, + patch("tasks.jobs.report.Provider.objects.get") as mock_provider_get, + patch("tasks.jobs.report._generate_output_directory") as mock_gen_dir, + patch("tasks.jobs.report.generate_threatscore_report"), + patch( + "tasks.jobs.report._upload_to_s3", return_value="s3://bucket/report.pdf" + ), + patch( + "tasks.jobs.report.rmtree", side_effect=Exception("Test deletion error") + ), + ): + mock_filter.return_value.exists.return_value = True + + # Mock provider + mock_provider = MagicMock() + mock_provider.uid = "aws-provider-uid" + mock_provider.provider = "aws" + mock_provider_get.return_value = mock_provider + + mock_gen_dir.return_value = ( + "/tmp/output", + "/tmp/compressed", + "/tmp/threatscore_path", + ) + + with caplog.at_level("ERROR"): + generate_threatscore_report_job( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) + assert "Error deleting output files" in caplog.text + + def test_generate_threatscore_report_azure_provider(self): + with ( + patch("tasks.jobs.report.ScanSummary.objects.filter") as mock_filter, + patch("tasks.jobs.report.Provider.objects.get") as mock_provider_get, + patch("tasks.jobs.report._generate_output_directory") as mock_gen_dir, + patch("tasks.jobs.report.generate_threatscore_report") as mock_generate, + patch( + "tasks.jobs.report._upload_to_s3", return_value="s3://bucket/report.pdf" + ), + patch("tasks.jobs.report.rmtree"), + ): + mock_filter.return_value.exists.return_value = True + + mock_provider = MagicMock() + mock_provider.uid = "azure-provider-uid" + mock_provider.provider = "azure" + mock_provider_get.return_value = mock_provider + + mock_gen_dir.return_value = ( + "/tmp/output", + "/tmp/compressed", + "/tmp/threatscore_path", + ) + + generate_threatscore_report_job( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) + + mock_generate.assert_called_once_with( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + compliance_id="prowler_threatscore_azure", + output_path="/tmp/threatscore_path_threatscore_report.pdf", + provider_id=self.provider_id, + only_failed=True, + min_risk_level=4, + ) + + +@pytest.mark.django_db +class TestAggregateRequirementStatistics: + """Test suite for _aggregate_requirement_statistics_from_database function.""" + + def test_aggregates_findings_correctly(self, tenants_fixture, scans_fixture): + """Verify correct pass/total counts per check are aggregated from database.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + # Create findings with different check_ids and statuses + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-1", + check_id="check_1", + status=StatusChoices.PASS, + severity=Severity.high, + impact=Severity.high, + check_metadata={}, + raw_result={}, + ) + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-2", + check_id="check_1", + status=StatusChoices.FAIL, + severity=Severity.high, + impact=Severity.high, + check_metadata={}, + raw_result={}, + ) + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-3", + check_id="check_2", + status=StatusChoices.PASS, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + result = _aggregate_requirement_statistics_from_database( + str(tenant.id), str(scan.id) + ) + + assert result == { + "check_1": {"passed": 1, "total": 2}, + "check_2": {"passed": 1, "total": 1}, + } + + def test_handles_empty_scan(self, tenants_fixture, scans_fixture): + """Return empty dict when no findings exist for the scan.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + result = _aggregate_requirement_statistics_from_database( + str(tenant.id), str(scan.id) + ) + + assert result == {} + + def test_multiple_findings_same_check(self, tenants_fixture, scans_fixture): + """Aggregate multiple findings for same check_id correctly.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + # Create 5 findings for same check, 3 passed + for i in range(3): + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid=f"finding-pass-{i}", + check_id="check_same", + status=StatusChoices.PASS, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + for i in range(2): + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid=f"finding-fail-{i}", + check_id="check_same", + status=StatusChoices.FAIL, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + result = _aggregate_requirement_statistics_from_database( + str(tenant.id), str(scan.id) + ) + + assert result == {"check_same": {"passed": 3, "total": 5}} + + def test_only_failed_findings(self, tenants_fixture, scans_fixture): + """Correctly count when all findings are FAIL status.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-fail-1", + check_id="check_fail", + status=StatusChoices.FAIL, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-fail-2", + check_id="check_fail", + status=StatusChoices.FAIL, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + result = _aggregate_requirement_statistics_from_database( + str(tenant.id), str(scan.id) + ) + + assert result == {"check_fail": {"passed": 0, "total": 2}} + + def test_mixed_statuses(self, tenants_fixture, scans_fixture): + """Test with PASS, FAIL, and MANUAL statuses mixed.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-pass", + check_id="check_mixed", + status=StatusChoices.PASS, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-fail", + check_id="check_mixed", + status=StatusChoices.FAIL, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-manual", + check_id="check_mixed", + status=StatusChoices.MANUAL, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + result = _aggregate_requirement_statistics_from_database( + str(tenant.id), str(scan.id) + ) + + # Only PASS status is counted as passed + assert result == {"check_mixed": {"passed": 1, "total": 3}} + + +@pytest.mark.django_db +class TestLoadFindingsForChecks: + """Test suite for _load_findings_for_requirement_checks function.""" + + def test_loads_only_requested_checks( + self, tenants_fixture, scans_fixture, providers_fixture + ): + """Verify only findings for specified check_ids are loaded.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + providers_fixture[0] + + # Create findings with different check_ids + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-1", + check_id="check_requested", + status=StatusChoices.PASS, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-2", + check_id="check_not_requested", + status=StatusChoices.FAIL, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + mock_provider = MagicMock() + + with patch( + "tasks.jobs.report.FindingOutput.transform_api_finding" + ) as mock_transform: + mock_finding_output = MagicMock() + mock_finding_output.check_id = "check_requested" + mock_transform.return_value = mock_finding_output + + result = _load_findings_for_requirement_checks( + str(tenant.id), str(scan.id), ["check_requested"], mock_provider + ) + + # Only one finding should be loaded + assert "check_requested" in result + assert "check_not_requested" not in result + assert len(result["check_requested"]) == 1 + assert mock_transform.call_count == 1 + + def test_empty_check_ids_returns_empty( + self, tenants_fixture, scans_fixture, providers_fixture + ): + """Return empty dict when check_ids list is empty.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + mock_provider = MagicMock() + + result = _load_findings_for_requirement_checks( + str(tenant.id), str(scan.id), [], mock_provider + ) + + assert result == {} + + def test_groups_by_check_id( + self, tenants_fixture, scans_fixture, providers_fixture + ): + """Multiple findings for same check are grouped correctly.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + # Create multiple findings for same check + for i in range(3): + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid=f"finding-{i}", + check_id="check_group", + status=StatusChoices.PASS, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + mock_provider = MagicMock() + + with patch( + "tasks.jobs.report.FindingOutput.transform_api_finding" + ) as mock_transform: + mock_finding_output = MagicMock() + mock_finding_output.check_id = "check_group" + mock_transform.return_value = mock_finding_output + + result = _load_findings_for_requirement_checks( + str(tenant.id), str(scan.id), ["check_group"], mock_provider + ) + + assert len(result["check_group"]) == 3 + + def test_transforms_to_finding_output( + self, tenants_fixture, scans_fixture, providers_fixture + ): + """Findings are transformed using FindingOutput.transform_api_finding.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid="finding-transform", + check_id="check_transform", + status=StatusChoices.PASS, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + mock_provider = MagicMock() + + with patch( + "tasks.jobs.report.FindingOutput.transform_api_finding" + ) as mock_transform: + mock_finding_output = MagicMock() + mock_finding_output.check_id = "check_transform" + mock_transform.return_value = mock_finding_output + + result = _load_findings_for_requirement_checks( + str(tenant.id), str(scan.id), ["check_transform"], mock_provider + ) + + # Verify transform was called + mock_transform.assert_called_once() + # Verify the transformed output is in the result + assert result["check_transform"][0] == mock_finding_output + + def test_batched_iteration(self, tenants_fixture, scans_fixture, providers_fixture): + """Works correctly with multiple batches of findings.""" + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + # Create enough findings to ensure batching (assuming batch size > 1) + for i in range(10): + Finding.objects.create( + tenant_id=tenant.id, + scan=scan, + uid=f"finding-batch-{i}", + check_id="check_batch", + status=StatusChoices.PASS, + severity=Severity.medium, + impact=Severity.medium, + check_metadata={}, + raw_result={}, + ) + + mock_provider = MagicMock() + + with patch( + "tasks.jobs.report.FindingOutput.transform_api_finding" + ) as mock_transform: + mock_finding_output = MagicMock() + mock_finding_output.check_id = "check_batch" + mock_transform.return_value = mock_finding_output + + result = _load_findings_for_requirement_checks( + str(tenant.id), str(scan.id), ["check_batch"], mock_provider + ) + + # All 10 findings should be loaded regardless of batching + assert len(result["check_batch"]) == 10 + assert mock_transform.call_count == 10 + + +@pytest.mark.django_db +class TestCalculateRequirementsData: + """Test suite for _calculate_requirements_data_from_statistics function.""" + + def test_requirement_status_all_pass(self): + """Status is PASS when all findings for requirement checks pass.""" + mock_compliance = MagicMock() + mock_compliance.Framework = "TestFramework" + mock_compliance.Version = "1.0" + + mock_requirement = MagicMock() + mock_requirement.Id = "req_1" + mock_requirement.Description = "Test requirement" + mock_requirement.Checks = ["check_1", "check_2"] + mock_requirement.Attributes = [MagicMock()] + + mock_compliance.Requirements = [mock_requirement] + + requirement_statistics = { + "check_1": {"passed": 5, "total": 5}, + "check_2": {"passed": 3, "total": 3}, + } + + attributes_by_id, requirements_list = ( + _calculate_requirements_data_from_statistics( + mock_compliance, requirement_statistics + ) + ) + + assert len(requirements_list) == 1 + assert requirements_list[0]["attributes"]["status"] == StatusChoices.PASS + assert requirements_list[0]["attributes"]["passed_findings"] == 8 + assert requirements_list[0]["attributes"]["total_findings"] == 8 + + def test_requirement_status_some_fail(self): + """Status is FAIL when some findings fail.""" + mock_compliance = MagicMock() + mock_compliance.Framework = "TestFramework" + mock_compliance.Version = "1.0" + + mock_requirement = MagicMock() + mock_requirement.Id = "req_2" + mock_requirement.Description = "Test requirement with failures" + mock_requirement.Checks = ["check_3"] + mock_requirement.Attributes = [MagicMock()] + + mock_compliance.Requirements = [mock_requirement] + + requirement_statistics = { + "check_3": {"passed": 2, "total": 5}, + } + + attributes_by_id, requirements_list = ( + _calculate_requirements_data_from_statistics( + mock_compliance, requirement_statistics + ) + ) + + assert len(requirements_list) == 1 + assert requirements_list[0]["attributes"]["status"] == StatusChoices.FAIL + assert requirements_list[0]["attributes"]["passed_findings"] == 2 + assert requirements_list[0]["attributes"]["total_findings"] == 5 + + def test_requirement_status_no_findings(self): + """Status is MANUAL when no findings exist for requirement.""" + mock_compliance = MagicMock() + mock_compliance.Framework = "TestFramework" + mock_compliance.Version = "1.0" + + mock_requirement = MagicMock() + mock_requirement.Id = "req_3" + mock_requirement.Description = "Manual requirement" + mock_requirement.Checks = ["check_nonexistent"] + mock_requirement.Attributes = [MagicMock()] + + mock_compliance.Requirements = [mock_requirement] + + requirement_statistics = {} + + attributes_by_id, requirements_list = ( + _calculate_requirements_data_from_statistics( + mock_compliance, requirement_statistics + ) + ) + + assert len(requirements_list) == 1 + assert requirements_list[0]["attributes"]["status"] == StatusChoices.MANUAL + assert requirements_list[0]["attributes"]["passed_findings"] == 0 + assert requirements_list[0]["attributes"]["total_findings"] == 0 + + def test_aggregates_multiple_checks(self): + """Correctly sum stats across multiple checks in requirement.""" + mock_compliance = MagicMock() + mock_compliance.Framework = "TestFramework" + mock_compliance.Version = "1.0" + + mock_requirement = MagicMock() + mock_requirement.Id = "req_4" + mock_requirement.Description = "Multi-check requirement" + mock_requirement.Checks = ["check_a", "check_b", "check_c"] + mock_requirement.Attributes = [MagicMock()] + + mock_compliance.Requirements = [mock_requirement] + + requirement_statistics = { + "check_a": {"passed": 10, "total": 15}, + "check_b": {"passed": 5, "total": 10}, + "check_c": {"passed": 0, "total": 5}, + } + + attributes_by_id, requirements_list = ( + _calculate_requirements_data_from_statistics( + mock_compliance, requirement_statistics + ) + ) + + assert len(requirements_list) == 1 + # 10 + 5 + 0 = 15 passed + assert requirements_list[0]["attributes"]["passed_findings"] == 15 + # 15 + 10 + 5 = 30 total + assert requirements_list[0]["attributes"]["total_findings"] == 30 + # Not all passed, so should be FAIL + assert requirements_list[0]["attributes"]["status"] == StatusChoices.FAIL + + def test_returns_correct_structure(self): + """Verify tuple structure and dict keys are correct.""" + mock_compliance = MagicMock() + mock_compliance.Framework = "TestFramework" + mock_compliance.Version = "1.0" + + mock_attribute = MagicMock() + mock_requirement = MagicMock() + mock_requirement.Id = "req_5" + mock_requirement.Description = "Structure test" + mock_requirement.Checks = ["check_struct"] + mock_requirement.Attributes = [mock_attribute] + + mock_compliance.Requirements = [mock_requirement] + + requirement_statistics = {"check_struct": {"passed": 1, "total": 1}} + + attributes_by_id, requirements_list = ( + _calculate_requirements_data_from_statistics( + mock_compliance, requirement_statistics + ) + ) + + # Verify attributes_by_id structure + assert "req_5" in attributes_by_id + assert "attributes" in attributes_by_id["req_5"] + assert "description" in attributes_by_id["req_5"] + assert "req_attributes" in attributes_by_id["req_5"]["attributes"] + assert "checks" in attributes_by_id["req_5"]["attributes"] + + # Verify requirements_list structure + assert len(requirements_list) == 1 + req = requirements_list[0] + assert "id" in req + assert "attributes" in req + assert "framework" in req["attributes"] + assert "version" in req["attributes"] + assert "status" in req["attributes"] + assert "description" in req["attributes"] + assert "passed_findings" in req["attributes"] + assert "total_findings" in req["attributes"] + + +@pytest.mark.django_db +class TestGenerateThreatscoreReportFunction: + def setup_method(self): + self.scan_id = str(uuid.uuid4()) + self.provider_id = str(uuid.uuid4()) + self.tenant_id = str(uuid.uuid4()) + self.compliance_id = "prowler_threatscore_aws" + self.output_path = "/tmp/test_threatscore_report.pdf" + + @patch("tasks.jobs.report.initialize_prowler_provider") + @patch("tasks.jobs.report.Provider.objects.get") + @patch("tasks.jobs.report.Compliance.get_bulk") + @patch("tasks.jobs.report._aggregate_requirement_statistics_from_database") + @patch("tasks.jobs.report._calculate_requirements_data_from_statistics") + @patch("tasks.jobs.report._load_findings_for_requirement_checks") + @patch("tasks.jobs.report.SimpleDocTemplate") + @patch("tasks.jobs.report.Image") + @patch("tasks.jobs.report.Spacer") + @patch("tasks.jobs.report.Paragraph") + @patch("tasks.jobs.report.PageBreak") + @patch("tasks.jobs.report.Table") + @patch("tasks.jobs.report.TableStyle") + @patch("tasks.jobs.report.plt.subplots") + @patch("tasks.jobs.report.plt.savefig") + @patch("tasks.jobs.report.io.BytesIO") + def test_generate_threatscore_report_success( + self, + mock_bytesio, + mock_savefig, + mock_subplots, + mock_table_style, + mock_table, + mock_page_break, + mock_paragraph, + mock_spacer, + mock_image, + mock_doc_template, + mock_load_findings, + mock_calculate_requirements, + mock_aggregate_statistics, + mock_compliance_get_bulk, + mock_provider_get, + mock_initialize_provider, + ): + """Test the updated generate_threatscore_report using new memory-efficient architecture.""" + mock_provider = MagicMock() + mock_provider.provider = "aws" + mock_provider_get.return_value = mock_provider + + prowler_provider = MagicMock() + mock_initialize_provider.return_value = prowler_provider + + # Mock compliance object with requirements + mock_compliance_obj = MagicMock() + mock_compliance_obj.Framework = "ProwlerThreatScore" + mock_compliance_obj.Version = "1.0" + mock_compliance_obj.Description = "Test Description" + + # Configure requirement with properly set numeric attributes for chart generation + mock_requirement = MagicMock() + mock_requirement.Id = "req_1" + mock_requirement.Description = "Test requirement" + mock_requirement.Checks = ["check_1"] + + # Create a properly configured attribute mock with numeric values + mock_requirement_attr = MagicMock() + mock_requirement_attr.Section = "1. IAM" + mock_requirement_attr.SubSection = "1.1 Identity" + mock_requirement_attr.Title = "Test Requirement Title" + mock_requirement_attr.LevelOfRisk = 3 + mock_requirement_attr.Weight = 100 + mock_requirement_attr.AttributeDescription = "Test requirement description" + mock_requirement_attr.AdditionalInformation = "Additional test information" + + mock_requirement.Attributes = [mock_requirement_attr] + mock_compliance_obj.Requirements = [mock_requirement] + + mock_compliance_get_bulk.return_value = { + self.compliance_id: mock_compliance_obj + } + + # Mock the aggregated statistics from database + mock_aggregate_statistics.return_value = {"check_1": {"passed": 5, "total": 10}} + + # Mock the calculated requirements data with properly configured attributes + mock_attributes_by_id = { + "req_1": { + "attributes": { + "req_attributes": [mock_requirement_attr], + "checks": ["check_1"], + }, + "description": "Test requirement", + } + } + mock_requirements_list = [ + { + "id": "req_1", + "attributes": { + "framework": "ProwlerThreatScore", + "version": "1.0", + "status": StatusChoices.FAIL, + "description": "Test requirement", + "passed_findings": 5, + "total_findings": 10, + }, + } + ] + mock_calculate_requirements.return_value = ( + mock_attributes_by_id, + mock_requirements_list, + ) + + # Mock the on-demand loaded findings + mock_finding_output = MagicMock() + mock_finding_output.check_id = "check_1" + mock_finding_output.status = "FAIL" + mock_finding_output.metadata = MagicMock() + mock_finding_output.metadata.CheckTitle = "Test Check" + mock_finding_output.metadata.Severity = "HIGH" + mock_finding_output.resource_name = "test-resource" + mock_finding_output.region = "us-east-1" + + mock_load_findings.return_value = {"check_1": [mock_finding_output]} + + # Mock PDF generation components + mock_doc = MagicMock() + mock_doc_template.return_value = mock_doc + + mock_fig, mock_ax = MagicMock(), MagicMock() + mock_subplots.return_value = (mock_fig, mock_ax) + mock_buffer = MagicMock() + mock_bytesio.return_value = mock_buffer + + mock_image.return_value = MagicMock() + mock_spacer.return_value = MagicMock() + mock_paragraph.return_value = MagicMock() + mock_page_break.return_value = MagicMock() + mock_table.return_value = MagicMock() + mock_table_style.return_value = MagicMock() + + # Execute the function + generate_threatscore_report( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + compliance_id=self.compliance_id, + output_path=self.output_path, + provider_id=self.provider_id, + only_failed=True, + min_risk_level=4, + ) + + # Verify the new workflow was followed + mock_provider_get.assert_called_once_with(id=self.provider_id) + mock_initialize_provider.assert_called_once_with(mock_provider) + mock_compliance_get_bulk.assert_called_once_with("aws") + + # Verify the new functions were called in correct order with correct parameters + mock_aggregate_statistics.assert_called_once_with(self.tenant_id, self.scan_id) + mock_calculate_requirements.assert_called_once_with( + mock_compliance_obj, {"check_1": {"passed": 5, "total": 10}} + ) + mock_load_findings.assert_called_once_with( + self.tenant_id, self.scan_id, ["check_1"], prowler_provider + ) + + # Verify PDF was built + mock_doc_template.assert_called_once() + mock_doc.build.assert_called_once() + + @patch("tasks.jobs.report.initialize_prowler_provider") + @patch("tasks.jobs.report.Provider.objects.get") + @patch("tasks.jobs.report.Compliance.get_bulk") + @patch("tasks.jobs.report.Finding.all_objects.filter") + def test_generate_threatscore_report_exception_handling( + self, + mock_finding_filter, + mock_compliance_get_bulk, + mock_provider_get, + mock_initialize_provider, + ): + mock_provider_get.side_effect = Exception("Provider not found") + + with pytest.raises(Exception, match="Provider not found"): + generate_threatscore_report( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + compliance_id=self.compliance_id, + output_path=self.output_path, + provider_id=self.provider_id, + only_failed=True, + min_risk_level=4, + ) + + +@pytest.mark.django_db +class TestGenerateThreatscoreReportTask: + def setup_method(self): + self.scan_id = str(uuid.uuid4()) + self.provider_id = str(uuid.uuid4()) + self.tenant_id = str(uuid.uuid4()) + + @patch("tasks.tasks.generate_threatscore_report_job") + def test_generate_threatscore_report_task_calls_job(self, mock_generate_job): + mock_generate_job.return_value = {"upload": True} + + result = generate_threatscore_report_task( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) + + assert result == {"upload": True} + mock_generate_job.assert_called_once_with( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) + + @patch("tasks.tasks.generate_threatscore_report_job") + def test_generate_threatscore_report_task_handles_job_exception( + self, mock_generate_job + ): + mock_generate_job.side_effect = Exception("Job failed") + + with pytest.raises(Exception, match="Job failed"): + generate_threatscore_report_task( + tenant_id=self.tenant_id, + scan_id=self.scan_id, + provider_id=self.provider_id, + ) diff --git a/api/src/backend/tasks/tests/test_tasks.py b/api/src/backend/tasks/tests/test_tasks.py index b4262027f6..a98341ef35 100644 --- a/api/src/backend/tasks/tests/test_tasks.py +++ b/api/src/backend/tasks/tests/test_tasks.py @@ -98,7 +98,11 @@ class TestGenerateOutputs: ), patch( "tasks.tasks._generate_output_directory", - return_value=("out-dir", "comp-dir"), + return_value=( + "/tmp/test/out-dir", + "/tmp/test/comp-dir", + "/tmp/test/threat-dir", + ), ), patch("tasks.tasks.Scan.all_objects.filter") as mock_scan_update, patch("tasks.tasks.rmtree"), @@ -126,7 +130,8 @@ class TestGenerateOutputs: patch("tasks.tasks.get_compliance_frameworks"), patch("tasks.tasks.Finding.all_objects.filter") as mock_findings, patch( - "tasks.tasks._generate_output_directory", return_value=("out", "comp") + "tasks.tasks._generate_output_directory", + return_value=("/tmp/test/out", "/tmp/test/comp", "/tmp/test/threat"), ), patch("tasks.tasks.FindingOutput._transform_findings_stats"), patch("tasks.tasks.FindingOutput.transform_api_finding"), @@ -168,15 +173,35 @@ class TestGenerateOutputs: mock_finding_output = MagicMock() mock_finding_output.compliance = {"cis": ["requirement-1", "requirement-2"]} + html_writer_mock = MagicMock() + html_writer_mock._data = [] + html_writer_mock.close_file = False + html_writer_mock.transform = MagicMock() + html_writer_mock.batch_write_data_to_file = MagicMock() + + compliance_writer_mock = MagicMock() + compliance_writer_mock._data = [] + compliance_writer_mock.close_file = False + compliance_writer_mock.transform = MagicMock() + compliance_writer_mock.batch_write_data_to_file = MagicMock() + + # Create a mock class that returns our mock instance when called + mock_compliance_class = MagicMock(return_value=compliance_writer_mock) + + mock_provider = MagicMock() + mock_provider.provider = "aws" + mock_provider.uid = "test-provider-uid" + with ( patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter, - patch("tasks.tasks.Provider.objects.get"), + patch("tasks.tasks.Provider.objects.get", return_value=mock_provider), patch("tasks.tasks.initialize_prowler_provider"), patch("tasks.tasks.Compliance.get_bulk", return_value={"cis": MagicMock()}), patch("tasks.tasks.get_compliance_frameworks", return_value=["cis"]), patch("tasks.tasks.Finding.all_objects.filter") as mock_findings, patch( - "tasks.tasks._generate_output_directory", return_value=("out", "comp") + "tasks.tasks._generate_output_directory", + return_value=("/tmp/test/out", "/tmp/test/comp", "/tmp/test/threat"), ), patch( "tasks.tasks.FindingOutput._transform_findings_stats", @@ -190,6 +215,20 @@ class TestGenerateOutputs: patch("tasks.tasks._upload_to_s3", return_value="s3://bucket/f.zip"), patch("tasks.tasks.Scan.all_objects.filter"), patch("tasks.tasks.rmtree"), + patch( + "tasks.tasks.OUTPUT_FORMATS_MAPPING", + { + "html": { + "class": lambda *args, **kwargs: html_writer_mock, + "suffix": ".html", + "kwargs": {}, + } + }, + ), + patch( + "tasks.tasks.COMPLIANCE_CLASS_MAP", + {"aws": [(lambda x: True, mock_compliance_class)]}, + ), ): mock_filter.return_value.exists.return_value = True mock_findings.return_value.order_by.return_value.iterator.return_value = [ @@ -197,29 +236,12 @@ class TestGenerateOutputs: True, ] - html_writer_mock = MagicMock() - with ( - patch( - "tasks.tasks.OUTPUT_FORMATS_MAPPING", - { - "html": { - "class": lambda *args, **kwargs: html_writer_mock, - "suffix": ".html", - "kwargs": {}, - } - }, - ), - patch( - "tasks.tasks.COMPLIANCE_CLASS_MAP", - {"aws": [(lambda x: True, MagicMock())]}, - ), - ): - generate_outputs_task( - scan_id=self.scan_id, - provider_id=self.provider_id, - tenant_id=self.tenant_id, - ) - html_writer_mock.batch_write_data_to_file.assert_called_once() + generate_outputs_task( + scan_id=self.scan_id, + provider_id=self.provider_id, + tenant_id=self.tenant_id, + ) + html_writer_mock.batch_write_data_to_file.assert_called_once() def test_transform_called_only_on_second_batch(self): raw1 = MagicMock() @@ -256,7 +278,11 @@ class TestGenerateOutputs: ), patch( "tasks.tasks._generate_output_directory", - return_value=("outdir", "compdir"), + return_value=( + "/tmp/test/outdir", + "/tmp/test/compdir", + "/tmp/test/threatdir", + ), ), patch("tasks.tasks._compress_output_files", return_value="outdir.zip"), patch("tasks.tasks._upload_to_s3", return_value="s3://bucket/outdir.zip"), @@ -303,12 +329,14 @@ class TestGenerateOutputs: def __init__(self, *args, **kwargs): self.transform_calls = [] self._data = [] + self.close_file = False writer_instances.append(self) def transform(self, fos, comp_obj, name): self.transform_calls.append((fos, comp_obj, name)) def batch_write_data_to_file(self): + # Mock implementation - do nothing pass two_batches = [ @@ -329,7 +357,11 @@ class TestGenerateOutputs: patch("tasks.tasks.get_compliance_frameworks", return_value=["cis"]), patch( "tasks.tasks._generate_output_directory", - return_value=("outdir", "compdir"), + return_value=( + "/tmp/test/outdir", + "/tmp/test/compdir", + "/tmp/test/threatdir", + ), ), patch("tasks.tasks.FindingOutput._transform_findings_stats"), patch( @@ -368,15 +400,35 @@ class TestGenerateOutputs: mock_finding_output = MagicMock() mock_finding_output.compliance = {"cis": ["requirement-1", "requirement-2"]} + json_writer_mock = MagicMock() + json_writer_mock._data = [] + json_writer_mock.close_file = False + json_writer_mock.transform = MagicMock() + json_writer_mock.batch_write_data_to_file = MagicMock() + + compliance_writer_mock = MagicMock() + compliance_writer_mock._data = [] + compliance_writer_mock.close_file = False + compliance_writer_mock.transform = MagicMock() + compliance_writer_mock.batch_write_data_to_file = MagicMock() + + # Create a mock class that returns our mock instance when called + mock_compliance_class = MagicMock(return_value=compliance_writer_mock) + + mock_provider = MagicMock() + mock_provider.provider = "aws" + mock_provider.uid = "test-provider-uid" + with ( patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter, - patch("tasks.tasks.Provider.objects.get"), + patch("tasks.tasks.Provider.objects.get", return_value=mock_provider), patch("tasks.tasks.initialize_prowler_provider"), patch("tasks.tasks.Compliance.get_bulk", return_value={"cis": MagicMock()}), patch("tasks.tasks.get_compliance_frameworks", return_value=["cis"]), patch("tasks.tasks.Finding.all_objects.filter") as mock_findings, patch( - "tasks.tasks._generate_output_directory", return_value=("out", "comp") + "tasks.tasks._generate_output_directory", + return_value=("/tmp/test/out", "/tmp/test/comp", "/tmp/test/threat"), ), patch( "tasks.tasks.FindingOutput._transform_findings_stats", @@ -390,6 +442,20 @@ class TestGenerateOutputs: patch("tasks.tasks._upload_to_s3", return_value="s3://bucket/file.zip"), patch("tasks.tasks.Scan.all_objects.filter"), patch("tasks.tasks.rmtree", side_effect=Exception("Test deletion error")), + patch( + "tasks.tasks.OUTPUT_FORMATS_MAPPING", + { + "json": { + "class": lambda *args, **kwargs: json_writer_mock, + "suffix": ".json", + "kwargs": {}, + } + }, + ), + patch( + "tasks.tasks.COMPLIANCE_CLASS_MAP", + {"aws": [(lambda x: True, mock_compliance_class)]}, + ), ): mock_filter.return_value.exists.return_value = True mock_findings.return_value.order_by.return_value.iterator.return_value = [ @@ -397,29 +463,13 @@ class TestGenerateOutputs: True, ] - with ( - patch( - "tasks.tasks.OUTPUT_FORMATS_MAPPING", - { - "json": { - "class": lambda *args, **kwargs: MagicMock(), - "suffix": ".json", - "kwargs": {}, - } - }, - ), - patch( - "tasks.tasks.COMPLIANCE_CLASS_MAP", - {"aws": [(lambda x: True, MagicMock())]}, - ), - ): - with caplog.at_level("ERROR"): - generate_outputs_task( - scan_id=self.scan_id, - provider_id=self.provider_id, - tenant_id=self.tenant_id, - ) - assert "Error deleting output files" in caplog.text + with caplog.at_level("ERROR"): + generate_outputs_task( + scan_id=self.scan_id, + provider_id=self.provider_id, + tenant_id=self.tenant_id, + ) + assert "Error deleting output files" in caplog.text @patch("tasks.tasks.rls_transaction") @patch("tasks.tasks.Integration.objects.filter") @@ -435,7 +485,8 @@ class TestGenerateOutputs: patch("tasks.tasks.get_compliance_frameworks", return_value=[]), patch("tasks.tasks.Finding.all_objects.filter") as mock_findings, patch( - "tasks.tasks._generate_output_directory", return_value=("out", "comp") + "tasks.tasks._generate_output_directory", + return_value=("/tmp/test/out", "/tmp/test/comp", "/tmp/test/threat"), ), patch("tasks.tasks.FindingOutput._transform_findings_stats"), patch("tasks.tasks.FindingOutput.transform_api_finding"), @@ -476,8 +527,15 @@ class TestScanCompleteTasks: @patch("tasks.tasks.create_compliance_requirements_task.apply_async") @patch("tasks.tasks.perform_scan_summary_task.si") @patch("tasks.tasks.generate_outputs_task.si") + @patch("tasks.tasks.generate_threatscore_report_task.si") + @patch("tasks.tasks.check_integrations_task.si") def test_scan_complete_tasks( - self, mock_outputs_task, mock_scan_summary_task, mock_compliance_tasks + self, + mock_check_integrations_task, + mock_threatscore_task, + mock_outputs_task, + mock_scan_summary_task, + mock_compliance_tasks, ): _perform_scan_complete_tasks("tenant-id", "scan-id", "provider-id") mock_compliance_tasks.assert_called_once_with( @@ -492,6 +550,16 @@ class TestScanCompleteTasks: provider_id="provider-id", tenant_id="tenant-id", ) + mock_threatscore_task.assert_called_once_with( + tenant_id="tenant-id", + scan_id="scan-id", + provider_id="provider-id", + ) + mock_check_integrations_task.assert_called_once_with( + tenant_id="tenant-id", + provider_id="provider-id", + scan_id="scan-id", + ) @pytest.mark.django_db @@ -662,7 +730,7 @@ class TestCheckIntegrationsTask: mock_initialize_provider.return_value = MagicMock() mock_compliance_bulk.return_value = {} mock_get_frameworks.return_value = [] - mock_generate_dir.return_value = ("out-dir", "comp-dir") + mock_generate_dir.return_value = ("out-dir", "comp-dir", "threat-dir") mock_transform_stats.return_value = {"stats": "data"} # Mock findings @@ -787,7 +855,7 @@ class TestCheckIntegrationsTask: mock_initialize_provider.return_value = MagicMock() mock_compliance_bulk.return_value = {} mock_get_frameworks.return_value = [] - mock_generate_dir.return_value = ("out-dir", "comp-dir") + mock_generate_dir.return_value = ("out-dir", "comp-dir", "threat-dir") mock_transform_stats.return_value = {"stats": "data"} # Mock findings @@ -903,7 +971,7 @@ class TestCheckIntegrationsTask: mock_initialize_provider.return_value = MagicMock() mock_compliance_bulk.return_value = {} mock_get_frameworks.return_value = [] - mock_generate_dir.return_value = ("out-dir", "comp-dir") + mock_generate_dir.return_value = ("out-dir", "comp-dir", "threat-dir") mock_transform_stats.return_value = {"stats": "data"} # Mock findings diff --git a/docs/developer-guide/provider.mdx b/docs/developer-guide/provider.mdx index e0b7c62284..85dafc6300 100644 --- a/docs/developer-guide/provider.mdx +++ b/docs/developer-guide/provider.mdx @@ -17,160 +17,3442 @@ A provider is any platform or service that offers resources, data, or functional For providers supported by Prowler, refer to [Prowler Hub](https://hub.prowler.com/). -There are some custom providers added by the community, like [NHN Cloud](https://www.nhncloud.com/), that are not maintained by the Prowler team, but can be used in the Prowler CLI. They can be checked directly at the [Prowler GitHub repository](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers). - + There are some custom providers added by the community, like [NHN Cloud](https://www.nhncloud.com/), that are not maintained by the Prowler team, but can be used in the Prowler CLI. The main purpose of this documentation is to guide you through creating a new provider and integrating it not only in the CLI, but also in the API and UI. Non official providers can be checked directly at the [Prowler GitHub repository](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers). -## Adding a New Provider +--- -To integrate an unsupported Prowler provider and implement its security checks, create a dedicated folder for all related files (e.g., services, checks)." +## Provider Types in Prowler -This folder must be placed within [`prowler/providers//`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers). +Prowler supports several types of providers, each with its own implementation pattern and use case. Understanding these differences is key to designing your provider correctly. -Within this folder the following folders are also to be created: +### Classifying your Provider -- `lib` – Stores additional utility functions and core files required by every provider. The following files and subfolders are commonly found in every provider's `lib` folder: +Before implementing a new provider, you need to determine which type it belongs to. This classification will guide your implementation approach and help you choose the right patterns and libraries. - - `service/service.py` – Provides a generic service class to be inherited by all services. - - `arguments/arguments.py` – Handles provider-specific argument parsing. - - `mutelist/mutelist.py` – Manages the mutelist functionality for the provider. +#### Decision Criteria -- `services` – Stores all [services](/developer-guide/services) that the provider offers and want to be audited by [Prowler checks](/developer-guide/checks). +Once you have decided the provider you want or need to add to Prowler, the next step is to study how to retrieve data from it. Based on that, the provider will fall into one of the following types: SDK, API or Tool/Wrapper (maybe in the future there will be new types but for now this are the only ones). -- `__init__.py` (empty) – Ensures Python recognizes this folder as a package. +**Choose SDK Provider if:** -- `_provider.py` – Defines authentication logic, configurations, and other provider-specific data. +- The target platform/service has an **official Python SDK** available +- The target platform/service has a **non-official Python SDK** available but it's been updated and maintained +- You need to support **multiple authentication methods** (profiles, service principals, IAM roles, etc.) +- The SDK provides **built-in session management**, retry logic, and error handling +- You want to leverage **SDK-specific features** like credential chaining, role assumption, etc +- The platform is a **major cloud provider** (AWS, Azure, GCP, etc.) or has mature SDK support -- `models.py` – Contains necessary models for the new provider. +**Choose API Provider if:** -By adhering to this structure, Prowler can effectively support services and security checks for additional providers. +- The target platform has a **REST API** but **no official Python SDK** +- The target platform has a **non-official Python SDK** available but it's not updated and maintained +- You need to implement **custom authentication flows** (OAuth, token-based, etc.) +- The platform is a **custom or community service** without official SDK support +- You want to use **standard HTTP libraries** like `requests` for API calls +- The platform exposes **well-documented REST endpoints** but lacks SDK tooling - -If your new provider requires a Python library (such as an official SDK or API client) to connect to its services, make sure to add it as a dependency in the `pyproject.toml` file. This ensures that all contributors and users have the necessary packages installed when working with your provider. +**Choose Tool/Wrapper Provider if:** - -## Provider Structure in Prowler +- You're integrating a **third-party security tool** or library +- The tool provides **scanning capabilities** that need to be adapted to Prowler's interface +- You don't need **authentication or session management** (the tool handles this) +- You need to **map tool arguments** and **convert outputs** to Prowler's format -Prowler's provider architecture is designed to facilitate security audits through a generic service tailored to each provider. This is accomplished by passing the necessary parameters to the constructor, which initializes all required session values. +**Special Case - Hybrid Providers:** -### Base Class +- Some providers may **combine multiple approaches** (e.g., SDK + Tool wrapper, SDK + API, etc.) +- Example: M365 uses **msgraph SDK** for authentication and some checks, and **PowerShell wrapper** for other checks that the SDK doesn't support +- These require **custom implementation patterns** that blend different provider types -All Prowler providers inherit from the same base class located in [`prowler/providers/common/provider.py`](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/common/provider.py). It is an [abstract base class](https://docs.python.org/3/library/abc.html) that defines the interface for all provider classes. +#### Classification Examples -### Provider Class +| Provider | Type | Reasoning | +| ----------- | ------ | ----------------------------------------------------------------- | +| AWS | SDK | Official boto3 SDK, multiple auth methods, mature ecosystem | +| Azure | SDK | Official azure-identity SDK, service principals, managed identity | +| GCP | SDK | Official google-auth SDK, service accounts, ADC support | +| Kubernetes | SDK | Official kubernetes SDK, service accounts, ADC support | +| NHN Cloud | API | Custom REST API, no official SDK, community provider | +| MongoDB Atlas| API | Custom REST API, no official SDK | +| IAC | Tool | Third-party security tool that uses trivy, no auth needed, output conversion| +| M365 | Hybrid | Combines msgraph SDK for auth + PowerShell wrapper for operations | +| GitHub | Hybrid | Non-Official PyGithub SDK but it's been updated and maintained + Official graphql API requests| -#### Provider Implementation Guidance +#### Questions to Ask Yourself -Given the complexity and variability of providers, use existing provider implementations as templates when developing new integrations. +**1. Does the platform have an official Python SDK?** -- [AWS](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/aws_provider.py) -- [GCP](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/gcp/gcp_provider.py) -- [Azure](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/azure/azure_provider.py) -- [Kubernetes](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/kubernetes/kubernetes_provider.py) -- [Microsoft365](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/microsoft365/microsoft365_provider.py) -- [GitHub](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/github/github_provider.py) -- [MongoDB Atlas](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/mongodbatlas/mongodbatlas_provider.py) +- Yes → Consider SDK Provider +- No → Continue to question 2 -### Basic Provider Implementation: Pseudocode Example +**2. Does the platform have a non-official Python SDK?** -To simplify understanding, the following pseudocode outlines the fundamental structure of a provider, including library imports necessary for authentication. +- Yes → Then if the SDK is updated and maintained, consider SDK Provider, otherwise continue to question 3. +- No → Continue to question 3 -```python title="Provider Example Class" +**3. Is this a third-party security tool or library?** -# Library Imports for Authentication +- Yes → Consider Tool/Wrapper Provider +- No → Continue to question 4 -# When implementing authentication for a provider, import the required libraries. +**4. Does the platform expose a REST API?** -from prowler.config.config import load_and_validate_config_file -from prowler.lib.logger import logger -from prowler.lib.mutelist.mutelist import parse_mutelist_file -from prowler.lib.utils.utils import print_boxes -from prowler.providers.common.models import Audit_Metadata +- Yes → Consider API Provider +- No → You may need a custom approach + +![FlowChart Decision](../img/provider-decision-tree.png) + +#### Implementation Complexity + +- **SDK Providers**: Low complexity. You have mature examples like AWS, Azure, GCP, Kubernetes, etc. that you can leverage to implement your provider. +- **API Providers**: Medium complexity. You need to implement the authentication and session management, and the API calls to the provider. You now have NHN and MongoDB Atlas as example to follow. +- **Tool/Wrapper Providers**: High complexity. You need to implement the argument/output mapping to the provider and handle problems that the tool/wrapper may have. You now have IAC and the PowerShell wrapper as example to follow. +- **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers in order to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and Github (PyGithub SDK + graphql API requests) as examples. + +### Determining Regional vs Non-Regional Architecture + +After classifying your provider type, the next critical decision is determining whether your provider operates with **regional concepts** or is **global/non-regional**. This decision fundamentally affects how your provider and services are structured and executed. + +#### Regional Providers + +Regional providers operate across multiple geographic locations and require region-specific resource discovery and iteration. + +**Examples:** + +- **AWS**: Has regions like `us-east-1`, `eu-west-1`, `ap-southeast-2` +- **Azure**: Has regions like `East US`, `West Europe`, `Australia East` +- **GCP**: Has regions like `us-central1`, `europe-west1`, `asia-southeast1` + +**Implementation Requirements:** + +- Must implement region discovery and iteration +- Services must be instantiated per region or handle multi-region data +- Checks must execute across all available/specified regions +- Resource ARNs/IDs must include region information +- Region-specific client initialization + +**Execution Pattern:** + +```python +# Regional provider execution pattern +for region in provider.get_regions(): + regional_client = service.get_regional_client(region) + regional_resources = regional_client.discover_resources() + # Process regional resources +``` + +#### Non-Regional (Global) Providers + +Non-regional providers operate globally without geographic partitioning. + +**Examples:** + +- **GitHub**: Repositories, organizations are global concepts +- **M365**: Tenants operate globally across Microsoft datacenters +- **Kubernetes**: Clusters are independent units without regional concepts + +**Implementation Requirements:** + +- Single global client/session +- No region iteration required +- Global resource discovery +- Simpler resource identification (no region in ARNs/IDs) +- Single audit execution + +**Execution Pattern:** + +```python +# Non-regional provider execution pattern +global_client = service.get_client() +global_resources = global_client.discover_resources() +# Process all resources in single iteration +``` + +#### Decision Matrix + +| Aspect | Regional Provider | Non-Regional Provider | +| ------------------------ | ------------------------ | ---------------------- | +| **Client Init** | Per-region clients | Single global client | +| **Resource Discovery** | Iterate through regions | Single discovery call | +| **Resource ARN/ID** | Include region | Global identifier/None | +| **Audit Execution** | Multi-region loops | Single execution | +| **Service Architecture** | Region-aware services | Global services | +| **Performance** | Parallelizable by region | Linear execution | + +#### Region Discovery + +Region discovery is the process of getting the list of regions that are available for the account. This is done by the provider and is stored in the `prowler/providers//lib/regions/_regions.py` file. + +```python +# File: prowler/providers/aws/aws_provider.py +def get_aws_enabled_regions(self, current_session: Session) -> set: + """get_aws_enabled_regions returns a set of enabled AWS regions""" + try: + # EC2 Client to check enabled regions + service = "ec2" + default_region = self.get_default_region(service) + ec2_client = current_session.client(service, region_name=default_region) + + enabled_regions = set() + # With AllRegions=False we only get the enabled regions for the account + for region in ec2_client.describe_regions(AllRegions=False).get("Regions", []): + enabled_regions.add(region.get("RegionName")) + + return enabled_regions + except Exception as error: + logger.error(f"{error.__class__.__name__}: {error}") + return set() +``` + +The function returns a JSON file containing the list of regions for the provider. It is used to retrieve the provider’s regions and to validate the region specified by the user. + +```json +# File: prowler/providers/aws/aws_regions_by_service.json (extract) +{ + "services": { + "ec2": { + "regions": { + "aws": [ + "af-south-1", "ap-east-1", "ap-northeast-1", "ap-northeast-2", + "ap-northeast-3", "ap-south-1", "ap-southeast-1", "ap-southeast-2", + "ca-central-1", "eu-central-1", "eu-north-1", "eu-south-1", + "eu-west-1", "eu-west-2", "eu-west-3", "me-south-1", + "sa-east-1", "us-east-1", "us-east-2", "us-west-1", "us-west-2" + ], + "aws-cn": ["cn-north-1", "cn-northwest-1"], + "aws-us-gov": ["us-gov-east-1", "us-gov-west-1"] + } + } + } +} +``` + +### Regional Service Implementation + +For detailed guidance on implementing services for regional services, including code examples, service architecture, and check execution patterns, see the [Regional Service Implementation](./services#regional-service-implementation) section in the Services documentation. + +**Key concepts covered:** + +- Threading and parallel processing across regions +- Service implementation patterns for regional providers +- Cross-region resource attribution and ARN handling +- Best practices for performance and error isolation + +## Step 1: Create the Provider Backend (CLI Integration) + +Once the type of provider and its regional architecture are determined, the next step is to start creating the code of the provider. + +### SDK Providers + +General aspects to consider when implementing a new SDK provider: + +**Definition:** + +- Use the official SDK of the provider to interact with its resources and APIs. +- Examples: AWS (boto3), Azure (azure-identity), GCP (google-auth), Kubernetes (kubernetes), M365 (msal/msgraph), GitHub (PyGithub). + +**Typical Use Cases:** + +- Cloud platforms and services with mature Python SDKs. +- Need to support multiple authentication methods (profiles, service principals, etc). +- Providers that offer comprehensive Python libraries for resource management. + +**Key Characteristics:** + +- Authentication and session management handled by the SDK. +- Arguments: Depends on the provider, but for example we can have `profile`, `region`, `tenant_id`, `client_id`, `client_secret`, etc. +- Outputs: Standardized via SDK models and responses. +- Session objects that can be reused across multiple API calls. +- Built-in retry logic and error handling. + +**Implementation Details:** + +- SDK providers typically use credential objects or session objects provided by the official SDK. +- They often support multiple authentication methods (several types of credentials, configuration files, IAM roles, etc.). +- Session management includes token refresh, connection pooling, and retry mechanisms. +- Resource discovery and enumeration is usually straightforward through SDK methods. + +--- + +### Implementation Guide for SDK Providers + +Now it's time to start creating the code needed to implement the provider. + +#### Step 1: Create the Provider Structure + +**Explanation:** +SDK providers require a specific folder structure to organize authentication, configuration, and service management. This structure follows Prowler's conventions and ensures proper integration with the CLI and API. + +**Required Structure:** + +``` +prowler/providers// +├── __init__.py +├── _provider.py +├── models.py +├── exceptions/ +│ ├── __init__.py +│ └── exceptions.py +├── services/ +│ ├── service_name1/ +│ └── service_name2/ +└── lib/ + ├── __init__.py + ├── arguments/ + │ ├── __init__.py + │ └── arguments.py + ├── mutelist/ + │ ├── __init__.py + │ └── mutelist.py + ├── regions/ + │ ├── __init__.py + │ └── _regions.py + └── service/ + ├── __init__.py + └── service.py +``` + +**Key Components:** + +- **`_provider.py`**: Main provider class with authentication and session management +- **`models.py`**: Data structures for identity, session, and provider-specific information +- **`exceptions/`**: Custom exception classes for error handling +- **`services/`**: Folder that contains all the provider services, how to make a new service is explained in another section. +- **`lib/arguments/`**: CLI argument validation and parsing +- **`lib/mutelist/`**: Resource exclusion and muting functionality +- **`lib/regions/`**: Region management and validation. If the provider is NOT regional, this folder will not be created. +- **`lib/service/`**: Base service class for provider-specific services + +#### Step 2: Implement the Provider Class + +**Explanation:** +The provider class is the core component that handles authentication, session management, and identity information. It inherits from Prowler's base Provider class and implements SDK-specific authentication flows. All providers must share, as far as possible, common patterns for session setup, identity management, and credential validation. + +Nevertheless, you may encounter changes and must adapt the implementation logic accordingly. A basic example of a common provider implementation is the following: + +**File:** `prowler/providers//_provider.py` + +```python +import os +from typing import Optional, Union from prowler.providers.common.provider import Provider -from prowler.providers..models import ( - # All provider models needed. - ProviderSessionModel, - ProviderIdentityModel, - ProviderOutputOptionsModel -) +from prowler.providers.common.models import Audit_Metadata, Connection +from prowler.config.config import load_and_validate_config_file, get_default_mute_file_path +from prowler.lib.logger import logger +from prowler.lib.utils.utils import print_boxes -class NewProvider(Provider): - # All properties from the class, some of which are properties in the base class. - _type: str = "" - _session: - _identity: +# Import your SDK and all the needed libraries for the provider. +import your_sdk_library +from your_sdk_library.auth_methods import ClientSecretCredential, ProfileCredential, DefaultCredential + +# Import the needed exceptions, mutelist and models for the provider. +from prowler.providers..exceptions.exceptions import Exceptions +from prowler.providers..mutelist.mutelist import Mutelist +from prowler.providers..models import NeededModels + +class YourProvider(Provider): + """ + YourProvider class is the main class for the Your Provider. + + This class is responsible for initializing the provider, setting up the session, + validating credentials, and managing identity information. + + Attributes: + _type (str): The provider type. + _session (YourSDKSession): The provider session. + _identity (YourProviderIdentityInfo): The provider identity information. + _audit_config (dict): The audit configuration. + _mutelist (YourProviderMutelist): The provider mutelist. + audit_metadata (Audit_Metadata): The audit metadata. + """ + + _type: str = "your_provider" + _session: your_sdk_library.Session + _identity: YourProviderIdentityInfo _audit_config: dict - _output_options: ProviderOutputOptionsModel - _mutelist: dict + _mutelist: YourProviderMutelist audit_metadata: Audit_Metadata - def __init__(self, arguments): + def __init__( + self, + # Authentication parameters + client_id: str = None, + client_secret: str = None, + tenant_id: str = None, + # Configuration + config_path: str = None, + config_content: dict = None, + mutelist_path: str = None, + mutelist_content: dict = None, + # Additional provider-specific parameters + region: str = None, + profile: str = None, + ): """ - Initializes the NewProvider instance. + Initializes the YourProvider instance. + Args: - arguments (dict): A dictionary containing configuration arguments. + client_id: The client ID for authentication + client_secret: The client secret for authentication + tenant_id: The tenant ID for authentication + config_path: Path to the configuration file + config_content: Configuration content as dictionary + mutelist_path: Path to the mutelist file + mutelist_content: Mutelist content as dictionary + region: The region to use + profile: The profile to use + + Raises: + YourProviderSetUpSessionError: If session setup fails + YourProviderInvalidCredentialsError: If credentials are invalid """ - logger.info("Setting provider ...") + logger.info("Initializing YourProvider ...") - # Initializing the Provider Session - - # Steps: - - # - Retrieve Account Information - # - Extract relevant account identifiers (subscriptions, projects, or other service references) from the provided arguments. - - # Establish a Session - - # Use the method enforced by the parent class to set up the session: - self._session = self.setup_session(credentials_file) - - # Define Provider Identity - # Assign the identity class, typically provided by the Python provider library: - self._identity = () - - # Configure the Provider - # Set the provider-specific configuration. - self._audit_config = load_and_validate_config_file( - self._type, arguments.config_file + # Setup session using SDK + self._session = self.setup_session( + client_id, client_secret, tenant_id, region, profile ) - # All the enforced properties by the parent class. + # Get identity information + self._identity = self.setup_identity(self._session) + + # Load configuration + if config_content: + self._audit_config = config_content + else: + if not config_path: + config_path = default_config_file_path + self._audit_config = load_and_validate_config_file(self._type, config_path) + + # Setup mutelist + if mutelist_content: + self._mutelist = YourProviderMutelist(mutelist_content=mutelist_content) + else: + if not mutelist_path: + mutelist_path = get_default_mute_file_path(self._type) + self._mutelist = YourProviderMutelist(mutelist_path=mutelist_path) + + Provider.set_global_provider(self) + + @staticmethod + def setup_session( + client_id: str = None, + client_secret: str = None, + tenant_id: str = None, + region: str = None, + profile: str = None, + ) -> your_sdk_library.Session: + """ + Sets up the provider session using the provided credentials. + + This method handles the authentication flow and creates a session object + that can be used to interact with the provider's services. + + Args: + client_id: The client ID for authentication + client_secret: The client secret for authentication + tenant_id: The tenant ID for authentication + region: The region to use + profile: The profile to use + + Returns: + YourSDKSession: The authenticated session object + + Raises: + YourProviderSetUpSessionError: If session setup fails + """ + try: + logger.debug("Creating session ...") + + # Determine authentication method based on provided parameters + if client_id and client_secret and tenant_id: + # Use client credentials authentication + credentials = your_sdk_library.ClientSecretCredential( + tenant_id=tenant_id, + client_id=client_id, + client_secret=client_secret + ) + auth_method = "Client Credentials" + elif profile: + # Use profile-based authentication + credentials = your_sdk_library.ProfileCredential(profile=profile) + auth_method = "Profile" + else: + # Use default authentication (environment variables, etc.) + credentials = your_sdk_library.DefaultCredential() + auth_method = "Default" + + # Create session with credentials + session = your_sdk_library.Session( + credentials=credentials, + region=region + ) + + logger.debug(f"Session created using {auth_method} authentication") + return session + + except Exception as error: + logger.critical(f"Failed to setup session: {error}") + raise YourProviderSetUpSessionError( + original_exception=error, + file=os.path.basename(__file__), + ) + + def setup_identity(self, session: your_sdk_library.Session) -> YourProviderIdentityInfo: + """ + Gets identity information from the provider session. + + This method retrieves account information, user details, and other + identity-related data from the provider. + + Args: + session: The authenticated session object + + Returns: + YourProviderIdentityInfo: The identity information + + Raises: + YourProviderSetUpIdentityError: If identity setup fails + """ + try: + # Use SDK to get account/identity information + identity_info = session.get_identity() + + return YourProviderIdentityInfo( + account_id=identity_info.account_id, + account_name=identity_info.account_name, + region=identity_info.region, + user_id=identity_info.user_id, + # Add other identity fields as needed + ) + except Exception as e: + logger.error(f"Failed to get identity information: {e}") + raise YourProviderSetUpIdentityError( + original_exception=e, + file=os.path.basename(__file__), + ) + @property def identity(self): + """Returns the provider identity information.""" return self._identity @property def session(self): + """Returns the provider session object.""" return self._session @property def type(self): + """Returns the provider type.""" return self._type @property def audit_config(self): + """Returns the audit configuration.""" return self._audit_config @property - def output_options(self): - return self._output_options + def mutelist(self): + """Returns the provider mutelist.""" + return self._mutelist - def setup_session(self, ): + def print_credentials(self): """ - Sets up the Provider session. + Display account information with color formatting. + + This method prints the provider credentials and account information + in a formatted way using colorama for better readability. + """ + from colorama import Fore, Style + from prowler.lib.utils.utils import print_boxes + + report_lines = [ + f" Account ID: {Fore.YELLOW}{self._identity.account_id}{Style.RESET_ALL}", + f" Account Name: {Fore.YELLOW}{self._identity.account_name}{Style.RESET_ALL}", + f" Region: {Fore.YELLOW}{self._identity.region}{Style.RESET_ALL}", + f" User ID: {Fore.YELLOW}{self._identity.user_id}{Style.RESET_ALL}", + ] + report_title = f"{Style.BRIGHT}Using the {self._type.upper()} credentials below:{Style.RESET_ALL}" + print_boxes(report_lines, report_title) + + @staticmethod + def test_connection( + client_id: str = None, + client_secret: str = None, + tenant_id: str = None, + region: str = None, + profile: str = None, + raise_on_exception: bool = True, + provider_id: str = None, + ) -> Connection: + """ + Test connection to the provider. + + This method validates the provided credentials and tests the connection + to the provider's services. Args: - Can include all necessary arguments to set up the session + client_id: The client ID for authentication + client_secret: The client secret for authentication + tenant_id: The tenant ID for authentication + region: The region to test + profile: The profile to use + raise_on_exception: Whether to raise exceptions or return Connection object + provider_id: The provider ID to validate against Returns: - Credentials necessary to communicate with the provider. - """ - pass + Connection: Connection test result - """ - This method is enforced by parent class and is used to print all relevant - information during the prowler execution as a header of execution. - Displaying Account Information with Color Formatting. In Prowler, Account IDs, usernames, and other identifiers are typically displayed using color formatting provided by the colorama module (Fore). - """ - def print_credentials(self): - pass + Raises: + YourProviderSetUpSessionError: If session setup fails + YourProviderInvalidCredentialsError: If credentials are invalid + """ + try: + # Create temporary session for testing + test_session = YourProvider.setup_session( + client_id, client_secret, tenant_id, region, profile + ) + + # Test the connection by getting identity + identity = YourProvider.setup_identity(test_session) + + # Validate provider ID if provided + if provider_id and identity.account_id != provider_id: + raise YourProviderInvalidProviderIdError( + file=os.path.basename(__file__), + ) + + return Connection( + status=True, + message=f"Successfully connected to {provider_id or 'provider'}", + error=None, + ) + except Exception as e: + if raise_on_exception: + raise e + return Connection( + status=False, + message="Failed to connect", + error=str(e), + ) + + def get_regions(self) -> set: + """ + Get available regions for the provider. + + Returns: + set: Set of available region names + """ + # Implementation depends on your provider + # Example for cloud providers that support regions + return {"region1", "region2", "region3"} + + def get_services(self) -> list: + """ + Get available services for the provider. + + Returns: + list: List of available service names + """ + # Implementation depends on your provider + return ["service1", "service2", "service3"] ``` + +#### Step 3: Create Models + +**Explanation:** +Models define the data structures used by your provider. They include identity information, session details, and provider-specific configurations. These models ensure type safety and consistent data handling across the provider. + +**File:** `prowler/providers//models.py` + +```python +# Import the needed generic libraries for the provider. +from pydantic import BaseModel +from dataclasses import dataclass +from typing import Optional, List + +# Import the needed Prowler libraries for the provider. +from prowler.providers.common.models import ProviderOutputOptions +from prowler.config.config import output_file_timestamp + +class YourProviderIdentityInfo: + """ + Identity information for the provider. + + This class holds all the identity-related information retrieved + from the provider, including account details and user information. + """ + account_id: str + account_name: str + region: str + user_id: str + # Add other identity fields as needed + +class YourProviderSession: + """ + Session object that contains the credentials and authentication details for the provider. + + This class holds the actual credentials and authentication information needed + to establish a connection with the provider's services. + """ + # Authentication credentials + access_key: str + secret_key: str + # Or for other providers: + # client_id: str + # client_secret: str + # tenant_id: str + + # Connection details + region: str +``` + +#### Step 4: Implement Arguments + +**Explanation:** +Argument validation ensures that the provider receives valid configuration parameters. This step is crucial for preventing runtime errors and providing clear error messages to users. The validation should check for required parameters and validate their format. + +**File:** `prowler/providers//lib/arguments/arguments.py` + +```python +def init_parser(self): + """Init the Provider CLI parser""" + _parser = self.subparsers.add_parser( + "", parents=[self.common_providers_parser], help=" Provider" + ) + # Authentication Modes + _auth_subparser = _parser.add_argument_group("Authentication Modes") + _auth_modes_group = _auth_subparser.add_mutually_exclusive_group() + _auth_modes_group.add_argument( + "--credentials-file", + nargs="?", + metavar="FILE_PATH", + help="Authenticate using a Service Account Application Credentials JSON file", + ) + _auth_modes_group.add_argument( + "--impersonate-service-account", + nargs="?", + metavar="SERVICE_ACCOUNT", + help="Impersonate a Service Account", + ) + _parser.add_argument( + "--your-provider-region", + help="Your Provider Region", + type=str, + ) + _parser.add_argument( + "--env-auth", + action="store_true", + help="Use User and Password environment variables authentication to log in against ", + ) + # More arguments for the provider. +``` + +#### Step 5: Implement Mutelist + +**Explanation:** +The mutelist functionality allows users to exclude specific resources or checks from the audit. This is useful for handling false positives or excluding resources that are intentionally configured differently. + +**File:** `prowler/providers//lib/mutelist/mutelist.py` + +```python +from prowler.lib.mutelist.mutelist import Mutelist +from prowler.lib.check.models import CheckReportYourProvider + +class YourProviderMutelist(Mutelist): + """ + Mutelist implementation for YourProvider. + + This class handles the muting functionality for the provider, + allowing users to exclude specific checks or resources from audits. + """ + + def is_finding_muted(self, finding: CheckReportYourProvider) -> bool: + """ + Check if a specific finding is muted. + + Args: + finding: The finding to check + """ + return self.is_muted(finding.check_id, finding.resource_id) +``` + +#### Step 6: Implement Regions + +**Explanation:** +Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality. + + +Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does. + + +**File:** `prowler/providers//lib/regions/_regions.py` + +```python +from typing import List, Set + +def get_regions() -> List[str]: + """ + Get list of available regions for the provider. + + Returns: + List[str]: List of available region names + """ + return [ + "region1", + "region2", + "region3", + # ... other regions + ] + +def validate_region(region: str) -> bool: + """ + Validate if a region is supported. + + Args: + region: The region to validate + + Returns: + bool: True if the region is valid, False otherwise + """ + return region in get_regions() + +def get_default_region() -> str: + """ + Get the default region for the provider. + + Returns: + str: The default region name + """ + return "region1" + +def get_global_region() -> str: + """ + Get the global region for the provider. + + Returns: + str: The global region name + """ + return "global" +``` + +#### Step 7: Create Custom Exceptions + +**Explanation:** +Custom exceptions are needed to be able to handle the errors in a more specific way. Prowler uses a structured exception system with error codes, messages, and remediation steps. + +**File:** `prowler/providers//exceptions.py` + +```python +from prowler.exceptions.exceptions import ProwlerException + + +# Exceptions codes from 7000 to 7999 are reserved for YourProvider exceptions (Numbers as example) +class YourProviderBaseException(ProwlerException): + """Base class for YourProvider Errors.""" + + YOUR_PROVIDER_ERROR_CODES = { + (7001, "YourProviderCredentialsError"): { + "message": "Error loading credentials for YourProvider", + "remediation": "Check the credentials and ensure they are properly set up. API_KEY and API_SECRET are required.", + }, + (7002, "YourProviderAuthenticationError"): { + "message": "Authentication failed with YourProvider", + "remediation": "Check the API credentials and ensure they are valid and have proper permissions.", + }, + (7003, "YourProviderInvalidRegionError"): { + "message": "Invalid region provided for YourProvider", + "remediation": "Check the region and ensure it is a valid region for YourProvider.", + }, + (7004, "YourProviderSetUpSessionError"): { + "message": "Error setting up session", + "remediation": "Check the session setup and ensure it is properly configured.", + }, + (7005, "YourProviderInvalidProviderIdError"): { + "message": "Provider does not match with the expected account_id", + "remediation": "Check the provider and ensure it matches the expected account_id.", + }, + } + + def __init__(self, code, file=None, original_exception=None, message=None): + provider = "YourProvider" + error_info = self.YOUR_PROVIDER_ERROR_CODES.get((code, self.__class__.__name__)) + if message: + error_info["message"] = message + super().__init__( + code=code, + source=provider, + file=file, + original_exception=original_exception, + error_info=error_info, + ) + + +class YourProviderCredentialsError(YourProviderBaseException): + """Base class for YourProvider credentials errors.""" + + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + 7001, file=file, original_exception=original_exception, message=message + ) + + +class YourProviderAuthenticationError(YourProviderCredentialsError): + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + 7002, file=file, original_exception=original_exception, message=message + ) + + +class YourProviderInvalidRegionError(YourProviderBaseException): + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + 7003, file=file, original_exception=original_exception, message=message + ) + + +class YourProviderSetUpSessionError(YourProviderCredentialsError): + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + 7004, file=file, original_exception=original_exception, message=message + ) + + +class YourProviderInvalidProviderIdError(YourProviderBaseException): + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + 7005, file=file, original_exception=original_exception, message=message + ) +``` + +#### Step 8: Implement Service Base Class + +**Explanation:** +The service base class defines a common interface for all services in your provider, since they will inherit from it. It defines the client to make requests to, the audit configuration and the fixer configuration. + +**File:** `prowler/providers//lib/service/service.py` + +```python +from prowler.providers.._provider import Provider + +class YourProviderService(BaseService): + """ + Base service class for YourProvider services. + + This class provides common functionality for all services + within the provider, including session management and error handling. + """ + + def __init__(self, provider: Provider): + """ + Initialize the service. + + Args: + provider: The provider instance + """ + self.client = provider.session.get_client(self.service_name) + self.audit_config = provider.audit_config + self.fixer_config = provider.fixer_config +``` + +#### Step 9: Register in CLI + +**Explanation:** +Add your provider to the available providers in the CLI. + +**File:** `prowler/lib/cli/parser.py` + +```python +class ProwlerArgumentParser: + # Set the default parser + def __init__(self): + # CLI Arguments + self.parser = argparse.ArgumentParser( + prog="prowler", + formatter_class=RawTextHelpFormatter, + usage="prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,nhn,dashboard,iac,your_provider} ...", + epilog=""" +Available Cloud Providers: + {aws,azure,gcp,kubernetes,m365,github,iac,nhn,your_provider} + aws AWS Provider + azure Azure Provider + gcp GCP Provider + kubernetes Kubernetes Provider + m365 Microsoft 365 Provider + github GitHub Provider + iac IaC Provider (Preview) + nhn NHN Provider (Unofficial) + your_provider Your Provider + +Available components: + dashboard Local dashboard + +To see the different available options on a specific component, run: + prowler {provider|dashboard} -h|--help + +Detailed documentation at https://docs.prowler.com +""", +``` + +#### Step 10: Register in Main + +**Explanation:** +Main registration makes your provider discoverable by Prowler's core system. It's needed to add your provider to the output options and to the compliance evaluation. + +**File:** `prowler/__main__.py` + +```python +# In the prowler setup output options section + if provider == "aws": + output_options = AWSOutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + elif provider == "azure": + output_options = AzureOutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + elif provider == "gcp": + output_options = GCPOutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + elif provider == "kubernetes": + output_options = KubernetesOutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + elif provider == "github": + output_options = GithubOutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + elif provider == "m365": + output_options = M365OutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + elif provider == "nhn": + output_options = NHNOutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + elif provider == "iac": + output_options = IACOutputOptions( + args, bulk_checks_metadata + ) + elif provider == "your_provider": + output_options = YourProviderOutputOptions( + args, bulk_checks_metadata, global_provider.identity + ) + + + # Setup Compliance Options + elif provider == "your_provider": + for compliance_name in input_compliance_frameworks: + if compliance_name.startswith("cis_"): + # Generate CIS Finding Object (example of compliance with CIS framework) + filename = ( + f"{output_options.output_directory}/compliance/" + f"{output_options.output_filename}_{compliance_name}.csv" + ) + cis = YourProviderCIS( + findings=finding_outputs, + compliance=bulk_compliance_frameworks[compliance_name], + file_path=filename, + ) + generated_outputs["compliance"].append(cis) + cis.batch_write_data_to_file() +``` + +#### Step 11: Register in the list of providers + +**Explanation:** +This is needed to be able to use the provider in the generic checks. The provider must be registered in the `init_global_provider` method to handle CLI arguments and initialization. + +**File:** `prowler/providers/common/provider.py` + +```python +elif "your_provider" in provider_class_name.lower(): + provider_class( + username=arguments.your_provider_username, + password=arguments.your_provider_password, + tenant_id=arguments.your_provider_tenant_id, + config_path=arguments.config_file, + mutelist_path=arguments.mutelist_file, + fixer_config=fixer_config, + ) +``` + +#### Step 12: Add to Config + +**Explanation:** +Configuration registration ensures your provider is recognized by Prowler's configuration system. This enables proper handling of provider-specific settings and defaults. + +**File:** `prowler/config/config.py` + +```python +class Provider(str, Enum): + AWS = "aws" + AZURE = "azure" + GCP = "gcp" + KUBERNETES = "kubernetes" + M365 = "m365" + GITHUB = "github" + YOUR_PROVIDER = "your_provider" # Add your provider here +``` + +In some cases, you may need to create a new configuration file for your provider, for example, the AWS one that is inside `prowler/providers/aws/config.py`. + +#### Step 13: Create Compliance Files + +**Explanation:** +Compliance files define the security checks and standards that your provider supports. These JSON files map security controls to specific checks and provide remediation guidance. It's needed to create the folder with an init file to ensure the provider will work, however, adding different compliance files is optional. + +**Folder:** `prowler/compliance//` + +```json +{ + "Framework": "CIS", + "Version": "1.0", + "Provider": "your_provider", + "Description": "Description of the compliance framework", + # The requirements depends on the framework, for example, CIS has a requirements section with the checks and attributes. + "Requirements": [ + { + "Id": "1.1.1", + "Description": "Description of the requirement", + "Checks": ["your_provider_check_1", "your_provider_check_2"], + "Attributes": [] + } + ] +} +``` + +#### Step 14: Add Output Support + +**Explanation:** +Output support ensures that your provider's results are properly formatted in Prowler's various output formats (CSV, JSON, HTML, etc.). This step integrates your provider with Prowler's reporting system. + +**File:** `prowler/lib/outputs/summary_table.py` + +```python +# Add your provider case in the display_summary_table function +elif provider.type == "your_provider": + entity_type = "Your Entity Type" + audited_entities = provider.identity.your_entity_field +``` + +**File:** `prowler/lib/outputs/finding.py` + +```python +# Add your provider case in the fill_common_finding_data function +elif provider.type == "your_provider": + output_data["auth_method"] = f"Your Auth Method: {get_nested_attribute(provider, 'identity.auth_type')}" + output_data["account_uid"] = get_nested_attribute(provider, "identity.account_id") + output_data["account_name"] = get_nested_attribute(provider, "identity.account_name") + output_data["resource_name"] = check_output.resource_name + output_data["resource_uid"] = check_output.resource_id + output_data["region"] = check_output.location # or your location field +``` + +**File:** `prowler/lib/outputs/outputs.py` + +```python +# Add your provider case in the stdout_report function +if finding.check_metadata.Provider == "your_provider": + details = finding.your_location_field # e.g., finding.location, finding.namespace, etc. +``` + +#### Step 15: Generate the HTML Report + +**Explanation:** +The HTML file is needed to be able to generate the HTML report. This step involves adding support for your provider in the HTML output generation system to ensure proper display of assessment summaries and findings. + +**File:** `prowler/lib/outputs/html/html.py` + +```python +@staticmethod +def get_your_provider_assessment_summary(provider: Provider) -> str: + """ + get_your_provider_assessment_summary gets the HTML assessment summary for your provider + + Args: + provider (Provider): the provider object + + Returns: + str: the HTML assessment summary + """ + try: + return f""" +
+
+
+ Your Provider Assessment Summary +
+
    +
  • + Your Entity Type: {provider.identity.your_entity_field} +
    • +
  • + Your Location Field: {provider.identity.your_location_field} +
    • +
+
+
+
+
+
+ Your Provider Credentials +
+
    +
  • + Authentication Method: {provider.auth_method} +
    • +
  • + Identity ID: {provider.identity.identity_id} +
    • +
+
+
""" + except Exception as error: + logger.error( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" + ) + return "" +``` + +#### Step 16: Add the Check Report Model + +**Explanation:** +Add the provider to the generic models, this is needed to be able to use the provider in the generic checks. + +**File:** `prowler/providers/check/models.py` + +```python +@dataclass +class CheckReportYourProvider(CheckReport): + """ + Check report for YourProvider. + """ + resource_name: str + resource_id: str + + def _init_(self, metadata: Dict, resource: Any) -> None: + super()._init_(metadata, resource) + self.resource_name = resource.name + self.resource_id = resource.id +``` + +#### Step 17: Add Dependencies + +**Explanation:** +Dependencies ensure that your provider's required libraries are available when Prowler is installed. This step adds the necessary SDK or API client to Prowler's dependency management. + +**File:** `pyproject.toml` + +```toml +[tool.poetry.dependencies] +python = "^3.9" +# ... other dependencies +your-sdk-library = "^1.0.0" # Add your SDK dependency +``` + +#### Step 18: Create Tests + +**Explanation:** +Testing ensures that your provider works correctly and maintains compatibility as Prowler evolves. Comprehensive tests cover authentication, session management, and provider-specific functionality. + +**Folder:** `tests/providers//` + +```python +import pytest +from prowler.providers.your_provider.your_provider import YourProvider + +class TestYourProvider: + """Test cases for YourProvider.""" + + def test_provider_initialization_with_client_credentials(self): + """Test provider initialization with client credentials.""" + provider = YourProvider( + client_id="test_client_id", + client_secret="test_client_secret", + tenant_id="test_tenant_id" + ) + assert provider.type == "your_provider" + assert provider.identity is not None + assert provider.session is not None + + def test_provider_initialization_with_profile(self): + """Test provider initialization with profile.""" + provider = YourProvider( + profile="test_profile" + ) + assert provider.type == "your_provider" + assert provider.identity is not None + + def test_connection_test(self): + """Test connection functionality.""" + result = YourProvider.test_connection( + client_id="test_client_id", + client_secret="test_client_secret", + tenant_id="test_tenant_id" + ) + # Add assertions based on expected behavior + + def test_identity_retrieval(self): + """Test identity information retrieval.""" + provider = YourProvider( + client_id="test_client_id", + client_secret="test_client_secret", + tenant_id="test_tenant_id" + ) + assert provider.identity.account_id is not None + assert provider.identity.account_name is not None + + def test_argument_validation(self): + """Test argument validation.""" + from prowler.providers.your_provider.lib.arguments.arguments import ( + validate_your_provider_arguments + ) + + # Valid arguments + validate_your_provider_arguments( + client_id="test_client_id", + client_secret="test_client_secret", + tenant_id="test_tenant_id" + ) + + # Invalid arguments + with pytest.raises(ValueError, match="at least one authentication method"): + validate_your_provider_arguments() +``` + +#### Step 19: Update Documentation + +**Explanation:** +Documentation updates ensure that users can find information about your provider in Prowler's documentation. This includes examples, configuration guides, and troubleshooting information. + +Update the provider documentation to include your new provider in the examples and implementation guidance. + +--- + +### API Providers + +**Definition:** + +- Interact directly with the provider's REST API using HTTP requests (e.g., via `requests`). +- Examples: NHN Cloud. + +**Typical Use Cases:** + +- Providers without an official Python SDK. +- Providers with a non-official Python SDK that is not updated and maintained. +- Providers that expose REST APIs and meet above requirements. + +**Key Characteristics:** + +- Manual management of authentication (tokens, username/password, etc). +- Arguments: Depends on the provider, for example, `username`, `password`, `tenant_id`, etc. +- Outputs: Dicts or custom models based on API responses. +- Custom HTTP session management with headers and authentication. +- Manual handling of pagination, rate limiting, and error responses. + +**Implementation Details:** + +- API providers require manual HTTP request management using libraries like `requests`. +- Authentication typically involves obtaining tokens via login endpoints or OAuth flows. +- Session management includes setting appropriate headers (Authorization, Content-Type, etc.). +- Resource discovery often requires multiple API calls to different endpoints. +- Error handling and retry logic must be implemented manually. + +--- + +### Implementation Guide for API Providers + +#### Step 1: Create the Provider Structure + +**Explanation:** +API providers require the same structure as the SDK providers, the main difference would be that due to the lack of an official Python SDK, some methods could be implemented differently or not implemented at all. + +**Required Structure:** + +``` +prowler/providers// +├── __init__.py +├── _provider.py +├── models.py +├── exceptions/ +│ ├── __init__.py +│ └── exceptions.py +├── services/ +│ ├── service_name1/ +│ └── service_name2/ +└── lib/ + ├── __init__.py + ├── arguments/ + │ ├── __init__.py + │ └── arguments.py + ├── mutelist/ + │ ├── __init__.py + │ └── mutelist.py + ├── regions/ + │ ├── __init__.py + │ └── regions.py + └── service/ + ├── __init__.py + └── service.py +``` + +**Key Components:** + +- **`_provider.py`**: Main provider class with HTTP session management +- **`models.py`**: Data structures for identity and API responses +- **`exceptions/`**: Custom exception classes for API errors +- **`services/`**: Folder that contains all the provider services +- **`lib/arguments/`**: CLI argument validation and parsing +- **`lib/mutelist/`**: Resource exclusion and muting functionality +- **`lib/regions/`**: Region management and validation. If the provider is NOT regional, this folder will not be created. +- **`lib/service/`**: Base service class for provider-specific services + +#### Step 2: Implement the Provider Class + +**Explanation:** +The provider class is the core component that handles HTTP session management, authentication, and identity information. It inherits from Prowler's base Provider class and implements API-specific authentication flows using direct HTTP requests. + +**File:** `prowler/providers//_provider.py` + +```python +import os +from typing import Optional +import requests +from prowler.providers.common.provider import Provider +from prowler.providers.common.models import Audit_Metadata, Connection +from prowler.config.config import load_and_validate_config_file, get_default_mute_file_path +from prowler.lib.logger import logger +from prowler.lib.utils.utils import print_boxes + +# Import the needed exceptions, mutelist and models for the provider. +from prowler.providers..exceptions.exceptions import Exceptions +from prowler.providers..lib.mutelist.mutelist import Mutelist +from prowler.providers..models import NeededModels + +class APIProvider(Provider): + """ + APIProvider class is the main class for the API Provider. + + This class is responsible for initializing the provider, setting up the HTTP session, + validating credentials, and managing identity information through direct API calls. + + Attributes: + _type (str): The provider type. + _session (requests.Session): The HTTP session for API calls. + _identity (APIIdentityInfo): The provider identity information. + _audit_config (dict): The audit configuration. + _mutelist (APIMutelist): The provider mutelist. + audit_metadata (Audit_Metadata): The audit metadata. + """ + + _type: str = "api_provider" + _session: Optional[requests.Session] + _identity: APIIdentityInfo + _audit_config: dict + _mutelist: APIMutelist + audit_metadata: Audit_Metadata + + def __init__( + self, + # Authentication parameters + username: str = None, + password: str = None, + tenant_id: str = None, + # Configuration + config_path: str = None, + config_content: dict = None, + mutelist_path: str = None, + mutelist_content: dict = None, + fixer_config: dict = None, + ): + """ + Initializes the APIProvider instance. + + Args: + username: The API username for authentication + password: The API password for authentication + tenant_id: The tenant ID for authentication + config_path: Path to the configuration file + config_content: Configuration content as dictionary + mutelist_path: Path to the mutelist file + mutelist_content: Mutelist content as dictionary + fixer_config: Fixer configuration dictionary + + Raises: + ValueError: If required authentication parameters are missing + """ + logger.info("Initializing APIProvider ...") + + # 1) Store argument values with environment variable fallback + self._username = username or os.getenv("YOUR_PROVIDER_USERNAME") + self._password = password or os.getenv("YOUR_PROVIDER_PASSWORD") + self._tenant_id = tenant_id or os.getenv("YOUR_PROVIDER_TENANT_ID") + + # Validate required parameters + if not all([self._username, self._password, self._tenant_id]): + raise ValueError("APIProvider requires username, password and tenant_id") + + # 2) Load audit_config, fixer_config, mutelist + self._fixer_config = fixer_config if fixer_config else {} + + if config_content: + self._audit_config = config_content + else: + if not config_path: + config_path = default_config_file_path + self._audit_config = load_and_validate_config_file(self._type, config_path) + + if mutelist_content: + self._mutelist = APIMutelist(mutelist_content=mutelist_content) + else: + if not mutelist_path: + mutelist_path = get_default_mute_file_path(self._type) + self._mutelist = APIMutelist(mutelist_path=mutelist_path) + + # 3) Initialize session/token + self._token = None + self._session = None + self.setup_session() + + # 4) Create identity object + self._identity = APIIdentityInfo( + tenant_id=self._tenant_id, + username=self._username, + ) + + Provider.set_global_provider(self) + + @property + def type(self) -> str: + """Returns the type of the provider.""" + return self._type + + @property + def identity(self) -> APIIdentityInfo: + """Returns the provider identity information.""" + return self._identity + + @property + def session(self) -> requests.Session: + """Returns the HTTP session for API calls.""" + return self._session + + @property + def audit_config(self) -> dict: + """Returns the audit configuration.""" + return self._audit_config + + @property + def fixer_config(self) -> dict: + """Returns the fixer configuration.""" + return self._fixer_config + + @property + def mutelist(self) -> APIMutelist: + """Returns the provider mutelist.""" + return self._mutelist + + def print_credentials(self) -> None: + """ + Display account information with color formatting. + + This method prints the provider credentials and account information + in a formatted way using colorama for better readability. + """ + from colorama import Style + + report_lines = [ + f" Username: {self._username}", + f" TenantID: {self._tenant_id}", + ] + report_title = f"{Style.BRIGHT}Using the {self._type.upper()} credentials below:{Style.RESET_ALL}" + print_boxes(report_lines, report_title) + + def setup_session(self) -> None: + """ + Implement API authentication method by calling the provider's authentication endpoint. + + This method performs the authentication flow to obtain an access token + and creates a requests.Session with the appropriate headers for API calls. + """ + # Example for a Keystone-like authentication + url = "https://api.your-provider.com/v2.0/tokens" + data = { + "auth": { + "tenantId": self._tenant_id, + "passwordCredentials": { + "username": self._username, + "password": self._password, + }, + } + } + + try: + response = requests.post(url, json=data, timeout=10) + if response.status_code == 200: + resp_json = response.json() + self._token = resp_json["access"]["token"]["id"] + + # Create session with authentication headers + sess = requests.Session() + sess.headers.update({ + "X-Auth-Token": self._token, + "Content-Type": "application/json" + }) + self._session = sess + logger.info("API token acquired successfully and session is set up.") + else: + logger.critical( + f"Failed to get token. Status: {response.status_code}, Body: {response.text}" + ) + raise ValueError("Failed to get API token") + except Exception as e: + logger.critical(f"[setup_session] Error: {e}") + raise e + + @staticmethod + def test_connection( + username: str, + password: str, + tenant_id: str, + raise_on_exception: bool = True, + ) -> Connection: + """ + Test connection to the API provider by performing: + 1) Authentication token request + 2) (Optional) a small test API call to confirm credentials are valid + + Args: + username: The API username + password: The API password + tenant_id: The tenant ID + raise_on_exception: If True, raise the caught exception; + if False, return Connection(error=exception). + + Returns: + Connection: Connection test result + """ + try: + # 1) Validate arguments + if not username or not password or not tenant_id: + error_msg = "API test_connection error: missing username/password/tenant_id" + logger.error(error_msg) + raise ValueError(error_msg) + + # 2) Request authentication token + token_url = "https://api.your-provider.com/v2.0/tokens" + data = { + "auth": { + "tenantId": tenant_id, + "passwordCredentials": { + "username": username, + "password": password, + }, + } + } + + resp = requests.post(token_url, json=data, timeout=10) + if resp.status_code != 200: + error_msg = f"Failed to get token. Status: {resp.status_code}, Body: {resp.text}" + logger.error(error_msg) + if raise_on_exception: + raise Exception(error_msg) + return Connection(error=Exception(error_msg)) + + # Success + token_json = resp.json() + api_token = token_json["access"]["token"]["id"] + logger.info("API test_connection: Successfully acquired token.") + + # 3) (Optional) Test API call to confirm credentials are valid + test_endpoint = f"https://api.your-provider.com/v2/{tenant_id}/test" + headers = { + "X-Auth-Token": api_token, + "Content-Type": "application/json", + } + + test_resp = requests.get(test_endpoint, headers=headers, timeout=10) + if test_resp.status_code == 200: + logger.info("API test_connection: Test call success. Credentials valid.") + return Connection(is_connected=True) + else: + error_msg = f"Test call failed. Status: {test_resp.status_code}, Body: {test_resp.text}" + logger.error(error_msg) + if raise_on_exception: + raise Exception(error_msg) + return Connection(error=Exception(error_msg)) + + except Exception as e: + logger.critical(f"{e.__class__.__name__}[{e.__traceback__.tb_lineno}]: {e}") + if raise_on_exception: + raise e + return Connection(error=e) + + @staticmethod + def validate_arguments(username: str, password: str, tenant_id: str) -> None: + """ + Ensures that username, password, and tenant_id are not empty. + + Args: + username: The username to validate + password: The password to validate + tenant_id: The tenant ID to validate + + Raises: + ValueError: If any required parameter is missing + """ + if not username or not password or not tenant_id: + raise ValueError("API Provider requires username, password and tenant_id.") +``` + +#### Step 3: Create Models + +**Explanation:** +Models define the data structures used by your API provider. They include identity information and API response structures. These models ensure type safety and consistent data handling across the provider. + +**File:** `prowler/providers//models.py` + +This step is common with SDK providers so you can follow the same pattern as [there](#step-3-create-models). + +#### Step 4: Implement Arguments + +**Explanation:** +Argument validation ensures that the API provider receives valid configuration parameters. This step is crucial for preventing runtime errors and providing clear error messages to users. + +**File:** `prowler/providers//lib/arguments/arguments.py` + +Arguments depends on the provider and not the type, so the pattern for this step is the same as the [SDK providers](#step-4-implement-arguments). + +#### Step 5: Implement Mutelist + +**Explanation:** +The mutelist functionality allows users to exclude specific resources or checks from the audit. This is useful for handling false positives or excluding resources that are intentionally configured differently. + +**File:** `prowler/providers//lib/mutelist/mutelist.py` + +The implementation of the mutelist is the same as the [SDK providers](#step-5-implement-mutelist). + +#### Step 6: Implement Regions + +**Explanation:** +Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality. + + +Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does. + + +**File:** `prowler/providers//lib/regions/_regions.py` + +The implementation of the regions is the same as the [SDK providers](#step-6-implement-regions). + +#### Step 7: Create Custom Exceptions + +**Explanation:** +Custom exceptions provide specific error handling for API-related issues, making debugging and error reporting more effective. Prowler uses a structured exception system with error codes, messages, and remediation steps. + +**File:** `prowler/providers//exceptions/exceptions.py` + +```python +from prowler.exceptions.exceptions import ProwlerException + + +# Exceptions codes from 8000 to 8999 are reserved for API Provider exceptions (example numbers) +class APIProviderBaseException(ProwlerException): + """Base class for API Provider Errors.""" + + APIProvider_ERROR_CODES = { + (8000, "APIProviderCredentialsError"): { + "message": "API Provider credentials not found or invalid", + "remediation": "Check the API Provider API credentials and ensure they are properly set.", + }, + (8001, "APIProviderAuthenticationError"): { + "message": "API Provider authentication failed", + "remediation": "Check the API Provider API credentials and ensure they are valid.", + }, + (8002, "APIProviderSessionError"): { + "message": "API Provider session setup failed", + "remediation": "Check the session setup and ensure it is properly configured.", + }, + (8003, "APIProviderIdentityError"): { + "message": "API Provider identity setup failed", + "remediation": "Check credentials and ensure they are properly set up for API Provider.", + }, + (8004, "APIProviderAPIError"): { + "message": "API Provider API call failed", + "remediation": "Check the API request and ensure it is properly formatted.", + }, + (8005, "APIProviderRateLimitError"): { + "message": "API Provider API rate limit exceeded", + "remediation": "Reduce the number of API requests or wait before making more requests.", + }, + } + + def __init__(self, code, file=None, original_exception=None, message=None): + provider = "API Provider" + error_info = self.APIProvider_ERROR_CODES.get((code, self.__class__.__name__)) + if message: + error_info["message"] = message + super().__init__( + code=code, + source=provider, + file=file, + original_exception=original_exception, + error_info=error_info, + ) + + +class APIProviderCredentialsError(APIProviderBaseException): + """Exception for API Provider credentials errors""" + + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + code=8000, + file=file, + original_exception=original_exception, + message=message, + ) + + +class APIProviderAuthenticationError(APIProviderBaseException): + """Exception for API Provider authentication errors""" + + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + code=8001, + file=file, + original_exception=original_exception, + message=message, + ) + + +class APIProviderSessionError(APIProviderBaseException): + """Exception for API Provider session setup errors""" + + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + code=8002, + file=file, + original_exception=original_exception, + message=message, + ) + + +class APIProviderIdentityError(APIProviderBaseException): + """Exception for API Provider identity setup errors""" + + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + code=8003, + file=file, + original_exception=original_exception, + message=message, + ) + + +class APIProviderAPIError(APIProviderBaseException): + """Exception for API Provider API errors""" + + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + code=8004, + file=file, + original_exception=original_exception, + message=message, + ) + + +class APIProviderRateLimitError(APIProviderBaseException): + """Exception for API Provider rate limit errors""" + + def __init__(self, file=None, original_exception=None, message=None): + super().__init__( + code=8005, + file=file, + original_exception=original_exception, + message=message, + ) +``` + +#### Step 8: Implement Service Base Class + +**Explanation:** +The service base class defines a common interface for all services in your provider, since they will inherit from it. It defines the client to make requests to, the audit configuration and the fixer configuration. + +**File:** `prowler/providers//lib/service/service.py` + +```python +from prowler.providers.._provider import Provider + +class APIProviderService(BaseService): + """ + Base service class for API Provider services. + + This class provides common functionality for all services + within the provider, including session management and error handling. + """ + + def __init__(self, provider: Provider): + """ + Initialize the service. + + Args: + provider: The provider instance + """ + self.client = provider.session.get_client(self.service_name) + self.audit_config = provider.audit_config + self.fixer_config = provider.fixer_config + self.session = provider.session + self.base_url = provider.session.base_url + self.auth = HTTPDigestAuth( + provider.session.public_key, + provider.session.private_key, + ) + self.headers = { + "Authorization": self.auth.encode(), + "Content-Type": "application/json", + } +``` + +#### Step 9: Register in CLI + +**Explanation:** +Add your provider to the available providers in the CLI. + +**File:** `prowler/lib/cli/parser.py` + +This step is the same as the [SDK providers](#step-9-register-in-cli). + +#### Step 10: Register in Main + +**Explanation:** +Main registration makes your provider discoverable by Prowler's core system. It's needed to add your provider to the output options and to the compliance evaluation. + +**File:** `prowler/__main__.py` + +This step is the same as the [SDK providers](#step-10-register-in-main). + +#### Step 11: Register in the list of providers + +**Explanation:** +This is needed to be able to use the provider in the generic checks. The provider must be registered in the `init_global_provider` method to handle CLI arguments and initialization. + +**File:** `prowler/providers/common/provider.py` + +This step is the same as the [SDK providers](#step-11-register-in-the-list-of-providers). + +#### Step 12: Add to Config + +**Explanation:** +Configuration registration ensures your API provider is recognized by Prowler's configuration system. This enables proper handling of provider-specific settings and defaults. + +**File:** `prowler/config/config.py` + +This step is the same as the [SDK providers](#step-12-add-to-config). + +#### Step 13: Create Compliance Files + +**Explanation:** +Compliance files define the security checks and standards that your provider supports. These JSON files map security controls to specific checks and provide remediation guidance. It's needed to create the folder with an init file to ensure the provider will work, however, adding different compliance files is optional. + +**Folder:** `prowler/compliance//` + +This step is the same as the [SDK providers](#step-13-create-compliance-files). + +#### Step 14: Add Output Support + +**Explanation:** +Output support ensures that your provider's results are properly formatted in Prowler's various output formats (CSV, JSON, HTML, etc.). This step integrates your provider with Prowler's reporting system. + +**File:** `prowler/lib/outputs/summary_table.py` + +This step is the same as the [SDK providers](#step-14-add-output-support). + +#### Step 15: Generate the HTML Report + +**Explanation:** +The HTML file is needed to be able to generate the HTML report. This step involves adding support for your provider in the HTML output generation system to ensure proper display of assessment summaries and findings. + +**File:** `prowler/lib/outputs/html/html.py` + +This step is the same as the [SDK providers](#step-15-generate-the-html-report). + +#### Step 16: Add the Check Report Model + +**Explanation:** +Add the provider to the generic models, this is needed to be able to use the provider in the generic checks. + +**File:** `prowler/providers/check/models.py` + +This step is the same as the [SDK providers](#step-16-add-the-check-report-model). + +#### Step 17: Create Tests + +**Explanation:** +Testing ensures that your API provider works correctly and maintains compatibility as Prowler evolves. Comprehensive tests cover authentication, session management, and API-specific functionality. + +**Folder:** `tests/providers//` + +```python +import pytest +from prowler.providers.api_provider.api_provider import APIProvider + +class TestAPIProvider: + """Test cases for APIProvider.""" + + def test_provider_initialization(self): + """Test provider initialization with valid credentials.""" + provider = APIProvider( + username="test_user", + password="test_password", + tenant_id="test_tenant" + ) + assert provider.type == "your_api_provider" + assert provider.identity is not None + assert provider.session is not None + + def test_connection_test(self): + """Test connection functionality.""" + result = APIProvider.test_connection( + username="test_user", + password="test_password", + tenant_id="test_tenant" + ) + # Add assertions based on expected behavior + + def test_argument_validation(self): + """Test argument validation.""" + from prowler.providers.api_provider.api_provider import ( + APIProvider + ) + + # Valid arguments + APIProvider.validate_arguments( + username="test_user", + password="test_password", + tenant_id="test_tenant" + ) + + # Invalid arguments + with pytest.raises(ValueError, match="requires username, password and tenant_id"): + APIProvider.validate_arguments("", "", "") + + def test_session_setup(self): + """Test session setup.""" + provider = APIProvider( + username="test_user", + password="test_password", + tenant_id="test_tenant" + ) + assert provider.session is not None + assert "X-Auth-Token" in provider.session.headers +``` + +#### Step 18: Update Documentation + +**Explanation:** +Documentation updates ensure that users can find information about your API provider in Prowler's documentation. This includes examples, configuration guides, and troubleshooting information. + +Update the provider documentation to include your new API provider in the examples and implementation guidance. + +--- + +### Tool/Wrapper Providers + +**Definition:** + +- Integrate third-party tools as libraries or subprocesses (e.g., Trivy for IaC). +- Examples: IaC (Trivy). + +**Typical Use Cases:** + +- Providers that require integration with external security tools. +- Tools that need to be executed as subprocesses or imported as libraries. +- Providers that require specific tool configurations and argument mapping. +- Legacy systems or tools that don't have direct API access. + +**Key Characteristics:** + +- No session/identity management required (tool handles this internally). +- Arguments: specific to the tool, but for example: `scan_path`, `frameworks`, `exclude_path`, `scan_repository_url`, etc. +- Outputs: Tool-specific output formats that need to be parsed and converted. +- Tool execution and output parsing. +- Configuration file mapping and argument translation. + +**Implementation Details:** + +- Tool providers typically execute external tools as subprocesses (e.g., `pwsh` or `trivy` command). +- They require mapping between Prowler's interface and the tool's arguments. +- Output parsing and conversion to Prowler's standard format is crucial. +- Tool-specific configuration files and validation. +- Repository cloning and temporary file management for remote scans (if needed). + +**Note:** This guide provides a general framework for integrating any external tool. The specific implementation details (like repository cloning, authentication tokens, etc.) will depend on your particular tool's requirements. The core pattern is: integrate with Prowler's CLI, execute your tool via subprocess, and parse the output into Prowler's format. + +--- + +### Implementation Guide for Tool/Wrapper Providers + +#### Step 1: Create the Provider Structure + +**Explanation:** +Tool/Wrapper providers require a specific folder structure to organize tool integration, configuration, and service management. This structure follows Prowler's conventions and ensures proper integration with the CLI and API. + +**Required Structure:** + +``` +prowler/providers// +├── __init__.py +├── _provider.py +├── models.py +└── lib/ + ├── __init__.py + └── arguments/ + ├── __init__.py + └── arguments.py +``` + +**Key Components:** + +- **`_provider.py`**: Main provider class with tool integration +- **`models.py`**: Data structures for tool output and configuration +- **`lib/arguments/`**: CLI argument validation and parsing + +#### Step 2: Implement the Provider Class + +**Explanation:** +The provider class is the core component that handles tool integration, execution, and output parsing. It inherits from Prowler's base Provider class and implements tool-specific execution flows using subprocesses or library calls. + +**File:** `prowler/providers//_provider.py` + +```python +import json +import subprocess +import sys +from typing import List + +from colorama import Fore, Style + +from prowler.config.config import ( + default_config_file_path, + load_and_validate_config_file, +) +from prowler.lib.check.models import CheckReportYourTool +from prowler.lib.logger import logger +from prowler.lib.utils.utils import print_boxes +from prowler.providers.common.models import Audit_Metadata +from prowler.providers.common.provider import Provider + +class ToolProvider(Provider): + """ + ToolProvider class is the main class for the Your Tool Provider. + + This class is responsible for initializing the provider, executing the external tool, + parsing tool output, and converting results to Prowler's standard format. + + Attributes: + _type (str): The provider type. + _session: Not used for tool providers. + _identity (str): Simple identity for tool providers. + _audit_config (dict): The audit configuration. + audit_metadata (Audit_Metadata): The audit metadata. + """ + + _type: str = "your_tool_provider" + audit_metadata: Audit_Metadata + + def __init__( + self, + # Tool-specific parameters + scan_path: str = ".", + tool_specific_arg: str = "default_value", + exclude_path: list[str] = [], + # Configuration + config_path: str = None, + config_content: dict = None, + fixer_config: dict = {}, + # Authentication (if needed for your tool) + auth_token: str = None, + auth_username: str = None, + ): + """ + Initializes the ToolProvider instance. + + Args: + scan_path: Path to the folder containing files to scan + tool_specific_arg: Tool-specific argument for your external tool + exclude_path: List of paths to exclude from scan + config_path: Path to the configuration file + config_content: Configuration content as dictionary + fixer_config: Fixer configuration dictionary + auth_token: Authentication token for your tool (if needed) + auth_username: Username for your tool (if needed) + + Raises: + ValueError: If required parameters are missing + """ + logger.info("Instantiating YourTool Provider...") + + # Store tool-specific parameters + self.scan_path = scan_path + self.tool_specific_arg = tool_specific_arg + self.exclude_path = exclude_path + self.region = "global" + self.audited_account = "local-tool" + self._session = None + self._identity = "prowler" + self._auth_method = "No auth" + + # Handle tool authentication if needed + if auth_token: + self.auth_token = auth_token + self._auth_method = "Token" + logger.info("Using token for tool authentication") + elif auth_username: + self.auth_username = auth_username + self._auth_method = "Username" + logger.info("Using username for tool authentication") + logger.info("Using username for tool authentication") + else: + logger.debug("No authentication method provided; proceeding without authentication.") + + # Audit Config + if config_content: + self._audit_config = config_content + else: + if not config_path: + config_path = default_config_file_path + self._audit_config = load_and_validate_config_file(self._type, config_path) + + # Fixer Config + self._fixer_config = fixer_config + + # Mutelist (not needed for tool providers since tools have their own mutelist logic) + self._mutelist = None + + Provider.set_global_provider(self) + + @property + def auth_method(self): + """Returns the authentication method used.""" + return self._auth_method + + @property + def type(self): + """Returns the type of the provider.""" + return self._type + + @property + def identity(self): + """Returns the provider identity.""" + return self._identity + + @property + def session(self): + """Returns the session (not used for tool providers).""" + return self._session + + @property + def audit_config(self): + """Returns the audit configuration.""" + return self._audit_config + + @property + def fixer_config(self): + """Returns the fixer configuration.""" + return self._fixer_config + + def setup_session(self): + """Tool providers don't need a session since they use external tools directly""" + return None + + def _process_check(self, finding: dict, check: dict, status: str) -> CheckReportYourTool: + """ + Process a single check (failed or passed) and create a CheckReportYourTool object. + + Args: + finding: The finding object from tool output + check: The individual check data + status: The status of the check ("FAIL", "PASS", or "MUTED") + + Returns: + CheckReportYourTool: The processed check report + """ + try: + metadata_dict = { + "Provider": "your_tool_provider", + "CheckID": check.get("check_id", ""), + "CheckTitle": check.get("check_name", ""), + "CheckType": ["Your Tool Provider"], + "ServiceName": finding["check_type"], + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": ( + check.get("severity", "low").lower() + if check.get("severity") + else "low" + ), + "ResourceType": "your_tool", + "Description": check.get("check_name", ""), + "Risk": "", + "RelatedUrl": ( + check.get("guideline", "") if check.get("guideline") else "" + ), + "Remediation": { + "Code": { + "NativeIaC": "", + "Terraform": "", + "CLI": "", + "Other": "", + }, + "Recommendation": { + "Text": "", + "Url": ( + check.get("guideline", "") if check.get("guideline") else "" + ), + }, + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "", + } + + # Convert metadata dict to JSON string + metadata = json.dumps(metadata_dict) + + report = CheckReportYourTool(metadata=metadata, finding=check) + report.status = status + report.resource_tags = check.get("entity_tags", {}) + report.status_extended = check.get("check_name", "") + if status == "MUTED": + report.muted = True + return report + except Exception as error: + logger.critical( + f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}" + ) + sys.exit(1) + + def run(self) -> List[CheckReportYourTool]: + """ + Main execution method that handles tool execution. + + Returns: + List[CheckReportYourTool]: List of check reports from the tool scan + """ + return self.run_scan(self.scan_path, self.exclude_path) + + def run_scan( + self, directory: str, exclude_path: list[str] + ) -> List[CheckReportYourTool]: + """ + Execute the external tool and parse its output. + + Args: + directory: Directory to scan + frameworks: List of frameworks to scan + exclude_path: List of paths to exclude + + Returns: + List[CheckReportYourTool]: List of check reports + """ + try: + logger.info(f"Running YourTool scan on {directory} ...") + + # Build the tool command + tool_command = [ + "your_tool_command", + # Add your tool-specific arguments here, this are just examples + "-d", + directory, + "-o", + "json", + "-f", + ",".join(frameworks), + ] + if exclude_path: + tool_command.extend(["--skip-path", ",".join(exclude_path)]) + + # Run the tool with JSON output + process = subprocess.run( + tool_command, + capture_output=True, + text=True, + ) + + # Log tool's error output if any + if process.stderr: + logger.error(process.stderr) + + try: + output = json.loads(process.stdout) + if not output: + logger.warning("No findings returned from YourTool scan") + return [] + except Exception as error: + logger.critical( + f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}" + ) + sys.exit(1) + + reports = [] + + # If only one framework has findings, the output is a dict, otherwise it's a list of dicts + if isinstance(output, dict): + output = [output] + + # Process all frameworks findings + for finding in output: + results = finding.get("results", {}) + + # Process failed checks + failed_checks = results.get("failed_checks", []) + for failed_check in failed_checks: + report = self._process_check(finding, failed_check, "FAIL") + reports.append(report) + + # Process passed checks + passed_checks = results.get("passed_checks", []) + for passed_check in passed_checks: + report = self._process_check(finding, passed_check, "PASS") + reports.append(report) + + # Process skipped checks (muted) + skipped_checks = results.get("skipped_checks", []) + for skipped_check in skipped_checks: + report = self._process_check(finding, skipped_check, "MUTED") + reports.append(report) + + return reports + + except Exception as error: + if "No such file or directory: 'your_tool_command'" in str(error): + logger.critical("Please, install your_tool using 'pip install your_tool'") + sys.exit(1) + logger.critical( + f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}" + ) + sys.exit(1) + + def print_credentials(self): + """ + Display scan information with color formatting. + + This method prints the tool scan information in a formatted way + using colorama for better readability. + """ + if self.scan_repository_url: + report_title = ( + f"{Style.BRIGHT}Scanning remote repository:{Style.RESET_ALL}" + ) + report_lines = [ + f"Repository: {Fore.YELLOW}{self.scan_repository_url}{Style.RESET_ALL}", + ] + else: + report_title = ( + f"{Style.BRIGHT}Scanning local directory:{Style.RESET_ALL}" + ) + report_lines = [ + f"Directory: {Fore.YELLOW}{self.scan_path}{Style.RESET_ALL}", + ] + + if self.exclude_path: + report_lines.append( + f"Excluded paths: {Fore.YELLOW}{', '.join(self.exclude_path)}{Style.RESET_ALL}" + ) + + report_lines.append( + f"Frameworks: {Fore.YELLOW}{', '.join(self.frameworks)}{Style.RESET_ALL}" + ) + + report_lines.append( + f"Authentication method: {Fore.YELLOW}{self.auth_method}{Style.RESET_ALL}" + ) + + print_boxes(report_lines, report_title) +``` + +#### Step 3: Create Models + +**Explanation:** +Models define the data structures used by your tool provider. They include output options and tool-specific configurations. These models ensure type safety and consistent data handling across the provider. + +**File:** `prowler/providers//models.py` + +```python +from prowler.config.config import output_file_timestamp +from prowler.providers.common.models import ProviderOutputOptions + +class YourToolOutputOptions(ProviderOutputOptions): + """ + YourToolOutputOptions overrides ProviderOutputOptions for tool-specific output logic. + For example, generating a filename that includes the tool name. + + Attributes inherited from ProviderOutputOptions: + - output_filename (str): The base filename used for generated reports. + - output_directory (str): The directory to store the output files. + - ... see ProviderOutputOptions for more details. + + Methods: + - __init__: Customizes the output filename logic for the tool provider. + """ + + def __init__(self, arguments, bulk_checks_metadata): + super().__init__(arguments, bulk_checks_metadata) + + # If --output-filename is not specified, build a default name. + if not getattr(arguments, "output_filename", None): + self.output_filename = f"prowler-output-your_tool-{output_file_timestamp}" + # If --output-filename was explicitly given, respect that + else: + self.output_filename = arguments.output_filename +``` + +#### Step 4: Implement Arguments + +**Explanation:** +Argument validation ensures that the tool provider receives valid configuration parameters. This step is crucial for preventing runtime errors and providing clear error messages to users. + +**File:** `prowler/providers//lib/arguments/arguments.py` + +```python +# Add your tool-specific choices if needed +TOOL_SPECIFIC_CHOICES = [ + "option1", + "option2", + "option3", + # Add your tool's supported options +] + +def init_parser(self): + """Init the Provider CLI parser""" + _parser = self.subparsers.add_parser( + "", parents=[self.common_providers_parser], help=" Provider" + ) + + # Scan Path + _scan_subparser = _parser.add_argument_group("Scan Path") + _scan_subparser.add_argument( + "--scan-path", + "-P", + dest="scan_path", + default=".", + help="Path to the folder containing your files to scan. Default: current directory.", + ) + + _scan_subparser.add_argument( + "--tool-specific-arg", + dest="tool_specific_arg", + default="default_value", + choices=TOOL_SPECIFIC_CHOICES, + help="Tool-specific argument for your external tool. Default: default_value", + ) + + _scan_subparser.add_argument( + "--exclude-path", + dest="exclude_path", + nargs="+", + default=[], + help="Comma-separated list of paths to exclude from the scan. Default: none", + ) + + # Authentication (if needed for your tool) + _scan_subparser.add_argument( + "--auth-token", + dest="auth_token", + nargs="?", + default=None, + help="Authentication token for your tool. If not provided, will use YOUR_TOOL_AUTH_TOKEN env var.", + ) + _scan_subparser.add_argument( + "--auth-username", + dest="auth_username", + nargs="?", + default=None, + help="Username for your tool authentication. If not provided, will use YOUR_TOOL_AUTH_USERNAME env var.", + ) + +def validate_arguments(arguments): + """ + Validate tool-specific arguments. + + Args: + arguments: The parsed arguments + + Returns: + tuple: (is_valid, error_message) + """ + scan_path = getattr(arguments, "scan_path", None) + scan_repository_url = getattr(arguments, "scan_repository_url", None) + + if scan_path and scan_repository_url: + # If scan_path is set to default ("."), allow scan_repository_url + if scan_path != ".": + return ( + False, + "--scan-path (-P) and --scan-repository-url (-R) are mutually exclusive. Please specify only one.", + ) + return (True, "") +``` + +#### Step 5: Register in CLI + +**Explanation:** +Add your provider to the available providers in the CLI. + +**File:** `prowler/lib/cli/parser.py` + +This step is the same as the [SDK providers](#step-9-register-in-cli). + +#### Step 6: Register in Main + +**Explanation:** +Main registration makes your provider discoverable by Prowler's core system. It's needed to add your provider to the output options and to the compliance evaluation. + +**File:** `prowler/__main__.py` + +This step is the same as the [SDK providers](#step-10-register-in-main). + +#### Step 7: Register in the list of providers + +**Explanation:** +This is needed to be able to use the provider in the generic checks. The provider must be registered in the `init_global_provider` method to handle CLI arguments and initialization. + +**File:** `prowler/providers/common/provider.py` + +This step is the same as the [SDK providers](#step-11-register-in-the-list-of-providers). + +#### Step 8: Add to Config + +**Explanation:** +Configuration registration ensures your tool provider is recognized by Prowler's configuration system. This enables proper handling of provider-specific settings and defaults. + +**File:** `prowler/config/config.py` + +This step is the same as the [SDK providers](#step-12-add-to-config). + +In some cases, you may need to create a new configuration file for your provider, for example, the AWS one that is inside `prowler/providers/aws/config.py`. + +#### Step 9: Create Compliance Files + +**Explanation:** +Compliance files define the security checks and standards that your provider supports. These JSON files map security controls to specific checks and provide remediation guidance. It's needed to create the folder with an init file to ensure the provider will work, however, adding different compliance files is optional. + +**Folder:** `prowler/compliance//` + +This step is the same as the [SDK providers](#step-13-create-compliance-files). + +#### Step 10: Add Output Support + +**Explanation:** +Output support ensures that your provider's results are properly formatted in Prowler's various output formats (CSV, JSON, HTML, etc.). This step integrates your provider with Prowler's reporting system. + +**File:** `prowler/lib/outputs/summary_table.py` + +This step is the same as the [SDK providers](#step-14-add-output-support). + +#### Step 11: Generate the HTML Report + +**Explanation:** +The HTML file is needed to be able to generate the HTML report. This step involves adding support for your provider in the HTML output generation system to ensure proper display of assessment summaries and findings. + +**File:** `prowler/lib/outputs/html/html.py` + +This step is the same as the [SDK providers](#step-15-generate-the-html-report). + +#### Step 12: Add the Check Report Model + +**Explanation:** +Add the provider to the generic models, this is needed to be able to use the provider in the generic checks. + +**File:** `prowler/providers/check/models.py` + +This step is the same as the [SDK providers](#step-16-add-the-check-report-model). + +#### Step 13: Create Tests + +**Explanation:** +Testing ensures that your tool provider works correctly and maintains compatibility as Prowler evolves. Comprehensive tests cover tool execution, output parsing, and provider-specific functionality. + +**Folder:** `tests/providers//` + +```python +import pytest +import tempfile +import os +from prowler.providers.your_tool_provider.your_tool_provider import ToolProvider + +class TestToolProvider: + """Test cases for ToolProvider.""" + + def test_provider_initialization(self): + """Test provider initialization with valid parameters.""" + provider = ToolProvider( + scan_path=".", + frameworks=["framework1"] + ) + assert provider.type == "your_tool_provider" + assert provider.identity == "prowler" + assert provider.scan_path == "." + + def test_tool_execution(self): + """Test tool execution and output parsing.""" + provider = ToolProvider(scan_path=".") + # Mock the subprocess call and test output parsing + # This will depend on your specific tool's output format + + def test_argument_validation(self): + """Test argument validation.""" + from prowler.providers.your_tool_provider.lib.arguments.arguments import ( + validate_arguments + ) + + # Valid arguments + class MockArgs: + scan_path = "." + tool_specific_arg = "value" + + is_valid, message = validate_arguments(MockArgs()) + assert is_valid is True + + # Add more test cases as needed for your specific tool provider + + def test_print_credentials(self): + """Test print_credentials method.""" + provider = ToolProvider( + scan_path="/test/path", + frameworks=["framework1"] + ) + # This should not raise any exceptions + provider.print_credentials() +``` + +#### Step 14: Update Documentation + +**Explanation:** +Documentation updates ensure that users can find information about your tool provider in Prowler's documentation. This includes examples, configuration guides, and troubleshooting information. + +Update the provider documentation to include your new tool provider in the examples and implementation guidance. + +--- + + +## Step 2: Integrate the Provider in the API + +This step is required only if you want your provider to be available in the API and UI. The API integration involves several components: + +### 2.1. Backend API Models + +**Location:** `api/src/backend/api/models.py` + +Add your provider to the `ProviderChoices` enum and implement UID validation: + +```python +class ProviderChoices(models.TextChoices): + AWS = "aws", "AWS" + AZURE = "azure", "Azure" + GCP = "gcp", "GCP" + KUBERNETES = "kubernetes", "Kubernetes" + M365 = "m365", "Microsoft 365" + GITHUB = "github", "GitHub" + NHN = "nhn", "NHN Cloud" + IAC = "iac", "Infrastructure as Code" + YOUR_PROVIDER = "your_provider", "Your Provider" # Add your provider here + +@staticmethod +def validate_your_provider_uid(value): + """Validate your provider UID format.""" + if not re.match(r"^your-regex-pattern$", value): + raise ModelValidationError( + detail="Your provider UID must follow the specified format.", + code="your-provider-uid", + pointer="/data/attributes/uid", + ) +``` + +**Provider Model:** +The `Provider` model already exists and supports all provider types. Ensure your provider type is included in the choices. + +### 2.2. Add the provider to the Provider Choices + +Update the `return_prowler_provider` function to include your provider. This function is crucial for the API to instantiate the correct provider class. + +**File:** `api/src/backend/api/utils.py` + +```python +from prowler.providers.your_provider.your_provider import YourProvider # Add your import + +def return_prowler_provider( + provider: Provider, +) -> [ + AwsProvider + | AzureProvider + | GcpProvider + | GithubProvider + | KubernetesProvider + | M365Provider + | YourProvider # Add your provider to the return type annotation +]: + """Return the Prowler provider class based on the given provider type.""" + match provider.provider: + case Provider.ProviderChoices.AWS.value: + prowler_provider = AwsProvider + case Provider.ProviderChoices.AZURE.value: + prowler_provider = AzureProvider + case Provider.ProviderChoices.GCP.value: + prowler_provider = GcpProvider + case Provider.ProviderChoices.KUBERNETES.value: + prowler_provider = KubernetesProvider + case Provider.ProviderChoices.M365.value: + prowler_provider = M365Provider + case Provider.ProviderChoices.GITHUB.value: + prowler_provider = GithubProvider + case Provider.ProviderChoices.YOUR_PROVIDER.value: # Add your provider here + prowler_provider = YourProvider + case _: + raise ValueError(f"Provider type {provider.provider} not supported") + return prowler_provider +``` + +**Also update the `initialize_prowler_provider` function:** + +```python +def initialize_prowler_provider( + provider: Provider, + mutelist_processor: Processor | None = None, +) -> ( + AwsProvider + | AzureProvider + | GcpProvider + | GithubProvider + | KubernetesProvider + | M365Provider + | YourProvider # Add your provider to the return type annotation +): + """Initialize a Prowler provider instance based on the given provider type.""" + prowler_provider = return_prowler_provider(provider) + prowler_provider_kwargs = get_prowler_provider_kwargs(provider, mutelist_processor) + return prowler_provider(**prowler_provider_kwargs) +``` + +**Note:** The `match` statement requires Python 3.10+. If you're using an older version, you can use traditional `if-elif` statements instead. + +### 2.3. API Serializers + +Create or update serializers for your provider. You'll need to add your provider to the validation logic: + +**File:** `api/src/backend/api/v1/serializers.py` + +```python +def validate_secret_based_on_provider(provider_type, secret): + """Validate provider-specific secrets.""" + if provider_type == Provider.ProviderChoices.AWS.value: + serializer = AWSProviderSecret(data=secret) + elif provider_type == Provider.ProviderChoices.AZURE.value: + serializer = AzureProviderSecret(data=secret) + elif provider_type == Provider.ProviderChoices.GCP.value: + serializer = GCPProviderSecret(data=secret) + elif provider_type == Provider.ProviderChoices.YOUR_PROVIDER.value: # Add your provider here + serializer = YourProviderSecret(data=secret) + # ... other providers + + if serializer.is_valid(): + return serializer.validated_data + else: + raise serializers.ValidationError(serializer.errors) + +class YourProviderSecret(serializers.Serializer): + """Serializer for your provider credentials.""" + your_auth_field = serializers.CharField(required=True) + your_optional_field = serializers.CharField(required=False) + + class Meta: + resource_name = "provider-secrets" +``` + +Also update the providers included in the serializer: + +**File:** `api/src/backend/api/v1/serializer_utils/providers.py` + +```python +@extend_schema_field( + { + "oneOf": [ + # ... existing provider schemas ... + { + "type": "object", + "title": "Your Provider Credentials", + "properties": { + "your_auth_field": { + "type": "string", + "description": "Your provider authentication field description.", + }, + "your_optional_field": { + "type": "string", + "description": "Optional field for your provider (if applicable).", + }, + "your_required_field": { + "type": "string", + "description": "Required field for your provider authentication.", + } + }, + "required": ["your_auth_field", "your_required_field"] + }, + # ... other existing schemas ... + ] + } +) +``` + +### 2.4. Database Migration + +Create a new migration to add your provider to the database. This is crucial for the API to recognize your provider type. + +**File:** `api/src/backend/api/migrations/XXXX_your_provider.py` + +```python +# Generated by Django X.X.X on YYYY-MM-DD + +from django.db import migrations + +import api.db_utils + + +class Migration(migrations.Migration): + dependencies = [ + ("api", "previous_migration_name"), # Update this to the latest migration + ] + + operations = [ + migrations.AlterField( + model_name="provider", + name="provider", + field=api.db_utils.ProviderEnumField( + choices=[ + ("aws", "AWS"), + ("azure", "Azure"), + ("gcp", "GCP"), + ("kubernetes", "Kubernetes"), + ("m365", "M365"), + ("github", "GitHub"), + ("your_provider", "Your Provider"), # Add your provider here + ], + default="aws", + ), + ), + migrations.RunSQL( + "ALTER TYPE provider ADD VALUE IF NOT EXISTS 'your_provider';", + reverse_sql=migrations.RunSQL.noop, + ), + ] +``` + +**Important Notes:** + +- **Migration Number**: Use the next sequential number (e.g., if latest is 0044, use 0045) +- **Dependencies**: Update the `dependencies` list to point to the most recent migration +- **Choices Array**: Add your provider to the `choices` array with proper display name +- **SQL Operation**: The `RunSQL` operation adds your provider to the PostgreSQL enum type +- **Reverse SQL**: Use `migrations.RunSQL.noop` since adding enum values cannot be easily reversed + +**Migration Naming Convention:** + +- Format: `XXXX_your_provider.py` (e.g., `0045_your_provider.py`) +- Use descriptive names that indicate what the migration does +- Follow the existing pattern in the migrations folder + +### 2.5. Update the V1 Yaml + +Update the OpenAPI specification (`v1.yaml`) to include your provider in all relevant endpoints and schemas. This is crucial for API documentation and client generation. + +**File:** `api/src/backend/api/specs/v1.yaml` + +#### 2.5.1. Provider Enum Values + +Add your provider to the provider enum in the Provider schema: + +```yaml +# Around line 12150 in v1.yaml +Provider: + type: object + properties: + attributes: + properties: + provider: + enum: + - aws + - azure + - gcp + - kubernetes + - m365 + - github + - your_provider # Add your provider here + type: string + description: |- + * `aws` - AWS + * `azure` - Azure + * `gcp` - GCP + * `kubernetes` - Kubernetes + * `m365` - M365 + * `github` - GitHub + * `your_provider` - Your Provider # Add your provider here +``` + +#### 2.5.2. Provider Credential Schemas + +Add your provider's credential schema to the integration configuration. This defines how your provider's credentials are structured: + +```yaml +# Around line 11100 in v1.yaml, in the integration configuration +- type: object + title: Your Provider Credentials # Add your provider here + properties: + your_auth_field: + type: string + description: Your provider authentication field description. + your_optional_field: + type: string + description: Optional field for your provider (if applicable). + your_required_field: + type: string + description: Required field for your provider authentication. + required: + - your_auth_field + - your_required_field +``` + +#### 2.5.3. Example Provider Schemas + +Here are examples of how existing providers are documented: + +**AWS Provider:** +```yaml +- type: object + title: AWS Static Credentials + properties: + aws_access_key_id: + type: string + description: The AWS access key ID. + aws_secret_access_key: + type: string + description: The AWS secret access key. + required: + - aws_access_key_id + - aws_secret_access_key + +- type: object + title: AWS Assume Role + properties: + role_arn: + type: string + description: The Amazon Resource Name (ARN) of the role to assume. + external_id: + type: string + description: An identifier to enhance security for role assumption. + required: + - role_arn + - external_id +``` + +**GitHub Provider:** +```yaml +- type: object + title: GitHub Personal Access Token + properties: + personal_access_token: + type: string + description: GitHub personal access token for authentication. + required: + - personal_access_token + +- type: object + title: GitHub OAuth App Token + properties: + oauth_app_token: + type: string + description: GitHub OAuth App token for authentication. + required: + - oauth_app_token +``` + +**M365 Provider:** +```yaml +- type: object + title: M365 Static Credentials + properties: + client_id: + type: string + description: The Azure application (client) ID for authentication in Azure AD. + client_secret: + type: string + description: The client secret associated with the application (client) ID. + tenant_id: + type: string + description: The Azure tenant ID, representing the directory where the application is registered. + user: + type: email + description: User microsoft email address. + password: + type: string + description: User password. + required: + - client_id + - client_secret + - tenant_id + - user + - password +``` + +#### 2.5.4. Important Notes + +- **Position**: Add your schema in the `oneOf` array alongside existing providers +- **Structure**: Follow the exact pattern of other providers (title, properties, required fields) +- **Descriptions**: Provide clear, helpful descriptions for each field +- **Required Fields**: Specify which fields are mandatory in the `required` array +- **Field Types**: Use appropriate JSON schema types (`string`, `integer`, `boolean`, `email`, etc.) +- **Validation**: Add any field-specific validation patterns or constraints +- **Documentation**: Ensure your provider appears in the generated API documentation + +### 2.6. Testing API Integration + +Create tests for your provider: + +**Location:** `api/src/backend/api/tests/` + +```python +class YourProviderAPITestCase(APITestCase): + def setUp(self): + self.user = User.objects.create_user(username='testuser', password='testpass') + self.client.force_authenticate(user=self.user) + + def test_create_your_provider(self): + data = { + 'provider': 'your_provider', + 'uid': 'valid-uid-123', + 'alias': 'Test Account' + } + response = self.client.post('/api/v1/providers/', data) + self.assertEqual(response.status_code, 201) + self.assertEqual(response.data['provider'], 'your_provider') + + def test_your_provider_uid_validation(self): + """Test UID validation for your provider.""" + invalid_uids = [ + 'invalid@uid', + '-invalid-start', + 'a' * 40, # Too long + ] + + for invalid_uid in invalid_uids: + data = { + 'provider': 'your_provider', + 'uid': invalid_uid, + 'alias': 'Test' + } + response = self.client.post('/api/v1/providers/', data) + self.assertEqual(response.status_code, 400) + self.assertIn('your-provider-uid', str(response.data)) + + def test_add_your_provider_credentials(self): + # Create provider first + provider = Provider.objects.create( + user=self.user, + provider='your_provider', + uid='valid-uid-123' + ) + + # Add credentials + credentials_data = { + 'secret_type': 'your_provider_credentials', + 'secret': { + 'your_auth_field': 'auth_value', + 'your_optional_field': 'optional_value' + }, + 'provider': provider.id + } + response = self.client.post('/api/v1/providers/secrets/', credentials_data) + self.assertEqual(response.status_code, 201) +``` + +#### 2.6.1. Add your mocked provider to the tests + +If needed, add your mocked provider to the tests config file so you can use it on the tests. + +**File:** `api/src/backend/conftest.py` + +```python +@pytest.fixture +def providers_fixture(tenants_fixture): + tenant, *_ = tenants_fixture + providerX = Provider.objects.create( + provider="your_provider", + uid="your_uid", + alias="your_alias", + tenant_id=tenant.id, + ) + return provider1, provider2, provider3, ... providerX +``` + +### 2.7. Compliance and Output Support + +Add your provider to the compliance export functionality: + +**File:** `api/src/backend/tasks/jobs/export.py` + +```python +COMPLIANCE_FRAMEWORKS = { + "aws": [...], + "azure": [...], + "gcp": [...], + "kubernetes": [...], + "m365": [...], + "github": [...], + "your_provider": [ # Add your provider here + (lambda name: name.startswith("cis_"), YourProviderCIS), + (lambda name: name.startswith("iso27001_"), YourProviderISO27001), + ], +} +``` + +If your provider has specific fields, add them to the finding transformation: + +**File:** `prowler/lib/outputs/finding.py` + +```python +def transform_api_finding(cls, finding, provider) -> "Finding": + # ... existing code ... + + # Your provider specific field + if provider.type == "your_provider": + finding.your_field = resource.your_field + + # ... rest of the code ... +``` + +### 2.8. API Endpoints + +Your provider will be available through these endpoints: + +- `GET /api/v1/providers/` - List all providers +- `POST /api/v1/providers/` - Create a new provider +- `GET /api/v1/providers/{id}/` - Get provider details +- `PUT /api/v1/providers/{id}/` - Update provider +- `DELETE /api/v1/providers/{id}/` - Delete provider +- `POST /api/v1/providers/secrets/` - Add provider credentials + +### 2.9. Update the provider if needed + +Depending on your provider's authentication requirements, you may need to add new authentication methods that are compatible with the API. This involves updating the provider class to support additional credential types beyond the basic ones. + +#### 2.9.1. Adding New Authentication Methods + +If your provider requires specific authentication methods, you'll need to: + +1. **Update the provider constructor** to accept new authentication parameters +2. **Extend the credential handling** to support the new authentication method +3. **Update the API serializers** to include the new credential fields +4. **Modify the OpenAPI specification** to document the new authentication schema + +#### 2.9.2. Example: GitHub Provider Authentication Methods + +The GitHub provider demonstrates how to implement multiple authentication methods: + +```python +# In prowler/providers/github/github_provider.py +def __init__( + self, + # Authentication methods + personal_access_token: str = "", + oauth_app_token: str = "", + github_app_key: str = "", + #Needed for the API integration + github_app_key_content: str = "", + github_app_id: int = 0, + # Provider configuration + config_path: str = None, + # ... other parameters +): + """ + Initialize GitHub provider. + + Args: + personal_access_token (str): GitHub personal access token. + oauth_app_token (str): GitHub OAuth App token. + github_app_key (str): GitHub App key. + github_app_key_content (str): GitHub App key content. + github_app_id (int): GitHub App ID. + config_path (str): Path to the audit configuration file. + # ... other parameters + """ + super().__init__( + personal_access_token, + oauth_app_token, + github_app_id, + github_app_key, + github_app_key_content, + ) +``` + +--- + +## Step 3: Integrate the Provider in the UI + +TBD + +--- + +## Provider Implementation Guidance + +Use existing providers as templates, this will help you to understand better the structure and the implementation will be easier: + +- [AWS (SDK)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/aws_provider.py) +- [Azure (SDK)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/azure/azure_provider.py) +- [GCP (SDK)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/gcp/gcp_provider.py) +- [Kubernetes (SDK)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/kubernetes/kubernetes_provider.py) +- [M365 (SDK/Wrapper)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/m365/m365_provider.py) +- [GitHub (SDK)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/github/github_provider.py) +- [NHN (API)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/nhn/nhn_provider.py) +- [IAC (Tool)](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/iac/iac_provider.py) +- [MongoDB Atlas](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/mongodbatlas/mongodbatlas_provider.py) + +--- + +## Best Practices + +- **Code Quality & Documentation** + + - **Comprehensive Docstrings**: Every class, method, and function should have detailed docstrings following Prowler's format + ```python + def method_name(self, param: str) -> str: + """ + Brief description of what the method does. + + Args: + param: Description of the parameter + + Returns: + Description of the return value + + Raises: + ExceptionType: When and why this exception occurs + """ + ``` + + - **Type Hints**: Use type hints for all function parameters and return values + ```python + from typing import Optional, List, Dict, Any + ``` + + - **Logging**: Implement proper logging using Prowler's logger + ```python + from prowler.lib.logger import logger + + logger.info("Operation completed successfully") + logger.warning("Something to be aware of") + logger.error("Something went wrong") + logger.critical("Critical error that may cause failure") + ``` + +- **Error Handling & Validation** + + - **Custom Exceptions**: Create provider-specific exceptions for better error handling + - **Input Validation**: Validate all inputs and provide clear error messages + - **Graceful Degradation**: Handle errors gracefully without crashing the entire scan + - **Raise on Exception**: Use `raise_on_exception` parameter for test methods + +- **Testing & Quality Assurance** + + - **Comprehensive Test Coverage**: Aim for >80% test coverage + - **Test Naming**: Use descriptive test names: `test_method_name_scenario` + - **Test Organization**: Group related tests in test classes + - **Mock External Dependencies**: Mock external API calls and services + - **Test Edge Cases**: Include tests for error conditions and edge cases + - **End-to-End Testing**: Test the provider on real infrastructure + +- **Performance & Security** + + - **Session Management**: Reuse sessions when possible, don't create new ones unnecessarily + - **Rate Limiting**: Implement rate limiting for API calls to avoid hitting limits + - **Resource Cleanup**: Ensure proper cleanup of temporary resources + - **Authentication Security**: Never log sensitive credentials or tokens + +- **Code Organization** + + - **Single Responsibility**: Each method should have one clear purpose + - **Consistent Naming**: Follow Prowler's naming conventions + - **Modular Design**: Break complex functionality into smaller, testable methods + - **Configuration Management**: Use configuration files for provider-specific settings + +- **Documentation & Maintenance** + + - **README Updates**: Update provider-specific documentation + - **Changelog**: Document changes and new features + - **Examples**: Provide usage examples and common scenarios + - **Troubleshooting**: Include common issues and solutions + - **Documentation**: Update the provider documentation to include your new tool provider in the examples and implementation guidance. + +- **Integration Standards** + + - **CLI Consistency**: Follow Prowler's CLI argument patterns + - **Output Format**: Ensure outputs are compatible with Prowler's reporting system + - **Compliance Mapping**: Map provider checks to relevant compliance frameworks + - **Backward Compatibility**: Maintain compatibility when possible + +- **AI-Assisted Development** + + - **Use Rules**: Use rules to ensure the code generated by AI is following the way of working in Prowler. + +## Checklist for New Providers + +### CLI Integration Only + +**Phase 1: Research & Planning** + +- [ ] Soft research completed +- [ ] Spike date scheduled +- [ ] Deeper research completed +- [ ] Action plan created + +**Phase 2: Implementation** + +- [ ] Folder and files created in `prowler/providers/` +- [ ] Provider class implemented and inherits from `Provider` +- [ ] Authentication/session logic implemented +- [ ] Arguments/flags mapped and documented +- [ ] Outputs and metadata standardized +- [ ] Registered in the CLI +- [ ] Minimal usage example provided + +**Phase 3: Delivery** + +- [ ] PoC delivered +- [ ] MVP delivered +- [ ] Version 1 completed +- [ ] QA and documentation completed +- [ ] GA release ready + +### API Integration + +- [ ] All CLI integration items completed +- [ ] Provider added to `ProviderChoices` enum in API models +- [ ] API serializers created/updated for the provider +- [ ] API views support the new provider type +- [ ] Provider credentials model supports the new provider +- [ ] API endpoints tested and working +- [ ] Provider-specific validation implemented +- [ ] API tests created and passing + +### UI Integration + +- TBD + +--- + +## Next Steps + +- [How to add a new Service](./services) +- [How to add new Checks](./checks) +- [How to contribute](./introduction#contributing-to-prowler) diff --git a/docs/developer-guide/services.mdx b/docs/developer-guide/services.mdx index 8f7382f0e9..ac7088dda0 100644 --- a/docs/developer-guide/services.mdx +++ b/docs/developer-guide/services.mdx @@ -5,8 +5,7 @@ title: 'Prowler Services' Here you can find how to create a new service, or to complement an existing one, for a [Prowler Provider](/developer-guide/provider). -First ensure that the provider you want to add the service is already created. It can be checked [here](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers). If the provider is not present, please refer to the [Provider](/developer-guide/provider) documentation to create it from scratch. - +First ensure that the provider you want to add the service is already created. It can be checked [here](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers). If the provider is not present, please refer to the [Provider](./provider.md) documentation to create it from scratch. ## Introduction @@ -201,11 +200,11 @@ class (BaseModel): #### Service Attributes -*Optimized Data Storage with Python Dictionaries* +_Optimized Data Storage with Python Dictionaries_ Each group of resources within a service should be structured as a Python [dictionary](https://docs.python.org/3/tutorial/datastructures.html#dictionaries) to enable efficient lookups. The dictionary lookup operation has [O(1) complexity](https://en.wikipedia.org/wiki/Big_O_notation#Orders_of_common_functions), and lookups are constantly executed. -*Assigning Unique Identifiers* +_Assigning Unique Identifiers_ Each dictionary key must be a unique ID to identify the resource in a univocal way. @@ -241,6 +240,301 @@ Provider-Specific Permissions Documentation: - [M365](/user-guide/providers/microsoft365/authentication#required-permissions) - [GitHub](/user-guide/providers/github/authentication) +## Service Architecture and Cross-Service Communication + +### Core Principle: Service Isolation with Client Communication + +Each service must contain **ONLY** the information unique to that specific service. When a check requires information from multiple services, it must use the **client objects** of other services rather than directly accessing their data structures. + +This architecture ensures: + +- **Loose coupling** between services +- **Clear separation of concerns** +- **Maintainable and testable code** +- **Consistent data access patterns** + +### Cross-Service Communication Pattern + +Instead of services directly accessing each other's internal data, checks should import and use client objects: + +**❌ INCORRECT - Direct data access:** + +```python +# DON'T DO THIS +from prowler.providers.aws.services.cloudtrail.cloudtrail_service import cloudtrail_service +from prowler.providers.aws.services.s3.s3_service import s3_service + +class cloudtrail_bucket_requires_mfa_delete(Check): + def execute(self): + # WRONG: Directly accessing service data + for trail in cloudtrail_service.trails.values(): + for bucket in s3_service.buckets.values(): + # Direct access violates separation of concerns +``` + +**✅ CORRECT - Client-based communication:** + +```python +# DO THIS INSTEAD +from prowler.providers.aws.services.cloudtrail.cloudtrail_client import cloudtrail_client +from prowler.providers.aws.services.s3.s3_client import s3_client + +class cloudtrail_bucket_requires_mfa_delete(Check): + def execute(self): + # CORRECT: Using client objects for cross-service communication + for trail in cloudtrail_client.trails.values(): + trail_bucket = trail.s3_bucket + for bucket in s3_client.buckets.values(): + if trail_bucket == bucket.name: + # Use bucket properties through s3_client + if bucket.mfa_delete: + # Implementation logic +``` + +### Real-World Example: CloudTrail + S3 Integration + +This example demonstrates how CloudTrail checks validate S3 bucket configurations: + +```python +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.cloudtrail.cloudtrail_client import cloudtrail_client +from prowler.providers.aws.services.s3.s3_client import s3_client + +class cloudtrail_bucket_requires_mfa_delete(Check): + def execute(self): + findings = [] + if cloudtrail_client.trails is not None: + for trail in cloudtrail_client.trails.values(): + if trail.is_logging: + trail_bucket_is_in_account = False + trail_bucket = trail.s3_bucket + + # Cross-service communication: CloudTrail check uses S3 client + for bucket in s3_client.buckets.values(): + if trail_bucket == bucket.name: + trail_bucket_is_in_account = True + if bucket.mfa_delete: + report.status = "PASS" + report.status_extended = f"Trail {trail.name} bucket ({trail_bucket}) has MFA delete enabled." + + # Handle cross-account scenarios + if not trail_bucket_is_in_account: + report.status = "MANUAL" + report.status_extended = f"Trail {trail.name} bucket ({trail_bucket}) is a cross-account bucket or out of Prowler's audit scope, please check it manually." + + findings.append(report) + return findings +``` + +**Key Benefits:** + +- **CloudTrail service** only contains CloudTrail-specific data (trails, configurations) +- **S3 service** only contains S3-specific data (buckets, policies, ACLs) +- **Check logic** orchestrates between services using their public client interfaces +- **Cross-account detection** is handled gracefully when resources span accounts + +### Service Consolidation Guidelines + +**When to combine services in the same file:** + +Implement multiple services as **separate classes in the same file** when two services are **practically the same** or one is a **direct extension** of another. + +**Example: S3 and S3Control** + +S3Control is an extension of S3 that provides account-level controls and access points. Both are implemented in `s3_service.py`: + +```python +# File: prowler/providers/aws/services/s3/s3_service.py + +class S3(AWSService): + """Standard S3 service for bucket operations""" + def __init__(self, provider): + super().__init__(__class__.__name__, provider) + self.buckets = {} + self.regions_with_buckets = [] + + # S3-specific initialization + self._list_buckets(provider) + self._get_bucket_versioning() + # ... other S3-specific operations + +class S3Control(AWSService): + """S3Control service for account-level and access point operations""" + def __init__(self, provider): + super().__init__(__class__.__name__, provider) + self.account_public_access_block = None + self.access_points = {} + + # S3Control-specific initialization + self._get_public_access_block() + self._list_access_points() + # ... other S3Control-specific operations +``` + +**Separate client files:** + +```python +# File: prowler/providers/aws/services/s3/s3_client.py +from prowler.providers.aws.services.s3.s3_service import S3 +s3_client = S3(Provider.get_global_provider()) + +# File: prowler/providers/aws/services/s3/s3control_client.py +from prowler.providers.aws.services.s3.s3_service import S3Control +s3control_client = S3Control(Provider.get_global_provider()) +``` + +**When NOT to consolidate services:** + +Keep services separate when they: + +- **Operate on different resource types** (EC2 vs RDS) +- **Have different authentication mechanisms** (different API endpoints) +- **Serve different operational domains** (IAM vs CloudTrail) +- **Have different regional behaviors** (global vs regional services) + +### Cross-Service Dependencies Guidelines + +**1. Always use client imports:** + +```python +# Correct pattern +from prowler.providers.aws.services.service_a.service_a_client import service_a_client +from prowler.providers.aws.services.service_b.service_b_client import service_b_client +``` + +**2. Handle missing resources gracefully:** + +```python +# Handle cross-service scenarios +resource_found_in_account = False +for external_resource in other_service_client.resources.values(): + if target_resource_id == external_resource.id: + resource_found_in_account = True + # Process found resource + break + +if not resource_found_in_account: + # Handle cross-account or missing resource scenarios + report.status = "MANUAL" + report.status_extended = "Resource is cross-account or out of audit scope" +``` + +**3. Document cross-service dependencies:** + +```python +class check_with_dependencies(Check): + """ + Check Description + + Dependencies: + - service_a_client: For primary resource information + - service_b_client: For related resource validation + - service_c_client: For policy analysis + """ +``` + +## Regional Service Implementation + +When implementing services for regional providers (like AWS, Azure, GCP), special considerations are needed to handle resource discovery across multiple geographic locations. This section provides a complete guide using AWS as the reference example. + +### Regional vs Non-Regional Services + +**Regional Services:** Require iteration across multiple geographic locations where resources may exist (e.g., EC2 instances, VPC, RDS databases). + +**Non-Regional/Global Services:** Operate at a global or tenant level without regional concepts (e.g., IAM users, Route53 hosted zones). + +### AWS Regional Implementation Example + +AWS is the perfect example of a regional provider. Here's how Prowler handles AWS's regional architecture: + + +```python +# File: prowler/providers/aws/services/ec2/ec2_service.py +class EC2(AWSService): + def __init__(self, provider): + super().__init__(__class__.__name__, provider) + self.instances = {} + self.security_groups = {} + + # Regional resource discovery across all AWS regions + self.__threading_call__(self._describe_instances) + self.__threading_call__(self._describe_security_groups) + + def _describe_instances(self, regional_client): + """Discover EC2 instances in a specific region""" + try: + describe_instances_paginator = regional_client.get_paginator("describe_instances") + for page in describe_instances_paginator.paginate(): + for reservation in page["Reservations"]: + for instance in reservation["Instances"]: + # Each instance includes its region + self.instances[instance["InstanceId"]] = Instance( + id=instance["InstanceId"], + region=regional_client.region, + state=instance["State"]["Name"], + # ... other properties + ) + except Exception as error: + logger.error(f"Failed to describe instances in {regional_client.region}: {error}") +``` + +#### Regional Check Execution + +```python +# File: prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.py +class ec2_instance_public_ip(Check): + def execute(self): + findings = [] + + # Automatically iterates across ALL AWS regions where instances exist + for instance in ec2_client.instances.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource=instance) + report.region = instance.region # Critical: region attribution + report.resource_arn = f"arn:aws:ec2:{instance.region}:{instance.account_id}:instance/{instance.id}" + + if instance.public_ip: + report.status = "FAIL" + report.status_extended = f"Instance {instance.id} in {instance.region} has public IP {instance.public_ip}" + else: + report.status = "PASS" + report.status_extended = f"Instance {instance.id} in {instance.region} does not have a public IP" + + findings.append(report) + + return findings +``` + +#### Key AWS Regional Features + +**Region-Specific ARNs:** + +``` +arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0 +arn:aws:s3:eu-west-1:123456789012:bucket/my-bucket +arn:aws:rds:ap-southeast-2:123456789012:db:my-database +``` + +**Parallel Processing:** + +- Each region processed independently in separate threads +- Failed regions don't affect other regions +- User can filter specific regions: `-f us-east-1` + +**Global vs Regional Services:** + +- **Regional**: EC2, RDS, VPC (require region iteration) +- **Global**: IAM, Route53, CloudFront (single `us-east-1` call) + +This architecture allows Prowler to efficiently scan AWS accounts with resources spread across multiple regions while maintaining performance and error isolation. + +### Regional Service Best Practices + +1. **Use Threading for Regional Discovery**: Leverage the `__threading_call__` method to parallelize resource discovery across regions +2. **Store Region Information**: Always include region metadata in resource objects for proper attribution +3. **Handle Regional Failures Gracefully**: Ensure that failures in one region don't affect others +4. **Optimize for Performance**: Use paginated calls and efficient data structures for large-scale resource discovery +5. **Support Region Filtering**: Allow users to limit scans to specific regions for focused audits + ## Best Practices - When available in the provider, use threading or parallelization utilities for all methods that can be parallelized by to maximize performance and reduce scan time. @@ -252,3 +546,5 @@ Provider-Specific Permissions Documentation: - Collect and store resource tags and additional attributes to support richer checks and reporting. - Leverage shared utility helpers for session setup, identifier parsing, and other cross-cutting concerns to avoid code duplication. This kind of code is typically stored in a `lib` folder in the service folder. - Keep code modular, maintainable, and well-documented for ease of extension and troubleshooting. +- **Each service should contain only information unique to that specific service** - use client objects for cross-service communication. +- **Handle cross-account and missing resources gracefully** when checks span multiple services. diff --git a/docs/docs.json b/docs/docs.json index ca09740603..54402e5d8a 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -98,7 +98,7 @@ ] }, "user-guide/tutorials/prowler-app-rbac", - "user-guide/providers/prowler-app-api-keys", + "user-guide/tutorials/prowler-app-api-keys", "user-guide/tutorials/prowler-app-mute-findings", { "group": "Integrations", @@ -114,7 +114,8 @@ "group": "Tutorials", "pages": [ "user-guide/tutorials/prowler-app-sso-entra", - "user-guide/tutorials/bulk-provider-provisioning" + "user-guide/tutorials/bulk-provider-provisioning", + "user-guide/tutorials/aws-organizations-bulk-provisioning" ] } ] @@ -404,14 +405,6 @@ "source": "/projects/prowler-open-source/en/latest/tutorials/gcp/getting-started-gcp", "destination": "/user-guide/providers/gcp/getting-started-gcp" }, - { - "source": "/projects/prowler-open-source/en/latest/tutorials/prowler-app", - "destination": "/user-guide/tutorials/prowler-app#step-4-4%3A-kubernetes-credentials%3A" - }, - { - "source": "/projects/prowler-open-source/en/latest/tutorials/prowler-app/#step-3-add-a-provider", - "destination": "/user-guide/tutorials/prowler-app#step-3-add-a-provider" - }, { "source": "/projects/prowler-open-source/en/latest/tutorials/microsoft365/getting-started-m365", "destination": "/user-guide/providers/microsoft365/getting-started-m365" diff --git a/docs/getting-started/basic-usage/prowler-mcp.mdx b/docs/getting-started/basic-usage/prowler-mcp.mdx index 90cc3e0e63..5d89756acf 100644 --- a/docs/getting-started/basic-usage/prowler-mcp.mdx +++ b/docs/getting-started/basic-usage/prowler-mcp.mdx @@ -10,7 +10,7 @@ Configure your MCP client to connect to Prowler MCP Server. **Authentication is optional**: Prowler Hub and Prowler Documentation features work without authentication. An API key is only required for Prowler Cloud and Prowler App (Self-Managed) features. -To use Prowler Cloud or Prowler App (Self-Managed) features. To get the API key, please refer to the [API Keys](/user-guide/providers/prowler-app-api-keys) guide. +To use Prowler Cloud or Prowler App (Self-Managed) features. To get the API key, please refer to the [API Keys](/user-guide/tutorials/prowler-app-api-keys) guide. Keep the API key secure. Never share it publicly or commit it to version control. diff --git a/docs/getting-started/installation/prowler-app.mdx b/docs/getting-started/installation/prowler-app.mdx index 862d76a73f..4c49b8d4f0 100644 --- a/docs/getting-started/installation/prowler-app.mdx +++ b/docs/getting-started/installation/prowler-app.mdx @@ -25,6 +25,9 @@ Prowler configuration is based in `.env` files. Every version of Prowler can hav curl -LO https://raw.githubusercontent.com/prowler-cloud/prowler/refs/heads/master/.env docker compose up -d ``` + + > Containers are built for `linux/amd64`. If your workstation's architecture is different, please set `DOCKER_DEFAULT_PLATFORM=linux/amd64` in your environment or use the `--platform linux/amd64` flag in the docker command. + _Requirements_: diff --git a/docs/getting-started/installation/prowler-mcp.mdx b/docs/getting-started/installation/prowler-mcp.mdx index dfdf7d0822..8c3fd2f955 100644 --- a/docs/getting-started/installation/prowler-mcp.mdx +++ b/docs/getting-started/installation/prowler-mcp.mdx @@ -182,19 +182,19 @@ Configure the server using environment variables: |----------|-------------|----------|---------| | `PROWLER_APP_API_KEY` | Prowler API key | Only for STDIO mode | - | | `PROWLER_API_BASE_URL` | Custom Prowler API endpoint | No | `https://api.prowler.com` | -| `PROWLER_MCP_MODE` | Default transport mode (overwritten by `--transport` argument) | No | `stdio` | +| `PROWLER_MCP_TRANSPORT_MODE` | Default transport mode (overwritten by `--transport` argument) | No | `stdio` | ```bash macOS/Linux export PROWLER_APP_API_KEY="pk_your_api_key_here" export PROWLER_API_BASE_URL="https://api.prowler.com" -export PROWLER_MCP_MODE="http" +export PROWLER_MCP_TRANSPORT_MODE="http" ``` ```bash Windows PowerShell $env:PROWLER_APP_API_KEY="pk_your_api_key_here" $env:PROWLER_API_BASE_URL="https://api.prowler.com" -$env:PROWLER_MCP_MODE="http" +$env:PROWLER_MCP_TRANSPORT_MODE="http" ``` @@ -209,7 +209,7 @@ For convenience, create a `.env` file in the `mcp_server` directory: ```bash .env PROWLER_APP_API_KEY=pk_your_api_key_here PROWLER_API_BASE_URL=https://api.prowler.com -PROWLER_MCP_MODE=stdio +PROWLER_MCP_TRANSPORT_MODE=stdio ``` When using Docker, pass the environment file: @@ -228,6 +228,35 @@ uvx /path/to/prowler/mcp_server/ This is particularly useful when configuring MCP clients that need to launch the server from a specific path. +## Production Deployment + +For production deployments that require customization, it is recommended to use the ASGI application that can be found in `prowler_mcp_server.server`. This can be run with uvicorn: + +```bash +uvicorn prowler_mcp_server.server:app --host 0.0.0.0 --port 8000 +``` + +For more details on production deployment options, see the [FastMCP production deployment guide](https://gofastmcp.com/deployment/http#production-deployment) and [uvicorn settings](https://www.uvicorn.org/settings/). + +### Entrypoint Script + +The source tree includes `entrypoint.sh` to simplify switching between the +standard CLI runner and the ASGI app. The first argument selects the mode and +any additional flags are passed straight through: + +```bash +# Default CLI experience (prowler-mcp console script) +./entrypoint.sh main --transport http --host 0.0.0.0 + +# ASGI app via uvicorn +./entrypoint.sh uvicorn --host 0.0.0.0 --port 9000 +``` + +Omitting the mode defaults to `main`, matching the `prowler-mcp` console script. +When `uvicorn` mode is selected, the script exports `PROWLER_MCP_TRANSPORT_MODE=http` automatically. + +This is the default entrypoint for the Docker container. + ## Next Steps Now that you have the Prowler MCP Server installed, proceed to configure your MCP client: diff --git a/docs/img/provider-decision-tree.png b/docs/img/provider-decision-tree.png new file mode 100644 index 0000000000..f76d375f94 Binary files /dev/null and b/docs/img/provider-decision-tree.png differ diff --git a/docs/security.mdx b/docs/security.mdx index 49fb3684bb..d8a3f63c73 100644 --- a/docs/security.mdx +++ b/docs/security.mdx @@ -16,7 +16,7 @@ We use encryption everywhere possible. The data and communications used by **Pro Prowler Cloud is GDPR compliant in regards to personal data and the ["right to be forgotten"](https://gdpr.eu/right-to-be-forgotten/). When a user deletes their account their user information will be deleted from Prowler Cloud online and backup systems within 10 calendar days. -## Software Security +## Software Security We follow a **security-by-design approach** throughout our software development lifecycle. All changes go through automated checks at every stage, from local development to production deployment. diff --git a/docs/snippets/version-badge.mdx b/docs/snippets/version-badge.mdx new file mode 100644 index 0000000000..7541ff823a --- /dev/null +++ b/docs/snippets/version-badge.mdx @@ -0,0 +1,12 @@ +export const VersionBadge = ({ version }) => { + return ( + +

+ Added in:  + {version} +

+ + + + ); +}; diff --git a/docs/style.css b/docs/style.css new file mode 100644 index 0000000000..3e9bedbc80 --- /dev/null +++ b/docs/style.css @@ -0,0 +1,51 @@ +/* Version Badge Styling */ +.version-badge-container { + display: inline-block; + margin: 0 0 1rem 0; + padding: 0; +} + +.version-badge { + display: inline-flex; + align-items: center; + margin: 0; + padding: 0.375rem 0.75rem; + background: linear-gradient(135deg, #1a1a1a 0%, #000000 100%); + color: #ffffff; + border-radius: 1.25rem; + font-weight: 400; + font-size: 0.875rem; + line-height: 1.25rem; + border: 1px solid rgba(0, 0, 0, 0.15); + box-shadow: none; +} + +.version-badge-label { + font-weight: 400; + opacity: 1; +} + +.version-badge-version { + background: rgba(255, 255, 255, 0.12); + padding: 0.125rem 0.5rem; + border-radius: 0.875rem; + font-family: ui-monospace, SFMono-Regular, 'SF Mono', Menlo, Monaco, 'Cascadia Code', 'Roboto Mono', Consolas, 'Courier New', monospace; + font-weight: 600; + font-size: 0.875rem; + color: #ffffff; + border: none; +} + + +.dark .version-badge { + background: #55B685; + color: #000000; + border: 2px solid rgba(85, 182, 133, 0.3); + box-shadow: none; + } + + .dark .version-badge-version { + background: rgba(0, 0, 0, 0.1); + color: #000000; + border: none; +} diff --git a/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx b/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx new file mode 100644 index 0000000000..e19d416d32 --- /dev/null +++ b/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx @@ -0,0 +1,491 @@ +--- +title: 'AWS Organizations Bulk Provisioning in Prowler' +--- + +Prowler offers an automated tool to discover and provision all AWS accounts within an AWS Organization. This streamlines onboarding for organizations managing multiple AWS accounts by automatically generating the configuration needed for bulk provisioning. + +The tool, `aws_org_generator.py`‎, complements the [Bulk Provider Provisioning](./bulk-provider-provisioning) tool and is available in the Prowler repository at: [util/prowler-bulk-provisioning](https://github.com/prowler-cloud/prowler/tree/master/util/prowler-bulk-provisioning) + + +Native support for bulk provisioning AWS Organizations and similar multi-account structures directly in the Prowler UI/API is on the official roadmap. + +Track progress and vote for this feature at: [Bulk Provisioning in the UI/API for AWS Organizations](https://roadmap.prowler.com/p/builk-provisioning-in-the-uiapi-for-aws-organizations-and-alike) + + +{/* TODO: Add screenshot of the tool in action */} + +## Overview + +The AWS Organizations Bulk Provisioning tool simplifies multi-account onboarding by: + +* Automatically discovering all active accounts in an AWS Organization +* Generating YAML configuration files for bulk provisioning +* Supporting account filtering and custom role configurations +* Eliminating manual entry of account IDs and role ARNs + +## Prerequisites + +### Requirements + +* Python 3.7 or higher +* AWS credentials with Organizations read access +* ProwlerRole (or custom role) deployed across all target accounts +* Prowler API key (from Prowler Cloud or self-hosted Prowler App) + * For self-hosted Prowler App, remember to [point to your API base URL](./bulk-provider-provisioning#custom-api-endpoints) + * Learn how to create API keys: [Prowler App API Keys](../tutorials/prowler-app-api-keys) + +### Deploying ProwlerRole Across AWS Organizations + +Before using the AWS Organizations generator, deploy the ProwlerRole across all accounts in the organization using CloudFormation StackSets. + + +**Follow the official documentation:** +[Deploying Prowler IAM Roles Across AWS Organizations](../providers/aws/organizations#deploying-prowler-iam-roles-across-aws-organizations) + +**Key points:** + +* Use CloudFormation StackSets from the management account +* Deploy to all organizational units (OUs) or specific OUs +* Use an external ID for enhanced security +* Ensure the role has necessary permissions for Prowler scans + + +### Installation + +Clone the repository and install required dependencies: + +```bash +git clone https://github.com/prowler-cloud/prowler.git +cd prowler/util/prowler-bulk-provisioning +pip install -r requirements-aws-org.txt +``` + +### AWS Credentials Setup + +Configure AWS credentials with Organizations read access: + +* **Management account credentials**, or +* **Delegated administrator account** with `organizations:ListAccounts` permission + +Required IAM permissions: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "organizations:ListAccounts", + "organizations:DescribeOrganization" + ], + "Resource": "*" + } + ] +} +``` + +### Prowler API Key Setup + +Configure your Prowler API key: + +```bash +export PROWLER_API_KEY="pk_example-api-key" +``` + +To create an API key: + +1. Log in to Prowler Cloud or Prowler App +2. Click **Profile** → **Account** +3. Click **Create API Key** +4. Provide a descriptive name and optionally set an expiration date +5. Copy the generated API key (it will only be shown once) + +For detailed instructions, see: [Prowler App API Keys](../tutorials/prowler-app-api-keys) + +## Basic Usage + +### Generate Configuration for All Accounts + +To generate a YAML configuration file for all active accounts in the organization: + +```bash +python aws_org_generator.py -o aws-accounts.yaml --external-id prowler-ext-id-2024 +``` + +This command: + +1. Lists all ACTIVE accounts in the organization +2. Generates YAML entries for each account +3. Saves the configuration to `aws-accounts.yaml` + +**Output:** + +``` +Fetching accounts from AWS Organizations... +Found 47 active accounts in organization +Generated configuration for 47 accounts + +Configuration written to: aws-accounts.yaml + +Next steps: + 1. Review the generated file: cat aws-accounts.yaml | head -n 20 + 2. Run bulk provisioning: python prowler_bulk_provisioning.py aws-accounts.yaml +``` + +### Review Generated Configuration + +Review the generated YAML configuration: + +```bash +head -n 20 aws-accounts.yaml +``` + +**Example output:** + +```yaml +- provider: aws + uid: '111111111111' + alias: Production-Account + auth_method: role + credentials: + role_arn: arn:aws:iam::111111111111:role/ProwlerRole + external_id: prowler-ext-id-2024 + +- provider: aws + uid: '222222222222' + alias: Development-Account + auth_method: role + credentials: + role_arn: arn:aws:iam::222222222222:role/ProwlerRole + external_id: prowler-ext-id-2024 +``` + +### Dry Run Mode + +Test the configuration without writing a file: + +```bash +python aws_org_generator.py \ + --external-id prowler-ext-id-2024 \ + --dry-run +``` + +## Advanced Configuration + +### Using a Specific AWS Profile + +Specify an AWS profile when multiple profiles are configured: + +```bash +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --profile org-management-admin \ + --external-id prowler-ext-id-2024 +``` + +### Excluding Specific Accounts + +Exclude the management account or other accounts from provisioning: + +```bash +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --external-id prowler-ext-id-2024 \ + --exclude 123456789012,210987654321 +``` + +Common exclusion scenarios: + +* Management account (requires different permissions) +* Break-glass accounts (emergency access) +* Suspended or archived accounts + +### Including Only Specific Accounts + +Generate configuration for specific accounts only: + +```bash +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --external-id prowler-ext-id-2024 \ + --include 111111111111,222222222222,333333333333 +``` + +### Custom Role Name + +Specify a custom role name if not using the default `ProwlerRole`: + +```bash +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --role-name ProwlerExecutionRole \ + --external-id prowler-ext-id-2024 +``` + +### Custom Alias Format + +Customize account aliases using template variables: + +```bash +# Use account name and ID +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --alias-format "{name}-{id}" \ + --external-id prowler-ext-id-2024 + +# Use email prefix +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --alias-format "{email}" \ + --external-id prowler-ext-id-2024 +``` + +Available template variables: + +* `{name}` - Account name +* `{id}` - Account ID +* `{email}` - Account email + +### Additional Role Assumption Options + +Configure optional role assumption parameters: + +```bash +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --role-name ProwlerRole \ + --external-id prowler-ext-id-2024 \ + --session-name prowler-scan-session \ + --duration-seconds 3600 +``` + +## Complete Workflow Example + + + + 1. Log in to the AWS management account + 2. Open CloudFormation → StackSets + 3. Create a new StackSet using the [Prowler role template](https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml) + 4. Deploy to all organizational units + 5. Use a unique external ID (e.g., `prowler-org-2024-abc123`) + + {/* TODO: Add screenshot of CloudFormation StackSets deployment */} + + + + Configure AWS credentials and generate the YAML file: + + ```bash + # Using management account credentials + export AWS_PROFILE=org-management + + # Generate configuration + python aws_org_generator.py \ + -o aws-org-accounts.yaml \ + --external-id prowler-org-2024-abc123 \ + --exclude 123456789012 + ``` + + **Output:** + + ``` + Fetching accounts from AWS Organizations... + Using AWS profile: org-management + Found 47 active accounts in organization + Generated configuration for 46 accounts + + Configuration written to: aws-org-accounts.yaml + + Next steps: + 1. Review the generated file: cat aws-org-accounts.yaml | head -n 20 + 2. Run bulk provisioning: python prowler_bulk_provisioning.py aws-org-accounts.yaml + ``` + + + + Verify the generated YAML configuration: + + ```bash + # View first 20 lines + head -n 20 aws-org-accounts.yaml + + # Check for unexpected accounts + grep "uid:" aws-org-accounts.yaml + + # Verify role ARNs + grep "role_arn:" aws-org-accounts.yaml | head -5 + + # Count accounts + grep "provider: aws" aws-org-accounts.yaml | wc -l + ``` + + + + Provision all accounts to Prowler Cloud or Prowler App: + + ```bash + # Set Prowler API key + export PROWLER_API_KEY="pk_example-api-key" + + # Run bulk provisioning with connection testing + python prowler_bulk_provisioning.py aws-org-accounts.yaml + ``` + + **With custom options:** + + ```bash + python prowler_bulk_provisioning.py aws-org-accounts.yaml \ + --concurrency 10 \ + --timeout 120 + ``` + + **Successful output:** + + ``` + [1] ✅ Created provider (id=db9a8985-f9ec-4dd8-b5a0-e05ab3880bed) + [1] ✅ Created secret (id=466f76c6-5878-4602-a4bc-13f9522c1fd2) + [1] ✅ Connection test: Connected + + [2] ✅ Created provider (id=7a99f789-0cf5-4329-8279-2d443a962676) + [2] ✅ Created secret (id=c5702180-f7c4-40fd-be0e-f6433479b126) + [2] ✅ Connection test: Connected + + Done. Success: 47 Failures: 0 + ``` + + {/* TODO: Add screenshot of successful bulk provisioning output */} + + + +## Command Reference + +### Full Command-Line Options + +```bash +python aws_org_generator.py \ + -o OUTPUT_FILE \ + --role-name ROLE_NAME \ + --external-id EXTERNAL_ID \ + --session-name SESSION_NAME \ + --duration-seconds SECONDS \ + --alias-format FORMAT \ + --exclude ACCOUNT_IDS \ + --include ACCOUNT_IDS \ + --profile AWS_PROFILE \ + --region AWS_REGION \ + --dry-run +``` + +## Troubleshooting + +### Error: "No AWS credentials found" + +**Solution:** Configure AWS credentials using one of these methods: + +```bash +# Method 1: AWS CLI configure +aws configure + +# Method 2: Environment variables +export AWS_ACCESS_KEY_ID=your-key-id +export AWS_SECRET_ACCESS_KEY=your-secret-key + +# Method 3: Use AWS profile +export AWS_PROFILE=org-management +``` + +### Error: "Access denied to AWS Organizations API" + +**Cause:** Current credentials don't have permission to list organization accounts. + +**Solution:** + +* Ensure management account credentials are used +* Verify IAM permissions include `organizations:ListAccounts` +* Check IAM policies for Organizations access + +### Error: "AWS Organizations is not enabled" + +**Cause:** The account is not part of an organization. + +**Solution:** This tool requires an AWS Organization. Create one in the AWS Organizations console or use standard bulk provisioning for standalone accounts. + +### No Accounts Generated After Filters + +**Cause:** All accounts were filtered out by `--exclude` or `--include` options. + +**Solution:** Review filter options and verify account IDs are correct: + +```bash +# List all accounts in organization +aws organizations list-accounts --query "Accounts[?Status=='ACTIVE'].[Id,Name]" --output table +``` + +### Connection Test Failures During Bulk Provisioning + +**Cause:** ProwlerRole may not be deployed correctly or credentials are invalid. + +**Solution:** + +* Verify StackSet deployment status in CloudFormation +* Check role trust policy includes correct external ID +* Test role assumption manually: + +```bash +aws sts assume-role \ + --role-arn arn:aws:iam::123456789012:role/ProwlerRole \ + --role-session-name test \ + --external-id prowler-ext-id-2024 +``` + +## Security Best Practices + +### Use External ID + +Always use an external ID when assuming cross-account roles: + +```bash +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --external-id $(uuidgen | tr '[:upper:]' '[:lower:]') +``` + +The external ID must match the one configured in the ProwlerRole trust policy across all accounts. + +### Exclude Sensitive Accounts + +Exclude accounts that shouldn't be scanned or require special handling: + +```bash +python aws_org_generator.py \ + -o aws-accounts.yaml \ + --external-id prowler-ext-id \ + --exclude 123456789012,111111111111 # management, break-glass accounts +``` + +### Review Generated Configuration + +Always review the generated YAML before provisioning: + +```bash +# Check for unexpected accounts +grep "uid:" aws-org-accounts.yaml + +# Verify role ARNs +grep "role_arn:" aws-org-accounts.yaml | head -5 + +# Count accounts +grep "provider: aws" aws-org-accounts.yaml | wc -l +``` + +## Next Steps + + + + Learn how to bulk provision providers in Prowler. + + + Detailed instructions on how to use Prowler. + + diff --git a/docs/user-guide/tutorials/bulk-provider-provisioning.mdx b/docs/user-guide/tutorials/bulk-provider-provisioning.mdx index 11e7f14cf8..3ad5d9c0d5 100644 --- a/docs/user-guide/tutorials/bulk-provider-provisioning.mdx +++ b/docs/user-guide/tutorials/bulk-provider-provisioning.mdx @@ -17,14 +17,18 @@ The Bulk Provider Provisioning tool automates the creation of cloud providers in * Testing connections to verify successful authentication * Processing multiple providers concurrently for efficiency + +**Using AWS Organizations?** For organizations with many AWS accounts, use the automated [AWS Organizations Bulk Provisioning](./aws-organizations-bulk-provisioning) tool to automatically discover and generate configuration for all accounts in your organization. + ## Prerequisites ### Requirements * Python 3.7 or higher -* Prowler API token (from Prowler Cloud or self-hosted Prowler App) +* Prowler API key (from Prowler Cloud or self-hosted Prowler App) * For self-hosted Prowler App, remember to [point to your API base URL](#custom-api-endpoints) + * Learn how to create API keys: [Prowler App API Keys](../tutorials/prowler-app-api-keys) * Authentication credentials for target cloud providers ### Installation @@ -39,28 +43,21 @@ pip install -r requirements.txt ### Authentication Setup -Configure your Prowler API token: +Configure your Prowler API key: ```bash -export PROWLER_API_TOKEN="your-prowler-api-token" +export PROWLER_API_KEY="pk_example-api-key" ``` -To obtain an API token programmatically: +To create an API key: -```bash -export PROWLER_API_TOKEN=$(curl --location 'https://api.prowler.com/api/v1/tokens' \ - --header 'Content-Type: application/vnd.api+json' \ - --header 'Accept: application/vnd.api+json' \ - --data-raw '{ - "data": { - "type": "tokens", - "attributes": { - "email": "your@email.com", - "password": "your-password" - } - } - }' | jq -r .data.attributes.access) -``` +1. Log in to Prowler Cloud or Prowler App +2. Click **Profile** → **Account** +3. Click **Create API Key** +4. Provide a descriptive name and optionally set an expiration date +5. Copy the generated API key (it will only be shown once) + +For detailed instructions, see: [Prowler App API Keys](../tutorials/prowler-app-api-keys) ## Configuration File Structure @@ -340,11 +337,11 @@ Done. Success: 2 Failures: 0 ## Troubleshooting -### Invalid API Token +### Invalid API Key ``` Error: 401 Unauthorized -Solution: Verify your PROWLER_API_TOKEN or --token parameter +Solution: Verify your PROWLER_API_KEY environment variable or --api-key parameter ``` ### Network Timeouts diff --git a/docs/user-guide/providers/prowler-app-api-keys.mdx b/docs/user-guide/tutorials/prowler-app-api-keys.mdx similarity index 99% rename from docs/user-guide/providers/prowler-app-api-keys.mdx rename to docs/user-guide/tutorials/prowler-app-api-keys.mdx index f7a656e173..4e51e62bac 100644 --- a/docs/user-guide/providers/prowler-app-api-keys.mdx +++ b/docs/user-guide/tutorials/prowler-app-api-keys.mdx @@ -2,6 +2,10 @@ title: 'API Keys' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + + API key authentication in Prowler App provides an alternative to JWT tokens and empowers automation, CI/CD pipelines, and third-party integrations. This guide explains how to create, manage, and safeguard API keys when working with the Prowler API. ## API Key Advantages diff --git a/docs/user-guide/tutorials/prowler-app-jira-integration.mdx b/docs/user-guide/tutorials/prowler-app-jira-integration.mdx index a4eed1e494..19a31347c9 100644 --- a/docs/user-guide/tutorials/prowler-app-jira-integration.mdx +++ b/docs/user-guide/tutorials/prowler-app-jira-integration.mdx @@ -1,6 +1,9 @@ --- title: "Jira Integration" --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + Prowler App enables automatic export of security findings to Jira, providing seamless integration with Atlassian's work item tracking and project management platform. This comprehensive guide demonstrates how to configure and manage Jira integrations to streamline security incident management and enhance team collaboration across security workflows. diff --git a/docs/user-guide/tutorials/prowler-app-lighthouse.mdx b/docs/user-guide/tutorials/prowler-app-lighthouse.mdx index 1ea3da3ac5..abff053dc8 100644 --- a/docs/user-guide/tutorials/prowler-app-lighthouse.mdx +++ b/docs/user-guide/tutorials/prowler-app-lighthouse.mdx @@ -2,6 +2,10 @@ title: 'Prowler Lighthouse AI' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + + Prowler Lighthouse AI is a Cloud Security Analyst chatbot that helps you understand, prioritize, and remediate security findings in your cloud environments. It's designed to provide security expertise for teams without dedicated resources, acting as your 24/7 virtual cloud security analyst. Prowler Lighthouse diff --git a/docs/user-guide/tutorials/prowler-app-mute-findings.mdx b/docs/user-guide/tutorials/prowler-app-mute-findings.mdx index 76b85f0e66..9f3bdad640 100644 --- a/docs/user-guide/tutorials/prowler-app-mute-findings.mdx +++ b/docs/user-guide/tutorials/prowler-app-mute-findings.mdx @@ -1,6 +1,9 @@ --- title: 'Mute Findings (Mutelist)' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + Prowler App allows users to mute specific findings to focus on the most critical security issues. This comprehensive guide demonstrates how to effectively use the Mutelist feature to manage and prioritize security findings. diff --git a/docs/user-guide/tutorials/prowler-app-rbac.mdx b/docs/user-guide/tutorials/prowler-app-rbac.mdx index 8accc77488..72059436f5 100644 --- a/docs/user-guide/tutorials/prowler-app-rbac.mdx +++ b/docs/user-guide/tutorials/prowler-app-rbac.mdx @@ -2,6 +2,10 @@ title: 'Managing Users and Role-Based Access Control (RBAC)' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + + **Prowler App** supports multiple users within a single tenant, enabling seamless collaboration by allowing team members to easily share insights and manage security findings. [Roles](#roles) help you control user permissions, determining what actions each user can perform and the data they can access within Prowler. By default, each account includes an immutable **admin** role, ensuring that your account always retains administrative access. diff --git a/docs/user-guide/tutorials/prowler-app-s3-integration.mdx b/docs/user-guide/tutorials/prowler-app-s3-integration.mdx index 8e8158b0c0..728e4a4354 100644 --- a/docs/user-guide/tutorials/prowler-app-s3-integration.mdx +++ b/docs/user-guide/tutorials/prowler-app-s3-integration.mdx @@ -2,6 +2,10 @@ title: 'Amazon S3 Integration' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + + **Prowler App** allows automatic export of scan results to Amazon S3 buckets, providing seamless integration with existing data workflows and storage infrastructure. This comprehensive guide demonstrates configuration and management of Amazon S3 integrations to streamline security finding management and reporting. When enabled and configured, scan results are automatically stored in the configured bucket. Results are provided in `csv`, `html` and `json-ocsf` formats, offering flexibility for custom integrations: diff --git a/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx b/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx index 4c192e7a0c..592ff2b26d 100644 --- a/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx +++ b/docs/user-guide/tutorials/prowler-app-security-hub-integration.mdx @@ -1,6 +1,9 @@ --- title: "AWS Security Hub Integration" --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + Prowler App enables automatic export of security findings to AWS Security Hub, providing seamless integration with AWS's native security and compliance service. This comprehensive guide demonstrates how to configure and manage AWS Security Hub integrations to centralize security findings and enhance compliance tracking across AWS environments. diff --git a/docs/user-guide/tutorials/prowler-app-social-login.mdx b/docs/user-guide/tutorials/prowler-app-social-login.mdx index ecc75959e9..45fe8ec62f 100644 --- a/docs/user-guide/tutorials/prowler-app-social-login.mdx +++ b/docs/user-guide/tutorials/prowler-app-social-login.mdx @@ -2,6 +2,10 @@ title: 'Social Login Configuration' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + + **Prowler App** supports social login using Google and GitHub OAuth providers. This document guides you through configuring the required environment variables to enable social authentication. Social login buttons diff --git a/docs/user-guide/tutorials/prowler-app-sso.mdx b/docs/user-guide/tutorials/prowler-app-sso.mdx index b22ae7941a..f56336f415 100644 --- a/docs/user-guide/tutorials/prowler-app-sso.mdx +++ b/docs/user-guide/tutorials/prowler-app-sso.mdx @@ -2,6 +2,10 @@ title: 'SAML Single Sign-On (SSO)' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + + + This guide provides comprehensive instructions to configure SAML-based Single Sign-On (SSO) in Prowler App. This configuration allows users to authenticate using the organization's Identity Provider (IdP). This document is divided into two main sections: diff --git a/mcp_server/.env.template b/mcp_server/.env.template index 6227bdd388..7713b5ae33 100644 --- a/mcp_server/.env.template +++ b/mcp_server/.env.template @@ -1,3 +1,3 @@ PROWLER_APP_API_KEY="pk_your_api_key_here" PROWLER_API_BASE_URL="https://api.prowler.com" -PROWLER_MCP_MODE="stdio" +PROWLER_MCP_TRANSPORT_MODE="stdio" diff --git a/mcp_server/CHANGELOG.md b/mcp_server/CHANGELOG.md index be766b4162..80b43bcfff 100644 --- a/mcp_server/CHANGELOG.md +++ b/mcp_server/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes to the **Prowler MCP Server** are documented in this file. -## [0.1.0] (Prowler UNRELEASED) +## [0.1.0] (Prowler 5.13.0) ### Added - Initial release of Prowler MCP Server [(#8695)](https://github.com/prowler-cloud/prowler/pull/8695) @@ -13,4 +13,5 @@ All notable changes to the **Prowler MCP Server** are documented in this file. - Add new MCP Server for Prowler Documentation [(#8795)](https://github.com/prowler-cloud/prowler/pull/8795) - API key support for STDIO mode and enhanced HTTP mode authentication [(#8823)](https://github.com/prowler-cloud/prowler/pull/8823) - Add health check endpoint [(#8905)](https://github.com/prowler-cloud/prowler/pull/8905) -- Update Prowler Documentation MCP Server to use Mintlify API [(#8915)](https://github.com/prowler-cloud/prowler/pull/8915) +- Update Prowler Documentation MCP Server to use Mintlify API [(#8916)](https://github.com/prowler-cloud/prowler/pull/8916) +- Add custom production deployment using uvicorn [(#8958)](https://github.com/prowler-cloud/prowler/pull/8958) diff --git a/mcp_server/Dockerfile b/mcp_server/Dockerfile index fd92db7cdd..d075e83b5f 100644 --- a/mcp_server/Dockerfile +++ b/mcp_server/Dockerfile @@ -47,13 +47,12 @@ COPY --from=builder --chown=prowler /app/prowler_mcp_server /app/prowler_mcp_ser # 3. Project metadata file (may be needed by some packages at runtime) COPY --from=builder --chown=prowler /app/pyproject.toml /app/pyproject.toml +# 4. Entrypoint helper script for selecting runtime mode +COPY --from=builder --chown=prowler /app/entrypoint.sh /app/entrypoint.sh + # Add virtual environment to PATH so prowler-mcp command is available ENV PATH="/app/.venv/bin:$PATH" -# Entry point for the MCP server -# Default to stdio mode, but allow overriding via command arguments -# Examples: -# docker run -p 8000:8000 prowler-mcp --transport http --host 0.0.0.0 --port 8000 -# docker run prowler-mcp --transport stdio -ENTRYPOINT ["prowler-mcp"] -CMD ["--transport", "stdio"] +# Entrypoint wrapper defaults to CLI mode; override with `uvicorn` to run ASGI app +ENTRYPOINT ["/app/entrypoint.sh"] +CMD ["main"] diff --git a/mcp_server/README.md b/mcp_server/README.md index eebe139fba..e652ee5fcc 100644 --- a/mcp_server/README.md +++ b/mcp_server/README.md @@ -144,11 +144,11 @@ uv run prowler-mcp --transport http uv run prowler-mcp --transport http --host 0.0.0.0 --port 8080 ``` -For self-deployed MCP remote server, you can use also configure the server to use a custom API base URL with the environment variable `PROWLER_API_BASE_URL`; and the transport mode with the environment variable `PROWLER_MCP_MODE`. +For self-deployed MCP remote server, you can use also configure the server to use a custom API base URL with the environment variable `PROWLER_API_BASE_URL`; and the transport mode with the environment variable `PROWLER_MCP_TRANSPORT_MODE`. ```bash export PROWLER_API_BASE_URL="https://api.prowler.com" -export PROWLER_MCP_MODE="http" +export PROWLER_MCP_TRANSPORT_MODE="http" ``` ### Using uv directly @@ -190,6 +190,16 @@ docker run --rm --env-file ./.env -p 8000:8000 -it prowler-mcp --transport http docker run --rm --env-file ./.env -p 8080:8080 -it prowler-mcp --transport http --host 0.0.0.0 --port 8080 ``` +## Production Deployment + +For production deployments that require customization, it is recommended to use the ASGI application that can be found in `prowler_mcp_server.server`. This can be run with uvicorn: + +```bash +uvicorn prowler_mcp_server.server:app --host 0.0.0.0 --port 8000 +``` + +For more details on production deployment options, see the [FastMCP production deployment guide](https://gofastmcp.com/deployment/http#production-deployment) and [uvicorn settings](https://www.uvicorn.org/settings/). + ## Command Line Arguments The Prowler MCP server supports the following command line arguments: @@ -482,6 +492,10 @@ If you want to have it globally available, add the example server to Cursor's co If you want to have it only for the current project, add the example server to the project's root in a new `.cursor/mcp.json` file. +## Documentation + +For detailed documentation about the Prowler MCP Server, including guides, tutorials, and use cases, visit the [official Prowler documentation](https://docs.prowler.com). + ## License -This project follows the repository’s main license. See the [LICENSE](../LICENSE) file at the repository root. +This project follows the repository's main license. See the [LICENSE](../LICENSE) file at the repository root. diff --git a/mcp_server/entrypoint.sh b/mcp_server/entrypoint.sh new file mode 100755 index 0000000000..7b56e08708 --- /dev/null +++ b/mcp_server/entrypoint.sh @@ -0,0 +1,50 @@ +#!/bin/sh +set -eu + +usage() { + cat <<'EOF' +Usage: ./entrypoint.sh [main|uvicorn] [args...] + +Modes: + main (default) Run prowler-mcp + uvicorn Run uvicorn prowler_mcp_server.server:app + +All additional arguments are forwarded to the selected command. +EOF +} + +mode="main" + +if [ "$#" -gt 0 ]; then + case "$1" in + main|cli) + mode="main" + shift + ;; + uvicorn|asgi) + mode="uvicorn" + shift + ;; + -h|--help) + usage + exit 0 + ;; + *) + mode="main" + ;; + esac +fi + +case "$mode" in + main) + exec prowler-mcp "$@" + ;; + uvicorn) + export PROWLER_MCP_TRANSPORT_MODE="http" + exec uvicorn prowler_mcp_server.server:app "$@" + ;; + *) + usage + exit 1 + ;; +esac diff --git a/mcp_server/prowler_mcp_server/main.py b/mcp_server/prowler_mcp_server/main.py index 272cfa3043..596e1c31b9 100644 --- a/mcp_server/prowler_mcp_server/main.py +++ b/mcp_server/prowler_mcp_server/main.py @@ -1,10 +1,8 @@ import argparse -import asyncio import os import sys from prowler_mcp_server.lib.logger import logger -from prowler_mcp_server.server import setup_main_server def parse_arguments(): @@ -13,7 +11,7 @@ def parse_arguments(): parser.add_argument( "--transport", choices=["stdio", "http"], - default=os.getenv("PROWLER_MCP_MODE", "stdio"), + default=None, help="Transport method (default: stdio)", ) parser.add_argument( @@ -35,13 +33,26 @@ def main(): try: args = parse_arguments() - # Set up server with configuration - prowler_mcp_server = asyncio.run(setup_main_server(transport=args.transport)) + print(f"args.transport: {args.transport}") + + if args.transport is None: + args.transport = os.getenv("PROWLER_MCP_TRANSPORT_MODE", "stdio") + else: + os.environ["PROWLER_MCP_TRANSPORT_MODE"] = args.transport + + from prowler_mcp_server.server import prowler_mcp_server if args.transport == "stdio": - prowler_mcp_server.run(transport="stdio") + prowler_mcp_server.run(transport=args.transport, show_banner=False) elif args.transport == "http": - prowler_mcp_server.run(transport="http", host=args.host, port=args.port) + prowler_mcp_server.run( + transport=args.transport, + host=args.host, + port=args.port, + show_banner=False, + ) + else: + logger.error(f"Invalid transport: {args.transport}") except KeyboardInterrupt: logger.info("Shutting down Prowler MCP server...") diff --git a/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py b/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py index 1fdc23d431..b23c58d016 100644 --- a/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py +++ b/mcp_server/prowler_mcp_server/prowler_app/utils/auth.py @@ -14,7 +14,7 @@ class ProwlerAppAuth: def __init__( self, - mode: str = os.getenv("PROWLER_MCP_MODE", "stdio"), + mode: str = os.getenv("PROWLER_MCP_TRANSPORT_MODE", "stdio"), base_url: str = os.getenv("PROWLER_API_BASE_URL", "https://api.prowler.com"), ): self.base_url = base_url.rstrip("/") @@ -33,7 +33,14 @@ class ProwlerAppAuth: raise ValueError("Prowler App API key format is incorrect") def _parse_jwt(self, token: str) -> Optional[Dict]: - """Parse JWT token and return payload, similar to JS parseJwt function.""" + """Parse JWT token and return payload + + Args: + token: JWT token to parse + + Returns: + Parsed JWT payload, or None if parsing fails + """ if not token: return None diff --git a/mcp_server/prowler_mcp_server/server.py b/mcp_server/prowler_mcp_server/server.py index 644135497a..9f36befb73 100644 --- a/mcp_server/prowler_mcp_server/server.py +++ b/mcp_server/prowler_mcp_server/server.py @@ -1,16 +1,16 @@ +import asyncio import os from fastmcp import FastMCP +from prowler_mcp_server import __version__ from prowler_mcp_server.lib.logger import logger from starlette.responses import JSONResponse +prowler_mcp_server = FastMCP("prowler-mcp-server") -async def setup_main_server(transport: str) -> FastMCP: + +async def setup_main_server(): """Set up the main Prowler MCP server with all available integrations.""" - - # Initialize main Prowler MCP server - prowler_mcp_server = FastMCP("prowler-mcp-server") - # Import Prowler Hub tools with prowler_hub_ prefix try: logger.info("Importing Prowler Hub server...") @@ -21,12 +21,10 @@ async def setup_main_server(transport: str) -> FastMCP: except Exception as e: logger.error(f"Failed to import Prowler Hub server: {e}") + # Import Prowler App tools with prowler_app_ prefix try: logger.info("Importing Prowler App server...") - if os.getenv("PROWLER_MCP_MODE", None) is None: - os.environ["PROWLER_MCP_MODE"] = transport - if not os.path.exists( os.path.join(os.path.dirname(__file__), "prowler_app", "server.py") ): @@ -44,6 +42,7 @@ async def setup_main_server(transport: str) -> FastMCP: except Exception as e: logger.error(f"Failed to import Prowler App server: {e}") + # Import Prowler Documentation tools with prowler_docs_ prefix try: logger.info("Importing Prowler Documentation server...") from prowler_mcp_server.prowler_documentation.server import docs_mcp_server @@ -53,9 +52,23 @@ async def setup_main_server(transport: str) -> FastMCP: except Exception as e: logger.error(f"Failed to import Prowler Documentation server: {e}") - # Add health check endpoint - @prowler_mcp_server.custom_route("/health", methods=["GET"]) - async def health_check(request): - return JSONResponse({"status": "healthy", "service": "prowler-mcp-server"}) - return prowler_mcp_server +# Add health check endpoint +@prowler_mcp_server.custom_route("/health", methods=["GET"]) +async def health_check(request) -> JSONResponse: + """Health check endpoint.""" + return JSONResponse( + {"status": "healthy", "service": "prowler-mcp-server", "version": __version__} + ) + + +# Get or create the event loop +try: + loop = asyncio.get_running_loop() + # If we have a running loop, schedule the setup as a task + loop.create_task(setup_main_server()) +except RuntimeError: + # No running loop, use asyncio.run (for standalone execution) + asyncio.run(setup_main_server()) + +app = prowler_mcp_server.http_app() diff --git a/prowler/AGENTS.md b/prowler/AGENTS.md new file mode 100644 index 0000000000..0a9fb455e8 --- /dev/null +++ b/prowler/AGENTS.md @@ -0,0 +1,366 @@ +# Prowler SDK Agent Guide + +**Complete guide for AI agents and developers working on the Prowler SDK - the core Python security scanning engine.** + +## Project Overview + +The Prowler SDK is the core Python engine that powers Prowler's cloud security assessment capabilities. It provides: + +- **Multi-cloud Security Scanning**: AWS, Azure, GCP, Kubernetes, GitHub, M365, Oracle Cloud, MongoDB Atlas, and more +- **Compliance Frameworks**: 30+ frameworks including CIS, NIST, PCI-DSS, SOC2, GDPR +- **1000+ Security Checks**: Comprehensive coverage across all supported providers +- **Multiple Output Formats**: JSON, CSV, HTML, ASFF, OCSF, and compliance-specific formats + +## Mission & Scope + +- Maintain and enhance the core Prowler SDK functionality with security and stability as top priorities +- Follow best practices for Python patterns, code style, security, and comprehensive testing +- To get more information about development guidelines, please refer to the Prowler Developer Guide in `docs/developer-guide/` + +--- + +## Architecture Rules + +### 1. Provider Architecture Pattern + +All Prowler providers MUST follow the established pattern: + +``` +prowler/providers/{provider}/ +├── {provider}_provider.py # Main provider class +├── models.py # Provider-specific models +├── config.py # Provider configuration +├── exceptions/ # Provider-specific exceptions +├── lib/ # Provider libraries (as minimun it should have implemented the next folders: service, arguments, mutelist) +│ ├── service/ # Provider-specific service class to be inherited by all services of the provider +│ ├── arguments/ # Provider-specific CLI arguments parser +│ └── mutelist/ # Provider-specific mutelist functionality +└── services/ # All provider services to be audited + └── {service}/ # Individual service + ├── {service}_service.py # Class to fetch the needed resources from the API and store them to be used by the checks + ├── {service}_client.py # Python instance of the service class to be used by the checks + └── {check_name}/ # Individual check folder + ├── {check_name}.py # Python class to implement the check logic + └── {check_name}.metadata.json # JSON file to store the check metadata + └── {check_name_2}/ # Other checks can be added to the same service folder + ├── {check_name_2}.py + └── {check_name_2}.metadata.json + ... + └── {service_2}/ # Other services can be added to the same provider folder + ... +``` + +### 2. Check Implementation Standards + +Every security check MUST implement: + +```python +from prowler.lib.check.models import Check, CheckReport +from prowler.providers..services.._client import _client + +class check_name(Check): + """Ensure that meets .""" + def execute(self) -> list[CheckReport]: + """Execute the check logic. + + Returns: + A list of reports containing the result of the check. + """ + findings = [] + # Check implementation here + for resource in _client.: + # Security validation logic + report = CheckReport(metadata=self.metadata(), resource=resource) + report.status = "PASS" | "FAIL" + report.status_extended = "Detailed explanation" + findings.append(report) # Add the report to the list of findings + return findings +``` + +### 3. Compliance Framework Integration + +All compliance frameworks must be defined in: +- `prowler/compliance/{provider}/{framework}.json` +- Follow the established Compliance model structure +- Include proper requirement mappings and metadata + +--- + +## Tech Stack + +- **Language**: Python 3.9+ +- **Dependency Management**: Poetry 2+ +- **CLI Framework**: Custom argument parser with provider-specific subcommands +- **Testing**: Pytest with extensive unit and integration tests +- **Code Quality**: Pre-commit hooks for Black, Flake8, Pylint, Bandit for security scanning + +## Commands + +### Development Environment + +```bash +# Core development setup +poetry install --with dev # Install all dependencies +poetry run pre-commit install # Install pre-commit hooks + +# Code quality +poetry run pre-commit run --all-files + +# Run tests +poetry run pytest -n auto -vvv -s -x tests/ +``` + +### Running Prowler CLI + +```bash +# Run Prowler +poetry run python prowler-cli.py --help + +# Run Prowler with a specific provider +poetry run python prowler-cli.py + +# Run Prowler with error logging +poetry run python prowler-cli.py --log-level ERROR --verbose + +# Run specific checks +poetry run python prowler-cli.py --checks +``` + +## Project Structure + +``` +prowler/ +├── __main__.py # Main CLI entry point +├── config/ # Global configuration +│ ├── config.py # Core configuration settings +│ └── __init__.py +├── lib/ # Core library functions +│ ├── check/ # Check execution engine +│ │ ├── check.py # Check execution logic +│ │ ├── checks_loader.py # Dynamic check loading +│ │ ├── compliance.py # Compliance framework handling +│ │ └── models.py # Check and report models +│ ├── cli/ # Command-line interface +│ │ └── parser.py # Argument parsing +│ ├── outputs/ # Output format handlers +│ │ ├── csv/ # CSV output +│ │ ├── html/ # HTML reports +│ │ ├── json/ # JSON formats +│ │ └── compliance/ # Compliance reports +│ ├── scan/ # Scan orchestration +│ ├── utils/ # Utility functions +│ └── mutelist/ # Mute list functionality +├── providers/ # Cloud provider implementations +│ ├── aws/ # AWS provider +│ ├── azure/ # Azure provider +│ ├── gcp/ # Google Cloud provider +│ ├── kubernetes/ # Kubernetes provider +│ ├── github/ # GitHub provider +│ ├── m365/ # Microsoft 365 provider +│ ├── mongodbatlas/ # MongoDB Atlas provider +│ ├── oci/ # Oracle Cloud provider +│ ├── ... +│ └── common/ # Shared provider utilities +├── compliance/ # Compliance framework definitions +│ ├── aws/ # AWS compliance frameworks +│ ├── azure/ # Azure compliance frameworks +│ ├── gcp/ # GCP compliance frameworks +│ ├── ... +└── exceptions/ # Global exception definitions +``` + +## Key Components + +### 1. Provider System + +Each cloud provider implements: + +```python +class Provider: + """Base provider class""" + + def __init__(self, arguments): + self.session = self._setup_session(arguments) + self.regions = self._get_regions() + # Initialize all services + + def _setup_session(self, arguments): + """Provider-specific authentication""" + pass + + def _get_regions(self): + """Get available regions for provider""" + pass +``` + +### 2. Check Engine + +The check execution system: + +- **Dynamic Loading**: Automatically discovers and loads checks +- **Parallel Execution**: Runs checks in parallel for performance +- **Error Isolation**: Individual check failures don't affect others +- **Comprehensive Reporting**: Detailed findings with remediation guidance + +### 3. Compliance Framework Engine + +Compliance frameworks are defined as JSON files mapping checks to requirements: + +```json +{ + "Framework": "CIS", + "Name": "CIS Amazon Web Services Foundations Benchmark v2.0.0", + "Version": "2.0", + "Provider": "AWS", + "Description": "The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services with an emphasis on foundational, testable, and architecture agnostic settings.", + "Requirements": [ + { + "Id": "1.1", + "Description": "Maintain current contact details", + "Checks": ["account_contact_details_configured"] + } + ] +} +``` + +### 4. Output System + +Multiple output formats supported: + +- **JSON**: Machine-readable findings +- **CSV**: Spreadsheet-compatible format +- **HTML**: Interactive web reports +- **ASFF**: AWS Security Finding Format +- **OCSF**: Open Cybersecurity Schema Framework + +## Development Patterns + +### Adding New Cloud Providers + +1. **Create Provider Structure**: +```bash +mkdir -p prowler/providers/{provider} +mkdir -p prowler/providers/{provider}/services +mkdir -p prowler/providers/{provider}/lib/{service,arguments,mutelist} +mkdir -p prowler/providers/{provider}/exceptions +``` + +2. **Implement Provider Class**: +```python +from prowler.providers.common.provider import Provider + +class NewProvider(Provider): + def __init__(self, arguments): + super().__init__(arguments) + # Provider-specific initialization +``` + +3. **Add Provider to CLI**: +Update `prowler/lib/cli/parser.py` to include new provider arguments. + +### Adding New Security Checks + +The most common high level steps to create a new check are: + +1. Prerequisites: + - Verify the check does not already exist by searching in the same service folder as `prowler/providers//services///`. + - Ensure required provider and service exist. If not, you will need to create them first. + - Confirm the service has implemented all required methods and attributes for the check (in most cases, you will need to add or modify some methods in the service to get the data you need for the check). +2. Navigate to the service directory. The path should be as follows: `prowler/providers//services/`. +3. Create a check-specific folder. The path should follow this pattern: `prowler/providers//services//`. Adhere to the [Naming Format for Checks](/developer-guide/checks#naming-format-for-checks). +4. Create the check files, you can use next commands: +```bash +mkdir -p prowler/providers//services// +touch prowler/providers//services///__init__.py +touch prowler/providers//services///.py +touch prowler/providers//services///.metadata.json +``` +5. Run the check locally to ensure it works as expected. For checking you can use the CLI in the next way: + - To ensure the check has been detected by Prowler: `poetry run python prowler-cli.py --list-checks | grep `. + - To run the check, to find possible issues: `poetry run python prowler-cli.py --log-level ERROR --verbose --check `. +6. Create comprehensive tests for the check that cover multiple scenarios including both PASS (compliant) and FAIL (non-compliant) cases. For detailed information about test structure and implementation guidelines, refer to the [Testing](/developer-guide/unit-testing) documentation. +7. If the check and its corresponding tests are working as expected, you can submit a PR to Prowler. + +### Adding Compliance Frameworks + +1. **Create Framework File**: +```bash +# Create prowler/compliance/{provider}/{framework}.json +``` + +2. **Define Requirements**: +Map framework requirements to existing checks. + +3. **Test Compliance**: +```bash +poetry run python -m prowler {provider} --compliance {framework} +``` + +## Code Quality Standards + +### 1. Python Style + +- **PEP 8 Compliance**: Enforced by black and flake8 +- **Type Hints**: Required for all public functions +- **Docstrings**: Required for all classes and methods +- **Import Organization**: Use isort for consistent import ordering + +```python +import standard_library + +from third_party import library + +from prowler.lib import internal_module + +class ExampleClass: + """Class docstring.""" + + def method(self, param: str) -> dict | list | None: + """Method docstring. + + Args: + param: Description of parameter + + Returns: + Description of return value + """ + return None +``` + +### 2. Error Handling + +```python +from prowler.lib.logger import logger + +try: + # Risky operation + result = api_call() +except ProviderSpecificException as e: + logger.error(f"Provider error: {e}") + # Graceful handling +except Exception as e: + logger.error(f"Unexpected error: {e}") + # Never let checks crash the entire scan +``` + +### 3. Security Practices + +- **No Hardcoded Secrets**: Use environment variables or secure credential management +- **Input Validation**: Validate all external inputs +- **Principle of Least Privilege**: Request minimal necessary permissions +- **Secure Defaults**: Default to secure configurations + +## Testing Guidelines + +### Unit Tests + +- **100% Coverage Goal**: Aim for complete test coverage +- **Mock External Services**: Use mock objects to simulate the external services +- **Test Edge Cases**: Include error conditions and boundary cases + +## References + +- **Root Project Guide**: `../AGENTS.md` (takes priority for cross-component guidance) +- **Provider Examples**: Reference existing providers for implementation patterns +- **Check Examples**: Study existing checks for proper implementation patterns +- **Compliance Framework Examples**: Review existing frameworks for structure diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 8e07798608..7489582dcf 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -2,7 +2,28 @@ All notable changes to the **Prowler SDK** are documented in this file. -## [v5.13.0] (Prowler UNRELEASED) +## [v5.14.0] (Prowler UNRELEASED) + +### Added +- GitHub provider check `organization_default_repository_permission_strict` [(#8785)](https://github.com/prowler-cloud/prowler/pull/8785) +- `codepipeline_project_repo_private` check for AWS provider [(#5915)](https://github.com/prowler-cloud/prowler/pull/5915) + +### Changed +- Update AWS Direct Connect service metadata to new format [(#8855)](https://github.com/prowler-cloud/prowler/pull/8855) +- Update AWS DRS service metadata to new format [(#8870)](https://github.com/prowler-cloud/prowler/pull/8870) +- Update AWS DynamoDB service metadata to new format [(#8871)](https://github.com/prowler-cloud/prowler/pull/8871) + +--- + +## [v5.13.1] (Prowler UNRELEASED) + +### Fixed +- Add `resource_name` for checks under `logging` for the GCP provider [(#9023)](https://github.com/prowler-cloud/prowler/pull/9023) + + +--- + +## [v5.13.0] (Prowler v5.13.0) ### Added - Support for AdditionalURLs in outputs [(#8651)](https://github.com/prowler-cloud/prowler/pull/8651) @@ -17,6 +38,8 @@ All notable changes to the **Prowler SDK** are documented in this file. - Oracle Cloud provider with CIS 3.0 benchmark [(#8893)](https://github.com/prowler-cloud/prowler/pull/8893) - Support for Atlassian Document Format (ADF) in Jira integration [(#8878)](https://github.com/prowler-cloud/prowler/pull/8878) - Add Common Cloud Controls for AWS, Azure and GCP [(#8000)](https://github.com/prowler-cloud/prowler/pull/8000) +- Improve Provider documentation guide [(#8430)](https://github.com/prowler-cloud/prowler/pull/8430) +- `cloudstorage_bucket_lifecycle_management_enabled` check for GCP provider [(#8936)](https://github.com/prowler-cloud/prowler/pull/8936) ### Changed @@ -32,10 +55,13 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS AppStream service metadata to new format [(#8789)](https://github.com/prowler-cloud/prowler/pull/8789) - Update AWS API Gateway service metadata to new format [(#8788)](https://github.com/prowler-cloud/prowler/pull/8788) - Update AWS Athena service metadata to new format [(#8790)](https://github.com/prowler-cloud/prowler/pull/8790) +- Update AWS CloudTrail service metadata to new format [(#8831)](https://github.com/prowler-cloud/prowler/pull/8831) - Update AWS Auto Scaling service metadata to new format [(#8824)](https://github.com/prowler-cloud/prowler/pull/8824) - Update AWS Backup service metadata to new format [(#8826)](https://github.com/prowler-cloud/prowler/pull/8826) - Update AWS CloudFormation service metadata to new format [(#8828)](https://github.com/prowler-cloud/prowler/pull/8828) - Update AWS Lambda service metadata to new format [(#8825)](https://github.com/prowler-cloud/prowler/pull/8825) +- Update AWS DLM service metadata to new format [(#8860)](https://github.com/prowler-cloud/prowler/pull/8860) +- Update AWS DMS service metadata to new format [(#8861)](https://github.com/prowler-cloud/prowler/pull/8861) - Update AWS Directory Service service metadata to new format [(#8859)](https://github.com/prowler-cloud/prowler/pull/8859) - Update AWS CloudFront service metadata to new format [(#8829)](https://github.com/prowler-cloud/prowler/pull/8829) - Deprecate user authentication for M365 provider [(#8865)](https://github.com/prowler-cloud/prowler/pull/8865) @@ -47,13 +73,8 @@ All notable changes to the **Prowler SDK** are documented in this file. - Prowler ThreatScore scoring calculation CLI [(#8582)](https://github.com/prowler-cloud/prowler/pull/8582) - Add missing attributes for Mitre Attack AWS, Azure and GCP [(#8907)](https://github.com/prowler-cloud/prowler/pull/8907) - Fix KeyError in CloudSQL and Monitoring services in GCP provider [(#8909)](https://github.com/prowler-cloud/prowler/pull/8909) +- Fix Value Errors in Entra service for M365 provider [(#8919)](https://github.com/prowler-cloud/prowler/pull/8919) - Fix ResourceName in GCP provider [(#8928)](https://github.com/prowler-cloud/prowler/pull/8928) - ---- - -## [v5.12.4] (Prowler UNRELEASED) - -### Fixed - Fix KeyError in `elb_ssl_listeners_use_acm_certificate` check and handle None cluster version in `eks_cluster_uses_a_supported_version` check [(#8791)](https://github.com/prowler-cloud/prowler/pull/8791) - Fix file extension parsing for compliance reports [(#8791)](https://github.com/prowler-cloud/prowler/pull/8791) - Added user pagination to Entra and Admincenter services [(#8858)](https://github.com/prowler-cloud/prowler/pull/8858) diff --git a/prowler/compliance/aws/ccc_aws.json b/prowler/compliance/aws/ccc_aws.json index ba00424a72..1f6da6d5f6 100644 --- a/prowler/compliance/aws/ccc_aws.json +++ b/prowler/compliance/aws/ccc_aws.json @@ -6,19 +6,19 @@ "Description": "Common Cloud Controls Catalog (CCC) for AWS", "Requirements": [ { - "Id": "CCC.AuditLog.C01.TR01", + "Id": "CCC.AuditLog.CN01.AR01", "Description": "When the signature validation process is performed, then it MUST detect any modification of data.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure hash of data is included in digital signature.\n", + "Recommendation": "Ensure hash of data is included in digital signature. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -49,19 +49,19 @@ ] }, { - "Id": "CCC.AuditLog.C01.TR02", + "Id": "CCC.AuditLog.CN01.AR02", "Description": "When the signature validation process is performed, then it MUST detect any missing (deleted) log file.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure verification process includes a chained hash function.\n", + "Recommendation": "Ensure verification process includes a chained hash function. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -92,15 +92,15 @@ ] }, { - "Id": "CCC.AuditLog.C02.TR01", - "Description": "When a manual action is performed to generate each audit log type,\nthen the corresponding audit log type MUST be generated and recorded.", + "Id": "CCC.AuditLog.CN02.AR01", + "Description": "When a manual action is performed to generate each audit log type, then the corresponding audit log type MUST be generated and recorded.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C02 Enable And Validate All Audit Log Types", + "Section": "CCC.AuditLog.CN02 Enable And Validate All Audit Log Types", "SubSection": "", - "SubSectionObjective": "Review audit log configuration and ensure that all audit log types\nare being generated and replicated to configured sinks", + "SubSectionObjective": "Review audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks", "Applicability": [ "tlp-red", "tlp-amber" @@ -149,20 +149,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR01", + "Id": "CCC.AuditLog.CN03.AR01", "Description": "When an attempt is made to disable a log source, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -200,20 +200,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR02", - "Description": "When an attempt is made to alter the retention or object lock status\nof an external data log source or bucket, then an alert MUST be generated.", + "Id": "CCC.AuditLog.CN03.AR02", + "Description": "When an attempt is made to alter the retention or object lock status of an external data log source or bucket, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -254,20 +254,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", - "Description": "When audit log buckets are created then verify that server access\nlogging MUST be enabled for the audit log bucket,\nwith logs delivered to a separate, secure logging bucket.", + "Id": "CCC.AuditLog.CN04.AR01", + "Description": "When audit log buckets are created then verify that server access logging MUST be enabled for the audit log bucket, with logs delivered to a separate, secure logging bucket.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C04 Ensure Access Logging Is Enabled on the Audit Log Bucket", + "Section": "CCC.AuditLog.CN04 Ensure Access Logging Is Enabled on the Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to\ncapture all requests made to the bucket, providing an audit trail of data access.", + "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure the audit log bucket to enable server access logging.\nEnsure the target logging bucket is configured for appropriate security,\nincluding restricted access and immutability.\n", + "Recommendation": "Configure the audit log bucket to enable server access logging. Ensure the target logging bucket is configured for appropriate security, including restricted access and immutability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -303,20 +303,20 @@ ] }, { - "Id": "CCC.AuditLog.C05.TR01", + "Id": "CCC.AuditLog.CN05.AR01", "Description": "When audit logs are exported, then audit logs MUST be present in the configured data location.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C05 Export Audit Logs To Bucket", + "Section": "CCC.AuditLog.CN05 Export Audit Logs To Bucket", "SubSection": "", - "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated\nand can be subject to greater access control and data retention polices.", + "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure audit log exporting.\n", + "Recommendation": "Configure audit log exporting. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -357,21 +357,21 @@ ] }, { - "Id": "CCC.AuditLog.C06.TR01", - "Description": "When the retention policy is applied, then data MUST\nbe automatically deleted after the configured number of days.", + "Id": "CCC.AuditLog.CN06.AR01", + "Description": "When the retention policy is applied, then data MUST be automatically deleted after the configured number of days.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C06 Enforce Retention Policy on Audit Log Bucket", + "Section": "CCC.AuditLog.CN06 Enforce Retention Policy on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are\nretained for the correct number of days as defined by your organization's policy.", + "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce\nthe required data retention period.\n", + "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce the required data retention period. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -403,21 +403,21 @@ ] }, { - "Id": "CCC.AuditLog.C07.TR01", - "Description": "When a standard file deletion is attempted on an object within\nthe audit log bucket, then it MUST be prevented unless MFA is provided.", + "Id": "CCC.AuditLog.CN07.AR01", + "Description": "When a standard file deletion is attempted on an object within the audit log bucket, then it MUST be prevented unless MFA is provided.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C07 Enforce MFA Delete on Audit Log Bucket", + "Section": "CCC.AuditLog.CN07 Enforce MFA Delete on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to\nprovide greater protection against accidental or malicious deletion of audit data.", + "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations)\non the audit log bucket.\n", + "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations) on the audit log bucket. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -449,20 +449,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to delete data before the object\nlock period expires, then the deletion MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to delete data before the object lock period expires, then the deletion MUST be denied.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C08 Enable Object Lock On Audit Log Bucket", + "Section": "CCC.AuditLog.CN08 Enable Object Lock On Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket.\nThe lock time MUST be configured to meet your organization, legal and compliance goals.\nDeletion attempts before the lock period MUST be denied.", + "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket. The lock time MUST be configured to meet your organization, legal and compliance goals. Deletion attempts before the lock period MUST be denied.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -493,20 +493,20 @@ ] }, { - "Id": "CCC.AuditLog.C09.TR01", + "Id": "CCC.AuditLog.CN09.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C09 Restrict Field And Log Type Access", + "Section": "CCC.AuditLog.CN09 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on audit data.\n", + "Recommendation": "Review field level access controls on audit data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -545,21 +545,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR01", - "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny\npublic read and write access.", + "Id": "CCC.AuditLog.CN10.AR01", + "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -593,21 +593,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR02", - "Description": "When the URL of a audit log storage bucket's object is accessed publicly then,\nit should be denied by bucket policy.", + "Id": "CCC.AuditLog.CN10.AR02", + "Description": "When the URL of a audit log storage bucket's object is accessed publicly then, it should be denied by bucket policy.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -642,15 +642,15 @@ ] }, { - "Id": "CCC.Build.C01.TR01", + "Id": "CCC.Build.CN01.AR01", "Description": "Attempt to initiate a build using an unauthorized build agent and verify that the build is rejected.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C01 Restrict Allowed Build Agents", + "Section": "CCC.Build.CN01 Restrict Allowed Build Agents", "SubSection": "", - "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain\ncontrol over the build environment and prevent unauthorized code execution.", + "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain control over the build environment and prevent unauthorized code execution.", "Applicability": [ "tlp-red", "tlp-amber" @@ -693,15 +693,15 @@ ] }, { - "Id": "CCC.Build.C02.TR01", - "Description": "Attempt to trigger a build from an unauthorized external service or\nrepository and verify that the build does not start.", + "Id": "CCC.Build.CN02.AR01", + "Description": "Attempt to trigger a build from an unauthorized external service or repository and verify that the build does not start.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C02 Restrict Allowed External Services for Build Triggers", + "Section": "CCC.Build.CN02 Restrict Allowed External Services for Build Triggers", "SubSection": "", - "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or\nrepositories to prevent unauthorized code execution or tampering.", + "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or repositories to prevent unauthorized code execution or tampering.", "Applicability": [ "tlp-red", "tlp-amber" @@ -740,15 +740,15 @@ ] }, { - "Id": "CCC.Build.C03.TR01", + "Id": "CCC.Build.CN03.AR01", "Description": "Attempt to access the build environment from an external network and verify that access is denied.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C03 Deny External Network Access for Build Environments", + "Section": "CCC.Build.CN03 Deny External Network Access for Build Environments", "SubSection": "", - "SubSectionObjective": "Ensure that build environments do not have external network access to\nprevent unauthorized external access and data exfiltration.", + "SubSectionObjective": "Ensure that build environments do not have external network access to prevent unauthorized external access and data exfiltration.", "Applicability": [ "tlp-red", "tlp-amber" @@ -785,15 +785,15 @@ ] }, { - "Id": "CCC.CntrReg.C01.TR01", - "Description": "Attempt to push an artifact with known vulnerabilities to the registry\nand observe if it is flagged or rejected by the vulnerability scanning process.", + "Id": "CCC.CntrReg.CN01.AR01", + "Description": "Attempt to push an artifact with known vulnerabilities to the registry and observe if it is flagged or rejected by the vulnerability scanning process.", "Attributes": [ { "FamilyName": "Risk Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C01 Implement Vulnerability Scanning for Artifacts", + "Section": "CCC.CntrReg.CN01 Implement Vulnerability Scanning for Artifacts", "SubSection": "", - "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for\nvulnerabilities to identify and remediate security issues before deployment.", + "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for vulnerabilities to identify and remediate security issues before deployment.", "Applicability": [ "tlp-red", "tlp-amber" @@ -830,59 +830,15 @@ ] }, { - "Id": "CCC.CntrReg.C02.TR01", - "Description": "Confirm that artifacts older than the specified retention period are automatically\ndeleted from the registry.", - "Attributes": [ - { - "FamilyName": "Data Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C02 Implement Cleanup Policies for Artifacts", - "SubSection": "", - "SubSectionObjective": "Ensure that unused or outdated artifacts are cleaned up according to defined policies to\nmanage storage effectively and reduce security risks associated with outdated versions.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-12" - ] - } - ] - } - ], - "Checks": [ - "ecr_repositories_lifecycle_policy_enabled", - "s3_bucket_lifecycle_enabled" - ] - }, - { - "Id": "CCC.DataWar.C01.TR01", - "Description": "Attempt to access underlying database tables directly without\nusing managed views and verify that access is denied.", + "Id": "CCC.DataWar.CN01.AR01", + "Description": "Attempt to access underlying database tables directly without using managed views and verify that access is denied.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C01 Enforce Use of Managed Views for Data Access", + "Section": "CCC.DataWar.CN01 Enforce Use of Managed Views for Data Access", "SubSection": "", - "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users\nfrom accessing underlying tables directly and enforcing consistent security policies.", + "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users from accessing underlying tables directly and enforcing consistent security policies.", "Applicability": [ "tlp-red", "tlp-amber" @@ -916,15 +872,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C02.TR01", - "Description": "Attempt to query sensitive columns without the necessary permissions and\nverify that access is denied or data is masked.", + "Id": "CCC.DataWar.CN02.AR01", + "Description": "Attempt to query sensitive columns without the necessary permissions and verify that access is denied or data is masked.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C02 Enforce Column-Level Security Policies", + "Section": "CCC.DataWar.CN02 Enforce Column-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles,\npreventing unauthorized access to sensitive information.", + "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles, preventing unauthorized access to sensitive information.", "Applicability": [ "tlp-red", "tlp-amber" @@ -958,15 +914,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C03.TR01", - "Description": "Attempt to query data rows that the user should not have access to and verify\nthat access is denied or data is not returned.", + "Id": "CCC.DataWar.CN03.AR01", + "Description": "Attempt to query data rows that the user should not have access to and verify that access is denied or data is not returned.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C03 Enforce Row-Level Security Policies", + "Section": "CCC.DataWar.CN03 Enforce Row-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes,\npreventing unauthorized access to specific subsets of data.", + "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes, preventing unauthorized access to specific subsets of data.", "Applicability": [ "tlp-red", "tlp-amber" @@ -1000,743 +956,13 @@ "Checks": [] }, { - "Id": "CCC.GenAI.C01.TR01", - "Description": "Untrusted input such as user queries, RAG data or tool output\nMUST be validated before it is passed to a GenAI model.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.GenAI.C01.TR02", - "Description": "If malicious patterns such as prompt injection or sensitive\ndata are detected during input validation, the input MUST\nbe blocked or sanitised.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled" - ] - }, - { - "Id": "CCC.GenAI.C02.TR01", - "Description": "GenAI model output MUST be validated for format conformance,\nmalicious patterns, sensitive data and inapropriate content\nbefore being passed to users, application or plugins.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_guardrail_prompt_attack_filter_enabled" - ] - }, - { - "Id": "CCC.GenAI.C02.TR02", - "Description": "In the event of policy violations, the AI-generated content MUST\nbe redacted, encoded or rejected.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.GenAI.C03.TR01", - "Description": "When data is designated for model training or RAG ingestion, then its\nsource MUST be explicitly approved and its provenance documented.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C03.TR02", - "Description": "Data from unvetted sources MUST NOT be used in production systems.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [ - "vpc_endpoint_services_allowed_principals_trust_boundaries", - "vpc_endpoint_connections_trust_boundaries", - "s3_bucket_cross_account_access", - "s3_bucket_cross_region_replication", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_public_write_acl", - "s3_bucket_secure_transport_policy", - "s3_bucket_kms_encryption", - "s3_account_level_public_access_blocks", - "s3_bucket_level_public_access_block", - "s3_access_point_public_access_block" - ] - }, - { - "Id": "CCC.GenAI.C04.TR01", - "Description": "When data is ingested for training, fine-tuning or conversion\nto vector embeddings, it MUST be validated for sensitive\ninformation or malicious content.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [ - "cloudformation_stack_outputs_find_secrets", - "ec2_instance_secrets_user_data", - "ec2_launch_template_no_secrets", - "ssm_document_secrets", - "cloudwatch_log_group_no_secrets_in_logs", - "awslambda_function_no_secrets_in_variables", - "awslambda_function_no_secrets_in_code" - ] - }, - { - "Id": "CCC.GenAI.C04.TR02", - "Description": "If sensitive data or malicious content is detected, it must\nbe rejected, redacted or flagged for manual review.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.GenAI.C05.TR01", - "Description": "When a RAG-enabled system generates a response containing information\nretrieved from its knowledge base, then the response MUST include a\nverifiable citation that links back to the specific source document.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C05 Citations and Source Traceability", - "SubSection": "", - "SubSectionObjective": "Require the GenAI system to provide citations or direct links\nback to the source documents used to generate a response, in\nto enhance the transparency, trustworthiness, and verifiability\nof AI-generated content.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH09", - "CCC.GenAI.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-DET-013" - ] - } - ] - } - ], - "Checks": [ - "cloudtrail_multi_region_enabled", - "cloudtrail_cloudwatch_logging_enabled", - "cloudtrail_kms_encryption_enabled", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", - "cloudtrail_s3_dataevents_read_enabled", - "cloudtrail_s3_dataevents_write_enabled", - "cloudtrail_log_file_validation_enabled" - ] - }, - { - "Id": "CCC.GenAI.C06.TR01", - "Description": "When an LLM invokes an external tool (e.g., an API, a plugin),\nthen the tool MUST operate with the least privileges required\nfor performing its intended functionality.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", - "Section": "CCC.GenAI.C06 Least Privilege for Plugins", - "SubSection": "", - "SubSectionObjective": "Restricts the permissions of any external tools the GenAI system\ncan call to limit the potential damage if an agent is coerced\nto perform unintended actions or vulnerabilities in the tools\nare exploited.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH07", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Agent Permissions" - ] - } - ] - } - ], - "Checks": [ - "apigateway_restapi_authorizers_enabled", - "apigatewayv2_api_authorizers_enabled", - "apigateway_restapi_public", - "apigateway_restapi_public_with_authorizer", - "awslambda_function_url_public", - "awslambda_function_not_publicly_accessible", - "iam_policy_allows_privilege_escalation", - "iam_inline_policy_allows_privilege_escalation", - "iam_policy_no_full_access_to_cloudtrail", - "iam_policy_no_full_access_to_kms", - "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_inline_policy_no_full_access_to_kms", - "iam_group_administrator_access_policy", - "iam_user_administrator_access_policy", - "iam_role_administratoraccess_policy" - ] - }, - { - "Id": "CCC.GenAI.C07.TR01", - "Description": "When an application makes an API call to a foundational model in a\nproduction environment, then it MUST specify an explicit version\nidentifier.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "The Configuration Management control family involves establishing,\nmaintaining and monitoring the configuration of the service and\nrelated applications and infrastructure to ensure consistency,\nsecure defaults and compliance.\n", - "Section": "CCC.GenAI.C07 Model Version Pinning", - "SubSection": "", - "SubSectionObjective": "Mandate that applications are locked (\"pinned\") to a specific,\ntested version of a foundational model to prevent unexpected\nbehaviour changes introduced by provider-side updates.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-010" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C08.TR01", - "Description": "When a new AI model is considered for production deployment, it\nMUST undergo a formal red teaming and quality assurance review.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_agent_guardrail_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_api_key_no_administrative_privileges", - "bedrock_api_key_no_long_term_credentials" - ] - }, - { - "Id": "CCC.GenAI.C08.TR02", - "Description": "If model quality review or red teaming identifies an issue that exceeds\nthe organization's risk tolerance, the model MUST NOT be deployed until\nthe issue is remediated.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled", - "bedrock_api_key_no_administrative_privileges", - "bedrock_api_key_no_long_term_credentials" - ] - }, - { - "Id": "CCC.KeyMgmt.C01.TR01", - "Description": "When a key version is scheduled for deletion or disabled, an\nalert MUST be generated within five minutes.", + "Id": "CCC.KeyMgmt.CN01.AR01", + "Description": "When a key version is scheduled for deletion or disabled, an alert MUST be generated within five minutes.", "Attributes": [ { "FamilyName": "Logging and Metrics Publication", "FamilyDescription": "Controls that collect, alert, and retain key-management events.", - "Section": "CCC.KeyMgmt.C01 Alert on Key-version Changes", + "Section": "CCC.KeyMgmt.CN01 Alert on Key-version Changes", "SubSection": "", "SubSectionObjective": "Generate near-real-time alerts when a KMS key version is disabled or scheduled for deletion, enabling rapid investigation and recovery.", "Applicability": [ @@ -1773,13 +999,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C02.TR01", - "Description": "When IAM roles and key policies are reviewed, Decrypt permission\nMUST be granted exclusively to documented authorised principals.", + "Id": "CCC.KeyMgmt.CN02.AR01", + "Description": "When IAM roles and key policies are reviewed, Decrypt permission MUST be granted exclusively to documented authorised principals.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls that enforce least-privilege use of KMS operations.", - "Section": "CCC.KeyMgmt.C02 Limit Decrypt Permissions", + "Section": "CCC.KeyMgmt.CN02 Limit Decrypt Permissions", "SubSection": "", "SubSectionObjective": "Restrict the Decrypt operation to authorised principals only, applying the principle of least privilege to protect sensitive data.", "Applicability": [ @@ -1819,13 +1045,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C03.TR01", - "Description": "When rotation settings are examined, rotation MUST be enabled with\nan interval not exceeding 365 days.", + "Id": "CCC.KeyMgmt.CN03.AR01", + "Description": "When rotation settings are examined, rotation MUST be enabled with an interval not exceeding 365 days.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C03 Enforce Automatic Rotation", + "Section": "CCC.KeyMgmt.CN03 Enforce Automatic Rotation", "SubSection": "", "SubSectionObjective": "Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.", "Applicability": [ @@ -1861,13 +1087,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C04.TR01", - "Description": "When a key import request is processed, the key MUST use an\napproved algorithm (RSA-2048+, EC-P256+) and originate from a\ncertified HSM.", + "Id": "CCC.KeyMgmt.CN04.AR01", + "Description": "When a key import request is processed, the key MUST use an approved algorithm (RSA-2048+, EC-P256+) and originate from a certified HSM.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C04 Validate Imported Keys", + "Section": "CCC.KeyMgmt.CN04 Validate Imported Keys", "SubSection": "", "SubSectionObjective": "Accept only externally generated keys that meet approved cryptographic strength and provenance requirements.", "Applicability": [ @@ -1906,13 +1132,13 @@ ] }, { - "Id": "CCC.LB.C01.TR01", - "Description": "When a single client sends more than 2000 requests within any\n5-minute sliding window, the load balancer MUST throttle all\nsubsequent requests from that client for at least 60 seconds.", + "Id": "CCC.LB.CN01.AR01", + "Description": "When a single client sends more than 2000 requests within any 5-minute sliding window, the load balancer MUST throttle all subsequent requests from that client for at least 60 seconds.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1920,7 +1146,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement per-IP token-bucket limits with and verify via\nsynthetic traffic tests.\n", + "Recommendation": "Implement per-IP token-bucket limits with and verify via synthetic traffic tests. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1957,13 +1183,13 @@ ] }, { - "Id": "CCC.LB.C01.TR02", - "Description": "When throttling is invoked, the load balancer MUST\nrecord the event in the access log within 5 minutes\nfor alerting and trend analysis.", + "Id": "CCC.LB.CN01.AR02", + "Description": "When throttling is invoked, the load balancer MUST record the event in the access log within 5 minutes for alerting and trend analysis.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1971,7 +1197,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Enable access logging and configure metric filters\non HTTP 429 counts to trigger alerts.\n", + "Recommendation": "Enable access logging and configure metric filters on HTTP 429 counts to trigger alerts. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2008,21 +1234,21 @@ ] }, { - "Id": "CCC.LB.C06.TR01", - "Description": "When more than 10 percent of targets change from healthy to\nunhealthy within five minutes, an alert MUST be issued.", + "Id": "CCC.LB.CN06.AR01", + "Description": "When more than 10 percent of targets change from healthy to unhealthy within five minutes, an alert MUST be issued.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C06 Secure Health-Check Telemetry", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN06 Secure Health-Check Telemetry", "SubSection": "", - "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on\nabnormal status changes.", + "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on abnormal status changes.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Instrument metrics for health check results and target\nremoval events. Configure monitoring alarms to alert\non abnormal spikes in unhealthy targets.\n", + "Recommendation": "Instrument metrics for health check results and target removal events. Configure monitoring alarms to alert on abnormal spikes in unhealthy targets. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2056,21 +1282,21 @@ ] }, { - "Id": "CCC.LB.C04.TR01", - "Description": "When routing weights change, the request MUST originate\nfrom an explicitly defined and trusted identity and MUST\nbe logged.", + "Id": "CCC.LB.CN04.AR01", + "Description": "When routing weights change, the request MUST originate from an explicitly defined and trusted identity and MUST be logged.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C04 Enforce Distribution Policies", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN04 Enforce Distribution Policies", "SubSection": "", - "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified\nonly by trusted identities.", + "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified only by trusted identities.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Define a list of trusted principals allowed to modify\nrouting configurations. Enforce via conditional access\npolicies, and log changes using audit logging.\n", + "Recommendation": "Define a list of trusted principals allowed to modify routing configurations. Enforce via conditional access policies, and log changes using audit logging. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2105,15 +1331,15 @@ ] }, { - "Id": "CCC.LB.C05.TR01", - "Description": "When stickiness is enabled, session cookies MUST expire\nwithin 30 minutes of inactivity.", + "Id": "CCC.LB.CN05.AR01", + "Description": "When stickiness is enabled, session cookies MUST expire within 30 minutes of inactivity.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C05 Validate Session Affinity", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN05 Validate Session Affinity", "SubSection": "", - "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking\nrisks.", + "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking risks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2162,15 +1388,15 @@ ] }, { - "Id": "CCC.LB.C09.TR01", - "Description": "When an API call originates outside the approved CIDR\nset, the request MUST be denied.", + "Id": "CCC.LB.CN09.AR01", + "Description": "When an API call originates outside the approved CIDR set, the request MUST be denied.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C09 Restrict Management API Access", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN09 Restrict Management API Access", "SubSection": "", - "SubSectionObjective": "Limit load-balancer API calls to authorised identities and\ntrusted networks.", + "SubSectionObjective": "Limit load-balancer API calls to authorised identities and trusted networks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2208,15 +1434,15 @@ ] }, { - "Id": "CCC.LB.C02.TR01", - "Description": "When concurrent connections reach 80 percent of capacity, the\nautoscaling group MUST add at least one instance within five\nminutes.", + "Id": "CCC.LB.CN02.AR01", + "Description": "When concurrent connections reach 80 percent of capacity, the autoscaling group MUST add at least one instance within five minutes.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C02 Auto-Scale Load Balancer Capacity", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN02 Auto-Scale Load Balancer Capacity", "SubSection": "", - "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic\nspikes.", + "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic spikes.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2256,15 +1482,15 @@ ] }, { - "Id": "CCC.LB.C07.TR01", - "Description": "When responses pass through the load balancer, the\n\"Server\" header MUST be replaced with \"lb\".", + "Id": "CCC.LB.CN07.AR01", + "Description": "When responses pass through the load balancer, the \"Server\" header MUST be replaced with \"lb\".", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C07 Scrub Sensitive Headers", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN07 Scrub Sensitive Headers", "SubSection": "", - "SubSectionObjective": "Remove headers that disclose internal details or software\nversions from HTTP responses.", + "SubSectionObjective": "Remove headers that disclose internal details or software versions from HTTP responses.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2298,15 +1524,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C08.TR01", - "Description": "When a certificate is within 30 days of expiry, automated renewal\nMUST complete and deploy a new certificate within 24 hours.", + "Id": "CCC.LB.CN08.AR01", + "Description": "When a certificate is within 30 days of expiry, automated renewal MUST complete and deploy a new certificate within 24 hours.", "Attributes": [ { "FamilyName": "Encryption", "FamilyDescription": "Controls that ensure trustworthy TLS certificates and ciphers.", - "Section": "CCC.LB.C08 Automate Certificate Renewal", + "Section": "CCC.LB.CN08 Automate Certificate Renewal", "SubSection": "", - "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and\ndeployment before expiry.", + "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and deployment before expiry.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2344,15 +1570,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR01", - "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be\nenabled by default and directed to the central sink.", + "Id": "CCC.Logging.CN01.AR01", + "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be enabled by default and directed to the central sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2402,15 +1628,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR02", - "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant\nlogs (e.g., OS, application, service logs) to the central log sink.", + "Id": "CCC.Logging.CN01.AR02", + "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant logs (e.g., OS, application, service logs) to the central log sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2459,15 +1685,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR01", - "Description": "When a new log bucket or stream is created, its retention policy MUST be configured\nin accordance with organisation's data retention policy.", + "Id": "CCC.Logging.CN02.AR01", + "Description": "When a new log bucket or stream is created, its retention policy MUST be configured in accordance with organisation's data retention policy.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2504,15 +1730,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR02", - "Description": "When a query is performed to retrieve log events older than the number of days defined\nin the organisation's data retention policy, it MUST return an empty result.", + "Id": "CCC.Logging.CN02.AR02", + "Description": "When a query is performed to retrieve log events older than the number of days defined in the organisation's data retention policy, it MUST return an empty result.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2549,20 +1775,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to modify or delete data before the object\nlock period expires, then the action MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to modify or delete data before the object lock period expires, then the action MUST be denied.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C03 Enable Object Lock On Log Bucket", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN03 Enable Object Lock On Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection\nusing object lock on log storage buckets. This prevents logs from being modified\nor deleted during the defined retention period, supporting compliance and forensic\nintegrity.", + "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2593,20 +1819,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", + "Id": "CCC.AuditLog.CN04.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C04 Restrict Field And Log Type Access", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN04 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on log data.\n", + "Recommendation": "Review field level access controls on log data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2642,21 +1868,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR01", - "Description": "When a log storage bucket is created, the bucket's access control settings MUST\nexplicitly deny public read and write access.", + "Id": "CCC.Logging.CN05.AR01", + "Description": "When a log storage bucket is created, the bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2695,21 +1921,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR02", - "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied\nby bucket policy.", + "Id": "CCC.Logging.CN05.AR02", + "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied by bucket policy.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2745,15 +1971,15 @@ ] }, { - "Id": "CCC.Logging.C06.TR01", - "Description": "When a single principal executes an anomalously high number of log queries,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN06.AR01", + "Description": "When a single principal executes an anomalously high number of log queries, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C06 Detect and Alert on Potential Log Exfiltration", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN06 Detect and Alert on Potential Log Exfiltration", "SubSection": "", - "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt\nto exfiltrate log data.", + "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2793,15 +2019,15 @@ ] }, { - "Id": "CCC.Logging.C07.TR01", - "Description": "When an audit log event is recorded that corresponds to a modification of the logging service\nconfiguration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN07.AR01", + "Description": "When an audit log event is recorded that corresponds to a modification of the logging service configuration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C07 Detect and Alert on Log Service Tampering", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN07 Detect and Alert on Log Service Tampering", "SubSection": "", - "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified,\nor deleted, indicating a defense evasion attempt.", + "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2850,13 +2076,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR01", + "Id": "CCC.ObjStor.CN01.AR01", "Description": "When a request is made to read a protected bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2910,13 +2136,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR02", + "Id": "CCC.ObjStor.CN01.AR02", "Description": "When a request is made to read a protected object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2970,13 +2196,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR03", + "Id": "CCC.ObjStor.CN01.AR03", "Description": "When a request is made to write to a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3033,13 +2259,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR04", + "Id": "CCC.ObjStor.CN01.AR04", "Description": "When a request is made to write to an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3096,13 +2322,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR01", + "Id": "CCC.ObjStor.CN03.AR01", "Description": "When an object storage bucket deletion is attempted, the bucket MUST be fully recoverable for a set time-frame after deletion is requested.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3156,13 +2382,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR02", + "Id": "CCC.ObjStor.CN03.AR02", "Description": "When an attempt is made to modify the retention policy for an object storage bucket, the service MUST prevent the policy from being modified.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3215,13 +2441,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR01", + "Id": "CCC.ObjStor.CN04.AR01", "Description": "When an object is uploaded to the object storage system, the object MUST automatically receive a default retention policy that prevents premature deletion or modification.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3275,13 +2501,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR02", + "Id": "CCC.ObjStor.CN04.AR02", "Description": "When an attempt is made to delete or modify an object that is subject to an active retention policy, the service MUST prevent the action from being completed.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3334,13 +2560,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR01", + "Id": "CCC.ObjStor.CN05.AR01", "Description": "When an object is uploaded to the object storage bucket, the object MUST be stored with a unique identifier.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3393,13 +2619,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR02", + "Id": "CCC.ObjStor.CN05.AR02", "Description": "When an object is modified, the service MUST assign a new unique identifier to the modified object to differentiate it from the previous version.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3454,13 +2680,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR03", + "Id": "CCC.ObjStor.CN05.AR03", "Description": "When an object is modified, the service MUST allow for recovery of previous versions of the object.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3514,13 +2740,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR04", + "Id": "CCC.ObjStor.CN05.AR04", "Description": "When an object is deleted, the service MUST retain other versions of the object to allow for recovery of previous versions.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3574,13 +2800,13 @@ ] }, { - "Id": "CCC.ObjStor.C06.TR01", + "Id": "CCC.ObjStor.CN06.AR01", "Description": "When an object storage bucket is accessed, the service MUST store access logs in a separate data store.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C06 Prevent Deployment in Restricted Regions", + "Section": "CCC.CN06 Prevent Deployment in Restricted Regions", "SubSection": "CCC.ObjStor.C06 Access Logs are Stored in a Separate Data Store", "SubSectionObjective": "Ensure that access logs for object storage buckets are stored in a separate data store to protect against unauthorized access, tampering, or deletion of logs (Logbuckets are exempt from this requirement, but must be tlp-red).", "Applicability": [ @@ -3634,13 +2860,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR01", + "Id": "CCC.ObjStor.CN02.AR01", "Description": "When a permission set is allowed for an object in a bucket, the service MUST allow the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3692,13 +2918,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR02", + "Id": "CCC.ObjStor.CN02.AR02", "Description": "When a permission set is denied for an object in a bucket, the service MUST deny the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3751,972 +2977,9 @@ "s3_bucket_public_access" ] }, - { - "Id": "CCC.MLDE.CN01.AR01", - "Description": "Verify that only authorized users can access MLDE resources,\nand that access modes are properly defined and enforced.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN01 Define Access Mode for ML Development Environments", - "SubSection": "", - "SubSectionObjective": "Ensure that access to Machine Learning Development Environment (MLDE)\nresources is strictly defined and controlled.\nOnly authorized users with appropriate permissions can access these environments,\nmitigating the risk of unauthorized access, data leakage, or service disruption.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.1", - "2013 A.9.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-2", - "AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-01", - "IAM-02" - ] - } - ] - } - ], - "Checks": [ - "accessanalyzer_enabled", - "accessanalyzer_enabled_without_findings", - "iam_root_mfa_enabled", - "iam_root_credentials_management_enabled", - "iam_avoid_root_usage", - "iam_user_mfa_enabled_console_access", - "awslambda_function_not_publicly_accessible", - "awslambda_function_url_public", - "iam_group_administrator_access_policy", - "iam_user_administrator_access_policy", - "iam_policy_attached_only_to_group_or_roles", - "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_inline_policy_no_full_access_to_kms", - "iam_policy_allows_privilege_escalation", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_public_write_acl", - "s3_account_level_public_access_blocks", - "s3_bucket_cross_account_access" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR01", - "Description": "Verify that root access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN03.AR02", - "Description": "For MLDE instances without sensitive data, ensure that root access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_instance_managed_by_ssm", - "ec2_instance_imdsv2_enabled", - "ec2_launch_template_imdsv2_required", - "ec2_instance_account_imdsv2_enabled", - "ec2_instance_public_ip" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR01", - "Description": "Verify that terminal access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_public_ip", - "ec2_instance_internet_facing_with_instance_profile" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR02", - "Description": "For MLDE instances without sensitive data, ensure that terminal access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_public_ip", - "ec2_launch_template_no_public_ip", - "autoscaling_group_launch_configuration_no_public_ip" - ] - }, - { - "Id": "CCC.MLDE.CN02.AR01", - "Description": "Confirm that file download functionality is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN02.AR02", - "Description": "For MLDE instances without sensitive data, ensure that file downloads are monitored and logged.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "cloudtrail_s3_dataevents_read_enabled", - "cloudtrail_s3_dataevents_write_enabled", - "cloudtrail_kms_encryption_enabled", - "cloudtrail_cloudwatch_logging_enabled", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR01", - "Description": "Verify that only approved VM and container images can be selected when creating MLDE instances.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR02", - "Description": "Attempt to create an MLDE instance with an unapproved image and confirm that it is denied.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN06.AR01", - "Description": "Verify that automatic scheduled upgrades are enabled on user-managed\nMLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [ - "dms_instance_minor_version_upgrade_enabled", - "elasticache_redis_cluster_auto_minor_version_upgrades", - "memorydb_cluster_auto_minor_version_upgrades", - "mq_broker_auto_minor_version_upgrades", - "redshift_cluster_automatic_upgrades", - "rds_cluster_minor_version_upgrade_enabled", - "rds_instance_minor_version_upgrade_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR02", - "Description": "Ensure that the upgrade schedule is appropriately configured and\ndoes not interfere with critical operations.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN07.AR01", - "Description": "Verify that MLDE instances containing sensitive data cannot be accessed via public IP addresses.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_public_ip", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports" - ] - }, - { - "Id": "CCC.MLDE.CN07.AR02", - "Description": "For MLDE instances without sensitive data requiring public access,\nensure that appropriate security controls are in place and access is approved.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_public_ip", - "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_networkacl_allow_ingress_any_port" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR01", - "Description": "Verify that MLDE instances containing sensitive data can only be deployed in\napproved virtual networks with appropriate security controls.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "vpc_subnet_no_public_ip_by_default", - "vpc_subnet_different_az", - "vpc_flow_logs_enabled", - "vpc_endpoint_connections_trust_boundaries", - "vpc_peering_routing_tables_with_least_privilege" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR02", - "Description": "Ensure that MLDE instances without sensitive data are deployed in\nnetworks that meet organizational security standards.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "sagemaker_notebook_instance_without_direct_internet_access_configured", - "sagemaker_training_jobs_network_isolation_enabled", - "sagemaker_models_network_isolation_enabled", - "sagemaker_training_jobs_vpc_settings_configured", - "sagemaker_notebook_instance_vpc_settings_configured", - "sagemaker_notebook_instance_encryption_enabled" - ] - }, - { - "Id": "CCC.Message.CN01.AR01", - "Description": "Attempt to publish a message without using a customer-managed encryption key\nand verify that the message is rejected or not stored.", - "Attributes": [ - { - "FamilyName": "Encryption", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Message.CN01 Use Customer-Managed Encryption Keys (CMEK) for Messages", - "SubSection": "", - "SubSectionObjective": "Ensure that messages are encrypted using customer-managed encryption keys (CMEK)\nto provide enhanced control over encryption processes and keys, meeting compliance and security requirements.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-13" - ] - } - ] - } - ], - "Checks": [ - "firehose_stream_encrypted_at_rest", - "kinesis_stream_encrypted_at_rest" - ] - }, { "Id": "CCC.Monitor.CN01.AR01", - "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then\nRate Limiting MUST be applied and an Audit Alert MUST be generated.", + "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then Rate Limiting MUST be applied and an Audit Alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4769,7 +3032,7 @@ }, { "Id": "CCC.Monitor.CN02.AR01", - "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied\nto reduce the network impact of traffic and an alert must triggered.", + "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied to reduce the network impact of traffic and an alert must triggered.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4828,14 +3091,14 @@ }, { "Id": "CCC.Monitor.CN03.AR01", - "Description": "When external systems have approved access to internal systems not normally available for public access\nthen they MUST be secured to prevent unauthorised access jumping through to the internal systems and\nonly allow access to specific internal services.", + "Description": "When external systems have approved access to internal systems not normally available for public access then they MUST be secured to prevent unauthorised access jumping through to the internal systems and only allow access to specific internal services.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN03 Access External Monitoring", "SubSection": "", - "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to\nensure they don't become an attack path, preventing monitoring systems from forging network requests to\ngain access to internal systems.", + "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to ensure they don't become an attack path, preventing monitoring systems from forging network requests to gain access to internal systems.", "Applicability": [ "tlp-clear", "tlp-green", @@ -4880,7 +3143,7 @@ }, { "Id": "CCC.Monitor.CN04.AR01", - "Description": "When monitoring dashboards display degraded services which may become potential targets then the\ndashboard MUST be protected from unauthorised access.", + "Description": "When monitoring dashboards display degraded services which may become potential targets then the dashboard MUST be protected from unauthorised access.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4930,7 +3193,7 @@ }, { "Id": "CCC.Monitor.CN05.AR01", - "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised\nresponders silence or acknowledge the alert.", + "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised responders silence or acknowledge the alert.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4988,7 +3251,7 @@ "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN06 Metrics pushed for authorised services only", "SubSection": "", - "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised\nsystem pushing fabricated metrics about a different service", + "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised system pushing fabricated metrics about a different service", "Applicability": [ "tlp-clear", "tlp-green", @@ -5030,189 +3293,16 @@ "cloudwatch_log_group_not_publicly_accessible" ] }, - { - "Id": "CCC.SecMgmt.CN01.AR01", - "Description": "Attempt to use an outdated version of a secret after its rotation period\nhas passed and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN01 Enforce Automatic Secret Rotation", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are automatically rotated on a defined schedule to\nreduce the risk of secret compromise and unauthorized access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01", - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-28" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.SecMgmt.CN02.AR01", - "Description": "Attempt to retrieve a secret from an unauthorized region and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN02 Enforce Secret Replication Policies", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are replicated only to authorized locations as per\norganizational data residency and compliance requirements.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH03", - "CCC.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-3", - "SC-7" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.SvlsComp.CN01.AR01", - "Description": "Attempt to access the serverless function over the public internet and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN01 Enforce Use of Private Endpoints for Serverless Function", - "SubSection": "", - "SubSectionObjective": "Ensure that the serverless function is accessible only through a private endpoint,\nallowing it to communicate securely within a virtual private network and preventing\nunauthorized external access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "awslambda_function_url_public", - "awslambda_function_not_publicly_accessible", - "awslambda_function_inside_vpc" - ] - }, - { - "Id": "CCC.SvlsComp.CN02.AR01", - "Description": "Send requests to invoke the function up to the allowed threshold and confirm they\nare successful; then send additional requests exceeding the threshold from the same\nentity and verify that they are denied.", - "Attributes": [ - { - "FamilyName": "Availability", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN02 Implement Function Invocation Rate Limits", - "SubSection": "", - "SubSectionObjective": "Ensure that function invocation is limited to a specified threshold from any single entity,\npreventing resource exhaustion and denial of service attacks.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH12" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-5" - ] - } - ] - } - ], - "Checks": [] - }, { "Id": "CCC.VPC.CN01.AR01", - "Description": "When a subscription is created, the subscription MUST NOT\ncontain default network resources.", + "Description": "When a subscription is created, the subscription MUST NOT contain default network resources.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN01 Restrict Default Network Creation", "SubSection": "", - "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related\nresources during subscription initialization to avoid insecure default\nconfigurations and enforce custom network policies.", + "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5260,72 +3350,16 @@ "ec2_securitygroup_allow_ingress_from_internet_to_any_port" ] }, - { - "Id": "CCC.VPC.CN02.AR01", - "Description": "When a resource is created in a public subnet, that resource\nMUST NOT be assigned an external IP address by default.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.VPC.CN02 Limit Resource Creation in Public Subnet", - "SubSection": "", - "SubSectionObjective": "Restrict the creation of resources in the public subnet with\ndirect access to the internet to minimize attack surfaces.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-4" - ] - } - ] - } - ], - "Checks": [ - "vpc_subnet_no_public_ip_by_default", - "ec2_launch_template_no_public_ip", - "autoscaling_group_launch_configuration_no_public_ip" - ] - }, { "Id": "CCC.VPC.CN03.AR01", - "Description": "When a VPC peering connection is requested, the service MUST\nprevent connections from VPCs that are not explicitly\nallowed.", + "Description": "When a VPC peering connection is requested, the service MUST prevent connections from VPCs that are not explicitly allowed.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN03 Restrict VPC Peering to Authorized Accounts", "SubSection": "", - "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly\nauthorized destinations to limit network exposure and enforce boundary\ncontrols.", + "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5374,14 +3408,14 @@ }, { "Id": "CCC.VPC.CN04.AR01", - "Description": "When any network traffic goes to or from an interface in the VPC,\nthe service MUST capture and log all relevant information.", + "Description": "When any network traffic goes to or from an interface in the VPC, the service MUST capture and log all relevant information.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN04 Enforce VPC Flow Logs on VPCs", "SubSection": "", - "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic\ninformation.", + "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic information.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5429,14 +3463,14 @@ }, { "Id": "CCC.Vector.CN01.AR01", - "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it\nmatches expected schema, dimension, and format profiles.", + "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it matches expected schema, dimension, and format profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN01 Validate Embeddings Before Indexing", "SubSection": "", - "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated\nbefore indexing to prevent poisoning or corruption.", + "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated before indexing to prevent poisoning or corruption.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5468,14 +3502,14 @@ }, { "Id": "CCC.Vector.CN02.AR01", - "Description": "When an index lifecycle event is triggered, the service MUST\nverify that the actor has explicit permissions for the operation type.", + "Description": "When an index lifecycle event is triggered, the service MUST verify that the actor has explicit permissions for the operation type.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN02 Enforce Role-Based Index Lifecycle Management", "SubSection": "", - "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged\nidentities using fine-grained access controls.", + "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged identities using fine-grained access controls.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5519,14 +3553,14 @@ }, { "Id": "CCC.Vector.CN03.AR01", - "Description": "When a metadata filter is applied to a query, the service MUST\nverify the requester is authorized to access that field.", + "Description": "When a metadata filter is applied to a query, the service MUST verify the requester is authorized to access that field.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN03 Enforce Metadata-Level Access Controls", "SubSection": "", - "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to\nprevent unauthorized exposure or inference.", + "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to prevent unauthorized exposure or inference.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5557,14 +3591,14 @@ }, { "Id": "CCC.Vector.CN04.AR01", - "Description": "When ingestion exceeds pre-defined thresholds, the service MUST\nthrottle or reject excess vector write operations.", + "Description": "When ingestion exceeds pre-defined thresholds, the service MUST throttle or reject excess vector write operations.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN04 Enforce Ingestion Quotas and Throttling", "SubSection": "", - "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by\nrate-limiting vector submissions and enforcing quotas.", + "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by rate-limiting vector submissions and enforcing quotas.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5594,14 +3628,14 @@ }, { "Id": "CCC.Vector.CN05.AR01", - "Description": "When a rollback is attempted, the system MUST log\nthe action and verify rollback authorization.", + "Description": "When a rollback is attempted, the system MUST log the action and verify rollback authorization.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN05 Enforce Index Versioning with Rollback Protection", "SubSection": "", - "SubSectionObjective": "Ensure vector indexes are versioned and that rollback\noperations are authorized and auditable.", + "SubSectionObjective": "Ensure vector indexes are versioned and that rollback operations are authorized and auditable.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5631,14 +3665,14 @@ }, { "Id": "CCC.Vector.CN06.AR01", - "Description": "When an embedding is submitted, the service MUST validate\nthat its format and dimensionality match allowed profiles.", + "Description": "When an embedding is submitted, the service MUST validate that its format and dimensionality match allowed profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN06 Enforce Dimensional and Format Constraints", "SubSection": "", - "SubSectionObjective": "Reject embeddings that do not conform to expected model\nspecifications (dimensions, format, etc).", + "SubSectionObjective": "Reject embeddings that do not conform to expected model specifications (dimensions, format, etc).", "Applicability": [ "tlp-clear", "tlp-green", @@ -5669,14 +3703,14 @@ }, { "Id": "CCC.Vector.CN07.AR01", - "Description": "When a search request is issued, clients MUST be allowed\nto declare their requirement for exact vs approximate results.", + "Description": "When a search request is issued, clients MUST be allowed to declare their requirement for exact vs approximate results.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN07 Support Explicit ANN vs. Exact Search Configuration", "SubSection": "", - "SubSectionObjective": "Provide clients with the option to enforce exact-match\n(non-ANN) search where search fidelity is critical.", + "SubSectionObjective": "Provide clients with the option to enforce exact-match (non-ANN) search where search fidelity is critical.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5697,20 +3731,20 @@ }, { "Id": "CCC.Core.CN01.AR01", - "Description": "When a port is exposed for non-SSH network traffic, all traffic\nMUST include a TLS handshake AND be encrypted using TLS 1.3 or\nhigher.", + "Description": "When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not\nalready set, ensure that your services are configured or updated\naccordingly.\n", + "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not already set, ensure that your services are configured or updated accordingly. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5765,21 +3799,21 @@ }, { "Id": "CCC.Core.CN01.AR02", - "Description": "When a port is exposed for SSH network traffic, all traffic MUST\ninclude a SSH handshake AND be encrypted using SSHv2 or higher.", + "Description": "When a port is exposed for SSH network traffic, all traffic MUST include a SSH handshake AND be encrypted using SSHv2 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Any time port 22 is exposed, ensure that it has a properly\nimplemented SSH server with SSHv2 enabled and configured with\nstrong ciphers.\n", + "Recommendation": "Any time port 22 is exposed, ensure that it has a properly implemented SSH server with SSHv2 enabled and configured with strong ciphers. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5829,20 +3863,20 @@ }, { "Id": "CCC.Core.CN01.AR03", - "Description": "When the service receives unencrypted traffic, \nthen it MUST either block the request or automatically\nredirect it to the secure equivalent.", + "Description": "When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Review firewall, load balancer, and application configurations to\nensure insecure protocols such as HTTP, FTP, and Telnet are not\nexposed. Where possible, implement automatic redirection to secure\nprotocols such as HTTPS, SFTP, SSH, and regularly scan for\nprotocol drift.\n", + "Recommendation": "Review firewall, load balancer, and application configurations to ensure insecure protocols such as HTTP, FTP, and Telnet are not exposed. Where possible, implement automatic redirection to secure protocols such as HTTPS, SFTP, SSH, and regularly scan for protocol drift. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5896,21 +3930,21 @@ }, { "Id": "CCC.Core.CN01.AR07", - "Description": "When a port is exposed, the service MUST ensure that the protocol\nand service officially assigned to that port number by the IANA\nService Name and Transport Protocol Port Number Registry, and no\nother, is run on that port.", + "Description": "When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number\nRegistry for more information about correct protocol-to-port\nassignments. Avoid running non-standard services on well-known\nports.\n", + "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number Registry for more information about correct protocol-to-port assignments. Avoid running non-standard services on well-known ports. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5964,19 +3998,19 @@ }, { "Id": "CCC.Core.CN01.AR08", - "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be\nimplemented to require both client and server certificate\nauthentication for all connections.", + "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Configure mTLS for all endpoints that process or transmit\nsensitive data. Ensure both client and server certificates are\nvalidated and managed securely. Regularly review certificate\nauthorities and automate certificate rotation where possible.\n", + "Recommendation": "Configure mTLS for all endpoints that process or transmit sensitive data. Ensure both client and server certificates are validated and managed securely. Regularly review certificate authorities and automate certificate rotation where possible. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6035,21 +4069,21 @@ }, { "Id": "CCC.Core.CN13.AR01", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST only use valid, unexpired certificates issued by\na trusted certificate authority.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST only use valid, unexpired certificates issued by a trusted certificate authority.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6069,18 +4103,18 @@ }, { "Id": "CCC.Core.CN13.AR02", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 180 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-amber" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6098,18 +4132,18 @@ }, { "Id": "CCC.Core.CN13.AR03", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 90 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6127,21 +4161,21 @@ }, { "Id": "CCC.Core.CN06.AR01", - "Description": "When the service is running, its region and availability zone MUST\nbe included in a list of explicitly trusted or approved locations\nwithin the trust perimeter.", + "Description": "When the service is running, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate the service's deployment\nlocation is included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate the service's deployment location is included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6186,21 +4220,21 @@ }, { "Id": "CCC.Core.CN06.AR02", - "Description": "When a child resource is deployed, its region and availability\nzone MUST be included in a list of explicitly trusted or approved\nlocations within the trust perimeter.", + "Description": "When a child resource is deployed, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate that child resources can only\nbe deployed to locations included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate that child resources can only be deployed to locations included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6245,20 +4279,20 @@ }, { "Id": "CCC.Core.CN08.AR01", - "Description": "When data is created or modified, the data MUST have a complete\nand recoverable duplicate that is stored in a physically separate\ndata center.", + "Description": "When data is created or modified, the data MUST have a complete and recoverable duplicate that is stored in a physically separate data center.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement automated data replication processes to ensure that\ndata is consistently duplicated in another region or availability\nzone. Regularly test data recovery from the replicated location to\nensure integrity and availability.\n", + "Recommendation": "Implement automated data replication processes to ensure that data is consistently duplicated in another region or availability zone. Regularly test data recovery from the replicated location to ensure integrity and availability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6305,14 +4339,14 @@ }, { "Id": "CCC.Core.CN08.AR02", - "Description": "When data is replicated into a second location, the service MUST\nbe able to accurately represent the replication locations,\nreplication status, and data synchronization status.", + "Description": "When data is replicated into a second location, the service MUST be able to accurately represent the replication locations, replication status, and data synchronization status.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6358,14 +4392,14 @@ }, { "Id": "CCC.Core.CN09.AR01", - "Description": "When the service is operational, its logs and any child resource\nlogs MUST NOT be accessible from the resource they record access\nto.", + "Description": "When the service is operational, its logs and any child resource logs MUST NOT be accessible from the resource they record access to.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", @@ -6420,21 +4454,21 @@ }, { "Id": "CCC.Core.CN09.AR02", - "Description": "When the service is operational, disabling the logs for the service\nor its child resources MUST NOT be possible without also disabling\nthe corresponding resource.", + "Description": "When the service is operational, disabling the logs for the service or its child resources MUST NOT be possible without also disabling the corresponding resource.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should disable\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging mechanisms are tightly integrated with\nservice operations, so that logging cannot be disabled without\nstopping the service itself.\n", + "Recommendation": "No normal business operations should disable logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging mechanisms are tightly integrated with service operations, so that logging cannot be disabled without stopping the service itself. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6486,19 +4520,19 @@ }, { "Id": "CCC.Core.CN09.AR03", - "Description": "When the service is operational, any attempt to redirect logs for\nthe service or its child resources MUST NOT be possible without\nhalting operation of the corresponding resource and publishing\ncorresponding events to monitored channels.", + "Description": "When the service is operational, any attempt to redirect logs for the service or its child resources MUST NOT be possible without halting operation of the corresponding resource and publishing corresponding events to monitored channels.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should result in the redirection of\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging configurations are immutable during\nservice operation so that any changes require stopping the service\nand publishing corresponding events to monitored channels.\n", + "Recommendation": "No normal business operations should result in the redirection of logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging configurations are immutable during service operation so that any changes require stopping the service and publishing corresponding events to monitored channels. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6554,14 +4588,14 @@ }, { "Id": "CCC.Core.CN10.AR01", - "Description": "When data is replicated, the service MUST ensure that replication\nonly occurs to destinations that are explicitly included within\nthe defined trust perimeter.", + "Description": "When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN10 Restrict Data Replication to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations\nthat are explicitly included within a defined trust perimeter.", + "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6607,14 +4641,14 @@ }, { "Id": "CCC.Core.CN02.AR01", - "Description": "When data is stored, it MUST be encrypted using the latest\nindustry-standard encryption methods.", + "Description": "When data is stored, it MUST be encrypted using the latest industry-standard encryption methods.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN02 Encrypt Data for Storage", "SubSection": "", - "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong\nencryption algorithms.", + "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong encryption algorithms.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6676,14 +4710,14 @@ }, { "Id": "CCC.Core.CN11.AR01", - "Description": "When encryption keys are used, the service MUST verify that\nall encryption keys use the latest industry-standard cryptographic\nalgorithms.", + "Description": "When encryption keys are used, the service MUST verify that all encryption keys use the latest industry-standard cryptographic algorithms.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6737,14 +4771,14 @@ }, { "Id": "CCC.Core.CN11.AR02", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 180 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber" ], @@ -6797,14 +4831,14 @@ }, { "Id": "CCC.Core.CN11.AR03", - "Description": "When encrypting data, the service MUST verify that\ncustomer-managed encryption keys (CMEKs) are used.", + "Description": "When encrypting data, the service MUST verify that customer-managed encryption keys (CMEKs) are used.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "", "SubSection": "CCC.Core.CN11 Protect Encryption Keys", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6858,14 +4892,14 @@ }, { "Id": "CCC.Core.CN11.AR04", - "Description": "When encryption keys are accessed, the service MUST verify that\naccess to encryption keys is restricted to authorized personnel\nand services, following the principle of least privilege.", + "Description": "When encryption keys are accessed, the service MUST verify that access to encryption keys is restricted to authorized personnel and services, following the principle of least privilege.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green", @@ -6921,14 +4955,14 @@ }, { "Id": "CCC.Core.CN11.AR05", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 365 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 365 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green" @@ -6980,14 +5014,14 @@ }, { "Id": "CCC.Core.CN11.AR06", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 90 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-red" ], @@ -7037,21 +5071,21 @@ }, { "Id": "CCC.Core.CN14.AR01", - "Description": "When backups are created for disaster recovery purposes, the\nstorage mechanism MUST NOT allow modification or deletion\nwithin 30 days of creation.", + "Description": "When backups are created for disaster recovery purposes, the storage mechanism MUST NOT allow modification or deletion within 30 days of creation.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Use immutable storage solutions where possible. Implement backup\nretention policies that enforce a minimum retention period of 30\ndays.\n", + "Recommendation": "Use immutable storage solutions where possible. Implement backup retention policies that enforce a minimum retention period of 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7069,20 +5103,20 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n30 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 30 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 30 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7109,18 +5143,18 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n14 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 14 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-red" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 14 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 14 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7143,14 +5177,14 @@ }, { "Id": "CCC.Core.CN03.AR01", - "Description": "When an entity attempts to modify the service through a user\ninterface, the authentication process MUST require multiple\nidentifying factors for authentication.", + "Description": "When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7211,14 +5245,14 @@ }, { "Id": "CCC.Core.CN03.AR02", - "Description": "When an entity attempts to modify the service through an API\nendpoint, the authentication process MUST require a credential\nsuch as an API key or token AND originate from within the trust\nperimeter.", + "Description": "When an entity attempts to modify the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7279,14 +5313,14 @@ }, { "Id": "CCC.Core.CN03.AR03", - "Description": "When an entity attempts to view information on the service through\na user interface, the authentication process MUST require multiple\nidentifying factors from the user.", + "Description": "When an entity attempts to view information on the service through a user interface, the authentication process MUST require multiple identifying factors from the user.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7346,14 +5380,14 @@ }, { "Id": "CCC.Core.CN03.AR04", - "Description": "When an entity attempts to view information on the service through\nan API endpoint, the authentication process MUST require a\ncredential such as an API key or token AND originate from within\nthe trust perimeter.", + "Description": "When an entity attempts to view information on the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7414,14 +5448,14 @@ }, { "Id": "CCC.Core.CN05.AR01", - "Description": "When an attempt is made to modify data on the service or a child\nresource, the service MUST block requests from unauthorized\nentities.", + "Description": "When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7496,14 +5530,14 @@ }, { "Id": "CCC.Core.CN05.AR02", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST refuse requests\nfrom unauthorized entities.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7581,14 +5615,14 @@ }, { "Id": "CCC.Core.CN05.AR03", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource in a multi-tenant environment, the\nservice MUST refuse requests across tenant boundaries unless the\norigin is explicitly included in a pre-approved allowlist.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource in a multi-tenant environment, the service MUST refuse requests across tenant boundaries unless the origin is explicitly included in a pre-approved allowlist.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7648,14 +5682,14 @@ }, { "Id": "CCC.Core.CN05.AR04", - "Description": "When data is requested from outside the trust perimeter, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When data is requested from outside the trust perimeter, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "", "SubSection": "CCC.Core.CN05 Prevent Access from Untrusted Entities", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7722,14 +5756,14 @@ }, { "Id": "CCC.Core.CN05.AR05", - "Description": "When any request is made from outside the trust perimeter,\nthe service MUST NOT provide any response that may indicate the\nservice exists.", + "Description": "When any request is made from outside the trust perimeter, the service MUST NOT provide any response that may indicate the service exists.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-red" ], @@ -7797,14 +5831,14 @@ }, { "Id": "CCC.Core.CN05.AR06", - "Description": "When any request is made to the service or a child resource, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-green", "tlp-amber", @@ -7870,14 +5904,14 @@ }, { "Id": "CCC.Core.CN04.AR01", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST log the client\nidentity, time, and result of the attempt.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7943,14 +5977,14 @@ }, { "Id": "CCC.Core.CN04.AR02", - "Description": "When any attempt is made to modify data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-amber", "tlp-red" @@ -8004,14 +6038,14 @@ }, { "Id": "CCC.Core.CN04.AR03", - "Description": "When any attempt is made to read data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-red" ], @@ -8068,19 +6102,19 @@ }, { "Id": "CCC.Core.CN07.AR01", - "Description": "When enumeration activities are detected, the service MUST publish\nan event to a monitored channel which includes the client\nidentity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement event publication mechanisms and alerts for patterns\nindicative of enumeration activities, such as repeated access\nattempts, requests, or liveness probes. Configure alerts to notify\nsecurity teams of any activities that merit further investigation.\n", + "Recommendation": "Implement event publication mechanisms and alerts for patterns indicative of enumeration activities, such as repeated access attempts, requests, or liveness probes. Configure alerts to notify security teams of any activities that merit further investigation. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -8118,21 +6152,21 @@ }, { "Id": "CCC.Core.CN07.AR02", - "Description": "When enumeration activities are detected, the service MUST log the\nclient identity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement logging mechanisms to capture details of enumeration\nactivities, including client identity, timestamps, and activity\nnature. Retain logs according to organizational policies, and\noccasionally review them for patterns that may indicate\nreconnaissance activities.\n", + "Recommendation": "Implement logging mechanisms to capture details of enumeration activities, including client identity, timestamps, and activity nature. Retain logs according to organizational policies, and occasionally review them for patterns that may indicate reconnaissance activities. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", diff --git a/prowler/compliance/azure/ccc_azure.json b/prowler/compliance/azure/ccc_azure.json index efc2188406..004137ad53 100644 --- a/prowler/compliance/azure/ccc_azure.json +++ b/prowler/compliance/azure/ccc_azure.json @@ -6,19 +6,19 @@ "Description": "Common Cloud Controls Catalog (CCC) for Azure", "Requirements": [ { - "Id": "CCC.AuditLog.C01.TR01", + "Id": "CCC.AuditLog.CN01.AR01", "Description": "When the signature validation process is performed, then it MUST detect any modification of data.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure hash of data is included in digital signature.\n", + "Recommendation": "Ensure hash of data is included in digital signature. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -47,19 +47,19 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C01.TR02", + "Id": "CCC.AuditLog.CN01.AR02", "Description": "When the signature validation process is performed, then it MUST detect any missing (deleted) log file.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure verification process includes a chained hash function.\n", + "Recommendation": "Ensure verification process includes a chained hash function. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -88,15 +88,15 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C02.TR01", - "Description": "When a manual action is performed to generate each audit log type,\nthen the corresponding audit log type MUST be generated and recorded.", + "Id": "CCC.AuditLog.CN02.AR01", + "Description": "When a manual action is performed to generate each audit log type, then the corresponding audit log type MUST be generated and recorded.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C02 Enable And Validate All Audit Log Types", + "Section": "CCC.AuditLog.CN02 Enable And Validate All Audit Log Types", "SubSection": "", - "SubSectionObjective": "Review audit log configuration and ensure that all audit log types\nare being generated and replicated to configured sinks", + "SubSectionObjective": "Review audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks", "Applicability": [ "tlp-red", "tlp-amber" @@ -136,20 +136,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR01", + "Id": "CCC.AuditLog.CN03.AR01", "Description": "When an attempt is made to disable a log source, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -183,20 +183,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR02", - "Description": "When an attempt is made to alter the retention or object lock status\nof an external data log source or bucket, then an alert MUST be generated.", + "Id": "CCC.AuditLog.CN03.AR02", + "Description": "When an attempt is made to alter the retention or object lock status of an external data log source or bucket, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -240,20 +240,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", - "Description": "When audit log buckets are created then verify that server access\nlogging MUST be enabled for the audit log bucket,\nwith logs delivered to a separate, secure logging bucket.", + "Id": "CCC.AuditLog.CN04.AR01", + "Description": "When audit log buckets are created then verify that server access logging MUST be enabled for the audit log bucket, with logs delivered to a separate, secure logging bucket.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C04 Ensure Access Logging Is Enabled on the Audit Log Bucket", + "Section": "CCC.AuditLog.CN04 Ensure Access Logging Is Enabled on the Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to\ncapture all requests made to the bucket, providing an audit trail of data access.", + "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure the audit log bucket to enable server access logging.\nEnsure the target logging bucket is configured for appropriate security,\nincluding restricted access and immutability.\n", + "Recommendation": "Configure the audit log bucket to enable server access logging. Ensure the target logging bucket is configured for appropriate security, including restricted access and immutability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -289,20 +289,20 @@ ] }, { - "Id": "CCC.AuditLog.C05.TR01", + "Id": "CCC.AuditLog.CN05.AR01", "Description": "When audit logs are exported, then audit logs MUST be present in the configured data location.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C05 Export Audit Logs To Bucket", + "Section": "CCC.AuditLog.CN05 Export Audit Logs To Bucket", "SubSection": "", - "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated\nand can be subject to greater access control and data retention polices.", + "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure audit log exporting.\n", + "Recommendation": "Configure audit log exporting. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -337,21 +337,21 @@ ] }, { - "Id": "CCC.AuditLog.C06.TR01", - "Description": "When the retention policy is applied, then data MUST\nbe automatically deleted after the configured number of days.", + "Id": "CCC.AuditLog.CN06.AR01", + "Description": "When the retention policy is applied, then data MUST be automatically deleted after the configured number of days.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C06 Enforce Retention Policy on Audit Log Bucket", + "Section": "CCC.AuditLog.CN06 Enforce Retention Policy on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are\nretained for the correct number of days as defined by your organization's policy.", + "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce\nthe required data retention period.\n", + "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce the required data retention period. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -384,21 +384,21 @@ ] }, { - "Id": "CCC.AuditLog.C07.TR01", - "Description": "When a standard file deletion is attempted on an object within\nthe audit log bucket, then it MUST be prevented unless MFA is provided.", + "Id": "CCC.AuditLog.CN07.AR01", + "Description": "When a standard file deletion is attempted on an object within the audit log bucket, then it MUST be prevented unless MFA is provided.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C07 Enforce MFA Delete on Audit Log Bucket", + "Section": "CCC.AuditLog.CN07 Enforce MFA Delete on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to\nprovide greater protection against accidental or malicious deletion of audit data.", + "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations)\non the audit log bucket.\n", + "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations) on the audit log bucket. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -428,20 +428,20 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to delete data before the object\nlock period expires, then the deletion MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to delete data before the object lock period expires, then the deletion MUST be denied.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C08 Enable Object Lock On Audit Log Bucket", + "Section": "CCC.AuditLog.CN08 Enable Object Lock On Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket.\nThe lock time MUST be configured to meet your organization, legal and compliance goals.\nDeletion attempts before the lock period MUST be denied.", + "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket. The lock time MUST be configured to meet your organization, legal and compliance goals. Deletion attempts before the lock period MUST be denied.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -475,20 +475,20 @@ ] }, { - "Id": "CCC.AuditLog.C09.TR01", + "Id": "CCC.AuditLog.CN09.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C09 Restrict Field And Log Type Access", + "Section": "CCC.AuditLog.CN09 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on audit data.\n", + "Recommendation": "Review field level access controls on audit data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -525,21 +525,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR01", - "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny\npublic read and write access.", + "Id": "CCC.AuditLog.CN10.AR01", + "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -573,21 +573,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR02", - "Description": "When the URL of a audit log storage bucket's object is accessed publicly then,\nit should be denied by bucket policy.", + "Id": "CCC.AuditLog.CN10.AR02", + "Description": "When the URL of a audit log storage bucket's object is accessed publicly then, it should be denied by bucket policy.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -622,15 +622,15 @@ ] }, { - "Id": "CCC.Build.C01.TR01", + "Id": "CCC.Build.CN01.AR01", "Description": "Attempt to initiate a build using an unauthorized build agent and verify that the build is rejected.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C01 Restrict Allowed Build Agents", + "Section": "CCC.Build.CN01 Restrict Allowed Build Agents", "SubSection": "", - "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain\ncontrol over the build environment and prevent unauthorized code execution.", + "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain control over the build environment and prevent unauthorized code execution.", "Applicability": [ "tlp-red", "tlp-amber" @@ -664,15 +664,15 @@ "Checks": [] }, { - "Id": "CCC.Build.C02.TR01", - "Description": "Attempt to trigger a build from an unauthorized external service or\nrepository and verify that the build does not start.", + "Id": "CCC.Build.CN02.AR01", + "Description": "Attempt to trigger a build from an unauthorized external service or repository and verify that the build does not start.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C02 Restrict Allowed External Services for Build Triggers", + "Section": "CCC.Build.CN02 Restrict Allowed External Services for Build Triggers", "SubSection": "", - "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or\nrepositories to prevent unauthorized code execution or tampering.", + "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or repositories to prevent unauthorized code execution or tampering.", "Applicability": [ "tlp-red", "tlp-amber" @@ -706,15 +706,15 @@ "Checks": [] }, { - "Id": "CCC.Build.C03.TR01", + "Id": "CCC.Build.CN03.AR01", "Description": "Attempt to access the build environment from an external network and verify that access is denied.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C03 Deny External Network Access for Build Environments", + "Section": "CCC.Build.CN03 Deny External Network Access for Build Environments", "SubSection": "", - "SubSectionObjective": "Ensure that build environments do not have external network access to\nprevent unauthorized external access and data exfiltration.", + "SubSectionObjective": "Ensure that build environments do not have external network access to prevent unauthorized external access and data exfiltration.", "Applicability": [ "tlp-red", "tlp-amber" @@ -758,15 +758,15 @@ ] }, { - "Id": "CCC.CntrReg.C01.TR01", - "Description": "Attempt to push an artifact with known vulnerabilities to the registry\nand observe if it is flagged or rejected by the vulnerability scanning process.", + "Id": "CCC.CntrReg.CN01.AR01", + "Description": "Attempt to push an artifact with known vulnerabilities to the registry and observe if it is flagged or rejected by the vulnerability scanning process.", "Attributes": [ { "FamilyName": "Risk Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C01 Implement Vulnerability Scanning for Artifacts", + "Section": "CCC.CntrReg.CN01 Implement Vulnerability Scanning for Artifacts", "SubSection": "", - "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for\nvulnerabilities to identify and remediate security issues before deployment.", + "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for vulnerabilities to identify and remediate security issues before deployment.", "Applicability": [ "tlp-red", "tlp-amber" @@ -803,60 +803,15 @@ ] }, { - "Id": "CCC.CntrReg.C02.TR01", - "Description": "Confirm that artifacts older than the specified retention period are automatically\ndeleted from the registry.", - "Attributes": [ - { - "FamilyName": "Data Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C02 Implement Cleanup Policies for Artifacts", - "SubSection": "", - "SubSectionObjective": "Ensure that unused or outdated artifacts are cleaned up according to defined policies to\nmanage storage effectively and reduce security risks associated with outdated versions.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-12" - ] - } - ] - } - ], - "Checks": [ - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "containerregistry_admin_user_disabled" - ] - }, - { - "Id": "CCC.DataWar.C01.TR01", - "Description": "Attempt to access underlying database tables directly without\nusing managed views and verify that access is denied.", + "Id": "CCC.DataWar.CN01.AR01", + "Description": "Attempt to access underlying database tables directly without using managed views and verify that access is denied.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C01 Enforce Use of Managed Views for Data Access", + "Section": "CCC.DataWar.CN01 Enforce Use of Managed Views for Data Access", "SubSection": "", - "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users\nfrom accessing underlying tables directly and enforcing consistent security policies.", + "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users from accessing underlying tables directly and enforcing consistent security policies.", "Applicability": [ "tlp-red", "tlp-amber" @@ -890,15 +845,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C02.TR01", - "Description": "Attempt to query sensitive columns without the necessary permissions and\nverify that access is denied or data is masked.", + "Id": "CCC.DataWar.CN02.AR01", + "Description": "Attempt to query sensitive columns without the necessary permissions and verify that access is denied or data is masked.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C02 Enforce Column-Level Security Policies", + "Section": "CCC.DataWar.CN02 Enforce Column-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles,\npreventing unauthorized access to sensitive information.", + "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles, preventing unauthorized access to sensitive information.", "Applicability": [ "tlp-red", "tlp-amber" @@ -932,15 +887,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C03.TR01", - "Description": "Attempt to query data rows that the user should not have access to and verify\nthat access is denied or data is not returned.", + "Id": "CCC.DataWar.CN03.AR01", + "Description": "Attempt to query data rows that the user should not have access to and verify that access is denied or data is not returned.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C03 Enforce Row-Level Security Policies", + "Section": "CCC.DataWar.CN03 Enforce Row-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes,\npreventing unauthorized access to specific subsets of data.", + "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes, preventing unauthorized access to specific subsets of data.", "Applicability": [ "tlp-red", "tlp-amber" @@ -980,684 +935,13 @@ ] }, { - "Id": "CCC.GenAI.C01.TR01", - "Description": "Untrusted input such as user queries, RAG data or tool output\nMUST be validated before it is passed to a GenAI model.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C01.TR02", - "Description": "If malicious patterns such as prompt injection or sensitive\ndata are detected during input validation, the input MUST\nbe blocked or sanitised.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR01", - "Description": "GenAI model output MUST be validated for format conformance,\nmalicious patterns, sensitive data and inapropriate content\nbefore being passed to users, application or plugins.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR02", - "Description": "In the event of policy violations, the AI-generated content MUST\nbe redacted, encoded or rejected.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [ - "apim_threat_detection_llm_jacking" - ] - }, - { - "Id": "CCC.GenAI.C03.TR01", - "Description": "When data is designated for model training or RAG ingestion, then its\nsource MUST be explicitly approved and its provenance documented.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C03.TR02", - "Description": "Data from unvetted sources MUST NOT be used in production systems.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C04.TR01", - "Description": "When data is ingested for training, fine-tuning or conversion\nto vector embeddings, it MUST be validated for sensitive\ninformation or malicious content.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C04.TR02", - "Description": "If sensitive data or malicious content is detected, it must\nbe rejected, redacted or flagged for manual review.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C05.TR01", - "Description": "When a RAG-enabled system generates a response containing information\nretrieved from its knowledge base, then the response MUST include a\nverifiable citation that links back to the specific source document.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C05 Citations and Source Traceability", - "SubSection": "", - "SubSectionObjective": "Require the GenAI system to provide citations or direct links\nback to the source documents used to generate a response, in\nto enhance the transparency, trustworthiness, and verifiability\nof AI-generated content.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH09", - "CCC.GenAI.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-DET-013" - ] - } - ] - } - ], - "Checks": [ - "monitor_diagnostic_settings_exists", - "monitor_diagnostic_setting_with_appropriate_categories", - "keyvault_logging_enabled", - "app_http_logs_enabled", - "app_function_application_insights_enabled", - "appinsights_ensure_is_configured", - "monitor_alert_service_health_exists", - "sqlserver_auditing_enabled", - "sqlserver_auditing_retention_90_days", - "mysql_flexible_server_audit_log_enabled" - ] - }, - { - "Id": "CCC.GenAI.C06.TR01", - "Description": "When an LLM invokes an external tool (e.g., an API, a plugin),\nthen the tool MUST operate with the least privileges required\nfor performing its intended functionality.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", - "Section": "CCC.GenAI.C06 Least Privilege for Plugins", - "SubSection": "", - "SubSectionObjective": "Restricts the permissions of any external tools the GenAI system\ncan call to limit the potential damage if an agent is coerced\nto perform unintended actions or vulnerabilities in the tools\nare exploited.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH07", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Agent Permissions" - ] - } - ] - } - ], - "Checks": [ - "iam_custom_role_has_permissions_to_administer_resource_locks", - "iam_subscription_roles_owner_custom_not_created", - "iam_role_user_access_admin_restricted", - "app_function_identity_without_admin_privileges", - "app_function_identity_is_configured", - "cosmosdb_account_use_aad_and_rbac" - ] - }, - { - "Id": "CCC.GenAI.C07.TR01", - "Description": "When an application makes an API call to a foundational model in a\nproduction environment, then it MUST specify an explicit version\nidentifier.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "The Configuration Management control family involves establishing,\nmaintaining and monitoring the configuration of the service and\nrelated applications and infrastructure to ensure consistency,\nsecure defaults and compliance.\n", - "Section": "CCC.GenAI.C07 Model Version Pinning", - "SubSection": "", - "SubSectionObjective": "Mandate that applications are locked (\"pinned\") to a specific,\ntested version of a foundational model to prevent unexpected\nbehaviour changes introduced by provider-side updates.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-010" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C08.TR01", - "Description": "When a new AI model is considered for production deployment, it\nMUST undergo a formal red teaming and quality assurance review.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "apim_threat_detection_llm_jacking" - ] - }, - { - "Id": "CCC.GenAI.C08.TR02", - "Description": "If model quality review or red teaming identifies an issue that exceeds\nthe organization's risk tolerance, the model MUST NOT be deployed until\nthe issue is remediated.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "apim_threat_detection_llm_jacking" - ] - }, - { - "Id": "CCC.KeyMgmt.C01.TR01", - "Description": "When a key version is scheduled for deletion or disabled, an\nalert MUST be generated within five minutes.", + "Id": "CCC.KeyMgmt.CN01.AR01", + "Description": "When a key version is scheduled for deletion or disabled, an alert MUST be generated within five minutes.", "Attributes": [ { "FamilyName": "Logging and Metrics Publication", "FamilyDescription": "Controls that collect, alert, and retain key-management events.", - "Section": "CCC.KeyMgmt.C01 Alert on Key-version Changes", + "Section": "CCC.KeyMgmt.CN01 Alert on Key-version Changes", "SubSection": "", "SubSectionObjective": "Generate near-real-time alerts when a KMS key version is disabled or scheduled for deletion, enabling rapid investigation and recovery.", "Applicability": [ @@ -1700,13 +984,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C02.TR01", - "Description": "When IAM roles and key policies are reviewed, Decrypt permission\nMUST be granted exclusively to documented authorised principals.", + "Id": "CCC.KeyMgmt.CN02.AR01", + "Description": "When IAM roles and key policies are reviewed, Decrypt permission MUST be granted exclusively to documented authorised principals.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls that enforce least-privilege use of KMS operations.", - "Section": "CCC.KeyMgmt.C02 Limit Decrypt Permissions", + "Section": "CCC.KeyMgmt.CN02 Limit Decrypt Permissions", "SubSection": "", "SubSectionObjective": "Restrict the Decrypt operation to authorised principals only, applying the principle of least privilege to protect sensitive data.", "Applicability": [ @@ -1745,13 +1029,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C03.TR01", - "Description": "When rotation settings are examined, rotation MUST be enabled with\nan interval not exceeding 365 days.", + "Id": "CCC.KeyMgmt.CN03.AR01", + "Description": "When rotation settings are examined, rotation MUST be enabled with an interval not exceeding 365 days.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C03 Enforce Automatic Rotation", + "Section": "CCC.KeyMgmt.CN03 Enforce Automatic Rotation", "SubSection": "", "SubSectionObjective": "Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.", "Applicability": [ @@ -1787,13 +1071,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C04.TR01", - "Description": "When a key import request is processed, the key MUST use an\napproved algorithm (RSA-2048+, EC-P256+) and originate from a\ncertified HSM.", + "Id": "CCC.KeyMgmt.CN04.AR01", + "Description": "When a key import request is processed, the key MUST use an approved algorithm (RSA-2048+, EC-P256+) and originate from a certified HSM.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C04 Validate Imported Keys", + "Section": "CCC.KeyMgmt.CN04 Validate Imported Keys", "SubSection": "", "SubSectionObjective": "Accept only externally generated keys that meet approved cryptographic strength and provenance requirements.", "Applicability": [ @@ -1838,13 +1122,13 @@ ] }, { - "Id": "CCC.LB.C01.TR01", - "Description": "When a single client sends more than 2000 requests within any\n5-minute sliding window, the load balancer MUST throttle all\nsubsequent requests from that client for at least 60 seconds.", + "Id": "CCC.LB.CN01.AR01", + "Description": "When a single client sends more than 2000 requests within any 5-minute sliding window, the load balancer MUST throttle all subsequent requests from that client for at least 60 seconds.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1852,7 +1136,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement per-IP token-bucket limits with and verify via\nsynthetic traffic tests.\n", + "Recommendation": "Implement per-IP token-bucket limits with and verify via synthetic traffic tests. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1885,13 +1169,13 @@ "Checks": [] }, { - "Id": "CCC.LB.C01.TR02", - "Description": "When throttling is invoked, the load balancer MUST\nrecord the event in the access log within 5 minutes\nfor alerting and trend analysis.", + "Id": "CCC.LB.CN01.AR02", + "Description": "When throttling is invoked, the load balancer MUST record the event in the access log within 5 minutes for alerting and trend analysis.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1899,7 +1183,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Enable access logging and configure metric filters\non HTTP 429 counts to trigger alerts.\n", + "Recommendation": "Enable access logging and configure metric filters on HTTP 429 counts to trigger alerts. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1939,21 +1223,21 @@ ] }, { - "Id": "CCC.LB.C06.TR01", - "Description": "When more than 10 percent of targets change from healthy to\nunhealthy within five minutes, an alert MUST be issued.", + "Id": "CCC.LB.CN06.AR01", + "Description": "When more than 10 percent of targets change from healthy to unhealthy within five minutes, an alert MUST be issued.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C06 Secure Health-Check Telemetry", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN06 Secure Health-Check Telemetry", "SubSection": "", - "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on\nabnormal status changes.", + "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on abnormal status changes.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Instrument metrics for health check results and target\nremoval events. Configure monitoring alarms to alert\non abnormal spikes in unhealthy targets.\n", + "Recommendation": "Instrument metrics for health check results and target removal events. Configure monitoring alarms to alert on abnormal spikes in unhealthy targets. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1992,21 +1276,21 @@ ] }, { - "Id": "CCC.LB.C04.TR01", - "Description": "When routing weights change, the request MUST originate\nfrom an explicitly defined and trusted identity and MUST\nbe logged.", + "Id": "CCC.LB.CN04.AR01", + "Description": "When routing weights change, the request MUST originate from an explicitly defined and trusted identity and MUST be logged.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C04 Enforce Distribution Policies", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN04 Enforce Distribution Policies", "SubSection": "", - "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified\nonly by trusted identities.", + "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified only by trusted identities.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Define a list of trusted principals allowed to modify\nrouting configurations. Enforce via conditional access\npolicies, and log changes using audit logging.\n", + "Recommendation": "Define a list of trusted principals allowed to modify routing configurations. Enforce via conditional access policies, and log changes using audit logging. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2044,15 +1328,15 @@ ] }, { - "Id": "CCC.LB.C05.TR01", - "Description": "When stickiness is enabled, session cookies MUST expire\nwithin 30 minutes of inactivity.", + "Id": "CCC.LB.CN05.AR01", + "Description": "When stickiness is enabled, session cookies MUST expire within 30 minutes of inactivity.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C05 Validate Session Affinity", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN05 Validate Session Affinity", "SubSection": "", - "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking\nrisks.", + "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking risks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2090,15 +1374,15 @@ ] }, { - "Id": "CCC.LB.C09.TR01", - "Description": "When an API call originates outside the approved CIDR\nset, the request MUST be denied.", + "Id": "CCC.LB.CN09.AR01", + "Description": "When an API call originates outside the approved CIDR set, the request MUST be denied.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C09 Restrict Management API Access", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN09 Restrict Management API Access", "SubSection": "", - "SubSectionObjective": "Limit load-balancer API calls to authorised identities and\ntrusted networks.", + "SubSectionObjective": "Limit load-balancer API calls to authorised identities and trusted networks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2138,15 +1422,15 @@ ] }, { - "Id": "CCC.LB.C02.TR01", - "Description": "When concurrent connections reach 80 percent of capacity, the\nautoscaling group MUST add at least one instance within five\nminutes.", + "Id": "CCC.LB.CN02.AR01", + "Description": "When concurrent connections reach 80 percent of capacity, the autoscaling group MUST add at least one instance within five minutes.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C02 Auto-Scale Load Balancer Capacity", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN02 Auto-Scale Load Balancer Capacity", "SubSection": "", - "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic\nspikes.", + "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic spikes.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2180,15 +1464,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C07.TR01", - "Description": "When responses pass through the load balancer, the\n\"Server\" header MUST be replaced with \"lb\".", + "Id": "CCC.LB.CN07.AR01", + "Description": "When responses pass through the load balancer, the \"Server\" header MUST be replaced with \"lb\".", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C07 Scrub Sensitive Headers", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN07 Scrub Sensitive Headers", "SubSection": "", - "SubSectionObjective": "Remove headers that disclose internal details or software\nversions from HTTP responses.", + "SubSectionObjective": "Remove headers that disclose internal details or software versions from HTTP responses.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2222,15 +1506,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C08.TR01", - "Description": "When a certificate is within 30 days of expiry, automated renewal\nMUST complete and deploy a new certificate within 24 hours.", + "Id": "CCC.LB.CN08.AR01", + "Description": "When a certificate is within 30 days of expiry, automated renewal MUST complete and deploy a new certificate within 24 hours.", "Attributes": [ { "FamilyName": "Encryption", "FamilyDescription": "Controls that ensure trustworthy TLS certificates and ciphers.", - "Section": "CCC.LB.C08 Automate Certificate Renewal", + "Section": "CCC.LB.CN08 Automate Certificate Renewal", "SubSection": "", - "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and\ndeployment before expiry.", + "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and deployment before expiry.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2261,21 +1545,18 @@ ] } ], - "Checks": [ - "app_minimum_tls_version_12", - "storage_ensure_minimum_tls_version_12" - ] + "Checks": [] }, { - "Id": "CCC.Logging.C01.TR01", - "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be\nenabled by default and directed to the central sink.", + "Id": "CCC.Logging.CN01.AR01", + "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be enabled by default and directed to the central sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2317,15 +1598,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR02", - "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant\nlogs (e.g., OS, application, service logs) to the central log sink.", + "Id": "CCC.Logging.CN01.AR02", + "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant logs (e.g., OS, application, service logs) to the central log sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2367,15 +1648,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR01", - "Description": "When a new log bucket or stream is created, its retention policy MUST be configured\nin accordance with organisation's data retention policy.", + "Id": "CCC.Logging.CN02.AR01", + "Description": "When a new log bucket or stream is created, its retention policy MUST be configured in accordance with organisation's data retention policy.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2412,15 +1693,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR02", - "Description": "When a query is performed to retrieve log events older than the number of days defined\nin the organisation's data retention policy, it MUST return an empty result.", + "Id": "CCC.Logging.CN02.AR02", + "Description": "When a query is performed to retrieve log events older than the number of days defined in the organisation's data retention policy, it MUST return an empty result.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2459,20 +1740,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to modify or delete data before the object\nlock period expires, then the action MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to modify or delete data before the object lock period expires, then the action MUST be denied.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C03 Enable Object Lock On Log Bucket", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN03 Enable Object Lock On Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection\nusing object lock on log storage buckets. This prevents logs from being modified\nor deleted during the defined retention period, supporting compliance and forensic\nintegrity.", + "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2501,20 +1782,20 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C04.TR01", + "Id": "CCC.AuditLog.CN04.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C04 Restrict Field And Log Type Access", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN04 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on log data.\n", + "Recommendation": "Review field level access controls on log data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2552,21 +1833,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR01", - "Description": "When a log storage bucket is created, the bucket's access control settings MUST\nexplicitly deny public read and write access.", + "Id": "CCC.Logging.CN05.AR01", + "Description": "When a log storage bucket is created, the bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2600,21 +1881,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR02", - "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied\nby bucket policy.", + "Id": "CCC.Logging.CN05.AR02", + "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied by bucket policy.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2649,15 +1930,15 @@ ] }, { - "Id": "CCC.Logging.C06.TR01", - "Description": "When a single principal executes an anomalously high number of log queries,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN06.AR01", + "Description": "When a single principal executes an anomalously high number of log queries, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C06 Detect and Alert on Potential Log Exfiltration", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN06 Detect and Alert on Potential Log Exfiltration", "SubSection": "", - "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt\nto exfiltrate log data.", + "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2696,15 +1977,15 @@ ] }, { - "Id": "CCC.Logging.C07.TR01", - "Description": "When an audit log event is recorded that corresponds to a modification of the logging service\nconfiguration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN07.AR01", + "Description": "When an audit log event is recorded that corresponds to a modification of the logging service configuration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C07 Detect and Alert on Log Service Tampering", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN07 Detect and Alert on Log Service Tampering", "SubSection": "", - "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified,\nor deleted, indicating a defense evasion attempt.", + "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2755,13 +2036,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR01", + "Id": "CCC.ObjStor.CN01.AR01", "Description": "When a request is made to read a protected bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2815,13 +2096,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR02", + "Id": "CCC.ObjStor.CN01.AR02", "Description": "When a request is made to read a protected object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2877,13 +2158,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR03", + "Id": "CCC.ObjStor.CN01.AR03", "Description": "When a request is made to write to a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2940,13 +2221,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR04", + "Id": "CCC.ObjStor.CN01.AR04", "Description": "When a request is made to write to an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3001,13 +2282,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR01", + "Id": "CCC.ObjStor.CN03.AR01", "Description": "When an object storage bucket deletion is attempted, the bucket MUST be fully recoverable for a set time-frame after deletion is requested.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3060,13 +2341,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR02", + "Id": "CCC.ObjStor.CN03.AR02", "Description": "When an attempt is made to modify the retention policy for an object storage bucket, the service MUST prevent the policy from being modified.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3116,13 +2397,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C04.TR01", + "Id": "CCC.ObjStor.CN04.AR01", "Description": "When an object is uploaded to the object storage system, the object MUST automatically receive a default retention policy that prevents premature deletion or modification.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3176,13 +2457,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR02", + "Id": "CCC.ObjStor.CN04.AR02", "Description": "When an attempt is made to delete or modify an object that is subject to an active retention policy, the service MUST prevent the action from being completed.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3235,13 +2516,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR01", + "Id": "CCC.ObjStor.CN05.AR01", "Description": "When an object is uploaded to the object storage bucket, the object MUST be stored with a unique identifier.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3293,13 +2574,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR02", + "Id": "CCC.ObjStor.CN05.AR02", "Description": "When an object is modified, the service MUST assign a new unique identifier to the modified object to differentiate it from the previous version.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3351,13 +2632,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR03", + "Id": "CCC.ObjStor.CN05.AR03", "Description": "When an object is modified, the service MUST allow for recovery of previous versions of the object.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3409,13 +2690,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR04", + "Id": "CCC.ObjStor.CN05.AR04", "Description": "When an object is deleted, the service MUST retain other versions of the object to allow for recovery of previous versions.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3467,13 +2748,13 @@ ] }, { - "Id": "CCC.ObjStor.C06.TR01", + "Id": "CCC.ObjStor.CN06.AR01", "Description": "When an object storage bucket is accessed, the service MUST store access logs in a separate data store.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C06 Prevent Deployment in Restricted Regions", + "Section": "CCC.CN06 Prevent Deployment in Restricted Regions", "SubSection": "CCC.ObjStor.C06 Access Logs are Stored in a Separate Data Store", "SubSectionObjective": "Ensure that access logs for object storage buckets are stored in a separate data store to protect against unauthorized access, tampering, or deletion of logs (Logbuckets are exempt from this requirement, but must be tlp-red).", "Applicability": [ @@ -3528,13 +2809,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR01", + "Id": "CCC.ObjStor.CN02.AR01", "Description": "When a permission set is allowed for an object in a bucket, the service MUST allow the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3588,13 +2869,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR02", + "Id": "CCC.ObjStor.CN02.AR02", "Description": "When a permission set is denied for an object in a bucket, the service MUST deny the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3648,1001 +2929,9 @@ "storage_ensure_private_endpoints_in_storage_accounts" ] }, - { - "Id": "CCC.MLDE.CN01.AR01", - "Description": "Verify that only authorized users can access MLDE resources,\nand that access modes are properly defined and enforced.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN01 Define Access Mode for ML Development Environments", - "SubSection": "", - "SubSectionObjective": "Ensure that access to Machine Learning Development Environment (MLDE)\nresources is strictly defined and controlled.\nOnly authorized users with appropriate permissions can access these environments,\nmitigating the risk of unauthorized access, data leakage, or service disruption.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.1", - "2013 A.9.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-2", - "AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-01", - "IAM-02" - ] - } - ] - } - ], - "Checks": [ - "aks_cluster_rbac_enabled", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_ensure_auth_is_set_up", - "app_register_with_identity", - "app_function_identity_is_configured", - "app_function_identity_without_admin_privileges", - "app_function_not_publicly_accessible", - "app_function_access_keys_configured", - "keyvault_rbac_enabled", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "iam_custom_role_has_permissions_to_administer_resource_locks", - "iam_role_user_access_admin_restricted", - "iam_subscription_roles_owner_custom_not_created", - "entra_policy_user_consent_for_verified_apps", - "entra_security_defaults_enabled", - "entra_trusted_named_locations_exists", - "entra_global_admin_in_less_than_five_users", - "entra_non_privileged_user_has_mfa", - "entra_privileged_user_has_mfa", - "entra_policy_default_users_cannot_create_security_groups", - "entra_policy_ensure_default_user_cannot_create_apps", - "entra_users_cannot_create_microsoft_365_groups" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR01", - "Description": "Verify that root access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_function_not_publicly_accessible", - "app_function_identity_without_admin_privileges", - "iam_role_user_access_admin_restricted", - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication", - "app_function_identity_is_configured" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR02", - "Description": "For MLDE instances without sensitive data, ensure that root access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication", - "app_function_identity_without_admin_privileges", - "app_function_identity_is_configured", - "iam_role_user_access_admin_restricted", - "iam_subscription_roles_owner_custom_not_created", - "entra_global_admin_in_less_than_five_users", - "entra_privileged_user_has_mfa", - "entra_conditional_access_policy_require_mfa_for_management_api" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR01", - "Description": "Verify that terminal access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR02", - "Description": "For MLDE instances without sensitive data, ensure that terminal access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication" - ] - }, - { - "Id": "CCC.MLDE.CN02.AR01", - "Description": "Confirm that file download functionality is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN02.AR02", - "Description": "For MLDE instances without sensitive data, ensure that file downloads are monitored and logged.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "monitor_diagnostic_settings_exists", - "monitor_diagnostic_setting_with_appropriate_categories" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR01", - "Description": "Verify that only approved VM and container images can be selected when creating MLDE instances.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "vm_ensure_using_approved_images", - "vm_desired_sku_size", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR02", - "Description": "Attempt to create an MLDE instance with an unapproved image and confirm that it is denied.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "vm_ensure_using_approved_images" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR01", - "Description": "Verify that automatic scheduled upgrades are enabled on user-managed\nMLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [ - "defender_ensure_system_updates_are_applied" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR02", - "Description": "Ensure that the upgrade schedule is appropriately configured and\ndoes not interfere with critical operations.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN07.AR01", - "Description": "Verify that MLDE instances containing sensitive data cannot be accessed via public IP addresses.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_blob_public_access_level_is_disabled", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted", - "network_public_ip_shodan" - ] - }, - { - "Id": "CCC.MLDE.CN07.AR02", - "Description": "For MLDE instances without sensitive data requiring public access,\nensure that appropriate security controls are in place and access is approved.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR01", - "Description": "Verify that MLDE instances containing sensitive data can only be deployed in\napproved virtual networks with appropriate security controls.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_function_vnet_integration_enabled", - "app_function_not_publicly_accessible", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR02", - "Description": "Ensure that MLDE instances without sensitive data are deployed in\nnetworks that meet organizational security standards.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_function_vnet_integration_enabled", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "storage_ensure_azure_services_are_trusted_to_access_is_enabled", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted" - ] - }, - { - "Id": "CCC.Message.CN01.AR01", - "Description": "Attempt to publish a message without using a customer-managed encryption key\nand verify that the message is rejected or not stored.", - "Attributes": [ - { - "FamilyName": "Encryption", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Message.CN01 Use Customer-Managed Encryption Keys (CMEK) for Messages", - "SubSection": "", - "SubSectionObjective": "Ensure that messages are encrypted using customer-managed encryption keys (CMEK)\nto provide enhanced control over encryption processes and keys, meeting compliance and security requirements.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-13" - ] - } - ] - } - ], - "Checks": [ - "storage_ensure_encryption_with_customer_managed_keys", - "monitor_storage_account_with_activity_logs_cmk_encrypted" - ] - }, { "Id": "CCC.Monitor.CN01.AR01", - "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then\nRate Limiting MUST be applied and an Audit Alert MUST be generated.", + "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then Rate Limiting MUST be applied and an Audit Alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4698,7 +2987,7 @@ }, { "Id": "CCC.Monitor.CN02.AR01", - "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied\nto reduce the network impact of traffic and an alert must triggered.", + "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied to reduce the network impact of traffic and an alert must triggered.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4745,14 +3034,14 @@ }, { "Id": "CCC.Monitor.CN03.AR01", - "Description": "When external systems have approved access to internal systems not normally available for public access\nthen they MUST be secured to prevent unauthorised access jumping through to the internal systems and\nonly allow access to specific internal services.", + "Description": "When external systems have approved access to internal systems not normally available for public access then they MUST be secured to prevent unauthorised access jumping through to the internal systems and only allow access to specific internal services.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN03 Access External Monitoring", "SubSection": "", - "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to\nensure they don't become an attack path, preventing monitoring systems from forging network requests to\ngain access to internal systems.", + "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to ensure they don't become an attack path, preventing monitoring systems from forging network requests to gain access to internal systems.", "Applicability": [ "tlp-clear", "tlp-green", @@ -4793,7 +3082,7 @@ }, { "Id": "CCC.Monitor.CN04.AR01", - "Description": "When monitoring dashboards display degraded services which may become potential targets then the\ndashboard MUST be protected from unauthorised access.", + "Description": "When monitoring dashboards display degraded services which may become potential targets then the dashboard MUST be protected from unauthorised access.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4838,7 +3127,7 @@ }, { "Id": "CCC.Monitor.CN05.AR01", - "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised\nresponders silence or acknowledge the alert.", + "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised responders silence or acknowledge the alert.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4889,7 +3178,7 @@ "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN06 Metrics pushed for authorised services only", "SubSection": "", - "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised\nsystem pushing fabricated metrics about a different service", + "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised system pushing fabricated metrics about a different service", "Applicability": [ "tlp-clear", "tlp-green", @@ -4930,201 +3219,16 @@ "app_ensure_auth_is_set_up" ] }, - { - "Id": "CCC.SecMgmt.CN01.AR01", - "Description": "Attempt to use an outdated version of a secret after its rotation period\nhas passed and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN01 Enforce Automatic Secret Rotation", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are automatically rotated on a defined schedule to\nreduce the risk of secret compromise and unauthorized access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01", - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-28" - ] - } - ] - } - ], - "Checks": [ - "keyvault_key_rotation_enabled", - "storage_key_rotation_90_days" - ] - }, - { - "Id": "CCC.SecMgmt.CN02.AR01", - "Description": "Attempt to retrieve a secret from an unauthorized region and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN02 Enforce Secret Replication Policies", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are replicated only to authorized locations as per\norganizational data residency and compliance requirements.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH03", - "CCC.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-3", - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "keyvault_rbac_enabled", - "keyvault_logging_enabled" - ] - }, - { - "Id": "CCC.SvlsComp.CN01.AR01", - "Description": "Attempt to access the serverless function over the public internet and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN01 Enforce Use of Private Endpoints for Serverless Function", - "SubSection": "", - "SubSectionObjective": "Ensure that the serverless function is accessible only through a private endpoint,\nallowing it to communicate securely within a virtual private network and preventing\nunauthorized external access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "app_function_not_publicly_accessible", - "app_function_vnet_integration_enabled" - ] - }, - { - "Id": "CCC.SvlsComp.CN02.AR01", - "Description": "Send requests to invoke the function up to the allowed threshold and confirm they\nare successful; then send additional requests exceeding the threshold from the same\nentity and verify that they are denied.", - "Attributes": [ - { - "FamilyName": "Availability", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN02 Implement Function Invocation Rate Limits", - "SubSection": "", - "SubSectionObjective": "Ensure that function invocation is limited to a specified threshold from any single entity,\npreventing resource exhaustion and denial of service attacks.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH12" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-5" - ] - } - ] - } - ], - "Checks": [ - "app_function_access_keys_configured", - "app_function_not_publicly_accessible", - "app_function_vnet_integration_enabled", - "app_function_identity_is_configured" - ] - }, { "Id": "CCC.VPC.CN01.AR01", - "Description": "When a subscription is created, the subscription MUST NOT\ncontain default network resources.", + "Description": "When a subscription is created, the subscription MUST NOT contain default network resources.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN01 Restrict Default Network Creation", "SubSection": "", - "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related\nresources during subscription initialization to avoid insecure default\nconfigurations and enforce custom network policies.", + "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5168,86 +3272,16 @@ ], "Checks": [] }, - { - "Id": "CCC.VPC.CN02.AR01", - "Description": "When a resource is created in a public subnet, that resource\nMUST NOT be assigned an external IP address by default.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.VPC.CN02 Limit Resource Creation in Public Subnet", - "SubSection": "", - "SubSectionObjective": "Restrict the creation of resources in the public subnet with\ndirect access to the internet to minimize attack surfaces.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-4" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_public_access_disabled", - "aks_clusters_created_with_private_nodes", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "cosmosdb_account_use_private_endpoints", - "cosmosdb_account_firewall_use_selected_networks", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "storage_blob_public_access_level_is_disabled", - "sqlserver_unrestricted_inbound_access", - "app_function_not_publicly_accessible" - ] - }, { "Id": "CCC.VPC.CN03.AR01", - "Description": "When a VPC peering connection is requested, the service MUST\nprevent connections from VPCs that are not explicitly\nallowed.", + "Description": "When a VPC peering connection is requested, the service MUST prevent connections from VPCs that are not explicitly allowed.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN03 Restrict VPC Peering to Authorized Accounts", "SubSection": "", - "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly\nauthorized destinations to limit network exposure and enforce boundary\ncontrols.", + "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5294,14 +3328,14 @@ }, { "Id": "CCC.VPC.CN04.AR01", - "Description": "When any network traffic goes to or from an interface in the VPC,\nthe service MUST capture and log all relevant information.", + "Description": "When any network traffic goes to or from an interface in the VPC, the service MUST capture and log all relevant information.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN04 Enforce VPC Flow Logs on VPCs", "SubSection": "", - "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic\ninformation.", + "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic information.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5351,14 +3385,14 @@ }, { "Id": "CCC.Vector.CN01.AR01", - "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it\nmatches expected schema, dimension, and format profiles.", + "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it matches expected schema, dimension, and format profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN01 Validate Embeddings Before Indexing", "SubSection": "", - "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated\nbefore indexing to prevent poisoning or corruption.", + "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated before indexing to prevent poisoning or corruption.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5390,14 +3424,14 @@ }, { "Id": "CCC.Vector.CN02.AR01", - "Description": "When an index lifecycle event is triggered, the service MUST\nverify that the actor has explicit permissions for the operation type.", + "Description": "When an index lifecycle event is triggered, the service MUST verify that the actor has explicit permissions for the operation type.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN02 Enforce Role-Based Index Lifecycle Management", "SubSection": "", - "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged\nidentities using fine-grained access controls.", + "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged identities using fine-grained access controls.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5435,14 +3469,14 @@ }, { "Id": "CCC.Vector.CN03.AR01", - "Description": "When a metadata filter is applied to a query, the service MUST\nverify the requester is authorized to access that field.", + "Description": "When a metadata filter is applied to a query, the service MUST verify the requester is authorized to access that field.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN03 Enforce Metadata-Level Access Controls", "SubSection": "", - "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to\nprevent unauthorized exposure or inference.", + "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to prevent unauthorized exposure or inference.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5469,49 +3503,18 @@ ] } ], - "Checks": [ - "app_function_not_publicly_accessible", - "app_function_identity_is_configured", - "app_function_identity_without_admin_privileges", - "app_function_access_keys_configured", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "containerregistry_admin_user_disabled", - "cosmosdb_account_firewall_use_selected_networks", - "cosmosdb_account_use_private_endpoints", - "cosmosdb_account_use_aad_and_rbac", - "keyvault_rbac_enabled", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "keyvault_logging_enabled", - "storage_blob_public_access_level_is_disabled", - "storage_default_network_access_rule_is_denied", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_account_key_access_disabled", - "storage_secure_transfer_required_is_enabled", - "storage_ensure_encryption_with_customer_managed_keys", - "storage_ensure_soft_delete_is_enabled", - "storage_ensure_file_shares_soft_delete_is_enabled", - "iam_role_user_access_admin_restricted", - "iam_custom_role_has_permissions_to_administer_resource_locks", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled" - ] + "Checks": [] }, { "Id": "CCC.Vector.CN04.AR01", - "Description": "When ingestion exceeds pre-defined thresholds, the service MUST\nthrottle or reject excess vector write operations.", + "Description": "When ingestion exceeds pre-defined thresholds, the service MUST throttle or reject excess vector write operations.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN04 Enforce Ingestion Quotas and Throttling", "SubSection": "", - "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by\nrate-limiting vector submissions and enforcing quotas.", + "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by rate-limiting vector submissions and enforcing quotas.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5541,14 +3544,14 @@ }, { "Id": "CCC.Vector.CN05.AR01", - "Description": "When a rollback is attempted, the system MUST log\nthe action and verify rollback authorization.", + "Description": "When a rollback is attempted, the system MUST log the action and verify rollback authorization.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN05 Enforce Index Versioning with Rollback Protection", "SubSection": "", - "SubSectionObjective": "Ensure vector indexes are versioned and that rollback\noperations are authorized and auditable.", + "SubSectionObjective": "Ensure vector indexes are versioned and that rollback operations are authorized and auditable.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5578,14 +3581,14 @@ }, { "Id": "CCC.Vector.CN06.AR01", - "Description": "When an embedding is submitted, the service MUST validate\nthat its format and dimensionality match allowed profiles.", + "Description": "When an embedding is submitted, the service MUST validate that its format and dimensionality match allowed profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN06 Enforce Dimensional and Format Constraints", "SubSection": "", - "SubSectionObjective": "Reject embeddings that do not conform to expected model\nspecifications (dimensions, format, etc).", + "SubSectionObjective": "Reject embeddings that do not conform to expected model specifications (dimensions, format, etc).", "Applicability": [ "tlp-clear", "tlp-green", @@ -5616,14 +3619,14 @@ }, { "Id": "CCC.Vector.CN07.AR01", - "Description": "When a search request is issued, clients MUST be allowed\nto declare their requirement for exact vs approximate results.", + "Description": "When a search request is issued, clients MUST be allowed to declare their requirement for exact vs approximate results.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN07 Support Explicit ANN vs. Exact Search Configuration", "SubSection": "", - "SubSectionObjective": "Provide clients with the option to enforce exact-match\n(non-ANN) search where search fidelity is critical.", + "SubSectionObjective": "Provide clients with the option to enforce exact-match (non-ANN) search where search fidelity is critical.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5644,20 +3647,20 @@ }, { "Id": "CCC.Core.CN01.AR01", - "Description": "When a port is exposed for non-SSH network traffic, all traffic\nMUST include a TLS handshake AND be encrypted using TLS 1.3 or\nhigher.", + "Description": "When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not\nalready set, ensure that your services are configured or updated\naccordingly.\n", + "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not already set, ensure that your services are configured or updated accordingly. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5707,21 +3710,21 @@ }, { "Id": "CCC.Core.CN01.AR02", - "Description": "When a port is exposed for SSH network traffic, all traffic MUST\ninclude a SSH handshake AND be encrypted using SSHv2 or higher.", + "Description": "When a port is exposed for SSH network traffic, all traffic MUST include a SSH handshake AND be encrypted using SSHv2 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Any time port 22 is exposed, ensure that it has a properly\nimplemented SSH server with SSHv2 enabled and configured with\nstrong ciphers.\n", + "Recommendation": "Any time port 22 is exposed, ensure that it has a properly implemented SSH server with SSHv2 enabled and configured with strong ciphers. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5773,20 +3776,20 @@ }, { "Id": "CCC.Core.CN01.AR03", - "Description": "When the service receives unencrypted traffic, \nthen it MUST either block the request or automatically\nredirect it to the secure equivalent.", + "Description": "When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Review firewall, load balancer, and application configurations to\nensure insecure protocols such as HTTP, FTP, and Telnet are not\nexposed. Where possible, implement automatic redirection to secure\nprotocols such as HTTPS, SFTP, SSH, and regularly scan for\nprotocol drift.\n", + "Recommendation": "Review firewall, load balancer, and application configurations to ensure insecure protocols such as HTTP, FTP, and Telnet are not exposed. Where possible, implement automatic redirection to secure protocols such as HTTPS, SFTP, SSH, and regularly scan for protocol drift. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5837,21 +3840,21 @@ }, { "Id": "CCC.Core.CN01.AR07", - "Description": "When a port is exposed, the service MUST ensure that the protocol\nand service officially assigned to that port number by the IANA\nService Name and Transport Protocol Port Number Registry, and no\nother, is run on that port.", + "Description": "When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number\nRegistry for more information about correct protocol-to-port\nassignments. Avoid running non-standard services on well-known\nports.\n", + "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number Registry for more information about correct protocol-to-port assignments. Avoid running non-standard services on well-known ports. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5904,19 +3907,19 @@ }, { "Id": "CCC.Core.CN01.AR08", - "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be\nimplemented to require both client and server certificate\nauthentication for all connections.", + "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Configure mTLS for all endpoints that process or transmit\nsensitive data. Ensure both client and server certificates are\nvalidated and managed securely. Regularly review certificate\nauthorities and automate certificate rotation where possible.\n", + "Recommendation": "Configure mTLS for all endpoints that process or transmit sensitive data. Ensure both client and server certificates are validated and managed securely. Regularly review certificate authorities and automate certificate rotation where possible. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5965,21 +3968,21 @@ }, { "Id": "CCC.Core.CN13.AR01", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST only use valid, unexpired certificates issued by\na trusted certificate authority.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST only use valid, unexpired certificates issued by a trusted certificate authority.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6003,18 +4006,18 @@ }, { "Id": "CCC.Core.CN13.AR02", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 180 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-amber" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6037,18 +4040,18 @@ }, { "Id": "CCC.Core.CN13.AR03", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 90 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6068,21 +4071,21 @@ }, { "Id": "CCC.Core.CN06.AR01", - "Description": "When the service is running, its region and availability zone MUST\nbe included in a list of explicitly trusted or approved locations\nwithin the trust perimeter.", + "Description": "When the service is running, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate the service's deployment\nlocation is included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate the service's deployment location is included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6137,21 +4140,21 @@ }, { "Id": "CCC.Core.CN06.AR02", - "Description": "When a child resource is deployed, its region and availability\nzone MUST be included in a list of explicitly trusted or approved\nlocations within the trust perimeter.", + "Description": "When a child resource is deployed, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate that child resources can only\nbe deployed to locations included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate that child resources can only be deployed to locations included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6194,20 +4197,20 @@ }, { "Id": "CCC.Core.CN08.AR01", - "Description": "When data is created or modified, the data MUST have a complete\nand recoverable duplicate that is stored in a physically separate\ndata center.", + "Description": "When data is created or modified, the data MUST have a complete and recoverable duplicate that is stored in a physically separate data center.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement automated data replication processes to ensure that\ndata is consistently duplicated in another region or availability\nzone. Regularly test data recovery from the replicated location to\nensure integrity and availability.\n", + "Recommendation": "Implement automated data replication processes to ensure that data is consistently duplicated in another region or availability zone. Regularly test data recovery from the replicated location to ensure integrity and availability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6249,14 +4252,14 @@ }, { "Id": "CCC.Core.CN08.AR02", - "Description": "When data is replicated into a second location, the service MUST\nbe able to accurately represent the replication locations,\nreplication status, and data synchronization status.", + "Description": "When data is replicated into a second location, the service MUST be able to accurately represent the replication locations, replication status, and data synchronization status.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6302,14 +4305,14 @@ }, { "Id": "CCC.Core.CN09.AR01", - "Description": "When the service is operational, its logs and any child resource\nlogs MUST NOT be accessible from the resource they record access\nto.", + "Description": "When the service is operational, its logs and any child resource logs MUST NOT be accessible from the resource they record access to.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", @@ -6360,21 +4363,21 @@ }, { "Id": "CCC.Core.CN09.AR02", - "Description": "When the service is operational, disabling the logs for the service\nor its child resources MUST NOT be possible without also disabling\nthe corresponding resource.", + "Description": "When the service is operational, disabling the logs for the service or its child resources MUST NOT be possible without also disabling the corresponding resource.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should disable\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging mechanisms are tightly integrated with\nservice operations, so that logging cannot be disabled without\nstopping the service itself.\n", + "Recommendation": "No normal business operations should disable logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging mechanisms are tightly integrated with service operations, so that logging cannot be disabled without stopping the service itself. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6420,19 +4423,19 @@ }, { "Id": "CCC.Core.CN09.AR03", - "Description": "When the service is operational, any attempt to redirect logs for\nthe service or its child resources MUST NOT be possible without\nhalting operation of the corresponding resource and publishing\ncorresponding events to monitored channels.", + "Description": "When the service is operational, any attempt to redirect logs for the service or its child resources MUST NOT be possible without halting operation of the corresponding resource and publishing corresponding events to monitored channels.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should result in the redirection of\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging configurations are immutable during\nservice operation so that any changes require stopping the service\nand publishing corresponding events to monitored channels.\n", + "Recommendation": "No normal business operations should result in the redirection of logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging configurations are immutable during service operation so that any changes require stopping the service and publishing corresponding events to monitored channels. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6479,14 +4482,14 @@ }, { "Id": "CCC.Core.CN10.AR01", - "Description": "When data is replicated, the service MUST ensure that replication\nonly occurs to destinations that are explicitly included within\nthe defined trust perimeter.", + "Description": "When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN10 Restrict Data Replication to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations\nthat are explicitly included within a defined trust perimeter.", + "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6535,14 +4538,14 @@ }, { "Id": "CCC.Core.CN02.AR01", - "Description": "When data is stored, it MUST be encrypted using the latest\nindustry-standard encryption methods.", + "Description": "When data is stored, it MUST be encrypted using the latest industry-standard encryption methods.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN02 Encrypt Data for Storage", "SubSection": "", - "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong\nencryption algorithms.", + "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong encryption algorithms.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6596,14 +4599,14 @@ }, { "Id": "CCC.Core.CN11.AR01", - "Description": "When encryption keys are used, the service MUST verify that\nall encryption keys use the latest industry-standard cryptographic\nalgorithms.", + "Description": "When encryption keys are used, the service MUST verify that all encryption keys use the latest industry-standard cryptographic algorithms.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6664,14 +4667,14 @@ }, { "Id": "CCC.Core.CN11.AR02", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 180 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber" ], @@ -6723,14 +4726,14 @@ }, { "Id": "CCC.Core.CN11.AR03", - "Description": "When encrypting data, the service MUST verify that\ncustomer-managed encryption keys (CMEKs) are used.", + "Description": "When encrypting data, the service MUST verify that customer-managed encryption keys (CMEKs) are used.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "", "SubSection": "CCC.Core.CN11 Protect Encryption Keys", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6786,14 +4789,14 @@ }, { "Id": "CCC.Core.CN11.AR04", - "Description": "When encryption keys are accessed, the service MUST verify that\naccess to encryption keys is restricted to authorized personnel\nand services, following the principle of least privilege.", + "Description": "When encryption keys are accessed, the service MUST verify that access to encryption keys is restricted to authorized personnel and services, following the principle of least privilege.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green", @@ -6855,14 +4858,14 @@ }, { "Id": "CCC.Core.CN11.AR05", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 365 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 365 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green" @@ -6919,14 +4922,14 @@ }, { "Id": "CCC.Core.CN11.AR06", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 90 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-red" ], @@ -6976,21 +4979,21 @@ }, { "Id": "CCC.Core.CN14.AR01", - "Description": "When backups are created for disaster recovery purposes, the\nstorage mechanism MUST NOT allow modification or deletion\nwithin 30 days of creation.", + "Description": "When backups are created for disaster recovery purposes, the storage mechanism MUST NOT allow modification or deletion within 30 days of creation.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Use immutable storage solutions where possible. Implement backup\nretention policies that enforce a minimum retention period of 30\ndays.\n", + "Recommendation": "Use immutable storage solutions where possible. Implement backup retention policies that enforce a minimum retention period of 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7009,20 +5012,20 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n30 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 30 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 30 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7041,18 +5044,18 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n14 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 14 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-red" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 14 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 14 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7071,14 +5074,14 @@ }, { "Id": "CCC.Core.CN03.AR01", - "Description": "When an entity attempts to modify the service through a user\ninterface, the authentication process MUST require multiple\nidentifying factors for authentication.", + "Description": "When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7139,14 +5142,14 @@ }, { "Id": "CCC.Core.CN03.AR02", - "Description": "When an entity attempts to modify the service through an API\nendpoint, the authentication process MUST require a credential\nsuch as an API key or token AND originate from within the trust\nperimeter.", + "Description": "When an entity attempts to modify the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7206,14 +5209,14 @@ }, { "Id": "CCC.Core.CN03.AR03", - "Description": "When an entity attempts to view information on the service through\na user interface, the authentication process MUST require multiple\nidentifying factors from the user.", + "Description": "When an entity attempts to view information on the service through a user interface, the authentication process MUST require multiple identifying factors from the user.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7271,14 +5274,14 @@ }, { "Id": "CCC.Core.CN03.AR04", - "Description": "When an entity attempts to view information on the service through\nan API endpoint, the authentication process MUST require a\ncredential such as an API key or token AND originate from within\nthe trust perimeter.", + "Description": "When an entity attempts to view information on the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7336,14 +5339,14 @@ }, { "Id": "CCC.Core.CN05.AR01", - "Description": "When an attempt is made to modify data on the service or a child\nresource, the service MUST block requests from unauthorized\nentities.", + "Description": "When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7420,14 +5423,14 @@ }, { "Id": "CCC.Core.CN05.AR02", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST refuse requests\nfrom unauthorized entities.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7512,14 +5515,14 @@ }, { "Id": "CCC.Core.CN05.AR03", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource in a multi-tenant environment, the\nservice MUST refuse requests across tenant boundaries unless the\norigin is explicitly included in a pre-approved allowlist.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource in a multi-tenant environment, the service MUST refuse requests across tenant boundaries unless the origin is explicitly included in a pre-approved allowlist.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7594,14 +5597,14 @@ }, { "Id": "CCC.Core.CN05.AR04", - "Description": "When data is requested from outside the trust perimeter, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When data is requested from outside the trust perimeter, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "", "SubSection": "CCC.Core.CN05 Prevent Access from Untrusted Entities", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7688,14 +5691,14 @@ }, { "Id": "CCC.Core.CN05.AR05", - "Description": "When any request is made from outside the trust perimeter,\nthe service MUST NOT provide any response that may indicate the\nservice exists.", + "Description": "When any request is made from outside the trust perimeter, the service MUST NOT provide any response that may indicate the service exists.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-red" ], @@ -7774,14 +5777,14 @@ }, { "Id": "CCC.Core.CN05.AR06", - "Description": "When any request is made to the service or a child resource, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-green", "tlp-amber", @@ -7850,14 +5853,14 @@ }, { "Id": "CCC.Core.CN04.AR01", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST log the client\nidentity, time, and result of the attempt.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7916,14 +5919,14 @@ }, { "Id": "CCC.Core.CN04.AR02", - "Description": "When any attempt is made to modify data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7972,14 +5975,14 @@ }, { "Id": "CCC.Core.CN04.AR03", - "Description": "When any attempt is made to read data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-red" ], @@ -8028,19 +6031,19 @@ }, { "Id": "CCC.Core.CN07.AR01", - "Description": "When enumeration activities are detected, the service MUST publish\nan event to a monitored channel which includes the client\nidentity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement event publication mechanisms and alerts for patterns\nindicative of enumeration activities, such as repeated access\nattempts, requests, or liveness probes. Configure alerts to notify\nsecurity teams of any activities that merit further investigation.\n", + "Recommendation": "Implement event publication mechanisms and alerts for patterns indicative of enumeration activities, such as repeated access attempts, requests, or liveness probes. Configure alerts to notify security teams of any activities that merit further investigation. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -8078,21 +6081,21 @@ }, { "Id": "CCC.Core.CN07.AR02", - "Description": "When enumeration activities are detected, the service MUST log the\nclient identity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement logging mechanisms to capture details of enumeration\nactivities, including client identity, timestamps, and activity\nnature. Retain logs according to organizational policies, and\noccasionally review them for patterns that may indicate\nreconnaissance activities.\n", + "Recommendation": "Implement logging mechanisms to capture details of enumeration activities, including client identity, timestamps, and activity nature. Retain logs according to organizational policies, and occasionally review them for patterns that may indicate reconnaissance activities. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", diff --git a/prowler/compliance/gcp/ccc_gcp.json b/prowler/compliance/gcp/ccc_gcp.json index 5c780dcbee..e3060646c5 100644 --- a/prowler/compliance/gcp/ccc_gcp.json +++ b/prowler/compliance/gcp/ccc_gcp.json @@ -6,19 +6,19 @@ "Description": "Common Cloud Controls Catalog (CCC) for GCP", "Requirements": [ { - "Id": "CCC.AuditLog.C01.TR01", + "Id": "CCC.AuditLog.CN01.AR01", "Description": "When the signature validation process is performed, then it MUST detect any modification of data.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure hash of data is included in digital signature.\n", + "Recommendation": "Ensure hash of data is included in digital signature. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -52,19 +52,19 @@ ] }, { - "Id": "CCC.AuditLog.C01.TR02", + "Id": "CCC.AuditLog.CN01.AR02", "Description": "When the signature validation process is performed, then it MUST detect any missing (deleted) log file.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure verification process includes a chained hash function.\n", + "Recommendation": "Ensure verification process includes a chained hash function. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -97,15 +97,15 @@ ] }, { - "Id": "CCC.AuditLog.C02.TR01", - "Description": "When a manual action is performed to generate each audit log type,\nthen the corresponding audit log type MUST be generated and recorded.", + "Id": "CCC.AuditLog.CN02.AR01", + "Description": "When a manual action is performed to generate each audit log type, then the corresponding audit log type MUST be generated and recorded.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C02 Enable And Validate All Audit Log Types", + "Section": "CCC.AuditLog.CN02 Enable And Validate All Audit Log Types", "SubSection": "", - "SubSectionObjective": "Review audit log configuration and ensure that all audit log types\nare being generated and replicated to configured sinks", + "SubSectionObjective": "Review audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks", "Applicability": [ "tlp-red", "tlp-amber" @@ -151,20 +151,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR01", + "Id": "CCC.AuditLog.CN03.AR01", "Description": "When an attempt is made to disable a log source, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -205,20 +205,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR02", - "Description": "When an attempt is made to alter the retention or object lock status\nof an external data log source or bucket, then an alert MUST be generated.", + "Id": "CCC.AuditLog.CN03.AR02", + "Description": "When an attempt is made to alter the retention or object lock status of an external data log source or bucket, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -251,20 +251,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", - "Description": "When audit log buckets are created then verify that server access\nlogging MUST be enabled for the audit log bucket,\nwith logs delivered to a separate, secure logging bucket.", + "Id": "CCC.AuditLog.CN04.AR01", + "Description": "When audit log buckets are created then verify that server access logging MUST be enabled for the audit log bucket, with logs delivered to a separate, secure logging bucket.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C04 Ensure Access Logging Is Enabled on the Audit Log Bucket", + "Section": "CCC.AuditLog.CN04 Ensure Access Logging Is Enabled on the Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to\ncapture all requests made to the bucket, providing an audit trail of data access.", + "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure the audit log bucket to enable server access logging.\nEnsure the target logging bucket is configured for appropriate security,\nincluding restricted access and immutability.\n", + "Recommendation": "Configure the audit log bucket to enable server access logging. Ensure the target logging bucket is configured for appropriate security, including restricted access and immutability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -299,20 +299,20 @@ ] }, { - "Id": "CCC.AuditLog.C05.TR01", + "Id": "CCC.AuditLog.CN05.AR01", "Description": "When audit logs are exported, then audit logs MUST be present in the configured data location.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C05 Export Audit Logs To Bucket", + "Section": "CCC.AuditLog.CN05 Export Audit Logs To Bucket", "SubSection": "", - "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated\nand can be subject to greater access control and data retention polices.", + "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure audit log exporting.\n", + "Recommendation": "Configure audit log exporting. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -348,21 +348,21 @@ ] }, { - "Id": "CCC.AuditLog.C06.TR01", - "Description": "When the retention policy is applied, then data MUST\nbe automatically deleted after the configured number of days.", + "Id": "CCC.AuditLog.CN06.AR01", + "Description": "When the retention policy is applied, then data MUST be automatically deleted after the configured number of days.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C06 Enforce Retention Policy on Audit Log Bucket", + "Section": "CCC.AuditLog.CN06 Enforce Retention Policy on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are\nretained for the correct number of days as defined by your organization's policy.", + "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce\nthe required data retention period.\n", + "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce the required data retention period. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -395,21 +395,21 @@ ] }, { - "Id": "CCC.AuditLog.C07.TR01", - "Description": "When a standard file deletion is attempted on an object within\nthe audit log bucket, then it MUST be prevented unless MFA is provided.", + "Id": "CCC.AuditLog.CN07.AR01", + "Description": "When a standard file deletion is attempted on an object within the audit log bucket, then it MUST be prevented unless MFA is provided.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C07 Enforce MFA Delete on Audit Log Bucket", + "Section": "CCC.AuditLog.CN07 Enforce MFA Delete on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to\nprovide greater protection against accidental or malicious deletion of audit data.", + "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations)\non the audit log bucket.\n", + "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations) on the audit log bucket. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -443,20 +443,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to delete data before the object\nlock period expires, then the deletion MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to delete data before the object lock period expires, then the deletion MUST be denied.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C08 Enable Object Lock On Audit Log Bucket", + "Section": "CCC.AuditLog.CN08 Enable Object Lock On Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket.\nThe lock time MUST be configured to meet your organization, legal and compliance goals.\nDeletion attempts before the lock period MUST be denied.", + "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket. The lock time MUST be configured to meet your organization, legal and compliance goals. Deletion attempts before the lock period MUST be denied.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -487,20 +487,20 @@ ] }, { - "Id": "CCC.AuditLog.C09.TR01", + "Id": "CCC.AuditLog.CN09.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C09 Restrict Field And Log Type Access", + "Section": "CCC.AuditLog.CN09 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on audit data.\n", + "Recommendation": "Review field level access controls on audit data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -533,21 +533,21 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C10.TR01", - "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny\npublic read and write access.", + "Id": "CCC.AuditLog.CN10.AR01", + "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -580,21 +580,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR02", - "Description": "When the URL of a audit log storage bucket's object is accessed publicly then,\nit should be denied by bucket policy.", + "Id": "CCC.AuditLog.CN10.AR02", + "Description": "When the URL of a audit log storage bucket's object is accessed publicly then, it should be denied by bucket policy.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -626,7 +626,7 @@ ] }, { - "Id": "CCC.Build.C01.TR01", + "Id": "CCC.Build.CN01.AR01", "Description": "Attempt to initiate a build using an unauthorized build agent and verify that the build is rejected.", "Attributes": [ { @@ -634,7 +634,7 @@ "FamilyDescription": "TODO: Describe this control family", "Section": "", "SubSection": "CCC.Build.C01 Restrict Allowed Build Agents", - "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain\ncontrol over the build environment and prevent unauthorized code execution.", + "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain control over the build environment and prevent unauthorized code execution.", "Applicability": [ "tlp-red", "tlp-amber" @@ -668,15 +668,15 @@ "Checks": [] }, { - "Id": "CCC.Build.C02.TR01", - "Description": "Attempt to trigger a build from an unauthorized external service or\nrepository and verify that the build does not start.", + "Id": "CCC.Build.CN02.AR01", + "Description": "Attempt to trigger a build from an unauthorized external service or repository and verify that the build does not start.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", "Section": "", "SubSection": "CCC.Build.C02 Restrict Allowed External Services for Build Triggers", - "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or\nrepositories to prevent unauthorized code execution or tampering.", + "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or repositories to prevent unauthorized code execution or tampering.", "Applicability": [ "tlp-red", "tlp-amber" @@ -710,7 +710,7 @@ "Checks": [] }, { - "Id": "CCC.Build.C03.TR01", + "Id": "CCC.Build.CN03.AR01", "Description": "Attempt to access the build environment from an external network and verify that access is denied.", "Attributes": [ { @@ -718,7 +718,7 @@ "FamilyDescription": "TODO: Describe this control family", "Section": "", "SubSection": "CCC.Build.C03 Deny External Network Access for Build Environments", - "SubSectionObjective": "Ensure that build environments do not have external network access to\nprevent unauthorized external access and data exfiltration.", + "SubSectionObjective": "Ensure that build environments do not have external network access to prevent unauthorized external access and data exfiltration.", "Applicability": [ "tlp-red", "tlp-amber" @@ -760,15 +760,15 @@ ] }, { - "Id": "CCC.CntrReg.C01.TR01", - "Description": "Attempt to push an artifact with known vulnerabilities to the registry\nand observe if it is flagged or rejected by the vulnerability scanning process.", + "Id": "CCC.CntrReg.CN01.AR01", + "Description": "Attempt to push an artifact with known vulnerabilities to the registry and observe if it is flagged or rejected by the vulnerability scanning process.", "Attributes": [ { "FamilyName": "Risk Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C01 Implement Vulnerability Scanning for Artifacts", + "Section": "CCC.CntrReg.CN01 Implement Vulnerability Scanning for Artifacts", "SubSection": "", - "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for\nvulnerabilities to identify and remediate security issues before deployment.", + "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for vulnerabilities to identify and remediate security issues before deployment.", "Applicability": [ "tlp-red", "tlp-amber" @@ -805,56 +805,15 @@ ] }, { - "Id": "CCC.CntrReg.C02.TR01", - "Description": "Confirm that artifacts older than the specified retention period are automatically\ndeleted from the registry.", - "Attributes": [ - { - "FamilyName": "Data Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C02 Implement Cleanup Policies for Artifacts", - "SubSection": "", - "SubSectionObjective": "Ensure that unused or outdated artifacts are cleaned up according to defined policies to\nmanage storage effectively and reduce security risks associated with outdated versions.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-12" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.DataWar.C01.TR01", - "Description": "Attempt to access underlying database tables directly without\nusing managed views and verify that access is denied.", + "Id": "CCC.DataWar.CN01.AR01", + "Description": "Attempt to access underlying database tables directly without using managed views and verify that access is denied.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C01 Enforce Use of Managed Views for Data Access", + "Section": "CCC.DataWar.CN01 Enforce Use of Managed Views for Data Access", "SubSection": "", - "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users\nfrom accessing underlying tables directly and enforcing consistent security policies.", + "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users from accessing underlying tables directly and enforcing consistent security policies.", "Applicability": [ "tlp-red", "tlp-amber" @@ -888,15 +847,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C02.TR01", - "Description": "Attempt to query sensitive columns without the necessary permissions and\nverify that access is denied or data is masked.", + "Id": "CCC.DataWar.CN02.AR01", + "Description": "Attempt to query sensitive columns without the necessary permissions and verify that access is denied or data is masked.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C02 Enforce Column-Level Security Policies", + "Section": "CCC.DataWar.CN02 Enforce Column-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles,\npreventing unauthorized access to sensitive information.", + "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles, preventing unauthorized access to sensitive information.", "Applicability": [ "tlp-red", "tlp-amber" @@ -930,15 +889,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C03.TR01", - "Description": "Attempt to query data rows that the user should not have access to and verify\nthat access is denied or data is not returned.", + "Id": "CCC.DataWar.CN03.AR01", + "Description": "Attempt to query data rows that the user should not have access to and verify that access is denied or data is not returned.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C03 Enforce Row-Level Security Policies", + "Section": "CCC.DataWar.CN03 Enforce Row-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes,\npreventing unauthorized access to specific subsets of data.", + "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes, preventing unauthorized access to specific subsets of data.", "Applicability": [ "tlp-red", "tlp-amber" @@ -995,730 +954,13 @@ ] }, { - "Id": "CCC.GenAI.C01.TR01", - "Description": "Untrusted input such as user queries, RAG data or tool output\nMUST be validated before it is passed to a GenAI model.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C01.TR02", - "Description": "If malicious patterns such as prompt injection or sensitive\ndata are detected during input validation, the input MUST\nbe blocked or sanitised.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR01", - "Description": "GenAI model output MUST be validated for format conformance,\nmalicious patterns, sensitive data and inapropriate content\nbefore being passed to users, application or plugins.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR02", - "Description": "In the event of policy violations, the AI-generated content MUST\nbe redacted, encoded or rejected.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C03.TR01", - "Description": "When data is designated for model training or RAG ingestion, then its\nsource MUST be explicitly approved and its provenance documented.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [ - "dataproc_encrypted_with_cmks_disabled", - "bigquery_dataset_cmk_encryption", - "bigquery_dataset_public_access", - "bigquery_table_cmk_encryption", - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_uniform_bucket_level_access", - "cloudstorage_bucket_log_retention_policy_lock", - "kms_key_not_publicly_accessible", - "logging_sink_created", - "iam_audit_logs_enabled", - "iam_cloud_asset_inventory_enabled", - "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" - ] - }, - { - "Id": "CCC.GenAI.C03.TR02", - "Description": "Data from unvetted sources MUST NOT be used in production systems.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C04.TR01", - "Description": "When data is ingested for training, fine-tuning or conversion\nto vector embeddings, it MUST be validated for sensitive\ninformation or malicious content.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [ - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_uniform_bucket_level_access", - "gcr_container_scanning_enabled", - "compute_instance_public_ip", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_firewall_rdp_access_from_the_internet_allowed", - "dataproc_encrypted_with_cmks_disabled", - "bigquery_dataset_public_access", - "bigquery_table_cmk_encryption", - "cloudsql_instance_public_access", - "kms_key_not_publicly_accessible" - ] - }, - { - "Id": "CCC.GenAI.C04.TR02", - "Description": "If sensitive data or malicious content is detected, it must\nbe rejected, redacted or flagged for manual review.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C05.TR01", - "Description": "When a RAG-enabled system generates a response containing information\nretrieved from its knowledge base, then the response MUST include a\nverifiable citation that links back to the specific source document.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C05 Citations and Source Traceability", - "SubSection": "", - "SubSectionObjective": "Require the GenAI system to provide citations or direct links\nback to the source documents used to generate a response, in\nto enhance the transparency, trustworthiness, and verifiability\nof AI-generated content.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH09", - "CCC.GenAI.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-DET-013" - ] - } - ] - } - ], - "Checks": [ - "iam_audit_logs_enabled", - "logging_sink_created", - "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", - "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", - "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", - "iam_cloud_asset_inventory_enabled" - ] - }, - { - "Id": "CCC.GenAI.C06.TR01", - "Description": "When an LLM invokes an external tool (e.g., an API, a plugin),\nthen the tool MUST operate with the least privileges required\nfor performing its intended functionality.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", - "Section": "CCC.GenAI.C06 Least Privilege for Plugins", - "SubSection": "", - "SubSectionObjective": "Restricts the permissions of any external tools the GenAI system\ncan call to limit the potential damage if an agent is coerced\nto perform unintended actions or vulnerabilities in the tools\nare exploited.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH07", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Agent Permissions" - ] - } - ] - } - ], - "Checks": [ - "apikeys_api_restrictions_configured", - "compute_instance_default_service_account_in_use_with_full_api_access", - "compute_instance_default_service_account_in_use", - "gke_cluster_no_default_service_account", - "iam_no_service_roles_at_project_level", - "iam_sa_no_administrative_privileges", - "iam_sa_no_user_managed_keys", - "iam_sa_user_managed_key_rotate_90_days", - "iam_sa_user_managed_key_unused", - "iam_service_account_unused" - ] - }, - { - "Id": "CCC.GenAI.C07.TR01", - "Description": "When an application makes an API call to a foundational model in a\nproduction environment, then it MUST specify an explicit version\nidentifier.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "The Configuration Management control family involves establishing,\nmaintaining and monitoring the configuration of the service and\nrelated applications and infrastructure to ensure consistency,\nsecure defaults and compliance.\n", - "Section": "CCC.GenAI.C07 Model Version Pinning", - "SubSection": "", - "SubSectionObjective": "Mandate that applications are locked (\"pinned\") to a specific,\ntested version of a foundational model to prevent unexpected\nbehaviour changes introduced by provider-side updates.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-010" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C08.TR01", - "Description": "When a new AI model is considered for production deployment, it\nMUST undergo a formal red teaming and quality assurance review.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled", - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_log_retention_policy_lock", - "iam_audit_logs_enabled", - "iam_cloud_asset_inventory_enabled", - "logging_sink_created", - "bigquery_dataset_cmk_encryption", - "bigquery_table_cmk_encryption", - "kms_key_not_publicly_accessible", - "kms_key_rotation_enabled", - "dataproc_encrypted_with_cmks_disabled" - ] - }, - { - "Id": "CCC.GenAI.C08.TR02", - "Description": "If model quality review or red teaming identifies an issue that exceeds\nthe organization's risk tolerance, the model MUST NOT be deployed until\nthe issue is remediated.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "dataproc_encrypted_with_cmks_disabled", - "gcr_container_scanning_enabled", - "artifacts_container_analysis_enabled", - "iam_audit_logs_enabled", - "iam_cloud_asset_inventory_enabled", - "logging_sink_created", - "kms_key_not_publicly_accessible", - "bigquery_dataset_cmk_encryption", - "bigquery_dataset_public_access" - ] - }, - { - "Id": "CCC.KeyMgmt.C01.TR01", - "Description": "When a key version is scheduled for deletion or disabled, an\nalert MUST be generated within five minutes.", + "Id": "CCC.KeyMgmt.CN01.AR01", + "Description": "When a key version is scheduled for deletion or disabled, an alert MUST be generated within five minutes.", "Attributes": [ { "FamilyName": "Logging and Metrics Publication", "FamilyDescription": "Controls that collect, alert, and retain key-management events.", - "Section": "CCC.KeyMgmt.C01 Alert on Key-version Changes", + "Section": "CCC.KeyMgmt.CN01 Alert on Key-version Changes", "SubSection": "", "SubSectionObjective": "Generate near-real-time alerts when a KMS key version is disabled or scheduled for deletion, enabling rapid investigation and recovery.", "Applicability": [ @@ -1753,13 +995,13 @@ "Checks": [] }, { - "Id": "CCC.KeyMgmt.C02.TR01", - "Description": "When IAM roles and key policies are reviewed, Decrypt permission\nMUST be granted exclusively to documented authorised principals.", + "Id": "CCC.KeyMgmt.CN02.AR01", + "Description": "When IAM roles and key policies are reviewed, Decrypt permission MUST be granted exclusively to documented authorised principals.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls that enforce least-privilege use of KMS operations.", - "Section": "CCC.KeyMgmt.C02 Limit Decrypt Permissions", + "Section": "CCC.KeyMgmt.CN02 Limit Decrypt Permissions", "SubSection": "", "SubSectionObjective": "Restrict the Decrypt operation to authorised principals only, applying the principle of least privilege to protect sensitive data.", "Applicability": [ @@ -1796,13 +1038,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C03.TR01", - "Description": "When rotation settings are examined, rotation MUST be enabled with\nan interval not exceeding 365 days.", + "Id": "CCC.KeyMgmt.CN03.AR01", + "Description": "When rotation settings are examined, rotation MUST be enabled with an interval not exceeding 365 days.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C03 Enforce Automatic Rotation", + "Section": "CCC.KeyMgmt.CN03 Enforce Automatic Rotation", "SubSection": "", "SubSectionObjective": "Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.", "Applicability": [ @@ -1838,13 +1080,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C04.TR01", - "Description": "When a key import request is processed, the key MUST use an\napproved algorithm (RSA-2048+, EC-P256+) and originate from a\ncertified HSM.", + "Id": "CCC.KeyMgmt.CN04.AR01", + "Description": "When a key import request is processed, the key MUST use an approved algorithm (RSA-2048+, EC-P256+) and originate from a certified HSM.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C04 Validate Imported Keys", + "Section": "CCC.KeyMgmt.CN04 Validate Imported Keys", "SubSection": "", "SubSectionObjective": "Accept only externally generated keys that meet approved cryptographic strength and provenance requirements.", "Applicability": [ @@ -1881,13 +1123,13 @@ ] }, { - "Id": "CCC.LB.C01.TR01", - "Description": "When a single client sends more than 2000 requests within any\n5-minute sliding window, the load balancer MUST throttle all\nsubsequent requests from that client for at least 60 seconds.", + "Id": "CCC.LB.CN01.AR01", + "Description": "When a single client sends more than 2000 requests within any 5-minute sliding window, the load balancer MUST throttle all subsequent requests from that client for at least 60 seconds.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1895,7 +1137,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement per-IP token-bucket limits with and verify via\nsynthetic traffic tests.\n", + "Recommendation": "Implement per-IP token-bucket limits with and verify via synthetic traffic tests. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1936,13 +1178,13 @@ ] }, { - "Id": "CCC.LB.C01.TR02", - "Description": "When throttling is invoked, the load balancer MUST\nrecord the event in the access log within 5 minutes\nfor alerting and trend analysis.", + "Id": "CCC.LB.CN01.AR02", + "Description": "When throttling is invoked, the load balancer MUST record the event in the access log within 5 minutes for alerting and trend analysis.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1950,7 +1192,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Enable access logging and configure metric filters\non HTTP 429 counts to trigger alerts.\n", + "Recommendation": "Enable access logging and configure metric filters on HTTP 429 counts to trigger alerts. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1986,21 +1228,21 @@ ] }, { - "Id": "CCC.LB.C06.TR01", - "Description": "When more than 10 percent of targets change from healthy to\nunhealthy within five minutes, an alert MUST be issued.", + "Id": "CCC.LB.CN06.AR01", + "Description": "When more than 10 percent of targets change from healthy to unhealthy within five minutes, an alert MUST be issued.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C06 Secure Health-Check Telemetry", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN06 Secure Health-Check Telemetry", "SubSection": "", - "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on\nabnormal status changes.", + "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on abnormal status changes.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Instrument metrics for health check results and target\nremoval events. Configure monitoring alarms to alert\non abnormal spikes in unhealthy targets.\n", + "Recommendation": "Instrument metrics for health check results and target removal events. Configure monitoring alarms to alert on abnormal spikes in unhealthy targets. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2032,21 +1274,21 @@ ] }, { - "Id": "CCC.LB.C04.TR01", - "Description": "When routing weights change, the request MUST originate\nfrom an explicitly defined and trusted identity and MUST\nbe logged.", + "Id": "CCC.LB.CN04.AR01", + "Description": "When routing weights change, the request MUST originate from an explicitly defined and trusted identity and MUST be logged.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C04 Enforce Distribution Policies", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN04 Enforce Distribution Policies", "SubSection": "", - "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified\nonly by trusted identities.", + "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified only by trusted identities.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Define a list of trusted principals allowed to modify\nrouting configurations. Enforce via conditional access\npolicies, and log changes using audit logging.\n", + "Recommendation": "Define a list of trusted principals allowed to modify routing configurations. Enforce via conditional access policies, and log changes using audit logging. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2083,15 +1325,15 @@ ] }, { - "Id": "CCC.LB.C05.TR01", - "Description": "When stickiness is enabled, session cookies MUST expire\nwithin 30 minutes of inactivity.", + "Id": "CCC.LB.CN05.AR01", + "Description": "When stickiness is enabled, session cookies MUST expire within 30 minutes of inactivity.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C05 Validate Session Affinity", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN05 Validate Session Affinity", "SubSection": "", - "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking\nrisks.", + "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking risks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2139,15 +1381,15 @@ ] }, { - "Id": "CCC.LB.C09.TR01", - "Description": "When an API call originates outside the approved CIDR\nset, the request MUST be denied.", + "Id": "CCC.LB.CN09.AR01", + "Description": "When an API call originates outside the approved CIDR set, the request MUST be denied.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C09 Restrict Management API Access", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN09 Restrict Management API Access", "SubSection": "", - "SubSectionObjective": "Limit load-balancer API calls to authorised identities and\ntrusted networks.", + "SubSectionObjective": "Limit load-balancer API calls to authorised identities and trusted networks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2194,15 +1436,15 @@ ] }, { - "Id": "CCC.LB.C02.TR01", - "Description": "When concurrent connections reach 80 percent of capacity, the\nautoscaling group MUST add at least one instance within five\nminutes.", + "Id": "CCC.LB.CN02.AR01", + "Description": "When concurrent connections reach 80 percent of capacity, the autoscaling group MUST add at least one instance within five minutes.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C02 Auto-Scale Load Balancer Capacity", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN02 Auto-Scale Load Balancer Capacity", "SubSection": "", - "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic\nspikes.", + "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic spikes.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2236,15 +1478,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C07.TR01", - "Description": "When responses pass through the load balancer, the\n\"Server\" header MUST be replaced with \"lb\".", + "Id": "CCC.LB.CN07.AR01", + "Description": "When responses pass through the load balancer, the \"Server\" header MUST be replaced with \"lb\".", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C07 Scrub Sensitive Headers", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN07 Scrub Sensitive Headers", "SubSection": "", - "SubSectionObjective": "Remove headers that disclose internal details or software\nversions from HTTP responses.", + "SubSectionObjective": "Remove headers that disclose internal details or software versions from HTTP responses.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2278,15 +1520,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C08.TR01", - "Description": "When a certificate is within 30 days of expiry, automated renewal\nMUST complete and deploy a new certificate within 24 hours.", + "Id": "CCC.LB.CN08.AR01", + "Description": "When a certificate is within 30 days of expiry, automated renewal MUST complete and deploy a new certificate within 24 hours.", "Attributes": [ { "FamilyName": "Encryption", "FamilyDescription": "Controls that ensure trustworthy TLS certificates and ciphers.", - "Section": "CCC.LB.C08 Automate Certificate Renewal", + "Section": "CCC.LB.CN08 Automate Certificate Renewal", "SubSection": "", - "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and\ndeployment before expiry.", + "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and deployment before expiry.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2320,15 +1562,15 @@ "Checks": [] }, { - "Id": "CCC.Logging.C01.TR01", - "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be\nenabled by default and directed to the central sink.", + "Id": "CCC.Logging.CN01.AR01", + "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be enabled by default and directed to the central sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2368,15 +1610,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR02", - "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant\nlogs (e.g., OS, application, service logs) to the central log sink.", + "Id": "CCC.Logging.CN01.AR02", + "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant logs (e.g., OS, application, service logs) to the central log sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2419,15 +1661,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR01", - "Description": "When a new log bucket or stream is created, its retention policy MUST be configured\nin accordance with organisation's data retention policy.", + "Id": "CCC.Logging.CN02.AR01", + "Description": "When a new log bucket or stream is created, its retention policy MUST be configured in accordance with organisation's data retention policy.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2464,15 +1706,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR02", - "Description": "When a query is performed to retrieve log events older than the number of days defined\nin the organisation's data retention policy, it MUST return an empty result.", + "Id": "CCC.Logging.CN02.AR02", + "Description": "When a query is performed to retrieve log events older than the number of days defined in the organisation's data retention policy, it MUST return an empty result.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2509,20 +1751,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to modify or delete data before the object\nlock period expires, then the action MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to modify or delete data before the object lock period expires, then the action MUST be denied.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C03 Enable Object Lock On Log Bucket", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN03 Enable Object Lock On Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection\nusing object lock on log storage buckets. This prevents logs from being modified\nor deleted during the defined retention period, supporting compliance and forensic\nintegrity.", + "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2553,20 +1795,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", + "Id": "CCC.AuditLog.CN04.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C04 Restrict Field And Log Type Access", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN04 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on log data.\n", + "Recommendation": "Review field level access controls on log data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2599,21 +1841,21 @@ "Checks": [] }, { - "Id": "CCC.Logging.C05.TR01", - "Description": "When a log storage bucket is created, the bucket's access control settings MUST\nexplicitly deny public read and write access.", + "Id": "CCC.Logging.CN05.AR01", + "Description": "When a log storage bucket is created, the bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2647,21 +1889,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR02", - "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied\nby bucket policy.", + "Id": "CCC.Logging.CN05.AR02", + "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied by bucket policy.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2693,15 +1935,15 @@ ] }, { - "Id": "CCC.Logging.C06.TR01", - "Description": "When a single principal executes an anomalously high number of log queries,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN06.AR01", + "Description": "When a single principal executes an anomalously high number of log queries, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C06 Detect and Alert on Potential Log Exfiltration", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN06 Detect and Alert on Potential Log Exfiltration", "SubSection": "", - "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt\nto exfiltrate log data.", + "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2748,15 +1990,15 @@ ] }, { - "Id": "CCC.Logging.C07.TR01", - "Description": "When an audit log event is recorded that corresponds to a modification of the logging service\nconfiguration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN07.AR01", + "Description": "When an audit log event is recorded that corresponds to a modification of the logging service configuration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C07 Detect and Alert on Log Service Tampering", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN07 Detect and Alert on Log Service Tampering", "SubSection": "", - "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified,\nor deleted, indicating a defense evasion attempt.", + "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2803,13 +2045,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR01", + "Id": "CCC.ObjStor.CN01.AR01", "Description": "When a request is made to read a protected bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2861,13 +2103,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR02", + "Id": "CCC.ObjStor.CN01.AR02", "Description": "When a request is made to read a protected object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2916,13 +2158,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C01.TR03", + "Id": "CCC.ObjStor.CN01.AR03", "Description": "When a request is made to write to a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2979,13 +2221,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR04", + "Id": "CCC.ObjStor.CN01.AR04", "Description": "When a request is made to write to an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3043,13 +2285,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR01", + "Id": "CCC.ObjStor.CN03.AR01", "Description": "When an object storage bucket deletion is attempted, the bucket MUST be fully recoverable for a set time-frame after deletion is requested.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3101,13 +2343,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR02", + "Id": "CCC.ObjStor.CN03.AR02", "Description": "When an attempt is made to modify the retention policy for an object storage bucket, the service MUST prevent the policy from being modified.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3159,13 +2401,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR01", + "Id": "CCC.ObjStor.CN04.AR01", "Description": "When an object is uploaded to the object storage system, the object MUST automatically receive a default retention policy that prevents premature deletion or modification.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3217,13 +2459,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR02", + "Id": "CCC.ObjStor.CN04.AR02", "Description": "When an attempt is made to delete or modify an object that is subject to an active retention policy, the service MUST prevent the action from being completed.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3275,13 +2517,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR01", + "Id": "CCC.ObjStor.CN05.AR01", "Description": "When an object is uploaded to the object storage bucket, the object MUST be stored with a unique identifier.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3331,13 +2573,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C05.TR02", + "Id": "CCC.ObjStor.CN05.AR02", "Description": "When an object is modified, the service MUST assign a new unique identifier to the modified object to differentiate it from the previous version.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3387,13 +2629,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C05.TR03", + "Id": "CCC.ObjStor.CN05.AR03", "Description": "When an object is modified, the service MUST allow for recovery of previous versions of the object.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3443,13 +2685,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C05.TR04", + "Id": "CCC.ObjStor.CN05.AR04", "Description": "When an object is deleted, the service MUST retain other versions of the object to allow for recovery of previous versions.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3499,13 +2741,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C06.TR01", + "Id": "CCC.ObjStor.CN06.AR01", "Description": "When an object storage bucket is accessed, the service MUST store access logs in a separate data store.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C06 Prevent Deployment in Restricted Regions", + "Section": "CCC.CN06 Prevent Deployment in Restricted Regions", "SubSection": "CCC.ObjStor.C06 Access Logs are Stored in a Separate Data Store", "SubSectionObjective": "Ensure that access logs for object storage buckets are stored in a separate data store to protect against unauthorized access, tampering, or deletion of logs (Logbuckets are exempt from this requirement, but must be tlp-red).", "Applicability": [ @@ -3558,13 +2800,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR01", + "Id": "CCC.ObjStor.CN02.AR01", "Description": "When a permission set is allowed for an object in a bucket, the service MUST allow the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3616,13 +2858,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR02", + "Id": "CCC.ObjStor.CN02.AR02", "Description": "When a permission set is denied for an object in a bucket, the service MUST deny the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3673,982 +2915,9 @@ "cloudstorage_bucket_uniform_bucket_level_access" ] }, - { - "Id": "CCC.MLDE.CN01.AR01", - "Description": "Verify that only authorized users can access MLDE resources,\nand that access modes are properly defined and enforced.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN01 Define Access Mode for ML Development Environments", - "SubSection": "", - "SubSectionObjective": "Ensure that access to Machine Learning Development Environment (MLDE)\nresources is strictly defined and controlled.\nOnly authorized users with appropriate permissions can access these environments,\nmitigating the risk of unauthorized access, data leakage, or service disruption.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.1", - "2013 A.9.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-2", - "AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-01", - "IAM-02" - ] - } - ] - } - ], - "Checks": [ - "iam_account_access_approval_enabled", - "iam_audit_logs_enabled", - "iam_no_service_roles_at_project_level", - "iam_role_kms_enforce_separation_of_duties", - "iam_role_sa_enforce_separation_of_duties", - "iam_sa_no_administrative_privileges", - "iam_sa_no_user_managed_keys", - "iam_sa_user_managed_key_rotate_90_days", - "iam_sa_user_managed_key_unused", - "iam_service_account_unused", - "gke_cluster_no_default_service_account", - "compute_instance_default_service_account_in_use", - "compute_instance_default_service_account_in_use_with_full_api_access" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR01", - "Description": "Verify that root access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_project_os_login_enabled", - "compute_instance_block_project_wide_ssh_keys_disabled", - "compute_firewall_ssh_access_from_the_internet_allowed" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR02", - "Description": "For MLDE instances without sensitive data, ensure that root access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_instance_public_ip", - "compute_instance_block_project_wide_ssh_keys_disabled", - "compute_project_os_login_enabled", - "compute_instance_default_service_account_in_use", - "compute_instance_default_service_account_in_use_with_full_api_access", - "gke_cluster_no_default_service_account", - "iam_sa_no_administrative_privileges", - "iam_no_service_roles_at_project_level", - "iam_audit_logs_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR01", - "Description": "Verify that terminal access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_instance_serial_ports_in_use" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR02", - "Description": "For MLDE instances without sensitive data, ensure that terminal access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_serial_ports_in_use", - "compute_instance_public_ip" - ] - }, - { - "Id": "CCC.MLDE.CN02.AR01", - "Description": "Confirm that file download functionality is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN02.AR02", - "Description": "For MLDE instances without sensitive data, ensure that file downloads are monitored and logged.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "iam_audit_logs_enabled", - "logging_sink_created", - "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", - "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", - "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", - "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR01", - "Description": "Verify that only approved VM and container images can be selected when creating MLDE instances.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR02", - "Description": "Attempt to create an MLDE instance with an unapproved image and confirm that it is denied.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled", - "compute_instance_shielded_vm_enabled", - "compute_instance_confidential_computing_enabled", - "compute_instance_public_ip", - "compute_instance_ip_forwarding_is_enabled", - "compute_instance_default_service_account_in_use", - "compute_instance_serial_ports_in_use", - "compute_instance_block_project_wide_ssh_keys_disabled", - "compute_instance_encryption_with_csek_enabled", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_firewall_rdp_access_from_the_internet_allowed" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR01", - "Description": "Verify that automatic scheduled upgrades are enabled on user-managed\nMLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR02", - "Description": "Ensure that the upgrade schedule is appropriately configured and\ndoes not interfere with critical operations.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN07.AR01", - "Description": "Verify that MLDE instances containing sensitive data cannot be accessed via public IP addresses.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "compute_instance_public_ip", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed" - ] - }, - { - "Id": "CCC.MLDE.CN07.AR02", - "Description": "For MLDE instances without sensitive data requiring public access,\nensure that appropriate security controls are in place and access is approved.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "compute_instance_public_ip", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "cloudsql_instance_public_ip", - "cloudsql_instance_private_ip_assignment", - "cloudsql_instance_public_access" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR01", - "Description": "Verify that MLDE instances containing sensitive data can only be deployed in\napproved virtual networks with appropriate security controls.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "compute_network_default_in_use", - "compute_network_not_legacy", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_public_ip", - "cloudsql_instance_public_ip", - "cloudsql_instance_private_ip_assignment", - "cloudsql_instance_public_access" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR02", - "Description": "Ensure that MLDE instances without sensitive data are deployed in\nnetworks that meet organizational security standards.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_network_not_legacy", - "compute_network_default_in_use", - "compute_instance_public_ip", - "compute_instance_ip_forwarding_is_enabled", - "compute_instance_shielded_vm_enabled", - "compute_instance_serial_ports_in_use", - "cloudsql_instance_private_ip_assignment", - "cloudsql_instance_public_ip", - "cloudsql_instance_public_access", - "cloudstorage_bucket_public_access" - ] - }, - { - "Id": "CCC.Message.CN01.AR01", - "Description": "Attempt to publish a message without using a customer-managed encryption key\nand verify that the message is rejected or not stored.", - "Attributes": [ - { - "FamilyName": "Encryption", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Message.CN01 Use Customer-Managed Encryption Keys (CMEK) for Messages", - "SubSection": "", - "SubSectionObjective": "Ensure that messages are encrypted using customer-managed encryption keys (CMEK)\nto provide enhanced control over encryption processes and keys, meeting compliance and security requirements.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-13" - ] - } - ] - } - ], - "Checks": [ - "dataproc_encrypted_with_cmks_disabled", - "compute_instance_encryption_with_csek_enabled", - "bigquery_dataset_cmk_encryption", - "bigquery_table_cmk_encryption", - "kms_key_not_publicly_accessible", - "kms_key_rotation_enabled" - ] - }, { "Id": "CCC.Monitor.CN01.AR01", - "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then\nRate Limiting MUST be applied and an Audit Alert MUST be generated.", + "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then Rate Limiting MUST be applied and an Audit Alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4705,7 +2974,7 @@ }, { "Id": "CCC.Monitor.CN02.AR01", - "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied\nto reduce the network impact of traffic and an alert must triggered.", + "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied to reduce the network impact of traffic and an alert must triggered.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4764,14 +3033,14 @@ }, { "Id": "CCC.Monitor.CN03.AR01", - "Description": "When external systems have approved access to internal systems not normally available for public access\nthen they MUST be secured to prevent unauthorised access jumping through to the internal systems and\nonly allow access to specific internal services.", + "Description": "When external systems have approved access to internal systems not normally available for public access then they MUST be secured to prevent unauthorised access jumping through to the internal systems and only allow access to specific internal services.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN03 Access External Monitoring", "SubSection": "", - "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to\nensure they don't become an attack path, preventing monitoring systems from forging network requests to\ngain access to internal systems.", + "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to ensure they don't become an attack path, preventing monitoring systems from forging network requests to gain access to internal systems.", "Applicability": [ "tlp-clear", "tlp-green", @@ -4813,7 +3082,7 @@ }, { "Id": "CCC.Monitor.CN04.AR01", - "Description": "When monitoring dashboards display degraded services which may become potential targets then the\ndashboard MUST be protected from unauthorised access.", + "Description": "When monitoring dashboards display degraded services which may become potential targets then the dashboard MUST be protected from unauthorised access.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4858,7 +3127,7 @@ }, { "Id": "CCC.Monitor.CN05.AR01", - "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised\nresponders silence or acknowledge the alert.", + "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised responders silence or acknowledge the alert.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4920,7 +3189,7 @@ "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN06 Metrics pushed for authorised services only", "SubSection": "", - "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised\nsystem pushing fabricated metrics about a different service", + "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised system pushing fabricated metrics about a different service", "Applicability": [ "tlp-clear", "tlp-green", @@ -4964,199 +3233,16 @@ "iam_service_account_unused" ] }, - { - "Id": "CCC.SecMgmt.CN01.AR01", - "Description": "Attempt to use an outdated version of a secret after its rotation period\nhas passed and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN01 Enforce Automatic Secret Rotation", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are automatically rotated on a defined schedule to\nreduce the risk of secret compromise and unauthorized access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01", - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-28" - ] - } - ] - } - ], - "Checks": [ - "apikeys_key_rotated_in_90_days", - "iam_sa_user_managed_key_rotate_90_days", - "kms_key_rotation_enabled" - ] - }, - { - "Id": "CCC.SecMgmt.CN02.AR01", - "Description": "Attempt to retrieve a secret from an unauthorized region and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN02 Enforce Secret Replication Policies", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are replicated only to authorized locations as per\norganizational data residency and compliance requirements.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH03", - "CCC.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-3", - "SC-7" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.SvlsComp.CN01.AR01", - "Description": "Attempt to access the serverless function over the public internet and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN01 Enforce Use of Private Endpoints for Serverless Function", - "SubSection": "", - "SubSectionObjective": "Ensure that the serverless function is accessible only through a private endpoint,\nallowing it to communicate securely within a virtual private network and preventing\nunauthorized external access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_public_ip", - "cloudsql_instance_public_ip", - "cloudsql_instance_public_access", - "cloudsql_instance_private_ip_assignment", - "cloudstorage_bucket_public_access", - "bigquery_dataset_public_access", - "compute_public_address_shodan" - ] - }, - { - "Id": "CCC.SvlsComp.CN02.AR01", - "Description": "Send requests to invoke the function up to the allowed threshold and confirm they\nare successful; then send additional requests exceeding the threshold from the same\nentity and verify that they are denied.", - "Attributes": [ - { - "FamilyName": "Availability", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN02 Implement Function Invocation Rate Limits", - "SubSection": "", - "SubSectionObjective": "Ensure that function invocation is limited to a specified threshold from any single entity,\npreventing resource exhaustion and denial of service attacks.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH12" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-5" - ] - } - ] - } - ], - "Checks": [] - }, { "Id": "CCC.VPC.CN01.AR01", - "Description": "When a subscription is created, the subscription MUST NOT\ncontain default network resources.", + "Description": "When a subscription is created, the subscription MUST NOT contain default network resources.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN01 Restrict Default Network Creation", "SubSection": "", - "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related\nresources during subscription initialization to avoid insecure default\nconfigurations and enforce custom network policies.", + "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5202,74 +3288,16 @@ "compute_network_default_in_use" ] }, - { - "Id": "CCC.VPC.CN02.AR01", - "Description": "When a resource is created in a public subnet, that resource\nMUST NOT be assigned an external IP address by default.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.VPC.CN02 Limit Resource Creation in Public Subnet", - "SubSection": "", - "SubSectionObjective": "Restrict the creation of resources in the public subnet with\ndirect access to the internet to minimize attack surfaces.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-4" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_public_ip", - "cloudsql_instance_public_ip", - "cloudsql_instance_public_access" - ] - }, { "Id": "CCC.VPC.CN03.AR01", - "Description": "When a VPC peering connection is requested, the service MUST\nprevent connections from VPCs that are not explicitly\nallowed.", + "Description": "When a VPC peering connection is requested, the service MUST prevent connections from VPCs that are not explicitly allowed.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN03 Restrict VPC Peering to Authorized Accounts", "SubSection": "", - "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly\nauthorized destinations to limit network exposure and enforce boundary\ncontrols.", + "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5316,14 +3344,14 @@ }, { "Id": "CCC.VPC.CN04.AR01", - "Description": "When any network traffic goes to or from an interface in the VPC,\nthe service MUST capture and log all relevant information.", + "Description": "When any network traffic goes to or from an interface in the VPC, the service MUST capture and log all relevant information.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN04 Enforce VPC Flow Logs on VPCs", "SubSection": "", - "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic\ninformation.", + "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic information.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5371,14 +3399,14 @@ }, { "Id": "CCC.Vector.CN01.AR01", - "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it\nmatches expected schema, dimension, and format profiles.", + "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it matches expected schema, dimension, and format profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN01 Validate Embeddings Before Indexing", "SubSection": "", - "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated\nbefore indexing to prevent poisoning or corruption.", + "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated before indexing to prevent poisoning or corruption.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5410,14 +3438,14 @@ }, { "Id": "CCC.Vector.CN02.AR01", - "Description": "When an index lifecycle event is triggered, the service MUST\nverify that the actor has explicit permissions for the operation type.", + "Description": "When an index lifecycle event is triggered, the service MUST verify that the actor has explicit permissions for the operation type.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN02 Enforce Role-Based Index Lifecycle Management", "SubSection": "", - "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged\nidentities using fine-grained access controls.", + "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged identities using fine-grained access controls.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5455,14 +3483,14 @@ }, { "Id": "CCC.Vector.CN03.AR01", - "Description": "When a metadata filter is applied to a query, the service MUST\nverify the requester is authorized to access that field.", + "Description": "When a metadata filter is applied to a query, the service MUST verify the requester is authorized to access that field.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN03 Enforce Metadata-Level Access Controls", "SubSection": "", - "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to\nprevent unauthorized exposure or inference.", + "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to prevent unauthorized exposure or inference.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5489,28 +3517,18 @@ ] } ], - "Checks": [ - "iam_audit_logs_enabled", - "iam_account_access_approval_enabled", - "iam_no_service_roles_at_project_level", - "iam_role_sa_enforce_separation_of_duties", - "iam_sa_no_administrative_privileges", - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_uniform_bucket_level_access", - "iam_cloud_asset_inventory_enabled", - "compute_instance_default_service_account_in_use" - ] + "Checks": [] }, { "Id": "CCC.Vector.CN04.AR01", - "Description": "When ingestion exceeds pre-defined thresholds, the service MUST\nthrottle or reject excess vector write operations.", + "Description": "When ingestion exceeds pre-defined thresholds, the service MUST throttle or reject excess vector write operations.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN04 Enforce Ingestion Quotas and Throttling", "SubSection": "", - "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by\nrate-limiting vector submissions and enforcing quotas.", + "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by rate-limiting vector submissions and enforcing quotas.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5540,14 +3558,14 @@ }, { "Id": "CCC.Vector.CN05.AR01", - "Description": "When a rollback is attempted, the system MUST log\nthe action and verify rollback authorization.", + "Description": "When a rollback is attempted, the system MUST log the action and verify rollback authorization.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN05 Enforce Index Versioning with Rollback Protection", "SubSection": "", - "SubSectionObjective": "Ensure vector indexes are versioned and that rollback\noperations are authorized and auditable.", + "SubSectionObjective": "Ensure vector indexes are versioned and that rollback operations are authorized and auditable.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5588,14 +3606,14 @@ }, { "Id": "CCC.Vector.CN06.AR01", - "Description": "When an embedding is submitted, the service MUST validate\nthat its format and dimensionality match allowed profiles.", + "Description": "When an embedding is submitted, the service MUST validate that its format and dimensionality match allowed profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN06 Enforce Dimensional and Format Constraints", "SubSection": "", - "SubSectionObjective": "Reject embeddings that do not conform to expected model\nspecifications (dimensions, format, etc).", + "SubSectionObjective": "Reject embeddings that do not conform to expected model specifications (dimensions, format, etc).", "Applicability": [ "tlp-clear", "tlp-green", @@ -5626,14 +3644,14 @@ }, { "Id": "CCC.Vector.CN07.AR01", - "Description": "When a search request is issued, clients MUST be allowed\nto declare their requirement for exact vs approximate results.", + "Description": "When a search request is issued, clients MUST be allowed to declare their requirement for exact vs approximate results.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN07 Support Explicit ANN vs. Exact Search Configuration", "SubSection": "", - "SubSectionObjective": "Provide clients with the option to enforce exact-match\n(non-ANN) search where search fidelity is critical.", + "SubSectionObjective": "Provide clients with the option to enforce exact-match (non-ANN) search where search fidelity is critical.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5654,20 +3672,20 @@ }, { "Id": "CCC.Core.CN01.AR01", - "Description": "When a port is exposed for non-SSH network traffic, all traffic\nMUST include a TLS handshake AND be encrypted using TLS 1.3 or\nhigher.", + "Description": "When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not\nalready set, ensure that your services are configured or updated\naccordingly.\n", + "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not already set, ensure that your services are configured or updated accordingly. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5714,21 +3732,21 @@ }, { "Id": "CCC.Core.CN01.AR02", - "Description": "When a port is exposed for SSH network traffic, all traffic MUST\ninclude a SSH handshake AND be encrypted using SSHv2 or higher.", + "Description": "When a port is exposed for SSH network traffic, all traffic MUST include a SSH handshake AND be encrypted using SSHv2 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Any time port 22 is exposed, ensure that it has a properly\nimplemented SSH server with SSHv2 enabled and configured with\nstrong ciphers.\n", + "Recommendation": "Any time port 22 is exposed, ensure that it has a properly implemented SSH server with SSHv2 enabled and configured with strong ciphers. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5775,20 +3793,20 @@ }, { "Id": "CCC.Core.CN01.AR03", - "Description": "When the service receives unencrypted traffic, \nthen it MUST either block the request or automatically\nredirect it to the secure equivalent.", + "Description": "When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Review firewall, load balancer, and application configurations to\nensure insecure protocols such as HTTP, FTP, and Telnet are not\nexposed. Where possible, implement automatic redirection to secure\nprotocols such as HTTPS, SFTP, SSH, and regularly scan for\nprotocol drift.\n", + "Recommendation": "Review firewall, load balancer, and application configurations to ensure insecure protocols such as HTTP, FTP, and Telnet are not exposed. Where possible, implement automatic redirection to secure protocols such as HTTPS, SFTP, SSH, and regularly scan for protocol drift. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5841,21 +3859,21 @@ }, { "Id": "CCC.Core.CN01.AR07", - "Description": "When a port is exposed, the service MUST ensure that the protocol\nand service officially assigned to that port number by the IANA\nService Name and Transport Protocol Port Number Registry, and no\nother, is run on that port.", + "Description": "When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number\nRegistry for more information about correct protocol-to-port\nassignments. Avoid running non-standard services on well-known\nports.\n", + "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number Registry for more information about correct protocol-to-port assignments. Avoid running non-standard services on well-known ports. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5903,19 +3921,19 @@ }, { "Id": "CCC.Core.CN01.AR08", - "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be\nimplemented to require both client and server certificate\nauthentication for all connections.", + "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Configure mTLS for all endpoints that process or transmit\nsensitive data. Ensure both client and server certificates are\nvalidated and managed securely. Regularly review certificate\nauthorities and automate certificate rotation where possible.\n", + "Recommendation": "Configure mTLS for all endpoints that process or transmit sensitive data. Ensure both client and server certificates are validated and managed securely. Regularly review certificate authorities and automate certificate rotation where possible. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5962,21 +3980,21 @@ }, { "Id": "CCC.Core.CN13.AR01", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST only use valid, unexpired certificates issued by\na trusted certificate authority.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST only use valid, unexpired certificates issued by a trusted certificate authority.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5992,18 +4010,18 @@ }, { "Id": "CCC.Core.CN13.AR02", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 180 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-amber" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6019,18 +4037,18 @@ }, { "Id": "CCC.Core.CN13.AR03", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 90 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6049,21 +4067,21 @@ }, { "Id": "CCC.Core.CN06.AR01", - "Description": "When the service is running, its region and availability zone MUST\nbe included in a list of explicitly trusted or approved locations\nwithin the trust perimeter.", + "Description": "When the service is running, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate the service's deployment\nlocation is included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate the service's deployment location is included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6104,21 +4122,21 @@ }, { "Id": "CCC.Core.CN06.AR02", - "Description": "When a child resource is deployed, its region and availability\nzone MUST be included in a list of explicitly trusted or approved\nlocations within the trust perimeter.", + "Description": "When a child resource is deployed, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate that child resources can only\nbe deployed to locations included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate that child resources can only be deployed to locations included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6159,20 +4177,20 @@ }, { "Id": "CCC.Core.CN08.AR01", - "Description": "When data is created or modified, the data MUST have a complete\nand recoverable duplicate that is stored in a physically separate\ndata center.", + "Description": "When data is created or modified, the data MUST have a complete and recoverable duplicate that is stored in a physically separate data center.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement automated data replication processes to ensure that\ndata is consistently duplicated in another region or availability\nzone. Regularly test data recovery from the replicated location to\nensure integrity and availability.\n", + "Recommendation": "Implement automated data replication processes to ensure that data is consistently duplicated in another region or availability zone. Regularly test data recovery from the replicated location to ensure integrity and availability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6213,14 +4231,14 @@ }, { "Id": "CCC.Core.CN08.AR02", - "Description": "When data is replicated into a second location, the service MUST\nbe able to accurately represent the replication locations,\nreplication status, and data synchronization status.", + "Description": "When data is replicated into a second location, the service MUST be able to accurately represent the replication locations, replication status, and data synchronization status.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6264,14 +4282,14 @@ }, { "Id": "CCC.Core.CN09.AR01", - "Description": "When the service is operational, its logs and any child resource\nlogs MUST NOT be accessible from the resource they record access\nto.", + "Description": "When the service is operational, its logs and any child resource logs MUST NOT be accessible from the resource they record access to.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", @@ -6321,21 +4339,21 @@ }, { "Id": "CCC.Core.CN09.AR02", - "Description": "When the service is operational, disabling the logs for the service\nor its child resources MUST NOT be possible without also disabling\nthe corresponding resource.", + "Description": "When the service is operational, disabling the logs for the service or its child resources MUST NOT be possible without also disabling the corresponding resource.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should disable\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging mechanisms are tightly integrated with\nservice operations, so that logging cannot be disabled without\nstopping the service itself.\n", + "Recommendation": "No normal business operations should disable logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging mechanisms are tightly integrated with service operations, so that logging cannot be disabled without stopping the service itself. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6381,19 +4399,19 @@ }, { "Id": "CCC.Core.CN09.AR03", - "Description": "When the service is operational, any attempt to redirect logs for\nthe service or its child resources MUST NOT be possible without\nhalting operation of the corresponding resource and publishing\ncorresponding events to monitored channels.", + "Description": "When the service is operational, any attempt to redirect logs for the service or its child resources MUST NOT be possible without halting operation of the corresponding resource and publishing corresponding events to monitored channels.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should result in the redirection of\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging configurations are immutable during\nservice operation so that any changes require stopping the service\nand publishing corresponding events to monitored channels.\n", + "Recommendation": "No normal business operations should result in the redirection of logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging configurations are immutable during service operation so that any changes require stopping the service and publishing corresponding events to monitored channels. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6435,14 +4453,14 @@ }, { "Id": "CCC.Core.CN10.AR01", - "Description": "When data is replicated, the service MUST ensure that replication\nonly occurs to destinations that are explicitly included within\nthe defined trust perimeter.", + "Description": "When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN10 Restrict Data Replication to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations\nthat are explicitly included within a defined trust perimeter.", + "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6484,14 +4502,14 @@ }, { "Id": "CCC.Core.CN02.AR01", - "Description": "When data is stored, it MUST be encrypted using the latest\nindustry-standard encryption methods.", + "Description": "When data is stored, it MUST be encrypted using the latest industry-standard encryption methods.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN02 Encrypt Data for Storage", "SubSection": "", - "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong\nencryption algorithms.", + "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong encryption algorithms.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6543,14 +4561,14 @@ }, { "Id": "CCC.Core.CN11.AR01", - "Description": "When encryption keys are used, the service MUST verify that\nall encryption keys use the latest industry-standard cryptographic\nalgorithms.", + "Description": "When encryption keys are used, the service MUST verify that all encryption keys use the latest industry-standard cryptographic algorithms.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6605,14 +4623,14 @@ }, { "Id": "CCC.Core.CN11.AR02", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 180 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber" ], @@ -6666,14 +4684,14 @@ }, { "Id": "CCC.Core.CN11.AR03", - "Description": "When encrypting data, the service MUST verify that\ncustomer-managed encryption keys (CMEKs) are used.", + "Description": "When encrypting data, the service MUST verify that customer-managed encryption keys (CMEKs) are used.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "", "SubSection": "CCC.Core.CN11 Protect Encryption Keys", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6728,14 +4746,14 @@ }, { "Id": "CCC.Core.CN11.AR04", - "Description": "When encryption keys are accessed, the service MUST verify that\naccess to encryption keys is restricted to authorized personnel\nand services, following the principle of least privilege.", + "Description": "When encryption keys are accessed, the service MUST verify that access to encryption keys is restricted to authorized personnel and services, following the principle of least privilege.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green", @@ -6792,14 +4810,14 @@ }, { "Id": "CCC.Core.CN11.AR05", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 365 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 365 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green" @@ -6854,14 +4872,14 @@ }, { "Id": "CCC.Core.CN11.AR06", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 90 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-red" ], @@ -6915,21 +4933,21 @@ }, { "Id": "CCC.Core.CN14.AR01", - "Description": "When backups are created for disaster recovery purposes, the\nstorage mechanism MUST NOT allow modification or deletion\nwithin 30 days of creation.", + "Description": "When backups are created for disaster recovery purposes, the storage mechanism MUST NOT allow modification or deletion within 30 days of creation.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Use immutable storage solutions where possible. Implement backup\nretention policies that enforce a minimum retention period of 30\ndays.\n", + "Recommendation": "Use immutable storage solutions where possible. Implement backup retention policies that enforce a minimum retention period of 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6948,20 +4966,20 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n30 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 30 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 30 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6979,18 +4997,18 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n14 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 14 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-red" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 14 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 14 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7009,14 +5027,14 @@ }, { "Id": "CCC.Core.CN03.AR01", - "Description": "When an entity attempts to modify the service through a user\ninterface, the authentication process MUST require multiple\nidentifying factors for authentication.", + "Description": "When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7071,14 +5089,14 @@ }, { "Id": "CCC.Core.CN03.AR02", - "Description": "When an entity attempts to modify the service through an API\nendpoint, the authentication process MUST require a credential\nsuch as an API key or token AND originate from within the trust\nperimeter.", + "Description": "When an entity attempts to modify the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7142,14 +5160,14 @@ }, { "Id": "CCC.Core.CN03.AR03", - "Description": "When an entity attempts to view information on the service through\na user interface, the authentication process MUST require multiple\nidentifying factors from the user.", + "Description": "When an entity attempts to view information on the service through a user interface, the authentication process MUST require multiple identifying factors from the user.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7202,14 +5220,14 @@ }, { "Id": "CCC.Core.CN03.AR04", - "Description": "When an entity attempts to view information on the service through\nan API endpoint, the authentication process MUST require a\ncredential such as an API key or token AND originate from within\nthe trust perimeter.", + "Description": "When an entity attempts to view information on the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7272,14 +5290,14 @@ }, { "Id": "CCC.Core.CN05.AR01", - "Description": "When an attempt is made to modify data on the service or a child\nresource, the service MUST block requests from unauthorized\nentities.", + "Description": "When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7351,14 +5369,14 @@ }, { "Id": "CCC.Core.CN05.AR02", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST refuse requests\nfrom unauthorized entities.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7433,14 +5451,14 @@ }, { "Id": "CCC.Core.CN05.AR03", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource in a multi-tenant environment, the\nservice MUST refuse requests across tenant boundaries unless the\norigin is explicitly included in a pre-approved allowlist.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource in a multi-tenant environment, the service MUST refuse requests across tenant boundaries unless the origin is explicitly included in a pre-approved allowlist.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7512,14 +5530,14 @@ }, { "Id": "CCC.Core.CN05.AR04", - "Description": "When data is requested from outside the trust perimeter, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When data is requested from outside the trust perimeter, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "", "SubSection": "CCC.Core.CN05 Prevent Access from Untrusted Entities", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7595,14 +5613,14 @@ }, { "Id": "CCC.Core.CN05.AR05", - "Description": "When any request is made from outside the trust perimeter,\nthe service MUST NOT provide any response that may indicate the\nservice exists.", + "Description": "When any request is made from outside the trust perimeter, the service MUST NOT provide any response that may indicate the service exists.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-red" ], @@ -7673,14 +5691,14 @@ }, { "Id": "CCC.Core.CN05.AR06", - "Description": "When any request is made to the service or a child resource, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-green", "tlp-amber", @@ -7757,14 +5775,14 @@ }, { "Id": "CCC.Core.CN04.AR01", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST log the client\nidentity, time, and result of the attempt.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7819,14 +5837,14 @@ }, { "Id": "CCC.Core.CN04.AR02", - "Description": "When any attempt is made to modify data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7879,14 +5897,14 @@ }, { "Id": "CCC.Core.CN04.AR03", - "Description": "When any attempt is made to read data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-red" ], @@ -7938,19 +5956,19 @@ }, { "Id": "CCC.Core.CN07.AR01", - "Description": "When enumeration activities are detected, the service MUST publish\nan event to a monitored channel which includes the client\nidentity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement event publication mechanisms and alerts for patterns\nindicative of enumeration activities, such as repeated access\nattempts, requests, or liveness probes. Configure alerts to notify\nsecurity teams of any activities that merit further investigation.\n", + "Recommendation": "Implement event publication mechanisms and alerts for patterns indicative of enumeration activities, such as repeated access attempts, requests, or liveness probes. Configure alerts to notify security teams of any activities that merit further investigation. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7996,21 +6014,21 @@ }, { "Id": "CCC.Core.CN07.AR02", - "Description": "When enumeration activities are detected, the service MUST log the\nclient identity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement logging mechanisms to capture details of enumeration\nactivities, including client identity, timestamps, and activity\nnature. Retain logs according to organizational policies, and\noccasionally review them for patterns that may indicate\nreconnaissance activities.\n", + "Recommendation": "Implement logging mechanisms to capture details of enumeration activities, including client identity, timestamps, and activity nature. Retain logs according to organizational policies, and occasionally review them for patterns that may indicate reconnaissance activities. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", diff --git a/prowler/compliance/github/cis_1.0_github.json b/prowler/compliance/github/cis_1.0_github.json index 731e75edbd..d488b92a00 100644 --- a/prowler/compliance/github/cis_1.0_github.json +++ b/prowler/compliance/github/cis_1.0_github.json @@ -753,7 +753,9 @@ { "Id": "1.3.8", "Description": "Base permissions define the permission level automatically granted to all organization members. Define strict base access permissions for all of the repositories in the organization, including new ones.", - "Checks": [], + "Checks": [ + "organization_default_repository_permission_strict" + ], "Attributes": [ { "Section": "1 Source Code", diff --git a/prowler/config/config.py b/prowler/config/config.py index 97200fe0b1..b8fbe91074 100644 --- a/prowler/config/config.py +++ b/prowler/config/config.py @@ -12,7 +12,7 @@ from prowler.lib.logger import logger timestamp = datetime.today() timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc) -prowler_version = "5.13.0" +prowler_version = "5.14.0" html_logo_url = "https://github.com/prowler-cloud/prowler/" square_logo_img = "https://prowler.com/wp-content/uploads/logo-html.png" aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png" diff --git a/prowler/providers/aws/aws_regions_by_service.json b/prowler/providers/aws/aws_regions_by_service.json index 1c5ea06b5f..745e36d648 100644 --- a/prowler/providers/aws/aws_regions_by_service.json +++ b/prowler/providers/aws/aws_regions_by_service.json @@ -199,6 +199,7 @@ "aws": [ "ap-south-1", "ap-southeast-2", + "ca-central-1", "eu-west-1", "eu-west-2", "us-east-1", @@ -819,18 +820,6 @@ "aws-us-gov": [] } }, - "apptest": { - "regions": { - "aws": [ - "ap-southeast-2", - "eu-central-1", - "sa-east-1", - "us-east-1" - ], - "aws-cn": [], - "aws-us-gov": [] - } - }, "aps": { "regions": { "aws": [ @@ -1223,6 +1212,7 @@ "b2bi": { "regions": { "aws": [ + "eu-west-1", "us-east-1", "us-east-2", "us-west-2" @@ -1574,6 +1564,7 @@ "ap-southeast-2", "ap-southeast-3", "ap-southeast-4", + "ap-southeast-5", "ca-central-1", "ca-west-1", "eu-central-1", @@ -2952,6 +2943,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -3618,6 +3610,7 @@ "ap-northeast-1", "ap-northeast-2", "ap-northeast-3", + "eu-central-1", "eu-west-1", "eu-west-2", "eu-west-3", @@ -5194,6 +5187,7 @@ "aws": [ "af-south-1", "ap-east-1", + "ap-east-2", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3", @@ -5204,6 +5198,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-7", "ca-central-1", "ca-west-1", "eu-central-1", @@ -7131,6 +7126,7 @@ "ap-southeast-1", "ap-southeast-2", "ap-southeast-3", + "ap-southeast-5", "ca-central-1", "eu-central-1", "eu-north-1", @@ -7718,6 +7714,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -8395,6 +8392,7 @@ "payment-cryptography": { "regions": { "aws": [ + "af-south-1", "ap-northeast-1", "ap-northeast-3", "ap-south-1", @@ -8723,6 +8721,7 @@ "ap-southeast-5", "ca-central-1", "eu-central-1", + "eu-central-2", "eu-north-1", "eu-south-2", "eu-west-1", @@ -9207,11 +9206,13 @@ "ap-east-2", "ap-northeast-1", "ap-northeast-2", + "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3", + "ap-southeast-5", "ap-southeast-7", "ca-central-1", "eu-central-1", @@ -12436,7 +12437,12 @@ "workspaces-instances": { "regions": { "aws": [ - "ap-northeast-2" + "ap-east-1", + "ap-northeast-2", + "ap-southeast-5", + "eu-south-2", + "me-central-1", + "us-east-2" ], "aws-cn": [], "aws-us-gov": [] diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_bucket_requires_mfa_delete/cloudtrail_bucket_requires_mfa_delete.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_bucket_requires_mfa_delete/cloudtrail_bucket_requires_mfa_delete.metadata.json index 1f8ec97e29..536d0070e0 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_bucket_requires_mfa_delete/cloudtrail_bucket_requires_mfa_delete.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_bucket_requires_mfa_delete/cloudtrail_bucket_requires_mfa_delete.metadata.json @@ -1,33 +1,38 @@ { "Provider": "aws", "CheckID": "cloudtrail_bucket_requires_mfa_delete", - "CheckTitle": "Ensure the S3 bucket CloudTrail bucket requires MFA delete", + "CheckTitle": "CloudTrail trail S3 bucket has MFA delete enabled", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure the S3 bucket CloudTrail bucket requires MFA", - "Risk": "If the S3 bucket CloudTrail bucket does not require MFA, it can be deleted by an attacker.", + "Description": "**CloudTrail log buckets** for actively logging trails are evaluated for **MFA Delete** on the associated S3 bucket. The assessment determines whether `MFA Delete` is configured on the in-account log bucket; *if the bucket resides in another account, its configuration should be verified separately*.", + "Risk": "Without **MFA Delete**, stolen or over-privileged credentials can permanently delete log versions or change versioning, compromising log **integrity** and **availability**. This enables attacker cover-ups, hinders **forensics**, and weakens evidence for investigations.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudTrail/cloudtrail-bucket-mfa-delete-enabled.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-bucket-versioning --bucket DOC-EXAMPLE-BUCKET1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \"SERIAL 123456\"", + "CLI": "aws s3api put-bucket-versioning --bucket --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \" \"", "NativeIaC": "", - "Other": "", + "Other": "1. Sign in to the AWS Management Console as the root user with MFA enabled\n2. Open AWS CloudShell (from the top navigation bar)\n3. Run:\n ```bash\n aws s3api put-bucket-versioning --bucket --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \" \"\n ```", "Terraform": "" }, "Recommendation": { - "Text": "Configure MFA Delete for the S3 bucket CloudTrail bucket", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html" + "Text": "Enable `MFA Delete` on the CloudTrail log bucket with versioning enabled. Enforce **least privilege** so only tightly controlled identities can delete or alter logs, and require MFA for such actions. Apply **defense in depth** using a dedicated logging account and log file integrity validation.", + "Url": "https://hub.prowler.com/check/cloudtrail_bucket_requires_mfa_delete" } }, "Categories": [ + "identity-access", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_cloudwatch_logging_enabled/cloudtrail_cloudwatch_logging_enabled.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_cloudwatch_logging_enabled/cloudtrail_cloudwatch_logging_enabled.metadata.json index 9f9339038f..00c76fcfba 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_cloudwatch_logging_enabled/cloudtrail_cloudwatch_logging_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_cloudwatch_logging_enabled/cloudtrail_cloudwatch_logging_enabled.metadata.json @@ -1,35 +1,39 @@ { "Provider": "aws", "CheckID": "cloudtrail_cloudwatch_logging_enabled", - "CheckTitle": "Ensure CloudTrail trails are integrated with CloudWatch Logs", + "CheckTitle": "CloudTrail trail has delivered logs to CloudWatch Logs in the last 24 hours", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure CloudTrail trails are integrated with CloudWatch Logs", - "Risk": "Sending CloudTrail logs to CloudWatch Logs will facilitate real-time and historic activity logging based on user, API, resource, and IP address, and provides opportunity to establish alarms and notifications for anomalous or sensitivity account activity.", + "Description": "**CloudTrail trails** are configured to send events to **CloudWatch Logs**, and show recent delivery within the last `24h`. Trails without integration or without recent CloudWatch delivery are identified, across single-Region and multi-Region trails.", + "Risk": "Missing or stale CloudWatch delivery weakens visibility and delays detection, impacting confidentiality and integrity. Adversaries can:\n- Hide **privilege escalation**\n- Perform unauthorized **resource changes**\n- Exfiltrate data via API misuse", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.prowler.com/checks/aws/logging-policies/logging_4#aws-console", + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html" + ], "Remediation": { "Code": { - "CLI": "aws cloudtrail update-trail --name --cloudwatch-logs-log-group- arn --cloudwatch-logs-role-arn ", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/logging-policies/logging_4#aws-console", - "Terraform": "" + "CLI": "aws cloudtrail update-trail --name --cloud-watch-logs-log-group-arn --cloud-watch-logs-role-arn ", + "NativeIaC": "```yaml\n# CloudFormation: enable CloudTrail delivery to CloudWatch Logs\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n S3BucketName: \"\"\n CloudWatchLogsLogGroupArn: \"\" # CRITICAL: sends CloudTrail events to CloudWatch Logs\n CloudWatchLogsRoleArn: \"\" # CRITICAL: role CloudTrail assumes to deliver events\n```", + "Other": "1. In AWS Console, go to CloudTrail > Trails and select the trail\n2. In the CloudWatch Logs section, click Edit\n3. Set CloudWatch Logs to Enabled\n4. Choose an existing Log group (or create new) and select an IAM role with permissions for CreateLogStream/PutLogEvents\n5. Click Save changes\n6. After a few minutes, verify events appear in the chosen CloudWatch Logs log group", + "Terraform": "```hcl\n# Terraform: enable CloudTrail delivery to CloudWatch Logs\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n cloud_watch_logs_group_arn = \"\" # CRITICAL: sends CloudTrail events to CloudWatch Logs\n cloud_watch_logs_role_arn = \"\" # CRITICAL: role CloudTrail assumes to deliver events\n}\n```" }, "Recommendation": { - "Text": "Validate that the trails in CloudTrail have an arn set in the CloudWatchLogsLogGroupArn property.", - "Url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html" + "Text": "Integrate every trail with **CloudWatch Logs** and maintain continuous, near-real-time delivery. Enforce **least privilege** on the delivery role, prefer **multi-Region** coverage, and implement **metric filters and alerts** for sensitive actions. Centralize retention to support **defense in depth**.", + "Url": "https://hub.prowler.com/check/cloudtrail_cloudwatch_logging_enabled" } }, "Categories": [ - "forensics-ready", - "logging" + "logging", + "forensics-ready" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_insights_exist/cloudtrail_insights_exist.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_insights_exist/cloudtrail_insights_exist.metadata.json index 1bff51d44e..9ca93b1bc7 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_insights_exist/cloudtrail_insights_exist.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_insights_exist/cloudtrail_insights_exist.metadata.json @@ -1,34 +1,39 @@ { "Provider": "aws", "CheckID": "cloudtrail_insights_exist", - "CheckTitle": "Ensure CloudTrail Insight is enabled", + "CheckTitle": "CloudTrail trail has Insights enabled", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure CloudTrail Insight is enabled", - "Risk": "CloudTrail Insights provides a powerful way to search and analyze CloudTrail log data using pre-built queries and machine learning algorithms. This can help you to identify potential security threats and suspicious activity in near real-time, such as unauthorized access attempts, policy changes, or resource modifications.", + "Description": "**CloudTrail trails** that are logging are evaluated for **Insights** via `insight selectors`, which enable anomaly detection on management-event patterns (API call and error rates). The finding pinpoints logging trails where these selectors are missing.", + "Risk": "Without **Insights**, abnormal API call or error rates can go unnoticed, delaying detection of credential abuse, privilege escalation, or runaway automation. Attackers may rapidly alter policies, delete resources, or exfiltrate data before response, impacting confidentiality and availability.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-insights-events-with-cloudtrail.html", + "https://awscli.amazonaws.com/v2/documentation/api/2.18.18/reference/cloudtrail/put-insight-selectors.html", + "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudtrail" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws cloudtrail put-insight-selectors --trail-name --insight-selectors '[{\"InsightType\":\"ApiCallRateInsight\"}]'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n TrailName: \n S3BucketName: \n IsLogging: true\n InsightSelectors:\n - InsightType: ApiCallRateInsight # Critical fix: enables CloudTrail Insights on the trail\n```", + "Other": "1. In the AWS Console, go to CloudTrail > Trails\n2. Select the trail that is logging\n3. Click Edit on the CloudTrail Insights section\n4. Enable Insights and select API call rate (or Error rate)\n5. Save changes", + "Terraform": "```hcl\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n enable_logging = true\n\n insight_selector {\n insight_type = \"ApiCallRateInsight\" # Critical fix: enables CloudTrail Insights on the trail\n }\n}\n```" }, "Recommendation": { - "Text": "Enable CloudTrail Insight", - "Url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-insights-events-with-cloudtrail.html" + "Text": "Enable **CloudTrail Insights** on all logging trails (ideally all-Region or organization trails). Activate both `ApiCallRateInsight` and `ApiErrorRateInsight`. Integrate alerts with monitoring and review anomalies regularly. Apply **defense in depth** and least privilege to reduce potential blast radius.", + "Url": "https://hub.prowler.com/check/cloudtrail_insights_exist" } }, "Categories": [ - "forensics-ready" + "threat-detection" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_kms_encryption_enabled/cloudtrail_kms_encryption_enabled.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_kms_encryption_enabled/cloudtrail_kms_encryption_enabled.metadata.json index d20a08ad78..25e995b18f 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_kms_encryption_enabled/cloudtrail_kms_encryption_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_kms_encryption_enabled/cloudtrail_kms_encryption_enabled.metadata.json @@ -1,34 +1,39 @@ { "Provider": "aws", "CheckID": "cloudtrail_kms_encryption_enabled", - "CheckTitle": "Ensure CloudTrail logs are encrypted at rest using KMS CMKs", + "CheckTitle": "CloudTrail trail logs are encrypted at rest with a KMS key", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure CloudTrail logs are encrypted at rest using KMS CMKs", - "Risk": "By default, the log files delivered by CloudTrail to your bucket are encrypted by Amazon server-side encryption with Amazon S3-managed encryption keys (SSE-S3). To provide a security layer that is directly manageable, you can instead use server-side encryption with AWS KMS–managed keys (SSE-KMS) for your CloudTrail log files.", + "Description": "**AWS CloudTrail trails** are evaluated for use of **SSE-KMS** with a customer-managed KMS key to encrypt delivered log files at rest in S3. Trails without a configured KMS key are identified. *Applies to single-Region and multi-Region trails.*", + "Risk": "Absent a **customer-managed KMS key**, log protection relies only on storage permissions. Bucket misconfigurations or stolen credentials can expose audit data, aiding evasion and lateral movement. Missing key-level controls, rotation, and usage audit weaken **confidentiality** and **forensic integrity**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html", + "https://trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudTrail/cloudtrail-logs-encrypted.html", + "https://www.stream.security/rules/ensure-cloudtrail-logs-are-encrypted-at-rest", + "https://www.clouddefense.ai/compliance-rules/cis-v130/logging/cis-v130-3-7" + ], "Remediation": { "Code": { - "CLI": "aws cloudtrail update-trail --name --kms-id aws kms put-key-policy --key-id --policy ", - "NativeIaC": "https://docs.prowler.com/checks/aws/logging-policies/logging_7#fix---buildtime", - "Other": "", - "Terraform": "" + "CLI": "aws cloudtrail update-trail --name --kms-key-id ", + "NativeIaC": "```yaml\n# CloudFormation: enable KMS encryption for an existing/new CloudTrail\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n S3BucketName: \n KmsKeyId: # Critical: sets the KMS key to encrypt CloudTrail logs at rest\n```", + "Other": "1. In the AWS Console, go to CloudTrail > Trails\n2. Select the trail , click Edit\n3. Under Log file encryption, choose Use a KMS key and select \n4. Click Save changes", + "Terraform": "```hcl\n# Enable KMS encryption for CloudTrail\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n kms_key_id = \"\" # Critical: uses this KMS key to encrypt CloudTrail logs\n}\n```" }, "Recommendation": { - "Text": "This approach has the following advantages: You can create and manage the CMK encryption keys yourself. You can use a single CMK to encrypt and decrypt log files for multiple accounts across all regions. You have control over who can use your key for encrypting and decrypting CloudTrail log files. You can assign permissions for the key to the users. You have enhanced security.", - "Url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html" + "Text": "Enable **SSE-KMS** on every trail using a **customer-managed KMS key**. Apply **least privilege** so only authorized roles can `Decrypt`, and enforce **separation of duties** between key admins and log readers. Rotate keys and monitor key usage to provide **defense in depth** for CloudTrail data.", + "Url": "https://hub.prowler.com/check/cloudtrail_kms_encryption_enabled" } }, "Categories": [ - "forensics-ready", "encryption" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_log_file_validation_enabled/cloudtrail_log_file_validation_enabled.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_log_file_validation_enabled/cloudtrail_log_file_validation_enabled.metadata.json index 95e0fdd478..4ea5fa8f23 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_log_file_validation_enabled/cloudtrail_log_file_validation_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_log_file_validation_enabled/cloudtrail_log_file_validation_enabled.metadata.json @@ -1,33 +1,40 @@ { "Provider": "aws", "CheckID": "cloudtrail_log_file_validation_enabled", - "CheckTitle": "Ensure CloudTrail log file validation is enabled", + "CheckTitle": "CloudTrail trail has log file validation enabled", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure CloudTrail log file validation is enabled", - "Risk": "Enabling log file validation will provide additional integrity checking of CloudTrail logs. ", + "Description": "**AWS CloudTrail trails** are evaluated for **log file integrity validation** being enabled (`LogFileValidationEnabled`).\n\nWhen enabled, CloudTrail generates signed digest files to verify that S3-delivered log files remain unchanged.", + "Risk": "Without validation, adversaries can alter, forge, or delete audit entries without detection, compromising log **integrity** and non-repudiation.\n\nThis impairs investigations, enables alert evasion, and obscures unauthorized changes across regions or accounts.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html", + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-enabling.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudTrail/cloudtrail-log-file-integrity-validation.html", + "https://deepwiki.com/acantril/learn-cantrill-io-labs/7.1-cloudtrail-log-file-integrity" + ], "Remediation": { "Code": { - "CLI": "aws cloudtrail update-trail --name --enable-log-file-validation", - "NativeIaC": "https://docs.prowler.com/checks/aws/logging-policies/logging_2#cloudformation", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/logging-policies/logging_2#terraform" + "CLI": "aws cloudtrail update-trail --name --enable-log-file-validation", + "NativeIaC": "```yaml\n# CloudFormation: Enable log file validation on a CloudTrail trail\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n S3BucketName: \n EnableLogFileValidation: true # Critical: enables integrity validation for delivered log files\n```", + "Other": "1. Open the AWS Console and go to CloudTrail\n2. Click Trails and select \n3. Click Edit\n4. In Additional/Advanced settings, check Enable log file validation\n5. Click Save changes", + "Terraform": "```hcl\n# Enable log file validation on a CloudTrail trail\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n enable_log_file_validation = true # Critical: ensures CloudTrail writes signed digests to detect tampering\n}\n```" }, "Recommendation": { - "Text": "Ensure LogFileValidationEnabled is set to true for each trail.", - "Url": "http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-filevalidation-enabling.html" + "Text": "Enable **log file integrity validation** on all trails (`LogFileValidationEnabled=true`).\n\nEnforce **least privilege** on the logs bucket, retain and protect digest files (e.g., S3 Object Lock/MFA Delete), and monitor validation results to support **defense in depth**.", + "Url": "https://hub.prowler.com/check/cloudtrail_log_file_validation_enabled" } }, "Categories": [ + "logging", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_access_logging_enabled/cloudtrail_logs_s3_bucket_access_logging_enabled.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_access_logging_enabled/cloudtrail_logs_s3_bucket_access_logging_enabled.metadata.json index 1dba458d47..6314d80dbd 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_access_logging_enabled/cloudtrail_logs_s3_bucket_access_logging_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_access_logging_enabled/cloudtrail_logs_s3_bucket_access_logging_enabled.metadata.json @@ -1,33 +1,38 @@ { "Provider": "aws", "CheckID": "cloudtrail_logs_s3_bucket_access_logging_enabled", - "CheckTitle": "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket", + "CheckTitle": "CloudTrail trail destination S3 bucket has access logging enabled", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket", - "Risk": "Server access logs can assist you in security and access audits, help you learn about your customer base, and understand your Amazon S3 bill.", + "Description": "CloudTrail trails deliver logs to an S3 bucket; this evaluates whether that bucket has **S3 server access logging** enabled to record requests against it.\n\n*If the destination bucket is outside the account or audit scope, a manual review is indicated.*", + "Risk": "Without access logging on the CloudTrail logs bucket, access and changes to log files lack an independent audit trail. Attackers could read, delete, or replace logs without attribution, undermining **log confidentiality** and **integrity**, and slowing **incident response**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html", + "https://docs.aws.amazon.com/AmazonS3/latest/dev/security-best-practices.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/logging-policies/logging_6#aws-console", - "Terraform": "" + "CLI": "aws s3api put-bucket-logging --bucket --bucket-logging-status \"{\\\"LoggingEnabled\\\":{\\\"TargetBucket\\\":\\\"\\\"}}\"", + "NativeIaC": "```yaml\n# CloudFormation: enable S3 access logging on the CloudTrail destination bucket\nResources:\n :\n Type: AWS::S3::Bucket\n\n :\n Type: AWS::S3::Bucket\n Properties:\n LoggingConfiguration:\n DestinationBucketName: !Ref # Critical: turns on server access logging to this destination bucket\n # This enables access logging so the check passes\n```", + "Other": "1. In the AWS Console, go to S3 and open the bucket used by your CloudTrail trail\n2. Select the Properties tab\n3. In Server access logging, click Edit\n4. Enable logging and choose a different destination S3 bucket for the logs\n5. Click Save changes", + "Terraform": "```hcl\n# Enable access logging on the CloudTrail S3 bucket\nresource \"aws_s3_bucket\" \"\" {\n bucket = \"\"\n}\n\nresource \"aws_s3_bucket\" \"\" {\n bucket = \"\"\n}\n\nresource \"aws_s3_bucket_logging\" \"\" {\n bucket = aws_s3_bucket..id\n target_bucket = aws_s3_bucket..id # Critical: enables server access logging to the target bucket\n}\n```" }, "Recommendation": { - "Text": "Ensure that S3 buckets have Logging enabled. CloudTrail data events can be used in place of S3 bucket logging. If that is the case, this finding can be considered a false positive.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/dev/security-best-practices.html" + "Text": "Enable **S3 server access logging** on the CloudTrail logs bucket and write logs to a separate, tightly controlled bucket. Apply **least privilege**, enable **versioning**, and consider **Object Lock** to deter tampering. Centralize monitoring to support defense-in-depth and rapid investigation.", + "Url": "https://hub.prowler.com/check/cloudtrail_logs_s3_bucket_access_logging_enabled" } }, "Categories": [ + "logging", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_is_not_publicly_accessible/cloudtrail_logs_s3_bucket_is_not_publicly_accessible.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_is_not_publicly_accessible/cloudtrail_logs_s3_bucket_is_not_publicly_accessible.metadata.json index 049820b5c5..1b0d76462b 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_is_not_publicly_accessible/cloudtrail_logs_s3_bucket_is_not_publicly_accessible.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_is_not_publicly_accessible/cloudtrail_logs_s3_bucket_is_not_publicly_accessible.metadata.json @@ -1,37 +1,45 @@ { "Provider": "aws", "CheckID": "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", - "CheckTitle": "Ensure the S3 bucket CloudTrail logs is not publicly accessible", + "CheckTitle": "CloudTrail trail S3 bucket is not publicly accessible", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "critical", - "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure the S3 bucket CloudTrail logs to is not publicly accessible", - "Risk": "Allowing public access to CloudTrail log content may aid an adversary in identifying weaknesses in the affected accounts use or configuration.", + "ResourceType": "AwsS3Bucket", + "Description": "CloudTrail log destination **S3 buckets** are inspected for ACL grants that expose data to the public `AllUsers` group.\n\nBuckets hosted in other accounts are flagged for out-of-scope review.", + "Risk": "Exposed CloudTrail logs erode **confidentiality** and **integrity**.\n\nAdversaries can harvest API activity to map accounts, roles, and keys, enabling **reconnaissance** and evasion. If write is allowed, logs can be **poisoned** or deleted, thwarting investigations and compromising incident timelines.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudTrail/cloudtrail-bucket-publicly-accessible.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html", + "https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-s3-bucket-public-access-prohibited.html", + "https://docs.panther.com/alerts/alert-runbooks/built-in-policies/aws-cloudtrail-logs-s3-bucket-not-publicly-accessible" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/logging-policies/logging_3#aws-console", - "Terraform": "" + "CLI": "aws s3api put-bucket-acl --bucket --acl private", + "NativeIaC": "```yaml\n# CloudFormation: ensure the CloudTrail S3 bucket ACL is not public\nResources:\n CloudTrailLogsBucket:\n Type: AWS::S3::Bucket\n Properties:\n BucketName: \n AccessControl: Private # CRITICAL: sets bucket ACL to private, removing any AllUsers (public) grants\n```", + "Other": "1. Open the AWS S3 Console\n2. Select the bucket used by CloudTrail\n3. Go to Permissions > Access control list (ACL)\n4. Click Edit under Public access, remove any grants to \"Everyone (public access)\" (uncheck Read/Write)\n5. Save changes", + "Terraform": "```hcl\n# Ensure the CloudTrail S3 bucket ACL is private\nresource \"aws_s3_bucket_acl\" \"fix_cloudtrail_logs_bucket\" {\n bucket = \"\"\n acl = \"private\" # CRITICAL: removes any public (AllUsers) ACL grants\n}\n```" }, "Recommendation": { - "Text": "Analyze Bucket policy to validate appropriate permissions. Ensure the AllUsers principal is not granted privileges. Ensure the AuthenticatedUsers principal is not granted privileges.", - "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html" + "Text": "Apply **least privilege** to the log bucket:\n- Enable S3 `Block Public Access` (account and bucket)\n- Remove `AllUsers`/`AuthenticatedUsers` ACLs; avoid wildcard principals\n- Permit only CloudTrail and constrain with `aws:SourceArn`\n\nUse a dedicated private bucket and monitor for permission changes.", + "Url": "https://hub.prowler.com/check/cloudtrail_logs_s3_bucket_is_not_publicly_accessible" } }, "Categories": [ - "forensics-ready", "internet-exposed" ], - "DependsOn": [], + "DependsOn": [ + "s3_bucket_public_access" + ], "RelatedTo": [], "Notes": "" } diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.metadata.json index 4ec89226eb..3209e88e73 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled/cloudtrail_multi_region_enabled.metadata.json @@ -1,33 +1,37 @@ { "Provider": "aws", "CheckID": "cloudtrail_multi_region_enabled", - "CheckTitle": "Ensure CloudTrail is enabled in all regions", + "CheckTitle": "Region has at least one CloudTrail trail logging", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure CloudTrail is enabled in all regions", - "Risk": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.", + "Description": "**AWS CloudTrail** has at least one trail with `logging` enabled in every region. A **multi-region trail** or a regional trail counts for coverage in that region.", + "Risk": "Missing coverage in any region creates **visibility gaps**.\n\nAttackers can use lesser-monitored regions to run API actions, hide **unauthorized changes**, and exfiltrate data without audit trails, weakening **detective controls**, hindering **forensics**, and delaying response (confidentiality and integrity).", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrailconcepts.html#cloudtrail-concepts-management-events" + ], "Remediation": { "Code": { - "CLI": "aws cloudtrail create-trail --name --bucket-name --is-multi-region-trail aws cloudtrail update-trail --name --is-multi-region-trail ", - "NativeIaC": "https://docs.prowler.com/checks/aws/logging-policies/logging_1#cloudformation", - "Other": "https://docs.prowler.com/checks/aws/logging-policies/logging_1#aws-console", - "Terraform": "https://docs.prowler.com/checks/aws/logging-policies/logging_1#terraform" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: Create a multi-region CloudTrail and start logging\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n TrailName: \n S3BucketName: \n IsMultiRegionTrail: true # Critical: applies the trail to all regions\n IsLogging: true # Critical: ensures the trail is logging\n```", + "Other": "1. In the AWS Console, go to CloudTrail > Trails\n2. If no trail exists: Click Create trail, enter a name, choose an S3 bucket, set Apply trail to all regions = Yes, then Create (logging starts)\n3. If a trail exists: Select it, click Edit, set Apply trail to all regions = Yes, Save\n4. If Status shows Not logging, click Start logging", + "Terraform": "```hcl\n# Terraform: Multi-region CloudTrail with logging enabled\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n\n is_multi_region_trail = true # Critical: applies the trail to all regions\n enable_logging = true # Critical: ensures the trail is logging\n}\n```" }, "Recommendation": { - "Text": "Ensure Logging is set to ON on all regions (even if they are not being used at the moment.", - "Url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrailconcepts.html#cloudtrail-concepts-management-events" + "Text": "Use a **multi-region CloudTrail trail** or per-region trails so `logging` is active in every region, including unused ones.\n\nCentralize logs, enforce **least privilege** to log stores, and add **defense-in-depth** with encryption, integrity validation, and retention. Continuously monitor trail health to catch gaps.", + "Url": "https://hub.prowler.com/check/cloudtrail_multi_region_enabled" } }, "Categories": [ + "logging", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled_logging_management_events/cloudtrail_multi_region_enabled_logging_management_events.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled_logging_management_events/cloudtrail_multi_region_enabled_logging_management_events.metadata.json index b4b0978ffe..babf6e85b4 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled_logging_management_events/cloudtrail_multi_region_enabled_logging_management_events.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_multi_region_enabled_logging_management_events/cloudtrail_multi_region_enabled_logging_management_events.metadata.json @@ -1,31 +1,38 @@ { "Provider": "aws", "CheckID": "cloudtrail_multi_region_enabled_logging_management_events", - "CheckTitle": "Ensure CloudTrail logging management events in All Regions", + "CheckTitle": "CloudTrail trail logs management events for read and write operations", "CheckType": [ - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure CloudTrail logging management events in All Regions", - "Risk": "AWS CloudTrail enables governance, compliance, operational auditing, and risk auditing of your AWS account. To meet FTR requirements, you must have management events enabled for all AWS accounts and in all regions and aggregate these logs into an Amazon Simple Storage Service (Amazon S3) bucket owned by a separate AWS account.", - "RelatedUrl": "https://docs.prowler.com/checks/aws/logging-policies/logging_14", + "Description": "**CloudTrail trails** record **management events** (`read` and `write`) in every AWS region and are actively logging, using a multi-region trail or per-region coverage.", + "Risk": "Without region-wide management event logging, changes to identities, networking, and audit settings can go untracked.\n\nAdversaries can operate in overlooked regions to create resources, modify permissions, or disable logging, undermining **integrity**, **confidentiality**, and incident response.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.prowler.com/checks/aws/logging-policies/logging_14#terraform", + "https://docs.prowler.com/checks/aws/logging-policies/logging_14" + ], "Remediation": { "Code": { - "CLI": "aws cloudtrail update-trail --name --is-multi-region-trail", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/logging-policies/logging_14", - "Terraform": "https://docs.prowler.com/checks/aws/logging-policies/logging_14#terraform" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: enable multi-region and log management events (read & write)\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n S3BucketName: \n IsMultiRegionTrail: true # CRITICAL: apply the trail to all regions\n EventSelectors:\n - IncludeManagementEvents: true # CRITICAL: log management events\n ReadWriteType: All # CRITICAL: log both read and write\n```", + "Other": "1. In the AWS Console, go to CloudTrail > Trails and select your trail\n2. Click Edit\n3. Set Apply trail to all regions to Yes\n4. Under Management events, set Read/write events to All\n5. Click Save changes\n6. If Logging is Off, click Start logging", + "Terraform": "```hcl\n# Terraform: enable multi-region and log management events (read & write)\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n\n is_multi_region_trail = true # CRITICAL: apply the trail to all regions\n\n event_selector {\n include_management_events = true # CRITICAL: log management events\n read_write_type = \"All\" # CRITICAL: log both read & write\n }\n}\n```" }, "Recommendation": { - "Text": "Enable CloudTrail logging management events in All Regions", - "Url": "https://docs.prowler.com/checks/aws/logging-policies/logging_14" + "Text": "Enable a **multi-region CloudTrail** that logs **management events** for `read` and `write` in all regions.\n\nCentralize logs in a separate, locked-down account; apply **least privilege**, encryption, retention, and integrity validation; and protect trails and storage with tamper-evident, deny-delete controls for **defense-in-depth**.", + "Url": "https://hub.prowler.com/check/cloudtrail_multi_region_enabled_logging_management_events" } }, "Categories": [ + "logging", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_read_enabled/cloudtrail_s3_dataevents_read_enabled.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_read_enabled/cloudtrail_s3_dataevents_read_enabled.metadata.json index 3e3f074c5f..31288482e7 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_read_enabled/cloudtrail_s3_dataevents_read_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_read_enabled/cloudtrail_s3_dataevents_read_enabled.metadata.json @@ -1,31 +1,41 @@ { "Provider": "aws", "CheckID": "cloudtrail_s3_dataevents_read_enabled", - "CheckTitle": "Check if S3 buckets have Object-level logging for read events is enabled in CloudTrail.", + "CheckTitle": "CloudTrail trail records S3 object-level read events for all S3 buckets", "CheckType": [ - "Logging and Monitoring" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure that all your AWS CloudTrail trails are configured to log Data events in order to record S3 object-level API operations, such as GetObject, DeleteObject and PutObject, for individual S3 buckets or for all current and future S3 buckets provisioned in your AWS account.", - "Risk": "If logs are not enabled, monitoring of service use and threat analysis is not possible.", + "Description": "**CloudTrail trails** log **S3 object-level read data events** for all buckets, capturing object access (for example `GetObject`) via selectors targeting `AWS::S3::Object`", + "Risk": "Without **object-level read logging**, S3 access is opaque. Attackers or insiders can exfiltrate data via `GetObject` without audit trails, eroding **confidentiality** and hindering **forensics**, anomaly detection, and incident response.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://awswala.medium.com/enable-cloudtrail-data-events-logging-for-objects-in-an-s3-bucket-33cade51ae2b", + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-23", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html", + "https://www.plerion.com/cloud-knowledge-base/ensure-object-level-logging-for-read-events-enabled-for-s3-bucket" + ], "Remediation": { "Code": { - "CLI": "aws cloudtrail put-event-selectors --trail-name --event-selectors '[{ 'ReadWriteType': 'ReadOnly', 'IncludeManagementEvents':true, 'DataResources': [{ 'Type': 'AWS::S3::Object', 'Values': ['arn:aws:s3'] }] }]'", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-23", - "Terraform": "" + "CLI": "aws cloudtrail put-event-selectors --trail-name --event-selectors '[{\"ReadWriteType\":\"ReadOnly\",\"DataResources\":[{\"Type\":\"AWS::S3::Object\",\"Values\":[\"arn:aws:s3\"]}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: enable S3 object-level READ data events for all buckets on a trail\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n S3BucketName: \n EventSelectors:\n - ReadWriteType: ReadOnly # CRITICAL: log read-only data events\n DataResources:\n - Type: AWS::S3::Object # CRITICAL: target S3 object-level events\n Values:\n - arn:aws:s3 # CRITICAL: applies to all S3 buckets/objects\n```", + "Other": "1. In the AWS Console, open CloudTrail and select Trails\n2. Open your trail and go to the Data events section\n3. Add data event for S3 and choose All current and future S3 buckets\n4. Select only Read events (or All if Read-only is unavailable)\n5. Save changes", + "Terraform": "```hcl\n# Terraform: enable S3 object-level READ data events for all buckets on a trail\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n\n event_selector {\n read_write_type = \"ReadOnly\" # CRITICAL: log read-only data events\n data_resource {\n type = \"AWS::S3::Object\" # CRITICAL: target S3 object-level events\n values = [\"arn:aws:s3\"] # CRITICAL: apply to all S3 buckets/objects\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Enable logs. Create an S3 lifecycle policy. Define use cases, metrics and automated responses where applicable.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html" + "Text": "Enable CloudTrail **data events** for S3 objects with `ReadOnly` (or `All`) across all current and future buckets. Use a multi-Region trail, centralize logs in an encrypted bucket with lifecycle retention, and integrate monitoring/alerts to support **defense in depth** and accountable access.", + "Url": "https://hub.prowler.com/check/cloudtrail_s3_dataevents_read_enabled" } }, - "Categories": [], + "Categories": [ + "logging", + "forensics-ready" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_write_enabled/cloudtrail_s3_dataevents_write_enabled.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_write_enabled/cloudtrail_s3_dataevents_write_enabled.metadata.json index 42c2801cc4..09772572a7 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_write_enabled/cloudtrail_s3_dataevents_write_enabled.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_s3_dataevents_write_enabled/cloudtrail_s3_dataevents_write_enabled.metadata.json @@ -1,31 +1,41 @@ { "Provider": "aws", "CheckID": "cloudtrail_s3_dataevents_write_enabled", - "CheckTitle": "Check if S3 buckets have Object-level logging for write events is enabled in CloudTrail.", + "CheckTitle": "CloudTrail trail records all S3 object-level API operations for all buckets", "CheckType": [ - "Logging and Monitoring" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsCloudTrailTrail", - "Description": "Ensure that all your AWS CloudTrail trails are configured to log Data events in order to record S3 object-level API operations, such as GetObject, DeleteObject and PutObject, for individual S3 buckets or for all current and future S3 buckets provisioned in your AWS account.", - "Risk": "If logs are not enabled, monitoring of service use and threat analysis is not possible.", + "Description": "**CloudTrail trails** include **S3 object-level data events** for **write (or all) operations** across **all current and future buckets**, via classic or advanced selectors. This records actions like `PutObject`, `DeleteObject`, and multipart uploads at the object level.", + "Risk": "Without object-level write logging, unauthorized or accidental changes and deletions can go unobserved, undermining data **integrity** and **availability**. Forensics lose visibility into who modified or removed objects, hindering detection of ransomware, rogue automation, or insider tampering.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html", + "https://www.go2share.net/article/s3-bucket-logging", + "https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-22" + ], "Remediation": { "Code": { - "CLI": "aws cloudtrail put-event-selectors --trail-name --event-selectors '[{ 'ReadWriteType': 'WriteOnly', 'IncludeManagementEvents':true, 'DataResources': [{ 'Type': 'AWS::S3::Object', 'Values': ['arn:aws:s3'] }] }]'", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-22", - "Terraform": "" + "CLI": "aws cloudtrail put-event-selectors --trail-name --event-selectors '[{\"ReadWriteType\":\"WriteOnly\",\"DataResources\":[{\"Type\":\"AWS::S3::Object\",\"Values\":[\"arn:aws:s3\"]}]}]'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::CloudTrail::Trail\n Properties:\n TrailName: \n S3BucketName: \n EventSelectors:\n - ReadWriteType: WriteOnly\n DataResources:\n - Type: AWS::S3::Object\n Values:\n - arn:aws:s3 # Critical: enables S3 object-level write data events for all buckets, fixing the check\n```", + "Other": "1. In the AWS Console, open CloudTrail and go to Trails\n2. Select and click Edit under Data events\n3. For Data event source, choose S3\n4. Select All current and future S3 buckets\n5. Check Write events (or All events)\n6. Click Save changes", + "Terraform": "```hcl\nresource \"aws_cloudtrail\" \"\" {\n name = \"\"\n s3_bucket_name = \"\"\n\n event_selector {\n read_write_type = \"WriteOnly\"\n data_resource {\n type = \"AWS::S3::Object\"\n values = [\"arn:aws:s3\"] # Critical: logs S3 object-level write events for all buckets to pass the check\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Enable logs. Create an S3 lifecycle policy. Define use cases, metrics and automated responses where applicable.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html" + "Text": "Enable **CloudTrail S3 data events** for object-level **write** (and *optionally* read) across all buckets on a multi-Region trail. Apply **least privilege** to log storage, set **lifecycle** retention, and integrate alerts. Use **advanced selectors** to target sensitive buckets/operations for cost control and **defense in depth**.", + "Url": "https://hub.prowler.com/check/cloudtrail_s3_dataevents_write_enabled" } }, "Categories": [ + "logging", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.metadata.json index d0b943254a..d41cda9430 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.metadata.json @@ -1,26 +1,37 @@ { "Provider": "aws", "CheckID": "cloudtrail_threat_detection_enumeration", - "CheckTitle": "Ensure there are no potential enumeration threats in CloudTrail", - "CheckType": [], + "CheckTitle": "CloudTrail logs show no potential enumeration activity", + "CheckType": [ + "TTPs/Discovery", + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "Unusual Behaviors/User" + ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsCloudTrailTrail", - "Description": "This check ensures that there are no potential enumeration threats in CloudTrail.", - "Risk": "Potential enumeration threats in CloudTrail can lead to unauthorized access to resources.", + "Description": "**CloudTrail activity** is analyzed for AWS identities executing a broad mix of discovery APIs like `List*`, `Describe*`, and `Get*` within a recent time window.\n\nAn identity exceeding a configurable ratio of these actions indicates potential enumeration behavior by that principal.", + "Risk": "Concentrated discovery activity signals **reconnaissance** with valid credentials. Adversaries can map assets and policies to enable **privilege escalation**, target data stores for **exfiltration** (confidentiality), and identify services to disrupt (availability), supporting stealthy lateral movement.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://medium.com/falconforce/falconfriday-detecting-enumeration-in-aws-0xff25-orangecon-25-edition-4aee83651088", + "https://www.elastic.co/guide/en/security/8.19/aws-discovery-api-calls-via-cli-from-a-single-resource.html", + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-logging-data-events", + "https://aws.plainenglish.io/aws-cloudtrail-event-cheatsheet-a-detection-engineers-guide-to-critical-api-calls-part-1-04fb1588556f", + "https://support.icompaas.com/support/solutions/articles/62000233455-ensure-there-are-no-potential-enumeration-threats-in-cloudtrail-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws iam update-access-key --user-name --access-key-id --status Inactive", + "NativeIaC": "```yaml\n# CloudFormation: deny common enumeration APIs for a specific IAM user\nResources:\n DenyEnumerationPolicy:\n Type: AWS::IAM::Policy\n Properties:\n PolicyName: deny-enumeration\n PolicyDocument:\n Version: \"2012-10-17\"\n Statement:\n - Effect: Deny # CRITICAL: blocks typical enumeration calls\n Action:\n - ec2:Describe* # CRITICAL: deny EC2 describe APIs\n - iam:List* # CRITICAL: deny IAM list APIs\n - s3:List* # CRITICAL: deny S3 list APIs\n - s3:Get* # CRITICAL: deny S3 get APIs (e.g., GetBucketAcl)\n Resource: \"*\"\n Users:\n - \"\" # CRITICAL: target the enumerating user\n```", + "Other": "1. In AWS Console, go to IAM > Users and open the user shown in the alert (ARN in the finding)\n2. Select the Security credentials tab\n3. For each active Access key, click Deactivate to set status to Inactive\n4. If the activity came from an EC2 instance role: go to EC2 > Instances > select the instance > Security > IAM role > Detach IAM role\n5. Re-run the check to confirm no new enumeration events occur", + "Terraform": "```hcl\n# Deny common enumeration APIs for a specific IAM user\nresource \"aws_iam_user_policy\" \"\" {\n name = \"deny-enumeration\"\n user = \"\"\n\n policy = jsonencode({\n Version = \"2012-10-17\",\n Statement = [{\n Effect = \"Deny\", # CRITICAL: blocks typical enumeration calls\n Action = [\n \"ec2:Describe*\", # CRITICAL\n \"iam:List*\", # CRITICAL\n \"s3:List*\", # CRITICAL\n \"s3:Get*\" # CRITICAL\n ],\n Resource = \"*\"\n }]\n })\n}\n```" }, "Recommendation": { - "Text": "To remediate this issue, ensure that there are no potential enumeration threats in CloudTrail.", - "Url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-logging-data-events" + "Text": "Apply **least privilege** to limit `List*`/`Describe*`/`Get*` to necessary resources and roles; use **separation of duties**.\n- Enforce MFA and short-lived sessions\n- Use **SCPs** to curb unnecessary discovery\n- Baseline expected reads and alert on spikes as **defense in depth**", + "Url": "https://hub.prowler.com/check/cloudtrail_threat_detection_enumeration" } }, "Categories": [ diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_llm_jacking/cloudtrail_threat_detection_llm_jacking.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_llm_jacking/cloudtrail_threat_detection_llm_jacking.metadata.json index 9b24373bcc..d961bc0764 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_llm_jacking/cloudtrail_threat_detection_llm_jacking.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_llm_jacking/cloudtrail_threat_detection_llm_jacking.metadata.json @@ -1,30 +1,43 @@ { "Provider": "aws", "CheckID": "cloudtrail_threat_detection_llm_jacking", - "CheckTitle": "Ensure there are no potential LLM Jacking threats in CloudTrail.", - "CheckType": [], + "CheckTitle": "No potential LLM jacking activity detected in CloudTrail", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "TTPs/Discovery", + "TTPs/Execution", + "TTPs/Defense Evasion", + "Effects/Resource Consumption", + "Unusual Behaviors/User" + ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsCloudTrailTrail", - "Description": "This check ensures that there are no potential LLM Jacking threats in CloudTrail. LLM Jacking attacks involve unauthorized access to cloud-hosted large language model (LLM) services, such as AWS Bedrock, by exploiting exposed credentials or vulnerabilities. These attacks can lead to resource hijacking, unauthorized model invocations, and high operational costs for the victim organization.", - "Risk": "Potential LLM Jacking threats in CloudTrail can lead to unauthorized access to sensitive AI models, stolen credentials, resource hijacking, or running costly workloads. Attackers may use reverse proxies or malicious credentials to sell access to models, exfiltrate sensitive data, or disrupt business operations.", - "RelatedUrl": "https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/", + "Description": "**CloudTrail Bedrock activity** is analyzed per identity for a high diversity of LLM-related API calls (e.g., `InvokeModel`, `InvokeModelWithResponseStream`, `GetFoundationModelAvailability`). *If an identity's share of these actions exceeds a configured threshold over a recent window*, it is surfaced as potential **LLM-jacking** behavior.", + "Risk": "Such patterns suggest **stolen credential** abuse to drive LLM usage.\n- Availability: cost exhaustion and service disruption\n- Confidentiality: leakage of prompts/outputs and model settings\n- Integrity: misuse of permissions for broader access\nAttackers may use reverse proxies to resell access and obfuscate sources.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://furkangungor.medium.com/automating-anomaly-detection-in-aws-cloudtrail-logs-4efb2ad9b958", + "https://help.sumologic.com/docs/integrations/amazon-aws/amazon-bedrock/", + "https://dzone.com/articles/ai-powered-aws-cloudtrail-analysis-strands-agent-bedrock" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation SCP that blocks all Amazon Bedrock actions to stop LLM jacking\nResources:\n :\n Type: AWS::Organizations::Policy\n Properties:\n Name: \n Type: SERVICE_CONTROL_POLICY\n TargetIds:\n - \"\" # CRITICAL: Attach SCP to the root/OU/account to enforce the deny\n Content:\n Version: \"2012-10-17\"\n Statement:\n - Sid: DenyBedrock\n Effect: Deny\n Action: \"bedrock:*\" # CRITICAL: Denies all Bedrock APIs (Invoke/Converse/list/entitlements/etc.)\n Resource: \"*\" # CRITICAL: Apply deny to all resources\n```", + "Other": "1. In the AWS Console, go to Organizations > Policies > Service control policies\n2. Click Create policy\n3. Set Name to \n4. In Policy, paste a deny for Bedrock:\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [{\"Sid\":\"DenyBedrock\",\"Effect\":\"Deny\",\"Action\":\"bedrock:*\",\"Resource\":\"*\"}]\n }\n5. Save the policy and click Attach\n6. Select the target (Root, OU, or the affected account ID ) and attach the policy\n7. Wait for propagation; no further Bedrock calls will occur, and the finding will clear after the detection window elapses", + "Terraform": "```hcl\n# SCP denying all Amazon Bedrock actions; attach it to the root/OU/account to halt LLM jacking\nresource \"aws_organizations_policy\" \"main\" {\n name = \"\"\n type = \"SERVICE_CONTROL_POLICY\"\n\n content = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Sid = \"DenyBedrock\"\n Effect = \"Deny\"\n Action = \"bedrock:*\" // CRITICAL: blocks all Bedrock APIs (prevents further suspicious activity)\n Resource = \"*\" // CRITICAL: deny across all resources\n }]\n })\n}\n\nresource \"aws_organizations_policy_attachment\" \"attach\" {\n policy_id = aws_organizations_policy.main.id\n target_id = \"\" // CRITICAL: attach to the affected account/OU/root to enforce the deny\n}\n```" }, "Recommendation": { - "Text": "To remediate this issue, enable detailed CloudTrail logging for Bedrock API calls, monitor suspicious activities, and secure sensitive credentials. Enable logging of model invocation inputs and outputs, and restrict access using IAM policies. Review CloudTrail logs regularly for suspicious `InvokeModel` actions or unauthorized access to models.", - "Url": "https://permiso.io/blog/exploiting-hosted-models" + "Text": "Apply **least privilege** to Bedrock; restrict `Invoke*` only to required roles and deny broadly via **SCPs** where unused. Enforce **MFA** and short-lived creds; rotate/remove exposed keys. Enable **model invocation logging** and budgets/quotas. Continuously monitor for Bedrock enumeration plus invoke bursts. Use **defense in depth** across identities and networks.", + "Url": "https://hub.prowler.com/check/cloudtrail_threat_detection_llm_jacking" } }, "Categories": [ - "threat-detection" + "threat-detection", + "gen-ai" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.metadata.json b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.metadata.json index f5237a1948..c725d4f1bd 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.metadata.json +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.metadata.json @@ -1,26 +1,34 @@ { "Provider": "aws", "CheckID": "cloudtrail_threat_detection_privilege_escalation", - "CheckTitle": "Ensure there are no potential privilege escalation threats in CloudTrail", - "CheckType": [], + "CheckTitle": "No potential privilege escalation activity detected in CloudTrail", + "CheckType": [ + "TTPs/Privilege Escalation", + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis" + ], "ServiceName": "cloudtrail", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsCloudTrailTrail", - "Description": "This check ensures that there are no potential privilege escalation threats in CloudTrail.", - "Risk": "Potential privilege escalation threats in CloudTrail can lead to unauthorized access to resources.", + "Description": "**CloudTrail** activity is analyzed for **identities** executing high-risk actions linked to **privilege escalation** (e.g., `Attach*Policy`, `PassRole`, `AssumeRole`, `CreateAccessKey`). Identities exceeding a configurable share of such events within a *recent time window* are highlighted for investigation.", + "Risk": "Escalation patterns can grant elevated entitlements, enabling:\n- Confidentiality loss via unauthorized data/secret access\n- Integrity compromise by changing IAM policies/roles\n- Availability impact by tampering with logging or resources\nThis also facilitates lateral movement and persistence.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-logging-data-events", + "https://signmycode.com/blog/what-is-privilege-escalation-in-aws-recommendations-to-prevent-it" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Organization SCP to block common IAM privilege-escalation actions\nResources:\n :\n Type: AWS::Organizations::Policy\n Properties:\n Name: deny-iam-privesc\n Type: SERVICE_CONTROL_POLICY\n # Critical: This SCP denies risky IAM actions often used for privilege escalation\n # Explanation: Denying these actions organization-wide prevents future privesc activity detected by CloudTrail\n Content: |\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Deny\",\n \"Action\": [\n \"iam:AttachUserPolicy\",\n \"iam:AttachRolePolicy\",\n \"iam:PutUserPolicy\",\n \"iam:PutRolePolicy\",\n \"iam:PutGroupPolicy\",\n \"iam:AddUserToGroup\",\n \"iam:CreateAccessKey\",\n \"iam:CreateLoginProfile\",\n \"iam:UpdateLoginProfile\",\n \"iam:UpdateAssumeRolePolicy\",\n \"iam:CreatePolicyVersion\",\n \"iam:SetDefaultPolicyVersion\",\n \"iam:PassRole\"\n ],\n \"Resource\": \"*\"\n }\n ]\n }\n Attachment:\n Type: AWS::Organizations::PolicyAttachment\n Properties:\n # Critical: Attach the SCP so it is enforced\n PolicyId: !Ref \n TargetId: # OU, Root, or Account ID\n```", + "Other": "1. In AWS Console, open IAM and identify the AWS identity shown in the Prowler finding (user or role ARN)\n2. If it is an IAM user:\n - Go to Security credentials > Access keys, set active keys to Inactive\n - Go to Permissions, detach all managed policies and delete inline policies\n - Go to Groups, remove the user from privileged groups\n - Go to Console password, delete the login profile\n3. If it is an IAM role:\n - Go to Permissions, detach managed policies and delete inline policies\n - Go to Trust relationships, remove principals that should not assume the role and save\n4. Re-run the scan after the detection window elapses to confirm no further privilege-escalation activity is detected", + "Terraform": "```hcl\n# SCP to block common IAM privilege-escalation actions\nresource \"aws_organizations_policy\" \"\" {\n name = \"deny-iam-privesc\"\n type = \"SERVICE_CONTROL_POLICY\"\n\n # Critical: Deny risky IAM actions to prevent future privesc\n # Explanation: Blocks escalation techniques commonly seen in CloudTrail\n content = jsonencode({\n Version = \"2012-10-17\",\n Statement = [\n {\n Effect = \"Deny\",\n Action = [\n \"iam:AttachUserPolicy\",\n \"iam:AttachRolePolicy\",\n \"iam:PutUserPolicy\",\n \"iam:PutRolePolicy\",\n \"iam:PutGroupPolicy\",\n \"iam:AddUserToGroup\",\n \"iam:CreateAccessKey\",\n \"iam:CreateLoginProfile\",\n \"iam:UpdateLoginProfile\",\n \"iam:UpdateAssumeRolePolicy\",\n \"iam:CreatePolicyVersion\",\n \"iam:SetDefaultPolicyVersion\",\n \"iam:PassRole\"\n ],\n Resource = \"*\"\n }\n ]\n })\n}\n\nresource \"aws_organizations_policy_attachment\" \"_attach\" {\n # Critical: Attach the SCP so it takes effect\n policy_id = aws_organizations_policy..id\n target_id = \"\" # OU, Root, or Account ID\n}\n```" }, "Recommendation": { - "Text": "To remediate this issue, ensure that there are no potential privilege escalation threats in CloudTrail.", - "Url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-logging-data-events" + "Text": "Apply **least privilege** and **defense in depth**:\n- Restrict `PassRole`, `Attach*Policy`, `UpdateAssumeRolePolicy`, `CreateAccessKey`\n- Enforce permission boundaries and SCPs\n- Require MFA and change approvals\n- Use multi-Region CloudTrail, immutable retention, and alerting on anomalous sequences", + "Url": "https://hub.prowler.com/check/cloudtrail_threat_detection_privilege_escalation" } }, "Categories": [ diff --git a/prowler/providers/aws/services/codepipeline/__init__.py b/prowler/providers/aws/services/codepipeline/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/codepipeline/codepipeline_client.py b/prowler/providers/aws/services/codepipeline/codepipeline_client.py new file mode 100644 index 0000000000..dc38e10891 --- /dev/null +++ b/prowler/providers/aws/services/codepipeline/codepipeline_client.py @@ -0,0 +1,6 @@ +from prowler.providers.aws.services.codepipeline.codepipeline_service import ( + CodePipeline, +) +from prowler.providers.common.provider import Provider + +codepipeline_client = CodePipeline(Provider.get_global_provider()) diff --git a/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/__init__.py b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.metadata.json b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.metadata.json new file mode 100644 index 0000000000..a02d7ef496 --- /dev/null +++ b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "aws", + "CheckID": "codepipeline_project_repo_private", + "CheckTitle": "Ensure that CodePipeline projects do not use public GitHub or GitLab repositories as source.", + "CheckType": [], + "ServiceName": "codepipeline", + "SubServiceName": "", + "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "Severity": "medium", + "ResourceType": "Other", + "Description": "Ensure that CodePipeline projects do not use public GitHub or GitLab repositories as source.", + "Risk": "Using public Git repositories in CodePipeline projects could expose sensitive deployment configurations and increase the risk of supply chain attacks.", + "RelatedUrl": "https://docs.aws.amazon.com/codepipeline/latest/userguide/connections-github.html", + "Remediation": { + "Code": { + "CLI": "aws codestar-connections create-connection --provider-type GitHub|GitLab --connection-name ", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Use private Git repositories for CodePipeline sources and ensure proper authentication is configured using AWS CodeStar Connections. Consider using AWS CodeCommit or other private repository solutions for sensitive code.", + "Url": "https://docs.aws.amazon.com/codepipeline/latest/userguide/connections" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "This check supports both GitHub and GitLab repositories through CodeStar Connections" +} diff --git a/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py new file mode 100644 index 0000000000..0c745fc658 --- /dev/null +++ b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py @@ -0,0 +1,95 @@ +import ssl +import urllib.error +import urllib.request + +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.codepipeline.codepipeline_client import ( + codepipeline_client, +) + + +class codepipeline_project_repo_private(Check): + """Checks if AWS CodePipeline source repositories are configured as private. + + This check verifies whether source repositories (GitHub or GitLab) connected to + CodePipeline are publicly accessible. It attempts to access the repositories + anonymously to determine their visibility status. + + Attributes: + None + """ + + def execute(self) -> list: + """Executes the repository privacy check for all CodePipeline sources. + + Iterates through all CodePipeline pipelines and checks if their source + repositories (GitHub/GitLab) are publicly accessible by attempting anonymous + access. + + Returns: + list: List of Check_Report_AWS objects containing the findings for each + pipeline's source repository. + """ + findings = [] + + for pipeline in codepipeline_client.pipelines.values(): + if ( + pipeline.source + and pipeline.source.type == "CodeStarSourceConnection" + and pipeline.source.repository_id + ): + report = Check_Report_AWS(self.metadata(), resource=pipeline) + report.region = pipeline.region + report.resource_id = pipeline.name + report.resource_arn = pipeline.arn + report.resource_tags = pipeline.tags + + # Try both GitHub and GitLab URLs + github_url = f"https://github.com/{pipeline.source.repository_id}" + gitlab_url = f"https://gitlab.com/{pipeline.source.repository_id}" + + is_public_github = self._is_public_repo(github_url) + is_public_gitlab = self._is_public_repo(gitlab_url) + + if is_public_github: + report.status = "FAIL" + report.status_extended = f"CodePipeline {pipeline.name} source repository is public: {github_url}" + elif is_public_gitlab: + report.status = "FAIL" + report.status_extended = f"CodePipeline {pipeline.name} source repository is public: {gitlab_url}" + else: + report.status = "PASS" + report.status_extended = f"CodePipeline {pipeline.name} source repository {pipeline.source.repository_id} is private." + + findings.append(report) + + return findings + + def _is_public_repo(self, repo_url: str) -> bool: + """Checks if a repository is publicly accessible. + + Attempts to access the repository URL anonymously to determine if it's + public or private. + + Args: + repo_url: String containing the repository URL to check. + + Returns: + bool: True if the repository is public, False if private or inaccessible. + + Note: + The method considers a repository private if: + - The URL redirects to a sign-in page + - The request fails with HTTP errors + - The URL is not accessible + """ + if repo_url.endswith(".git"): + repo_url = repo_url[:-4] + + try: + context = ssl._create_unverified_context() + req = urllib.request.Request(repo_url, method="HEAD") + response = urllib.request.urlopen(req, context=context) + return not response.geturl().endswith("sign_in") + except (urllib.error.HTTPError, urllib.error.URLError): + return False diff --git a/prowler/providers/aws/services/codepipeline/codepipeline_service.py b/prowler/providers/aws/services/codepipeline/codepipeline_service.py new file mode 100644 index 0000000000..3eb00009eb --- /dev/null +++ b/prowler/providers/aws/services/codepipeline/codepipeline_service.py @@ -0,0 +1,164 @@ +from typing import Optional + +from botocore.exceptions import ClientError +from pydantic import BaseModel + +from prowler.lib.logger import logger +from prowler.providers.aws.lib.service.service import AWSService + + +class CodePipeline(AWSService): + """AWS CodePipeline service class for managing pipeline resources. + + This class handles interactions with AWS CodePipeline service, including + listing pipelines and retrieving their states. It manages pipeline resources + and their associated metadata. + + Attributes: + pipelines: Dictionary mapping pipeline ARNs to Pipeline objects. + """ + + def __init__(self, provider): + """Initializes the CodePipeline service class. + + Args: + provider: AWS provider instance for making API calls. + """ + super().__init__(__class__.__name__, provider) + self.pipelines = {} + self.__threading_call__(self._list_pipelines) + if self.pipelines: + self.__threading_call__(self._get_pipeline_state, self.pipelines.values()) + self.__threading_call__( + self._list_tags_for_resource, self.pipelines.values() + ) + + def _list_pipelines(self, regional_client): + """Lists all CodePipeline pipelines in the specified region. + + Retrieves all pipelines using pagination and creates Pipeline objects + for each pipeline found. + + Args: + regional_client: AWS regional client for CodePipeline service. + + Raises: + ClientError: If there is an AWS API error. + """ + logger.info("CodePipeline - Listing pipelines...") + try: + list_pipelines_paginator = regional_client.get_paginator("list_pipelines") + for page in list_pipelines_paginator.paginate(): + for pipeline in page["pipelines"]: + pipeline_arn = f"arn:{self.audited_partition}:codepipeline:{regional_client.region}:{self.audited_account}:{pipeline['name']}" + if self.pipelines is None: + self.pipelines = {} + self.pipelines[pipeline_arn] = Pipeline( + name=pipeline["name"], + arn=pipeline_arn, + region=regional_client.region, + ) + except ClientError as error: + if error.response["Error"]["Code"] == "AccessDenied": + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + if not self.pipelines: + self.pipelines = None + else: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + + def _get_pipeline_state(self, pipeline): + """Retrieves the current state of a pipeline. + + Gets detailed information about a pipeline including its source configuration. + + Args: + pipeline: Pipeline object to retrieve state for. + + Raises: + ClientError: If there is an AWS API error. + """ + logger.info("CodePipeline - Getting pipeline state...") + try: + regional_client = self.regional_clients[pipeline.region] + pipeline_info = regional_client.get_pipeline(name=pipeline.name) + source_info = pipeline_info["pipeline"]["stages"][0]["actions"][0] + repository_id = source_info["configuration"].get("FullRepositoryId", "") + pipeline.source = Source( + type=source_info["actionTypeId"]["provider"], + repository_id=repository_id, + configuration=source_info["configuration"], + ) + except ClientError as error: + logger.error( + f"{pipeline.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{pipeline.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + + def _list_tags_for_resource(self, resource): + """Lists tags for a given resource. + + Args: + resource: Resource object to retrieve tags for. + """ + logger.info("CodePipeline - Listing Tags...") + try: + tags_response = self.regional_clients[ + resource.region + ].list_tags_for_resource(resourceArn=resource.arn) + resource.tags = tags_response.get("tags", []) + except ClientError as error: + if error.response["Error"]["Code"] == "ResourceNotFoundException": + logger.warning( + f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + else: + logger.error( + f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + + +class Source(BaseModel): + """Model representing a pipeline source configuration. + + Attributes: + type: The type of source provider. + location: The location/path of the source repository. + configuration: Optional dictionary containing additional source configuration. + """ + + type: str + repository_id: str + configuration: Optional[dict] + + +class Pipeline(BaseModel): + """Model representing an AWS CodePipeline pipeline. + + Attributes: + name: The name of the pipeline. + arn: The ARN (Amazon Resource Name) of the pipeline. + region: The AWS region where the pipeline exists. + source: Optional Source object containing source configuration. + tags: Optional list of pipeline tags. + """ + + name: str + arn: str + region: str + source: Optional[Source] = None + tags: Optional[list] = [] diff --git a/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.metadata.json b/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.metadata.json index 42dbbe68dc..8dd5c80844 100644 --- a/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.metadata.json +++ b/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.metadata.json @@ -1,32 +1,38 @@ { "Provider": "aws", "CheckID": "directconnect_connection_redundancy", - "CheckTitle": "Ensure Direct Connect connections are redundant", + "CheckTitle": "Direct Connect connections span at least two locations per region", "CheckType": [ - "Resilience" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability" ], "ServiceName": "directconnect", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:directconnect:region:account-id:directconnect/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Checks the resilience of the AWS Direct Connect used to connect your on-premises.", - "Risk": "This check alerts you if any Direct Connect connections are not redundant and the connections are coming from two distinct Direct Connect locations. Lack of location resiliency can result in unexpected downtime during maintenance, a fiber cut, a device failure, or a complete location failure.", - "RelatedUrl": "https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-direct-connect-location-resiliency", + "Description": "**AWS Direct Connect** connectivity is provisioned with **connection and location redundancy**-multiple connections spread across **at least two distinct Direct Connect locations** in each Region.", + "Risk": "Missing **connection/location redundancy** creates a **single point of failure**, degrading **availability**. A router, fiber, or site outage can sever private paths to AWS, stalling app traffic, data replication, and admin access, leading to timeouts or extended downtime until alternate paths are restored.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-direct-connect-location-resiliency", + "https://repost.aws/knowledge-center/direct-connect-physical-redundancy", + "https://aws.amazon.com/directconnect/resiliency-recommendation/" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws directconnect create-connection --region --location --bandwidth 1Gbps --connection-name ", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In the AWS Console, go to Direct Connect > Connections\n2. Click Create connection\n3. Region: select the Region where the existing connection resides\n4. Name: enter \n5. Location: select a different Direct Connect location than your existing connection\n6. Bandwidth: choose a supported value (e.g., 1 Gbps)\n7. Click Create connection", + "Terraform": "```hcl\n# Create an additional Direct Connect connection in a different location\nresource \"aws_dx_connection\" \"example\" {\n name = \"\"\n bandwidth = \"1Gbps\"\n location = \"\" # Critical: choose a different DX location in the same Region to achieve location redundancy\n}\n```" }, "Recommendation": { - "Text": "To build Direct Connect location resiliency, you should have at least two connections from at least two distinct Direct Connect locations.", - "Url": "https://aws.amazon.com/directconnect/resiliency-recommendation/" + "Text": "Apply **redundancy** and **defense in depth**:\n- Deploy 2 Direct Connect connections across **two distinct locations**\n- Use **dynamic, active/active routing** for automatic failover\n- Ensure **provider/device diversity**\n- Size capacity so one link loss doesn't overload remaining paths\n- Consider a **VPN** as tertiary backup", + "Url": "https://hub.prowler.com/check/directconnect_connection_redundancy" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.metadata.json b/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.metadata.json index a42a71ed83..f90ea79e3c 100644 --- a/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.metadata.json +++ b/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.metadata.json @@ -1,32 +1,38 @@ { "Provider": "aws", "CheckID": "directconnect_virtual_interface_redundancy", - "CheckTitle": "Ensure Direct Connect virtual interface(s) are providing redundant connections", + "CheckTitle": "Direct Connect gateway or virtual private gateway has at least two virtual interfaces on different Direct Connect connections", "CheckType": [ - "Resilience" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Denial of Service" ], "ServiceName": "directconnect", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:directconnect:region:account-id:directconnect/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Checks the resilience of the AWS Direct Connect used to connect your on-premises to each Direct Connect gateway or virtual private gateway.", - "Risk": "This check alerts you if any Direct Connect gateway or virtual private gateway isn't configured with virtual interfaces across at least two distinct Direct Connect locations. Lack of location resiliency can result in unexpected downtime during maintenance, a fiber cut, a device failure, or a complete location failure.", - "RelatedUrl": "https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-direct-connect-location-resiliency", + "Description": "**Direct Connect gateways** and **virtual private gateways** are assessed for **interface redundancy**: multiple virtual interfaces (`VIFs`) distributed across more than one **Direct Connect connection**.\n\n*Gateways with only one VIF or with all VIFs on a single connection are identified.*", + "Risk": "Missing connection diversity undermines **availability**. A single device, fiber, or location failure can cut on-prem to VPC connectivity, causing **outages**, **packet loss**, or routing blackholes. Fallback to internet VPN can add latency and throttle throughput, delaying recovery and impacting operations.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-direct-connect-location-resiliency", + "https://repost.aws/knowledge-center/direct-connect-physical-redundancy", + "https://aws.amazon.com/directconnect/resiliency-recommendation/" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws directconnect create-private-virtual-interface --connection-id --new-private-virtual-interface '{\"virtualInterfaceName\":\"\",\"vlan\":,\"asn\":,\"addressFamily\":\"ipv4\",\"amazonAddress\":\"\",\"customerAddress\":\"\",\"directConnectGatewayId\":\"\"}'", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In the AWS Console, open Direct Connect\n2. Go to Connections and select a different connection than the one used by your existing VIF\n3. Click Create virtual interface and choose Private\n4. For Gateway, select your Direct Connect gateway (or Virtual private gateway for VGW)\n5. Enter VLAN, BGP ASN, and IPv4 peer IPs (Amazon/Customer), then Create\n6. Verify the gateway now has at least two VIFs on different Direct Connect connections", + "Terraform": "```hcl\n# Create a second Private VIF on a different DX connection and attach to the gateway\nresource \"aws_dx_private_virtual_interface\" \"example\" {\n connection_id = \"\" # CRITICAL: use a DIFFERENT Direct Connect connection than existing VIFs\n dx_gateway_id = \"\" # CRITICAL: attaches the VIF to the Direct Connect gateway (use virtual_gateway_id for VGW)\n name = \"\"\n vlan = 100\n bgp_asn = 65000\n address_family = \"ipv4\"\n amazon_address = \"169.254.100.1/30\"\n customer_address = \"169.254.100.2/30\"\n}\n```" }, "Recommendation": { - "Text": "To build Direct Connect location resiliency, you can configure the Direct Connect gateway or virtual private gateway to connect to at least two distinct Direct Connect locations.", - "Url": "https://aws.amazon.com/directconnect/resiliency-recommendation/" + "Text": "Apply connectivity **defense in depth**:\n- Attach at least two `VIFs` per gateway on separate **Direct Connect connections** in distinct locations\n- Prefer active/active dynamic routing and size capacity to survive a link loss\n- *Optionally* add a **VPN/Transit Gateway** path to sustain operations during provider outages", + "Url": "https://hub.prowler.com/check/directconnect_virtual_interface_redundancy" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.metadata.json b/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.metadata.json index 12b55d3f12..db011dacd4 100644 --- a/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.metadata.json +++ b/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.metadata.json @@ -1,28 +1,34 @@ { "Provider": "aws", "CheckID": "dlm_ebs_snapshot_lifecycle_policy_exists", - "CheckTitle": "Ensure EBS Snapshot lifecycle policies are defined.", + "CheckTitle": "Region with EBS snapshots has at least one EBS snapshot lifecycle policy defined", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "dlm", - "SubServiceName": "ebs", - "ResourceIdTemplate": "arn:aws:iam::account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Ensure EBS Snapshot lifecycle policies are defined.", - "Risk": "With AWS DLM service, you can manage the lifecycle of your EBS volume snapshots. By automating the EBS volume backup management using lifecycle policies, you can protect your EBS data by enforcing a regular backup schedule, retain backups as required by auditors or internal compliance.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html#dlm-elements", + "Description": "**EBS snapshots** are expected to be governed by **Data Lifecycle Manager (DLM) policies** in each Region where snapshots exist.\n\nThe evaluation looks for lifecycle policies that automate snapshot creation, retention, and cleanup for those snapshots.", + "Risk": "Without **automated lifecycle policies**, backups become inconsistent and error-prone, reducing availability and weakening recovery objectives. Missing retention rules cause premature deletion or snapshot sprawl, increasing cost and exposing stale data. Lack of cross-Region/account copies limits resilience to regional outages and malicious deletion.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DLM/ebs-snapshot-automation.html", + "https://repost.aws/articles/ARmYgZmA8MRQi89pWd9D7eFw/how-to-create-a-automate-backup-aws-data-lifecycle-management-using-snapshots", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html#dlm-elements" + ], "Remediation": { "Code": { - "CLI": "aws dlm create-lifecycle-policy --region --execution-role-arn --description --state ENABLED --policy-details file://lifecycle-policy-config.json", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DLM/ebs-snapshot-automation.html", - "Terraform": "" + "CLI": "aws dlm create-lifecycle-policy --region --execution-role-arn --description \"\" --state ENABLED --policy-details '{\"PolicyType\":\"EBS_SNAPSHOT_MANAGEMENT\",\"ResourceTypes\":[\"VOLUME\"],\"TargetTags\":[{\"Key\":\"\",\"Value\":\"\"}],\"Schedules\":[{\"CreateRule\":{\"Interval\":24,\"IntervalUnit\":\"HOURS\"},\"RetainRule\":{\"Count\":1}}]}'", + "NativeIaC": "```yaml\n# CloudFormation: minimal EBS snapshot lifecycle policy\nResources:\n :\n Type: AWS::DLM::LifecyclePolicy\n Properties:\n Description: \"\"\n ExecutionRoleArn: \"\"\n State: ENABLED # Critical: enables the policy so it is counted by the check\n PolicyDetails:\n PolicyType: EBS_SNAPSHOT_MANAGEMENT # Critical: creates an EBS snapshot lifecycle policy\n ResourceTypes: [VOLUME]\n TargetTags:\n - Key: \"\" # Critical: selects target volumes by tag\n Value: \"\"\n Schedules:\n - CreateRule:\n Interval: 24\n IntervalUnit: HOURS\n RetainRule:\n Count: 1\n```", + "Other": "1. In the AWS console, switch to the Region that has EBS snapshots\n2. Open EC2 > Lifecycle Manager (DLM) > Create lifecycle policy\n3. Select EBS snapshot policy; Target resource: Volumes\n4. Add Target tags: Key = , Value = \n5. Set Schedule: Create every 24 hours; Retain 1 snapshot\n6. Ensure State is Enabled and click Create policy", + "Terraform": "```hcl\n# Terraform: minimal EBS snapshot lifecycle policy\nresource \"aws_dlm_lifecycle_policy\" \"\" {\n description = \"\"\n execution_role_arn = \"\"\n state = \"ENABLED\" # Critical: enables the policy so it is counted by the check\n\n policy_details {\n policy_type = \"EBS_SNAPSHOT_MANAGEMENT\" # Critical: creates an EBS snapshot lifecycle policy\n resource_types = [\"VOLUME\"]\n target_tags = {\n \"\" = \"\" # Critical: selects target volumes by tag\n }\n schedule {\n create_rule {\n interval = 24\n interval_unit = \"HOURS\"\n }\n retain_rule {\n count = 1\n }\n }\n }\n}\n```" }, "Recommendation": { - "Text": "To use Amazon Data Lifecycle Manager (DLM) service to manage the lifecycle of your EBS volume snapshots, you have to tag your AWS EBS volumes and create data lifecycle policies via Amazon DLM.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html#dlm-elements" + "Text": "Implement **DLM lifecycle policies** for all volumes that require backup.\n\n- Schedule creations to meet RPO/RTO\n- Define retention to prevent sprawl and enforce least data exposure\n- Use **least privilege** roles and separation of duties\n- Copy snapshots to another Region/account for **defense in depth**\n- Monitor policy health and coverage with tags", + "Url": "https://hub.prowler.com/check/dlm_ebs_snapshot_lifecycle_policy_exists" } }, "Categories": [ diff --git a/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.metadata.json b/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.metadata.json index 8a0b800295..d8a57d00b5 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.metadata.json +++ b/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.metadata.json @@ -1,31 +1,38 @@ { "Provider": "aws", "CheckID": "dms_endpoint_mongodb_authentication_enabled", - "CheckTitle": "Check if DMS endpoints for MongoDB have an authentication mechanism enabled.", + "CheckTitle": "DMS MongoDB endpoint has an authentication mechanism enabled", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "dms", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dms:region:account-id:endpoint/endpoint-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDmsEndpoint", - "Description": "This control checks whether an AWS DMS endpoint for MongoDB is configured with an authentication mechanism. The control fails if an authentication type isn't set for the endpoint.", - "Risk": "Without an authentication mechanism enabled, unauthorized users may gain access to sensitive data during migration, increasing the risk of data breaches and security incidents.", - "RelatedUrl": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MongoDB.html", + "Description": "**AWS DMS MongoDB endpoints** use an authentication mechanism. Configuration expects `AuthType` not `no` (e.g., `password`) with an `authMechanism` such as `scram_sha_1` or `mongodb_cr`.", + "Risk": "Without authentication, unauthenticated connections can access the source, degrading **confidentiality** and **integrity**. Adversaries could read or modify migrated documents, hijack CDC, inject data, or exfiltrate records during replication.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MongoDB.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-11" + ], "Remediation": { "Code": { - "CLI": "aws dms modify-endpoint --endpoint-arn --username --password --authentication-type ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-11", - "Terraform": "" + "CLI": "aws dms modify-endpoint --endpoint-arn --mongodb-settings '{\"AuthType\":\"password\"}' --username --password ", + "NativeIaC": "```yaml\n# CloudFormation: enable authentication on a MongoDB DMS endpoint\nResources:\n :\n Type: AWS::DMS::Endpoint\n Properties:\n EndpointIdentifier: \n EndpointType: source\n EngineName: mongodb\n MongoDbSettings:\n AuthType: password # CRITICAL: sets authentication mode to 'password' so auth is enabled\n```", + "Other": "1. In the AWS Console, go to Database Migration Service > Endpoints\n2. Select the MongoDB endpoint and click Modify\n3. Under MongoDB settings, set Authentication mode to Password\n4. Enter Username and Password\n5. Click Save changes", + "Terraform": "```hcl\n# Terraform: enable authentication on a MongoDB DMS endpoint\nresource \"aws_dms_endpoint\" \"\" {\n endpoint_id = \"\"\n endpoint_type = \"source\"\n engine_name = \"mongodb\"\n\n mongodb_settings {\n auth_type = \"password\" # CRITICAL: enables authentication for the MongoDB endpoint\n }\n}\n```" }, "Recommendation": { - "Text": "Enable an authentication mechanism on DMS endpoints for MongoDB to ensure secure access control during migration.", - "Url": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MongoDB.html" + "Text": "Enforce **strong authentication** on MongoDB endpoints: set `AuthType` to `password` and use `authMechanism` like `scram_sha_1`. Apply **least privilege** database accounts, store secrets in **Secrets Manager**, and pair with **TLS** for defense in depth.", + "Url": "https://hub.prowler.com/check/dms_endpoint_mongodb_authentication_enabled" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.metadata.json b/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.metadata.json index 45471a9268..ef8bfd6bde 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.metadata.json +++ b/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.metadata.json @@ -1,31 +1,38 @@ { "Provider": "aws", "CheckID": "dms_endpoint_neptune_iam_authorization_enabled", - "CheckTitle": "Check if DMS endpoints for Neptune databases have IAM authorization enabled.", + "CheckTitle": "DMS endpoint for Neptune has IAM authorization enabled", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "dms", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dms:region:account-id:endpoint/endpoint-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDmsEndpoint", - "Description": "This control checks whether an AWS DMS endpoint for an Amazon Neptune database is configured with IAM authorization. The control fails if the DMS endpoint doesn't have IAM authorization enabled.", - "Risk": "Without IAM authorization, DMS endpoints for Neptune databases may lack granular access control, increasing the risk of unauthorized access to sensitive data.", - "RelatedUrl": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Neptune.html", + "Description": "**DMS Neptune endpoints** have **IAM authorization** enabled via the endpoint setting `IamAuthEnabled`.", + "Risk": "Without **IAM authorization**, migration components can interact with Neptune using broad trust, enabling unauthorized data loads, reads, or alterations.\n\nThis degrades **confidentiality** and **integrity** and increases the chance of privilege abuse and data exfiltration.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Neptune.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-10" + ], "Remediation": { "Code": { - "CLI": "aws dms modify-endpoint --endpoint-arn --service-access-role-arn ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-10", + "CLI": "aws dms modify-endpoint --endpoint-arn --neptune-settings '{\"IamAuthEnabled\":true}'", + "NativeIaC": "```yaml\n# CloudFormation: Enable IAM authorization on a DMS Neptune endpoint\nResources:\n :\n Type: AWS::DMS::Endpoint\n Properties:\n EndpointType: target\n EngineName: neptune\n NeptuneSettings:\n ServiceAccessRoleArn: \n S3BucketName: \n S3BucketFolder: \n IamAuthEnabled: true # Critical: enables IAM authorization for the Neptune endpoint\n```", + "Other": "1. In the AWS Console, go to Database Migration Service > Endpoints\n2. Select the Neptune endpoint and click Modify\n3. Expand Endpoint settings (Neptune settings) and set IAM authorization to Enabled\n4. Ensure Service access role ARN is set, then click Save", "Terraform": "" }, "Recommendation": { - "Text": "Enable IAM authorization on DMS endpoints for Neptune databases by specifying a service role in the ServiceAccessRoleARN parameter.", - "Url": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Neptune.html" + "Text": "Enable **IAM authorization** on Neptune endpoints (`IamAuthEnabled=true`) and use a **least privilege** service role limited to minimal Neptune and S3 permissions.\n\nApply **defense in depth**: restrict network paths, separate duties for migration roles, and monitor access with logs and alerts.", + "Url": "https://hub.prowler.com/check/dms_endpoint_neptune_iam_authorization_enabled" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.metadata.json b/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.metadata.json index 471b27aee4..2aa1ee8a00 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.metadata.json +++ b/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.metadata.json @@ -1,31 +1,41 @@ { "Provider": "aws", "CheckID": "dms_endpoint_redis_in_transit_encryption_enabled", - "CheckTitle": "Check if DMS endpoints for Redis OSS are encrypted in transit.", + "CheckTitle": "DMS endpoint for Redis OSS is encrypted in transit", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices/Encryption in Transit", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS", + "Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls" ], "ServiceName": "dms", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dms:region:account-id:endpoint/endpoint-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDmsEndpoint", - "Description": "This control checks whether an AWS DMS endpoint for Redis OSS is configured with a TLS connection. The control fails if the endpoint doesn't have TLS enabled.", - "Risk": "Without TLS, data transmitted between databases may be vulnerable to interception or eavesdropping, increasing the risk of data breaches and other security incidents.", - "RelatedUrl": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.Redis.html", + "Description": "**DMS Redis OSS endpoints** are assessed for the presence of **TLS** in their endpoint settings, such as `ssl-encryption`, indicating encrypted connections between the DMS replication instance and Redis.", + "Risk": "Without **TLS**, traffic between DMS and Redis can be intercepted or altered, compromising **confidentiality** and **integrity**.\n\nAttackers can perform **man-in-the-middle** interception, steal auth tokens, and inject or corrupt migrated data.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-12", + "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redis.html#CHAP_Target.Redis.EndpointSettings", + "https://support.icompaas.com/support/solutions/articles/62000233450-ensure-encryption-in-transit-for-dms-endpoints-for-redis-oss" + ], "Remediation": { "Code": { - "CLI": "aws dms modify-endpoint --endpoint-arn --redis-settings '{'SslSecurityProtocol': 'ssl-encryption'}'", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-12", - "Terraform": "" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: Enable TLS for Redis OSS DMS endpoint\nResources:\n :\n Type: AWS::DMS::Endpoint\n Properties:\n EndpointIdentifier: \n EndpointType: target\n EngineName: redis\n RedisSettings:\n ServerName: \n Port: 6379\n AuthType: none\n SslSecurityProtocol: ssl-encryption # Critical: enables TLS for in-transit encryption\n```", + "Other": "1. In the AWS Console, go to Database Migration Service > Endpoints\n2. Select the Redis OSS endpoint and click Modify\n3. Set SSL security protocol (Encryption in transit) to \"SSL encryption\"\n4. Save changes", + "Terraform": "```hcl\n# Enable TLS for Redis OSS DMS endpoint\nresource \"aws_dms_endpoint\" \"\" {\n endpoint_id = \"\"\n endpoint_type = \"target\"\n engine_name = \"redis\"\n\n redis_settings {\n server_name = \"\"\n port = 6379\n auth_type = \"none\"\n ssl_security_protocol = \"ssl-encryption\" # Critical: enables TLS for in-transit encryption\n }\n}\n```" }, "Recommendation": { - "Text": "Enable TLS for DMS endpoints for Redis OSS to ensure encrypted communication during data migration.", - "Url": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redis.html#CHAP_Target.Redis.EndpointSettings" + "Text": "Enable **TLS** on Redis OSS endpoints (e.g., `ssl-encryption`) and require server certificate validation. Prohibit plaintext connections, prefer private networking, and enforce **least privilege** for DMS roles to strengthen **defense in depth**.", + "Url": "https://hub.prowler.com/check/dms_endpoint_redis_in_transit_encryption_enabled" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.metadata.json b/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.metadata.json index 3392ac2d64..881a4423ce 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.metadata.json +++ b/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "dms_endpoint_ssl_enabled", - "CheckTitle": "Ensure SSL mode is enabled in DMS endpoint", - "CheckType": ["Effects", "Data Exposure"], + "CheckTitle": "DMS endpoint has SSL enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Exposure" + ], "ServiceName": "dms", - "SubServiceName": "endpoint", - "ResourceIdTemplate": "arn:partition:dms:region:account-id:endpoint:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsDmsEndpoint", - "Description": "This check ensures that SSL mode is enabled for all AWS Database Migration Service (DMS) endpoints. Enabling SSL provides encryption in transit for data transferred through these endpoints.", - "Risk": "Without SSL enabled, data transferred through DMS endpoints is not encrypted, potentially exposing sensitive information to unauthorized access or interception during transit.", - "RelatedUrl": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.SSL.html", + "Description": "**AWS DMS endpoints** have their SSL/TLS mode inspected; any value other than `none` denotes encrypted connections between the replication instance and databases.\n\nSupported modes include `require`, `verify-ca`, and `verify-full`.", + "Risk": "Without TLS, data in transit can be read or altered, affecting:\n- **Confidentiality** via packet sniffing and credential leakage\n- **Integrity** through **MITM** tampering of migration streams\n- **Availability** from session hijack or task disruption", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://aws.amazon.com/blogs/database/configuring-ssl-encryption-on-oracle-and-postgresql-endpoints-in-aws-dms/", + "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.SSL.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-9" + ], "Remediation": { - "Code": { - "CLI": "aws dms modify-endpoint --endpoint-arn --ssl-mode require", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-9", - "Terraform": "" - }, - "Recommendation": { - "Text": "Enable SSL mode for all DMS endpoints. Use 'require' as the minimum SSL mode, and consider using 'verify-ca' or 'verify-full' for higher security.", - "Url": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.SSL.html" - } + "Code": { + "CLI": "aws dms modify-endpoint --endpoint-arn --ssl-mode require", + "NativeIaC": "```yaml\n# CloudFormation: Set SSL on a DMS endpoint\nResources:\n :\n Type: AWS::DMS::Endpoint\n Properties:\n EndpointIdentifier: \n EndpointType: source\n EngineName: sqlserver\n ServerName: \n Port: 1433\n Username: \n Password: \n SslMode: require # CRITICAL: enables SSL (not \"none\"), fixing the finding\n```", + "Other": "1. In the AWS DMS console, go to Endpoints\n2. Select the non-compliant endpoint and choose Modify\n3. Set SSL mode to Require (or Verify-ca/Verify-full if required by your engine and certificate is available)\n4. If Verify-ca/Verify-full is selected, choose the appropriate CA certificate\n5. Save changes, then Test connection to confirm", + "Terraform": "```hcl\n# Terraform: Set SSL on a DMS endpoint\nresource \"aws_dms_endpoint\" \"\" {\n endpoint_id = \"\"\n endpoint_type = \"source\"\n engine_name = \"sqlserver\"\n server_name = \"\"\n port = 1433\n username = \"\"\n password = \"\"\n\n ssl_mode = \"require\" # CRITICAL: enables SSL (not \"none\"), fixing the finding\n}\n```" + }, + "Recommendation": { + "Text": "Configure endpoints to use SSL/TLS at least `require`; prefer `verify-ca` or `verify-full` where supported. Manage trusted CA material and rotate regularly. Apply **defense in depth** with private connectivity and strict IAM, and enforce this posture via policy-as-code and continuous validation.", + "Url": "https://hub.prowler.com/check/dms_endpoint_ssl_enabled" + } }, "Categories": [ - "encryption" + "encryption" ], "DependsOn": [], "RelatedTo": [], "Notes": "" -} \ No newline at end of file +} diff --git a/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.metadata.json b/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.metadata.json index 19c2686130..44bbfe4374 100644 --- a/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.metadata.json +++ b/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.metadata.json @@ -1,29 +1,39 @@ { "Provider": "aws", "CheckID": "dms_instance_minor_version_upgrade_enabled", - "CheckTitle": "Ensure DMS instances have auto minor version upgrade enabled.", - "CheckType": [], + "CheckTitle": "DMS replication instance has auto minor version upgrade enabled", + "CheckType": [ + "Software and Configuration Checks/Patch Management", + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "dms", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rdmsds:region:account-id:rep", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDmsReplicationInstance", - "Description": "Ensure DMS instances have auto minor version upgrade enabled.", - "Risk": "Ensure that your Amazon Database Migration Service (DMS) replication instances have the Auto Minor Version Upgrade feature enabled in order to receive automatically minor engine upgrades.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-6", + "Description": "**AWS DMS replication instances** are evaluated for the `auto_minor_version_upgrade` setting to confirm **automatic minor engine updates** are enabled during the maintenance window.", + "Risk": "Without **automatic minor upgrades**, DMS engines can miss security patches and fixes, enabling exploitation of known flaws and instability.\n- Confidentiality: exposure via unpatched components\n- Integrity: replication errors or data drift\n- Availability: outages during migration or CDC", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-6", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DMS/auto-minor-version-upgrade.html" + ], "Remediation": { "Code": { "CLI": "aws dms modify-replication-instance --region --replication-instance-arn arn:aws:dms:::rep: --auto-minor-version-upgrade --apply-immediately", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/auto-minor-version-upgrade.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/auto-minor-version-upgrade.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/auto-minor-version-upgrade.html#" + "NativeIaC": "```yaml\n# CloudFormation: Enable auto minor version upgrade on a DMS replication instance\nResources:\n :\n Type: AWS::DMS::ReplicationInstance\n Properties:\n ReplicationInstanceIdentifier: \n ReplicationInstanceClass: dms.t3.micro\n AutoMinorVersionUpgrade: true # CRITICAL: turns on automatic minor version upgrades\n```", + "Other": "1. Open the AWS Console and go to Database Migration Service (DMS)\n2. Click Replication instances and select your instance\n3. Choose Actions > Modify\n4. Check Auto minor version upgrade\n5. Select Apply immediately\n6. Click Modify to save", + "Terraform": "```hcl\n# Terraform: Enable auto minor version upgrade on a DMS replication instance\nresource \"aws_dms_replication_instance\" \"\" {\n replication_instance_id = \"\"\n replication_instance_class = \"dms.t3.micro\"\n auto_minor_version_upgrade = true # CRITICAL: turns on automatic minor version upgrades\n}\n```" }, "Recommendation": { - "Text": "Enable auto minor version upgrade for all DMS replication instances.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-6" + "Text": "Enable `auto_minor_version_upgrade` on all replication instances to maintain **continuous patching**.\n- Set a maintenance window and validate in non-prod\n- Monitor release notes and health metrics\n- Enforce **least privilege** for change control\n- Keep **backups** for rollback", + "Url": "https://hub.prowler.com/check/dms_instance_minor_version_upgrade_enabled" } }, - "Categories": [], + "Categories": [ + "vulnerabilities" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.metadata.json b/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.metadata.json index 65d5cd4336..e460711cd7 100644 --- a/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.metadata.json +++ b/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.metadata.json @@ -1,30 +1,37 @@ { "Provider": "aws", "CheckID": "dms_instance_multi_az_enabled", - "CheckTitle": "Ensure DMS instances have multi az enabled.", - "CheckType": [], + "CheckTitle": "DMS replication instance has Multi-AZ enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Denial of Service" + ], "ServiceName": "dms", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rdmsds:region:account-id:rep", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDmsReplicationInstance", - "Description": "Ensure DMS instances have multi az enabled.", - "Risk": "Ensure that your Amazon Database Migration Service (DMS) replication instances are using Multi-AZ deployment configurations to provide High Availability (HA) through automatic failover to standby replicas in the event of a failure such as an Availability Zone (AZ) outage, an internal hardware or network outage, a software failure or in case of a planned maintenance session.", - "RelatedUrl": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/multi-az.html#", + "Description": "**AWS DMS replication instances** are evaluated for **Multi-AZ** configuration. Instances with `multi_az` enabled are treated as having a cross-AZ standby; those without it are identified as single-AZ.", + "Risk": "Without **Multi-AZ**, a single-AZ failure or maintenance event can halt migrations, causing extended downtime (**availability**) and replication gaps or rollbacks (**integrity**). Tasks may stall, increase cutover risk, and require manual recovery when the replication instance is unavailable.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DMS/multi-az.html" + ], "Remediation": { "Code": { - "CLI": "aws dms modify-replication-instance --region --replication-instance-arn arn:aws:dms:::rep: --multi-az --apply-immediately", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/multi-az.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/multi-az.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/multi-az.html#" + "CLI": "aws dms modify-replication-instance --replication-instance-arn arn:aws:dms:::rep: --multi-az --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: enable Multi-AZ on a DMS replication instance\nResources:\n :\n Type: AWS::DMS::ReplicationInstance\n Properties:\n ReplicationInstanceClass: dms.t3.micro\n MultiAZ: true # Critical: enables Multi-AZ to pass the check\n```", + "Other": "1. Open the AWS DMS console\n2. Go to Replication instances and select your instance\n3. Click Modify\n4. Check Multi-AZ\n5. Check Apply immediately\n6. Click Modify to save", + "Terraform": "```hcl\n# Enable Multi-AZ on a DMS replication instance\nresource \"aws_dms_replication_instance\" \"\" {\n replication_instance_id = \"\"\n replication_instance_class = \"dms.t3.micro\"\n multi_az = true # Critical: enables Multi-AZ to pass the check\n}\n```" }, "Recommendation": { - "Text": "Enable multi az for all DMS replication instances.", - "Url": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/multi-az.html#" + "Text": "Enable **Multi-AZ** (set `multi_az` to `true`) on DMS replication instances that handle production or time-sensitive migrations to ensure redundancy and automatic failover.\n\nApply HA principles: distribute across AZs, test failover, monitor health, and plan maintenance to minimize impact.", + "Url": "https://hub.prowler.com/check/dms_instance_multi_az_enabled" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.metadata.json b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.metadata.json index 7692268a5c..9a7917e3a5 100644 --- a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.metadata.json +++ b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.metadata.json @@ -1,26 +1,37 @@ { "Provider": "aws", "CheckID": "dms_instance_no_public_access", - "CheckTitle": "Ensure DMS instances are not publicly accessible.", - "CheckType": [], + "CheckTitle": "DMS replication instance is not publicly exposed to the Internet", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" + ], "ServiceName": "dms", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rdmsds:region:account-id:rep", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsDmsReplicationInstance", - "Description": "Ensure DMS instances are not publicly accessible.", - "Risk": "Ensure that your Amazon Database Migration Service (DMS) are not publicly accessible from the Internet in order to avoid exposing private data and minimize security risks. A DMS replication instance should have a private IP address and the Publicly Accessible feature disabled when both the source and the target databases are in the same network that is connected to the instance's VPC through a VPN, VPC peering connection, or using an AWS Direct Connect dedicated connection.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-1", + "Description": "**AWS DMS replication instances** are evaluated for **public exposure**. Exposure is identified when `PubliclyAccessible` is enabled and an attached security group allows inbound traffic from any address. Private or allowlisted instances are not considered exposed.", + "Risk": "Publicly reachable replication instances threaten:\n- Confidentiality: migration data and credentials can be intercepted or exfiltrated.\n- Integrity: attackers may alter tasks or inject records.\n- Availability: abuse or DDoS can stall replication and delay cutovers.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-1", + "https://docs.aws.amazon.com/amazonq/detector-library/terraform/restrict-public-access-dms-terraform/", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DMS/publicly-accessible.html", + "https://support.icompaas.com/support/solutions/articles/62000233448-ensure-dms-instances-are-not-publicly-accessible" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/publicly-accessible.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/publicly-accessible.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DMS/publicly-accessible.html#" + "NativeIaC": "```yaml\n# CloudFormation: DMS instance not publicly accessible\nResources:\n :\n Type: AWS::DMS::ReplicationInstance\n Properties:\n ReplicationInstanceClass: dms.t3.micro\n PubliclyAccessible: false # Critical: disables public access to prevent Internet exposure\n```", + "Other": "1. In the AWS Console, open Database Migration Service > Replication instances and select the instance\n2. In Details > Networking, click each attached Security Group ID to open it in the EC2 console\n3. In Inbound rules, delete any rule with Source 0.0.0.0/0 or ::/0\n4. Save rules for each security group", + "Terraform": "```hcl\n# DMS instance not publicly accessible\nresource \"aws_dms_replication_instance\" \"\" {\n replication_instance_id = \"\"\n replication_instance_class = \"dms.t3.micro\"\n publicly_accessible = false # Critical: disables public access to prevent Internet exposure\n}\n```" }, "Recommendation": { - "Text": "Restrict DMS Replication instances security groups to only required IPs, or re-create these instances that is only accessible privately.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-1" + "Text": "Adopt a **private-only** design:\n- Disable `PubliclyAccessible`; place instances in private subnets.\n- Enforce **least privilege** security groups (no `0.0.0.0/0`); allow only required sources/ports.\n- Provide access via **VPN**, peering, or Direct Connect.\n- Layer controls (ACLs, monitoring) and restrict IAM to necessary actions.", + "Url": "https://hub.prowler.com/check/dms_instance_no_public_access" } }, "Categories": [ diff --git a/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.metadata.json b/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.metadata.json index 981a51c73b..43c55ab39d 100644 --- a/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.metadata.json +++ b/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.metadata.json @@ -1,31 +1,39 @@ { "Provider": "aws", "CheckID": "dms_replication_task_source_logging_enabled", - "CheckTitle": "Check if DMS replication tasks for the source database have logging enabled.", + "CheckTitle": "DMS replication task has logging enabled and SOURCE_CAPTURE and SOURCE_UNLOAD components set to at least Default severity", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "TTPs/Defense Evasion" ], "ServiceName": "dms", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dms:region:account-id:task/task-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDmsReplicationTask", - "Description": "This control checks whether logging is enabled with the minimum severity level of LOGGER_SEVERITY_DEFAULT for DMS replication tasks SOURCE_CAPTURE and SOURCE_UNLOAD. The control fails if logging isn't enabled for these tasks or if the minimum severity level is less than LOGGER_SEVERITY_DEFAULT.", - "Risk": "Without logging enabled, issues in data migration may go undetected, affecting the integrity and compliance of replicated data.", - "RelatedUrl": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Monitoring.html#CHAP_Monitoring.ManagingLogs", + "Description": "**AWS DMS replication tasks** have **logging enabled** and configure `SOURCE_CAPTURE` and `SOURCE_UNLOAD` with severity at least `LOGGER_SEVERITY_DEFAULT` (or higher: `LOGGER_SEVERITY_DEBUG`, `LOGGER_SEVERITY_DETAILED_DEBUG`).", + "Risk": "Missing or low-severity source logs hinder visibility into **CDC** and full-load activity, risking undetected errors, stalls, or tampering. This can cause silent **data drift**, broken lineage, and failed recoveries, undermining **integrity** and **availability** and weakening auditability during investigations.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Monitoring.html", + "https://repost.aws/knowledge-center/dms-debug-logging", + "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-8" + ], "Remediation": { "Code": { - "CLI": "aws dms modify-replication-task --replication-task-arn --task-settings '{\"Logging\":{\"EnableLogging\":true,\"LogComponents\":[{\"Id\":\"SOURCE_CAPTURE\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"},{\"Id\":\"SOURCE_UNLOAD\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"}]}}'", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-8", - "Terraform": "" + "CLI": "aws dms modify-replication-task --replication-task-arn --replication-task-settings '{\"Logging\":{\"EnableLogging\":true,\"LogComponents\":[{\"Id\":\"SOURCE_CAPTURE\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"},{\"Id\":\"SOURCE_UNLOAD\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"}]}}'", + "NativeIaC": "```yaml\n# CloudFormation: enable DMS source logging at minimum DEFAULT severity\nResources:\n :\n Type: AWS::DMS::ReplicationTask\n Properties:\n ReplicationInstanceArn: \n SourceEndpointArn: \n TargetEndpointArn: \n MigrationType: full-load\n TableMappings: '{\"rules\":[]}'\n # Critical: Enables logging and sets SOURCE components to at least DEFAULT\n ReplicationTaskSettings: |\n {\n \"Logging\": {\n \"EnableLogging\": true,\n \"LogComponents\": [\n {\"Id\": \"SOURCE_CAPTURE\", \"Severity\": \"LOGGER_SEVERITY_DEFAULT\"},\n {\"Id\": \"SOURCE_UNLOAD\", \"Severity\": \"LOGGER_SEVERITY_DEFAULT\"}\n ]\n }\n }\n```", + "Other": "1. In the AWS console, go to Database Migration Service > Database migration tasks\n2. Select the task and choose Modify\n3. Click Modify task logging\n4. Turn on Enable logging\n5. For SOURCE_CAPTURE and SOURCE_UNLOAD, set Severity to Default (or higher)\n6. Save/Modify to apply", + "Terraform": "```hcl\n# Enable DMS source logging at minimum DEFAULT severity\nresource \"aws_dms_replication_task\" \"\" {\n replication_instance_arn = \"\"\n source_endpoint_arn = \"\"\n target_endpoint_arn = \"\"\n migration_type = \"full-load\"\n table_mappings = \"{\\\"rules\\\":[]}\"\n\n # Critical: Enables logging and sets SOURCE components to at least DEFAULT\n replication_task_settings = < --task-settings '{\"Logging\":{\"EnableLogging\":true,\"LogComponents\":[{\"Id\":\"TARGET_APPLY\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"},{\"Id\":\"TARGET_LOAD\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"}]}}'", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-7", - "Terraform": "" + "CLI": "aws dms modify-replication-task --replication-task-arn --replication-task-settings '{\"Logging\":{\"EnableLogging\":true,\"LogComponents\":[{\"Id\":\"TARGET_APPLY\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"},{\"Id\":\"TARGET_LOAD\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"}]}}'", + "NativeIaC": "```yaml\n# CloudFormation: enable DMS task logging for target components\nResources:\n :\n Type: AWS::DMS::ReplicationTask\n Properties:\n ReplicationInstanceArn: \n SourceEndpointArn: \n TargetEndpointArn: \n MigrationType: full-load\n TableMappings: |\n {\"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"1\",\"rule-name\":\"1\",\"object-locator\":{\"schema-name\":\"%\",\"table-name\":\"%\"},\"rule-action\":\"include\"}]}\n ReplicationTaskSettings: |\n {\"Logging\":{\"EnableLogging\":true, \"LogComponents\":[\n {\"Id\":\"TARGET_APPLY\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"}, # Critical: ensure TARGET_APPLY logging at default\n {\"Id\":\"TARGET_LOAD\",\"Severity\":\"LOGGER_SEVERITY_DEFAULT\"} # Critical: ensure TARGET_LOAD logging at default\n ]}}\n```", + "Other": "1. Open the AWS DMS console and go to Database migration tasks\n2. Select the replication task and choose Modify\n3. Expand Task settings (JSON) or Logging\n4. Enable CloudWatch logs (EnableLogging = true)\n5. Set log components:\n - TARGET_APPLY severity: DEFAULT\n - TARGET_LOAD severity: DEFAULT\n6. Save changes (Modify task), then rerun the task if required", + "Terraform": "```hcl\n# Enable DMS task logging for target components\nresource \"aws_dms_replication_task\" \"\" {\n replication_task_id = \"\"\n replication_instance_arn = \"\"\n source_endpoint_arn = \"\"\n target_endpoint_arn = \"\"\n migration_type = \"full-load\"\n table_mappings = jsonencode({ rules = [{\n \"rule-type\" : \"selection\", \"rule-id\" : \"1\", \"rule-name\" : \"1\",\n \"object-locator\" : { \"schema-name\" : \"%\", \"table-name\" : \"%\" },\n \"rule-action\" : \"include\"\n }]} )\n\n # Critical: enables logging and sets TARGET_APPLY and TARGET_LOAD to minimum required severity\n replication_task_settings = jsonencode({\n Logging = {\n EnableLogging = true\n LogComponents = [\n { Id = \"TARGET_APPLY\", Severity = \"LOGGER_SEVERITY_DEFAULT\" },\n { Id = \"TARGET_LOAD\", Severity = \"LOGGER_SEVERITY_DEFAULT\" }\n ]\n }\n })\n}\n```" }, "Recommendation": { - "Text": "Enable logging for target database DMS replication tasks with a minimum severity level of LOGGER_SEVERITY_DEFAULT.", - "Url": "https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.Logging.html" + "Text": "Enable and maintain **CloudWatch logging** at `LOGGER_SEVERITY_DEFAULT` or higher for target components:\n- Configure `TARGET_APPLY` and `TARGET_LOAD`\n- Enforce least-privilege log access\n- Monitor logs/alerts for anomalies\n- Standardize task settings and validate data for **defense in depth**", + "Url": "https://hub.prowler.com/check/dms_replication_task_target_logging_enabled" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.metadata.json b/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.metadata.json index 416bd22a7a..edd64d4ae0 100644 --- a/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.metadata.json +++ b/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.metadata.json @@ -1,29 +1,39 @@ { "Provider": "aws", "CheckID": "drs_job_exist", - "CheckTitle": "Ensure DRS is enabled with jobs.", - "CheckType": [], + "CheckTitle": "Region has AWS Elastic Disaster Recovery (DRS) enabled with at least one recovery job", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "drs", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:drs:region:account-id:job/job-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Ensure DRS is enabled with jobs.", - "Risk": "If DRS is not enabled with jobs, then it may not be able to recover from a disaster.", - "RelatedUrl": "https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html", + "Description": "**AWS Elastic Disaster Recovery** is assessed per Region to verify the service is **initialized** and that at least one **recovery or drill job** exists, demonstrating that failover has been exercised.", + "Risk": "Without DRS enabled or any prior jobs, workloads are **unprotected and untested**, undermining **availability**.\nDuring outages or ransomware, recovery may be delayed or fail, increasing RTO/RPO, causing **data loss** and prolonged downtime.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://aws.amazon.com/blogs/storage/cross-region-disaster-recovery-using-aws-elastic-disaster-recovery/", + "https://docs.aws.amazon.com/drs/latest/userguide/quick-start-guide-gs.html", + "https://aws.amazon.com/disaster-recovery/", + "https://docs.aws.amazon.com/drs/latest/userguide/recovery-job.html" + ], "Remediation": { "Code": { "CLI": "", "NativeIaC": "", - "Other": "", + "Other": "1. In the AWS Console, switch to the target Region\n2. Open Elastic Disaster Recovery (DRS)\n3. Click \"Set default replication settings\" (or Settings > Initialize) and choose \"Configure and initialize\" to enable DRS in this Region\n4. Go to \"Source servers\" > \"Add server\", copy the install command, run it on one server, and wait until it shows Data replication status = Healthy and Ready for recovery\n5. Select that server, choose \"Initiate recovery drill\" (or \"Initiate recovery\") and confirm to create a job\n6. Verify under \"Recovery job history\" that the job completes", "Terraform": "" }, "Recommendation": { - "Text": "Ensure DRS is enabled with jobs.", - "Url": "https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html" + "Text": "Enable DRS in required Regions and protect critical workloads. Define RTO/RPO and run **regular recovery drills** to validate launch settings and dependencies. Apply **least privilege**, monitor replication health, and document failover procedures to ensure consistent, repeatable recovery.", + "Url": "https://hub.prowler.com/check/drs_job_exist" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.metadata.json index fd755c6489..630765920b 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.metadata.json @@ -1,28 +1,35 @@ { "Provider": "aws", "CheckID": "dynamodb_accelerator_cluster_encryption_enabled", - "CheckTitle": "Check if DynamoDB DAX Clusters are encrypted at rest.", + "CheckTitle": "DynamoDB DAX cluster has encryption at rest enabled", "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:dax:region:account-id:cache/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "Check if DynamoDB DAX Clusters are encrypted at rest.", - "Risk": "Encryption at rest provides an additional layer of data protection by securing your data from unauthorized access to the underlying storage.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionAtRest.html", + "Description": "**Amazon DynamoDB Accelerator (DAX) clusters** are evaluated for **server-side `encryption at rest`**. The finding indicates whether the cluster's on-disk cache, configuration, and logs are encrypted using service-managed keys.", + "Risk": "Without **encryption at rest**, DAX on-disk cache and logs can be extracted from underlying storage by those with low-level access, compromising **confidentiality** and enabling offline data mining.\n\nThreats:\n- Compromised host or admin\n- Lost/retired media\n- Unauthorized backups or snapshots", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionAtRest.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DAX/encryption-enabled.html", + "https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/dynamodb.html" + ], "Remediation": { "Code": { - "CLI": "aws dax create-cluster --cluster-name --node-type --replication-factor --iam-role-arn --sse-specification Enabled=true", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_23#cloudformation", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_23#terraform" + "CLI": "aws dax create-cluster --cluster-name --node-type --replication-factor 1 --iam-role-arn --sse-specification Enabled=true", + "NativeIaC": "```yaml\nResources:\n DaxCluster:\n Type: AWS::DAX::Cluster\n Properties:\n ClusterName: \n NodeType: \n ReplicationFactor: 1\n IAMRoleARN: \n SSESpecification: # Critical: enables encryption at rest\n SSEEnabled: true # Encrypts DAX cluster data at rest\n```", + "Other": "1. In the AWS console, open **DynamoDB** > under **DAX**, choose **Clusters** > **Create cluster**\n2. Enter a name and choose a node type\n3. In **Encryption**, select **Enable encryption**\n4. Choose the IAM role and required networking, then click **Launch cluster**\n5. If replacing an existing unencrypted cluster: point your application to the new cluster endpoint, then delete the old cluster", + "Terraform": "```hcl\nresource \"aws_dax_cluster\" \"example\" {\n cluster_name = \"\"\n node_type = \"\"\n replication_factor = 1\n iam_role_arn = \"\"\n\n # Critical: enables encryption at rest\n server_side_encryption {\n enabled = true # Encrypts DAX cluster data at rest\n }\n}\n```" }, "Recommendation": { - "Text": "Re-create the cluster to enable encryption at rest if it was not enabled at creation.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionAtRest.html" + "Text": "Provision DAX clusters with **`encryption at rest`** enabled. Apply **least privilege** for DAX administration and data access, and monitor with logging.\n\nAdopt **defense in depth**: enable encryption in transit, restrict network exposure, and avoid caching highly sensitive data. Re-create unencrypted clusters to enforce this setting.", + "Url": "https://hub.prowler.com/check/dynamodb_accelerator_cluster_encryption_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.metadata.json index 50741ae1c2..328815df1d 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.metadata.json @@ -1,28 +1,33 @@ { "Provider": "aws", "CheckID": "dynamodb_accelerator_cluster_in_transit_encryption_enabled", - "CheckTitle": "Check if DynamoDB Accelerator (DAX) clusters are encrypted in transit.", + "CheckTitle": "DynamoDB Accelerator (DAX) cluster has encryption in transit enabled", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dynamodb:region:account-id:table/table-name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "This control checks whether an Amazon DynamoDB Accelerator (DAX) cluster is encrypted in transit, with the endpoint encryption type set to TLS. The control fails if the DAX cluster isn't encrypted in transit.", - "Risk": "Without encryption in transit, DAX clusters are vulnerable to person-in-the-middle attacks or eavesdropping on network traffic, which could lead to unauthorized access or manipulation of sensitive data.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionInTransit.html", + "Description": "**DAX clusters** have endpoint encryption set to `TLS`, enforcing **encryption in transit** for client connections to the cluster", + "Risk": "Missing **TLS** enables interception and manipulation of DAX traffic, impacting:\n- Confidentiality: exposure of queries, data, or credentials\n- Integrity: tampered requests/responses and cache poisoning\n- Availability: session hijacking or replay causing service disruption", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-7", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionInTransit.html" + ], "Remediation": { "Code": { "CLI": "aws dax create-cluster --cluster-name --node-type --replication-factor --cluster-endpoint-encryption-type TLS", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-7", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Create DAX cluster with TLS (encryption in transit)\nResources:\n :\n Type: AWS::DAX::Cluster\n Properties:\n ClusterName: \n IAMRoleARN: \n NodeType: \n ReplicationFactor: 1\n ClusterEndpointEncryptionType: TLS # Critical: Enables TLS for in-transit encryption\n```", + "Other": "1. In the AWS Console, go to DynamoDB > DAX\n2. Click Create cluster\n3. Set Cluster name, Node type, Replication factor, and IAM role\n4. Enable Encryption in transit (TLS)\n5. Create the cluster and wait until ACTIVE\n6. Update your application to use the new DAX cluster endpoint\n7. Delete the old non-TLS DAX cluster", + "Terraform": "```hcl\n# DAX cluster with encryption in transit enabled\nresource \"aws_dax_cluster\" \"\" {\n cluster_name = \"\"\n node_type = \"\"\n replication_factor = 1\n iam_role_arn = \"\"\n cluster_endpoint_encryption_type = \"TLS\" # Critical: Enables TLS for in-transit encryption\n}\n```" }, "Recommendation": { - "Text": "Ensure that DynamoDB Accelerator (DAX) clusters are encrypted in transit by enabling TLS during cluster creation.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionInTransit.html" + "Text": "Enforce **TLS** for all DAX endpoints and clients (`encryption in transit`). If an existing cluster lacks it, create a new TLS-enabled cluster and migrate.\n\nApply **defense in depth**: restrict network paths, keep access private, and use **least privilege** IAM to reduce blast radius.", + "Url": "https://hub.prowler.com/check/dynamodb_accelerator_cluster_in_transit_encryption_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.metadata.json index a39e2ae9bf..25497712f3 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.metadata.json @@ -1,30 +1,38 @@ { "Provider": "aws", "CheckID": "dynamodb_accelerator_cluster_multi_az", - "CheckTitle": "Check if DynamoDB Accelerator (DAX) clusters have nodes in multiple availability zones.", - "CheckType": [], + "CheckTitle": "DynamoDB Accelerator (DAX) cluster has nodes in multiple Availability Zones", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Denial of Service" + ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dax:region:account-id:cache/table-name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", - "Description": "This control checks whether an Amazon DynamoDB Accelerator (DAX) cluster has nodes in multiple availability zones.", - "Risk": "Without DAX nodes in multiple availability zones (AZ) the nodes are at risk of interruption if an AZ disruption occurs.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.concepts.cluster.html#DAX.concepts.regions-and-azs", + "Description": "**Amazon DynamoDB Accelerator (DAX)** cluster node placement across **Availability Zones** is evaluated. Clusters with nodes in more than one AZ within the Region are recognized as multi-AZ; clusters whose nodes reside in a single AZ are recognized as single-AZ.", + "Risk": "Without **multi-AZ DAX nodes**, an AZ outage or primary node failure can render the cache **unavailable**, harming **availability** and causing **latency spikes** and **throttling** as load shifts to DynamoDB. Loss of caching can drive higher costs and trigger **timeout cascades** in read-heavy workloads.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000233618-ensure-dynamodb-accelerator-dax-clusters-have-nodes-in-multiple-availability-zones", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.concepts.cluster.html#DAX.concepts.regions-and-azs", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.create-cluster.console.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws dax increase-replication-factor --cluster-name --new-replication-factor 2 --availability-zones ", + "NativeIaC": "```yaml\nResources:\n DAXCluster:\n Type: AWS::DAX::Cluster\n Properties:\n ClusterName: \n IAMRoleARN: \n NodeType: \n ReplicationFactor: 2 # CRITICAL: at least 2 nodes so nodes can be placed in multiple AZs\n SubnetGroupName: \n AvailabilityZones: # CRITICAL: specify multiple AZs to ensure multi-AZ placement\n - \n - \n```", + "Other": "1. In AWS Console, go to DynamoDB > DAX > Subnet groups and ensure the subnet group used by the cluster includes subnets from at least two Availability Zones; save if you add one.\n2. Go to DynamoDB > DAX > Clusters, select , and choose Modify.\n3. Set Cluster size to 2 or more.\n4. In Availability Zones (or node placement), select at least two different AZs.\n5. Save changes and wait until status is Available, then confirm nodes show multiple AZs in Cluster details.", + "Terraform": "```hcl\nresource \"aws_dax_cluster\" \"example\" {\n cluster_name = \"\"\n node_type = \"\"\n replication_factor = 2 # CRITICAL: at least 2 nodes to allow multi-AZ\n iam_role_arn = \"\"\n subnet_group_name = \"\"\n availability_zones = [\"\", \"\"] # CRITICAL: ensures nodes are in multiple AZs\n}\n```" }, "Recommendation": { - "Text": "Create a DAX cluster with nodes in multiple availability zones.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.concepts.cluster.html#DAX.concepts.regions-and-azs" + "Text": "Deploy **DAX clusters** with at least `3` nodes spread across distinct **Availability Zones** to ensure fault tolerance. Use subnet groups spanning multiple AZs, access via the cluster endpoint, and validate **failover** regularly. Monitor capacity to avoid single-AZ or single-node dependencies.", + "Url": "https://hub.prowler.com/check/dynamodb_accelerator_cluster_multi_az" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.metadata.json index bb77b56de1..17b9e81f99 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.metadata.json @@ -1,31 +1,39 @@ { "Provider": "aws", "CheckID": "dynamodb_table_autoscaling_enabled", - "CheckTitle": "Check if DynamoDB tables automatically scale capacity with demand.", + "CheckTitle": "DynamoDB table uses on-demand capacity or has auto scaling enabled for read and write capacity units", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Denial of Service", + "Effects/Resource Consumption" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dynamodb:region:account-id:table/table-name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDynamoDbTable", - "Description": "This check ensures that DynamoDB tables can scale their read and write capacity as needed, either using on-demand capacity mode or provisioned mode with auto scaling configured.", - "Risk": "If DynamoDB tables do not automatically scale capacity with demand, they may experience throttling exceptions, leading to reduced availability and performance of applications.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.Console.html#AutoScaling.Console.ExistingTable", + "Description": "**DynamoDB tables** use **automatic capacity scaling** via `on-demand` mode or `PROVISIONED` mode with **auto scaling** enabled for both `read` and `write` capacity units.\n\nProvisioned tables are evaluated for scaling on both dimensions.", + "Risk": "**Insufficient capacity scaling** causes throttling that degrades **availability** and increases latency.\n\nSustained throttling can trigger retry storms, timeouts, and backlogs, risking missed writes or out-of-order processing that impacts **data integrity** and drives **operational costs**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-1", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.Console.html#AutoScaling.Console.ExistingTable" + ], "Remediation": { "Code": { "CLI": "aws dynamodb update-table --table-name --billing-mode PAY_PER_REQUEST", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-1", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Set table to on-demand capacity\nResources:\n :\n Type: AWS::DynamoDB::Table\n Properties:\n AttributeDefinitions:\n - AttributeName: id\n AttributeType: S\n KeySchema:\n - AttributeName: id\n KeyType: HASH\n BillingMode: PAY_PER_REQUEST # Critical: enables on-demand capacity to pass the control\n```", + "Other": "1. Open the AWS console and go to DynamoDB\n2. Click Tables and select your table\n3. Open the Additional settings tab and click Edit in Read/write capacity\n4. Set Capacity mode to On-demand (PAY_PER_REQUEST)\n5. Click Save", + "Terraform": "```hcl\n# DynamoDB table with on-demand capacity\nresource \"aws_dynamodb_table\" \"\" {\n name = \"\"\n hash_key = \"id\"\n\n attribute {\n name = \"id\"\n type = \"S\"\n }\n\n billing_mode = \"PAY_PER_REQUEST\" # Critical: enables on-demand capacity to pass the control\n}\n```" }, "Recommendation": { - "Text": "Enable DynamoDB automatic scaling on existing tables by configuring on-demand capacity mode or provisioned mode with auto scaling.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.Console.html#AutoScaling.Console.ExistingTable" + "Text": "Adopt **elastic capacity**: prefer `on-demand` for unpredictable traffic, or use `PROVISIONED` with **auto scaling** on both reads and writes.\n\nDefine safe utilization targets and bounds, monitor consumption, and plan for bursts to maintain **availability** and **resilience** over manual fixed throughput.", + "Url": "https://hub.prowler.com/check/dynamodb_table_autoscaling_enabled" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.metadata.json index 1ab8b56140..2c18fa16aa 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.metadata.json @@ -1,32 +1,39 @@ { "Provider": "aws", "CheckID": "dynamodb_table_cross_account_access", - "CheckTitle": "DynamoDB tables should not be accessible from other AWS accounts", + "CheckTitle": "DynamoDB table resource-based policy does not allow cross-account access", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:dynamodb:region:account-id:table/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDynamoDbTable", - "Description": "This check determines if the DynamoDB table is accessible from other AWS accounts.", - "Risk": "If the DynamoDB table is accessible from other AWS accounts, it may lead to unauthorized access to the data stored in the table.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-resource-based.html", + "Description": "**DynamoDB tables** are evaluated for **resource-based policies** that permit cross-account or public principals.\n\nTables without a resource policy, or with policies restricted to the same account, are identified as isolated configurations.", + "Risk": "Allowing other accounts to access a table affects:\n- **Confidentiality**: unauthorized reads/data exfiltration\n- **Integrity**: writes or deletes by external principals\n- **Availability**: capacity exhaustion and throttling\n- **Cost**: owner pays for external requests\n\nIf public principals are allowed, exposure can be unrestricted.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000233614-ensure-dynamodb-tables-should-not-be-accessible-from-other-aws-accounts", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-resource-based.html", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-bpa-rbp.html" + ], "Remediation": { "Code": { "CLI": "aws dynamodb delete-resource-policy --resource-arn ", "NativeIaC": "", - "Other": "", + "Other": "1. Open the AWS Console and go to DynamoDB > Tables\n2. Select and open the Permissions tab\n3. In Resource-based policy, click Delete policy and confirm\n4. Save changes to remove any cross-account access", "Terraform": "" }, "Recommendation": { - "Text": "Ensure that the DynamoDB table is not accessible from other AWS accounts.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-bpa-rbp.html" + "Text": "Apply **least privilege**:\n- Avoid cross-account data access; *if required*, allow only named principals\n- Constrain with `aws:PrincipalOrgID`, `aws:SourceVpc`, `aws:PrincipalArn`; add `Deny` guardrails\n- Enable **Block Public Access** and monitor with **IAM Access Analyzer**", + "Url": "https://hub.prowler.com/check/dynamodb_table_cross_account_access" } }, "Categories": [ - "trustboundaries" + "trust-boundaries" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.metadata.json index 5516e61c76..28c5ab7c89 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.metadata.json @@ -1,31 +1,39 @@ { "Provider": "aws", "CheckID": "dynamodb_table_deletion_protection_enabled", - "CheckTitle": "Check if DynamoDB tables have deletion protection enabled.", + "CheckTitle": "DynamoDB table has deletion protection enabled", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dynamodb:region:account-id:table/table-name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDynamoDbTable", - "Description": "This control checks whether an Amazon DynamoDB table has deletion protection enabled to prevent accidental deletion during regular table management operations.", - "Risk": "If deletion protection is not enabled, a DynamoDB table could be accidentally deleted, leading to data loss and potential disruption of business operations.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html#WorkingWithTables.Basics.DeletionProtection", + "Description": "**DynamoDB tables** have **deletion protection** enabled via the `deletion protection` setting, meaning delete operations require this setting to be disabled first", + "Risk": "Without **deletion protection**, tables can be removed by authorized actions or misconfigured automation, causing irrecoverable data loss and service outage. This impacts **integrity** and **availability**, and increases the blast radius of compromised credentials or mistaken runbooks.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-6", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html#WorkingWithTables.Basics.DeletionProtection" + ], "Remediation": { "Code": { - "CLI": "aws dynamodb update-table --table-name --deletion-protection-enabled", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-6", - "Terraform": "" + "CLI": "aws dynamodb update-table --table-name --deletion-protection-enabled", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::DynamoDB::Table\n Properties:\n DeletionProtectionEnabled: true # CRITICAL: Enables deletion protection to prevent table deletion\n```", + "Other": "1. Open the AWS Management Console and go to DynamoDB\n2. Select the table\n3. Choose Additional settings\n4. Enable Deletion protection\n5. Save changes", + "Terraform": "```hcl\nresource \"aws_dynamodb_table\" \"\" {\n name = \"\"\n hash_key = \"id\"\n\n attribute {\n name = \"id\"\n type = \"S\"\n }\n\n deletion_protection_enabled = true # CRITICAL: Prevents accidental table deletion\n}\n```" }, "Recommendation": { - "Text": "Enable deletion protection for your DynamoDB tables to prevent accidental deletion.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html#WorkingWithTables.Basics.DeletionProtection" + "Text": "Enable **deletion protection** on critical tables.\n- Enforce **least privilege** to restrict who can modify this setting\n- Require change control to disable it before planned deletes\n- Combine with **PITR** and backups for defense in depth\n- Use automation to make this the default for new tables", + "Url": "https://hub.prowler.com/check/dynamodb_table_deletion_protection_enabled" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.metadata.json index 663c7f7e84..af18daf064 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.metadata.json @@ -1,32 +1,38 @@ { "Provider": "aws", "CheckID": "dynamodb_table_protected_by_backup_plan", - "CheckTitle": "Check if DynamoDB tables are included in a backup plan.", + "CheckTitle": "DynamoDB table is protected by a backup plan", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:dynamodb:region:account-id:table/table-name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDynamoDbTable", - "Description": "This control checks whether an Amazon DynamoDB table is covered by a backup plan. The control fails if the DynamoDB table isn't included in a backup plan.", - "Risk": "If a DynamoDB table is not covered by a backup plan, data loss may occur due to accidental deletion, corruption, or unexpected failure, compromising the resilience of your application.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html", + "Description": "**DynamoDB tables** are evaluated for inclusion in an **AWS Backup backup plan** through resource assignments, including explicit tables, resource-type wildcards, or all-resources coverage.\n\nThe result indicates whether a table is governed by scheduled backups and retention defined by the plan.", + "Risk": "Without a backup plan, table data lacks governed copies, harming **availability** and **integrity**. Accidental deletes, corrupt writes, or malicious actions can become unrecoverable, and RPO/RTO worsen. You also forfeit cross-Region/account copies and immutability features, increasing downtime and data loss.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/CreateBackupAWS.html", + "https://aws.amazon.com/blogs/database/set-up-scheduled-backups-for-amazon-dynamodb-using-aws-backup/" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-4", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Add DynamoDB tables to an AWS Backup plan\nResources:\n BackupPlan:\n Type: AWS::Backup::BackupPlan\n Properties:\n BackupPlan:\n BackupPlanName: \n BackupPlanRule:\n - RuleName: r\n TargetBackupVault: Default\n\n BackupSelection:\n Type: AWS::Backup::BackupSelection\n Properties:\n BackupPlanId: !Ref BackupPlan\n BackupSelection:\n SelectionName: \n IamRoleArn: \n Resources:\n - arn:aws:dynamodb:*:*:table/* # CRITICAL: adds all DynamoDB tables to the backup plan, making them protected\n```", + "Other": "1. In the AWS Backup console, go to Settings > Configure resources and enable DynamoDB, then Confirm\n2. Go to Backup plans > Create backup plan > Build a new plan\n3. Enter a plan name, set Rule name to any value, set Backup vault to Default, and Create plan\n4. On the plan page, choose Assign resources\n5. Enter a Resource assignment name, set IAM role to Default role, select your DynamoDB table, and choose Assign resources", + "Terraform": "```hcl\n# Terraform: Add DynamoDB tables to an AWS Backup plan\nresource \"aws_backup_plan\" \"\" {\n name = \"\"\n rule {\n rule_name = \"r\"\n target_vault_name = \"Default\"\n }\n}\n\ndata \"aws_iam_role\" \"\" {\n name = \"AWSServiceRoleForBackup\"\n}\n\nresource \"aws_backup_selection\" \"\" {\n name = \"\"\n plan_id = aws_backup_plan..id\n iam_role_arn = data.aws_iam_role..arn\n resources = [\n \"arn:aws:dynamodb:*:*:table/*\" # CRITICAL: adds all DynamoDB tables to the backup plan, making them protected\n ]\n}\n```" }, "Recommendation": { - "Text": "Ensure that all active DynamoDB tables are included in a backup plan to safeguard against data loss.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html" + "Text": "Place all critical tables under an **AWS Backup backup plan** following **defense in depth** and **least privilege**:\n- Use tag-based assignments for coverage at scale\n- Define schedules, retention, and cross-Region/account copies\n- Enable **Vault Lock** for immutability\n- Regularly test restores and restrict backup deletion", + "Url": "https://hub.prowler.com/check/dynamodb_table_protected_by_backup_plan" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.metadata.json index 935834773c..c419aa472d 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.metadata.json @@ -1,28 +1,34 @@ { "Provider": "aws", "CheckID": "dynamodb_tables_kms_cmk_encryption_enabled", - "CheckTitle": "Check if DynamoDB table has encryption at rest enabled using CMK KMS.", + "CheckTitle": "DynamoDB table is encrypted at rest with AWS KMS", "CheckType": [ - "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Software and Configuration Checks/AWS Security Best Practices" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:dynamodb:region:account-id:table/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDynamoDbTable", - "Description": "Check if DynamoDB table has encryption at rest enabled using CMK KMS.", - "Risk": "All user data stored in Amazon DynamoDB is fully encrypted at rest. This functionality helps reduce the operational burden and complexity involved in protecting sensitive data.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html", + "Description": "**DynamoDB tables** use **AWS KMS keys** (`KMS`) for encryption at rest instead of the default service-owned key", + "Risk": "Relying on the default service-owned key reduces control over **confidentiality**: no custom key policies, limited auditability, and no independent rotation or disablement. This weakens least-privilege enforcement and incident response, and can impede meeting mandates that require customer-controlled keys.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.prowler.com/checks/aws/general-policies/ensure-that-dynamodb-tables-are-encrypted#terraform", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-dynamodb-tables-are-encrypted#terraform" + "CLI": "aws dynamodb update-table --table-name --sse-specification Enabled=true,SSEType=KMS", + "NativeIaC": "```yaml\n# CloudFormation: Enable KMS encryption on a DynamoDB table\nResources:\n :\n Type: AWS::DynamoDB::Table\n Properties:\n AttributeDefinitions:\n - AttributeName: id\n AttributeType: S\n KeySchema:\n - AttributeName: id\n KeyType: HASH\n BillingMode: PAY_PER_REQUEST\n SSESpecification:\n SSEEnabled: true # Critical: enables KMS-based encryption\n SSEType: KMS # Critical: switches from DEFAULT to AWS KMS\n```", + "Other": "1. Open the AWS Management Console and go to DynamoDB\n2. Select your table\n3. In Table details, find Encryption at rest and click Edit\n4. Select AWS KMS: choose AWS managed key (alias/aws/dynamodb) or a customer managed key\n5. Click Save", + "Terraform": "```hcl\nresource \"aws_dynamodb_table\" \"\" {\n name = \"\"\n billing_mode = \"PAY_PER_REQUEST\"\n hash_key = \"id\"\n\n attribute {\n name = \"id\"\n type = \"S\"\n }\n\n server_side_encryption {\n enabled = true # Critical: enables AWS KMS encryption (uses AWS managed key if no key ARN provided)\n }\n}\n```" }, "Recommendation": { - "Text": "Specify an encryption key when you create a new table or switch the encryption keys on an existing table by using the AWS Management Console.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html" + "Text": "Encrypt tables with **KMS keys** in your account-prefer **customer-managed keys** for sensitive data.\n\n- Enforce least-privilege key policies and scope grants\n- Enable rotation and monitor key usage\n- Separate duties for key admins vs data users\n- Restrict which principals can use the key for DynamoDB", + "Url": "https://hub.prowler.com/check/dynamodb_tables_kms_cmk_encryption_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.metadata.json b/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.metadata.json index 9fc7112c6e..4ba8d96275 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.metadata.json +++ b/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.metadata.json @@ -1,31 +1,38 @@ { "Provider": "aws", "CheckID": "dynamodb_tables_pitr_enabled", - "CheckTitle": "Check if DynamoDB tables point-in-time recovery (PITR) is enabled.", + "CheckTitle": "DynamoDB table has point-in-time recovery (PITR) enabled", "CheckType": [ - "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "dynamodb", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:dynamodb:region:account-id:table/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsDynamoDbTable", - "Description": "Check if DynamoDB tables point-in-time recovery (PITR) is enabled.", - "Risk": "If the DynamoDB Table does not have point-in-time recovery enabled, it is vulnerable to accidental write or delete operations.", - "RelatedUrl": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html", + "Description": "**DynamoDB tables** have **Point-in-Time Recovery** (`PITR`) enabled", + "Risk": "Without **PITR**, unintended or malicious writes/deletes cannot be precisely rolled back, leading to permanent data loss and corrupted state. Failures from buggy deployments, compromised credentials, or faulty batch jobs reduce data **integrity** and **availability**, and prolong incident recovery and forensic analysis.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html", + "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery.Tutorial.html" + ], "Remediation": { "Code": { "CLI": "aws dynamodb update-continuous-backups --table-name --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_6#cloudformation--serverless", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_6#terraform" + "NativeIaC": "```yaml\n# CloudFormation: enable PITR on a DynamoDB table\nResources:\n :\n Type: AWS::DynamoDB::Table\n Properties:\n PointInTimeRecoverySpecification:\n PointInTimeRecoveryEnabled: true # Critical: enables Point-in-Time Recovery (PITR)\n```", + "Other": "1. Open the AWS Management Console and go to DynamoDB\n2. Select your table and open the Backups tab\n3. Click Edit in the Point-in-time recovery section and choose Turn on point-in-time recovery\n4. Click Save", + "Terraform": "```hcl\n# Enable PITR on a DynamoDB table\nresource \"aws_dynamodb_table\" \"\" {\n name = \"\"\n billing_mode = \"PAY_PER_REQUEST\"\n hash_key = \"id\"\n\n attribute {\n name = \"id\"\n type = \"S\"\n }\n\n point_in_time_recovery {\n enabled = true # Critical: enables PITR\n }\n}\n```" }, "Recommendation": { - "Text": "Enable point-in-time recovery, this is not enabled by default.", - "Url": "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html" + "Text": "Enable **PITR** on critical tables and set a recovery window aligned to your RPO (1-35 days). Enforce **least privilege** on who can modify backup settings. Regularly test restores and monitor backup status. Embed PITR in IaC and change control for consistency, and apply **defense in depth** with on-demand backups for key milestones.", + "Url": "https://hub.prowler.com/check/dynamodb_tables_pitr_enabled" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "Data Protection" diff --git a/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/__init__.py b/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled.metadata.json b/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled.metadata.json new file mode 100644 index 0000000000..450f2d96c5 --- /dev/null +++ b/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled.metadata.json @@ -0,0 +1,34 @@ +{ + "Provider": "gcp", + "CheckID": "cloudstorage_bucket_lifecycle_management_enabled", + "CheckTitle": "Cloud Storage buckets have lifecycle management enabled", + "CheckType": [], + "ServiceName": "cloudstorage", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "storage.googleapis.com/Bucket", + "Description": "**Google Cloud Storage buckets** are evaluated for the presence of **lifecycle management** with at least one valid rule (supported action and non-empty condition) to automatically transition or delete objects and optimize storage costs.", + "Risk": "Buckets without lifecycle rules can accumulate stale data, increase storage costs, and fail to meet data retention and internal compliance requirements.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudStorage/enable-lifecycle-management.html", + "https://cloud.google.com/storage/docs/lifecycle" + ], + "Remediation": { + "Code": { + "CLI": "gcloud storage buckets update gs:// --lifecycle-file=", + "NativeIaC": "", + "Other": "1) Open Google Cloud Console → Storage → Buckets → \n2) Tab 'Lifecycle'\n3) Add rule(s) to delete or transition objects (e.g., delete after 365 days; transition STANDARD→NEARLINE after 90 days)\n4) Save", + "Terraform": "```hcl\n# Example: enable lifecycle to transition and delete objects\nresource \"google_storage_bucket\" \"example\" {\n name = var.bucket_name\n location = var.location\n\n # Transition STANDARD → NEARLINE after 90 days\n lifecycle_rule {\n action {\n type = \"SetStorageClass\"\n storage_class = \"NEARLINE\"\n }\n condition {\n age = 90\n matches_storage_class = [\"STANDARD\"]\n }\n }\n\n # Delete objects after 365 days\n lifecycle_rule {\n action {\n type = \"Delete\"\n }\n condition {\n age = 365\n }\n }\n}\n```" + }, + "Recommendation": { + "Text": "Configure lifecycle rules to automatically delete stale objects or transition them to colder storage classes according to your organization's retention and cost-optimization policy.", + "Url": "https://hub.prowler.com/check/cloudstorage_bucket_lifecycle_management_enabled" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled.py b/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled.py new file mode 100644 index 0000000000..951bf57d4f --- /dev/null +++ b/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled.py @@ -0,0 +1,48 @@ +from prowler.lib.check.models import Check, Check_Report_GCP +from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import ( + cloudstorage_client, +) + + +class cloudstorage_bucket_lifecycle_management_enabled(Check): + """Ensure Cloud Storage buckets have lifecycle management enabled with at least one valid rule. + + Reports PASS if a bucket has at least one valid lifecycle rule + (with a supported action and condition), otherwise FAIL. + + """ + + def execute(self) -> list[Check_Report_GCP]: + """Run the lifecycle management check for each Cloud Storage bucket. + + Returns: + list[Check_Report_GCP]: Results for all evaluated buckets. + """ + + findings = [] + for bucket in cloudstorage_client.buckets: + report = Check_Report_GCP(metadata=self.metadata(), resource=bucket) + report.status = "FAIL" + report.status_extended = ( + f"Bucket {bucket.name} does not have lifecycle management enabled." + ) + + rules = bucket.lifecycle_rules + + if rules: + valid_rules = [] + for rule in rules: + action_type = rule.get("action", {}).get("type") + condition = rule.get("condition") + if action_type and condition: + valid_rules.append(rule) + + if valid_rules: + report.status = "PASS" + report.status_extended = f"Bucket {bucket.name} has lifecycle management enabled with {len(valid_rules)} valid rule(s)." + else: + report.status = "FAIL" + report.status_extended = f"Bucket {bucket.name} has lifecycle rules configured but none are valid." + + findings.append(report) + return findings diff --git a/prowler/providers/gcp/services/cloudstorage/cloudstorage_service.py b/prowler/providers/gcp/services/cloudstorage/cloudstorage_service.py index 294455077c..7d155d254f 100644 --- a/prowler/providers/gcp/services/cloudstorage/cloudstorage_service.py +++ b/prowler/providers/gcp/services/cloudstorage/cloudstorage_service.py @@ -31,6 +31,14 @@ class CloudStorage(GCPService): bucket_iam ) or "allUsers" in str(bucket_iam): public = True + + lifecycle_rules = None + lifecycle = bucket.get("lifecycle") + if isinstance(lifecycle, dict): + rules = lifecycle.get("rule") + if isinstance(rules, list): + lifecycle_rules = rules + self.buckets.append( Bucket( name=bucket["name"], @@ -42,6 +50,7 @@ class CloudStorage(GCPService): public=public, retention_policy=bucket.get("retentionPolicy"), project_id=project_id, + lifecycle_rules=lifecycle_rules, ) ) @@ -62,3 +71,4 @@ class Bucket(BaseModel): public: bool project_id: str retention_policy: Optional[dict] = None + lifecycle_rules: Optional[list[dict]] = None diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py index c6cca1fab2..166f7b7ee8 100644 --- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py +++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py @@ -14,35 +14,37 @@ class logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled( 'resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"' in metric.filter ): + metric_name = getattr(metric, "name", None) or "unknown" report = Check_Report_GCP( metadata=self.metadata(), resource=metric, + resource_id=metric_name, + project_id=metric.project_id, location=logging_client.region, - resource_name=metric.name if metric.name else "Log Metric Filter", + resource_name=( + metric_name if metric_name != "unknown" else "Log Metric Filter" + ), ) projects_with_metric.add(metric.project_id) report.status = "FAIL" - report.status_extended = f"Log metric filter {metric.name} found but no alerts associated in project {metric.project_id}." + report.status_extended = f"Log metric filter {metric_name} found but no alerts associated in project {metric.project_id}." for alert_policy in monitoring_client.alert_policies: for filter in alert_policy.filters: - if metric.name in filter: + if metric_name in filter: report.status = "PASS" - report.status_extended = f"Log metric filter {metric.name} found with alert policy {alert_policy.display_name} associated in project {metric.project_id}." + report.status_extended = f"Log metric filter {metric_name} found with alert policy {alert_policy.display_name} associated in project {metric.project_id}." break findings.append(report) for project in logging_client.project_ids: if project not in projects_with_metric: + project_obj = logging_client.projects.get(project) report = Check_Report_GCP( metadata=self.metadata(), - resource=logging_client.projects[project], + resource=project_obj, project_id=project, location=logging_client.region, - resource_name=( - logging_client.projects[project].name - if logging_client.projects[project].name - else "GCP Project" - ), + resource_name=(getattr(project_obj, "name", None) or "GCP Project"), ) report.status = "FAIL" report.status_extended = f"There are no log metric filters or alerts associated in project {project}." diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py index 9f3cb38d29..8c8927ec32 100644 --- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py +++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py @@ -14,35 +14,38 @@ class logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled( '(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")' in metric.filter ): + metric_name = getattr(metric, "name", None) or "unknown" report = Check_Report_GCP( metadata=self.metadata(), resource=metric, + resource_id=metric_name, + project_id=metric.project_id, location=logging_client.region, - resource_name=metric.name if metric.name else "Log Metric Filter", + resource_name=( + metric_name if metric_name != "unknown" else "Log Metric Filter" + ), ) projects_with_metric.add(metric.project_id) report.status = "FAIL" - report.status_extended = f"Log metric filter {metric.name} found but no alerts associated in project {metric.project_id}." + report.status_extended = f"Log metric filter {metric_name} found but no alerts associated in project {metric.project_id}." for alert_policy in monitoring_client.alert_policies: for filter in alert_policy.filters: - if metric.name in filter: + if metric_name in filter: report.status = "PASS" - report.status_extended = f"Log metric filter {metric.name} found with alert policy {alert_policy.display_name} associated in project {metric.project_id}." + report.status_extended = f"Log metric filter {metric_name} found with alert policy {alert_policy.display_name} associated in project {metric.project_id}." break findings.append(report) for project in logging_client.project_ids: if project not in projects_with_metric: + project_obj = logging_client.projects.get(project) report = Check_Report_GCP( metadata=self.metadata(), - resource=logging_client.projects[project], + resource=project_obj, + resource_id=project, project_id=project, location=logging_client.region, - resource_name=( - logging_client.projects[project].name - if logging_client.projects[project].name - else "GCP Project" - ), + resource_name=(getattr(project_obj, "name", None) or "GCP Project"), ) report.status = "FAIL" report.status_extended = f"There are no log metric filters or alerts associated in project {project}." diff --git a/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py b/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py index e57ff0e671..30104a050d 100644 --- a/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py +++ b/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py @@ -12,32 +12,32 @@ class logging_sink_created(Check): for project in logging_client.project_ids: if project not in projects_with_logging_sink.keys(): + project_obj = logging_client.projects.get(project) report = Check_Report_GCP( metadata=self.metadata(), - resource=logging_client.projects[project], + resource=project_obj, + resource_id=project, project_id=project, location=logging_client.region, - resource_name=( - logging_client.projects[project].name - if logging_client.projects[project].name - else "GCP Project" - ), + resource_name=(getattr(project_obj, "name", None) or "GCP Project"), ) report.status = "FAIL" report.status_extended = f"There are no logging sinks to export copies of all the log entries in project {project}." findings.append(report) else: + sink = projects_with_logging_sink[project] + sink_name = getattr(sink, "name", None) or "unknown" report = Check_Report_GCP( metadata=self.metadata(), - resource=projects_with_logging_sink[project], + resource=sink, + resource_id=sink_name, + project_id=project, location=logging_client.region, resource_name=( - projects_with_logging_sink[project].name - if projects_with_logging_sink[project].name - else "Logging Sink" + sink_name if sink_name != "unknown" else "Logging Sink" ), ) report.status = "PASS" - report.status_extended = f"Sink {projects_with_logging_sink[project].name} is enabled exporting copies of all the log entries in project {project}." + report.status_extended = f"Sink {sink_name} is enabled exporting copies of all the log entries in project {project}." findings.append(report) return findings diff --git a/prowler/providers/github/services/organization/organization_default_repository_permission_strict/__init__.py b/prowler/providers/github/services/organization/organization_default_repository_permission_strict/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict.metadata.json b/prowler/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict.metadata.json new file mode 100644 index 0000000000..7c2e738958 --- /dev/null +++ b/prowler/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict.metadata.json @@ -0,0 +1,32 @@ +{ + "Provider": "github", + "CheckID": "organization_default_repository_permission_strict", + "CheckTitle": "Ensure strict base repository permissions are set for the organization", + "CheckType": [], + "ServiceName": "organization", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "GitHubOrganization", + "Description": "Ensure the organization's base repository permission for members is set to 'read' or 'none' to minimize risk.", + "Risk": "If base repository permissions allow 'write' or 'admin' by default, organization members may unintentionally gain excessive privileges across repositories, increasing the risk of unauthorized changes or accidental modifications.", + "RelatedUrl": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/setting-base-permissions-for-an-organization", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Set the organization's base repository permission to 'read' or 'none' for members, unless stricter requirements are needed.", + "Url": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/setting-base-permissions-for-an-organization" + } + }, + "AdditionalURLs": [], + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} + diff --git a/prowler/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict.py b/prowler/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict.py new file mode 100644 index 0000000000..3d31f00bbc --- /dev/null +++ b/prowler/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict.py @@ -0,0 +1,36 @@ +from typing import List + +from prowler.lib.check.models import Check, CheckReportGithub +from prowler.providers.github.services.organization.organization_client import ( + organization_client, +) + + +class organization_default_repository_permission_strict(Check): + """Check if an organization's base repository permission is set to a strict level. + + PASS: base permission is "read" or "none" + FAIL: base permission is "write" or "admin" (or any other non-strict value) + """ + + def execute(self) -> List[CheckReportGithub]: + findings = [] + for org in organization_client.organizations.values(): + base_perm = getattr(org, "base_permission", None) + if base_perm is None: + # Unknown / no permission to read → skip producing a finding + continue + + p = str(base_perm).lower() + report = CheckReportGithub(metadata=self.metadata(), resource=org) + + if p in ("read", "none"): + report.status = "PASS" + report.status_extended = f"Organization {org.name} base repository permission is '{p}', which is strict." + else: + report.status = "FAIL" + report.status_extended = f"Organization {org.name} base repository permission is '{p}', which is not strict." + + findings.append(report) + + return findings diff --git a/prowler/providers/github/services/organization/organization_service.py b/prowler/providers/github/services/organization/organization_service.py index 9bbc5f2671..484ebcd378 100644 --- a/prowler/providers/github/services/organization/organization_service.py +++ b/prowler/providers/github/services/organization/organization_service.py @@ -5,7 +5,7 @@ from pydantic.v1 import BaseModel from prowler.lib.logger import logger from prowler.providers.github.lib.service.service import GithubService -from prowler.providers.github.models import GithubAppIdentityInfo, GithubIdentityInfo +from prowler.providers.github.models import GithubAppIdentityInfo class Organization(GithubService): @@ -38,13 +38,15 @@ class Organization(GithubService): org_names_to_check = set() try: - for client in self.clients: - if self.provider.organizations: + for client in getattr(self, "clients", []) or []: + if getattr(self.provider, "organizations", None): org_names_to_check.update(self.provider.organizations) # If repositories are specified without organizations, don't perform organization checks # Only add repository owners to organization checks if organizations are also specified - if self.provider.repositories and self.provider.organizations: + if getattr(self.provider, "repositories", None) and getattr( + self.provider, "organizations", None + ): for repo_name in self.provider.repositories: if "/" in repo_name: owner_name = repo_name.split("/")[0] @@ -111,18 +113,19 @@ class Organization(GithubService): logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) - elif not self.provider.repositories: + elif not getattr(self.provider, "repositories", None): # Default behavior: get all organizations the user is a member of # Only when no repositories are specified - if isinstance(self.provider.identity, GithubIdentityInfo): + if isinstance(self.provider.identity, GithubAppIdentityInfo): + orgs = client.get_organizations() + if getattr(orgs, "totalCount", 0) > 0: + for org in orgs: + self._process_organization(org, organizations) + else: + # Default (personal access/OAuth): use user organizations orgs = client.get_user().get_orgs() for org in orgs: self._process_organization(org, organizations) - elif isinstance(self.provider.identity, GithubAppIdentityInfo): - orgs = client.get_organizations() - if orgs.totalCount > 0: - for org in orgs: - self._process_organization(org, organizations) except github.RateLimitExceededException as error: logger.error(f"GitHub API rate limit exceeded: {error}") @@ -144,10 +147,22 @@ class Organization(GithubService): logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + + # Base permission (default repository permission for members) + base_perm: Optional[str] = None + try: + base_perm = getattr(org, "default_repository_permission", None) + except Exception as error: + logger.error( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + base_perm = None + organizations[org.id] = Org( id=org.id, name=org.login, mfa_required=require_mfa, + base_permission=base_perm, ) @@ -157,3 +172,4 @@ class Org(BaseModel): id: int name: str mfa_required: Optional[bool] = False + base_permission: Optional[str] = None diff --git a/prowler/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled.py b/prowler/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled.py index 6f0fbc281d..647eb8176a 100644 --- a/prowler/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled.py +++ b/prowler/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled.py @@ -2,7 +2,6 @@ from prowler.lib.check.models import Check, CheckReportM365 from prowler.providers.m365.services.entra.entra_client import entra_client from prowler.providers.m365.services.entra.entra_service import ( AdminRoles, - AuthenticationStrength, ConditionalAccessPolicyState, ) @@ -47,7 +46,25 @@ class entra_admin_users_phishing_resistant_mfa_enabled(Check): if ( policy.grant_controls.authentication_strength is not None and policy.grant_controls.authentication_strength - == AuthenticationStrength.PHISHING_RESISTANT_MFA + != "Multifactor authentication" + and policy.grant_controls.authentication_strength != "Passwordless MFA" + and policy.grant_controls.authentication_strength + != "Phishing-resistant MFA" + ): + report = CheckReportM365( + metadata=self.metadata(), + resource=policy, + resource_name=policy.display_name, + resource_id=policy.id, + ) + report.status = "MANUAL" + report.status_extended = f"Conditional Access Policy '{policy.display_name}' has a custom authentication strength, review it is Phishing-resistant MFA." + continue + + if ( + policy.grant_controls.authentication_strength is not None + and policy.grant_controls.authentication_strength + == "Phishing-resistant MFA" ): report = CheckReportM365( metadata=self.metadata(), diff --git a/prowler/providers/m365/services/entra/entra_service.py b/prowler/providers/m365/services/entra/entra_service.py index 7c566b484a..e7751fdef9 100644 --- a/prowler/providers/m365/services/entra/entra_service.py +++ b/prowler/providers/m365/services/entra/entra_service.py @@ -253,9 +253,7 @@ class Entra(M365Service): ) ), authentication_strength=( - AuthenticationStrength( - policy.grant_controls.authentication_strength.display_name - ) + policy.grant_controls.authentication_strength.display_name if policy.grant_controls is not None and policy.grant_controls.authentication_strength is not None @@ -455,6 +453,7 @@ class ConditionalAccessPolicyState(Enum): class UserAction(Enum): REGISTER_SECURITY_INFO = "urn:user:registersecurityinfo" + REGISTER_DEVICE = "urn:user:registerdevice" class ApplicationsConditions(BaseModel): @@ -523,11 +522,19 @@ class SessionControls(BaseModel): class ConditionalAccessGrantControl(Enum): + """ + Built-in grant controls for Conditional Access policies. + Reference: https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccessgrantcontrols + """ + MFA = "mfa" BLOCK = "block" DOMAIN_JOINED_DEVICE = "domainJoinedDevice" PASSWORD_CHANGE = "passwordChange" COMPLIANT_DEVICE = "compliantDevice" + APPROVED_APPLICATION = "approvedApplication" + COMPLIANT_APPLICATION = "compliantApplication" + TERMS_OF_USE = "termsOfUse" class GrantControlOperator(Enum): @@ -535,16 +542,10 @@ class GrantControlOperator(Enum): OR = "OR" -class AuthenticationStrength(Enum): - MFA = "Multifactor authentication" - PASSWORDLESS_MFA = "Passwordless MFA" - PHISHING_RESISTANT_MFA = "Phishing-resistant MFA" - - class GrantControls(BaseModel): built_in_controls: List[ConditionalAccessGrantControl] operator: GrantControlOperator - authentication_strength: Optional[AuthenticationStrength] + authentication_strength: Optional[str] class ConditionalAccessPolicy(BaseModel): diff --git a/pyproject.toml b/pyproject.toml index 7b7934011c..0af7b5c479 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -76,7 +76,7 @@ maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"} name = "prowler" readme = "README.md" requires-python = ">3.9.1,<3.13" -version = "5.13.0" +version = "5.14.0" [project.scripts] prowler = "prowler.__main__:prowler" diff --git a/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py b/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py new file mode 100644 index 0000000000..d0d1057307 --- /dev/null +++ b/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py @@ -0,0 +1,253 @@ +import urllib.error +import urllib.request +from unittest import mock + +from prowler.providers.aws.services.codepipeline.codepipeline_service import ( + Pipeline, + Source, +) +from tests.providers.aws.utils import set_mocked_aws_provider + +AWS_REGION = "eu-west-1" +AWS_ACCOUNT_NUMBER = "123456789012" + + +class Test_codepipeline_project_repo_private: + """Tests for AWS CodePipeline repository privacy checks. + This module contains test cases to verify the functionality of checking + whether CodePipeline source repositories are private or public. + """ + + def test_pipeline_private_repo(self): + """Test detection of private repository in CodePipeline. + Tests that the check correctly identifies a private repository + when both GitHub and GitLab return 404. + """ + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider([AWS_REGION]), + ): + codepipeline_client = mock.MagicMock + pipeline_name = "test-pipeline" + pipeline_arn = f"arn:aws:codepipeline:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_name}" + connection_arn = f"arn:aws:codestar-connections:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:connection/test-connection" + repo_id = "prowler-cloud/prowler-private" + + codepipeline_client.pipelines = { + pipeline_arn: Pipeline( + name=pipeline_name, + arn=pipeline_arn, + region=AWS_REGION, + source=Source( + type="CodeStarSourceConnection", + repository_id=repo_id, + configuration={ + "FullRepositoryId": repo_id, + "ConnectionArn": connection_arn, + }, + ), + tags=[], + ) + } + + with ( + mock.patch( + "prowler.providers.aws.services.codepipeline.codepipeline_service.CodePipeline", + codepipeline_client, + ), + mock.patch( + "prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private.codepipeline_client", + codepipeline_client, + ), + mock.patch("boto3.client") as mock_client, + mock.patch("urllib.request.urlopen") as mock_urlopen, + ): + mock_connection = mock_client.return_value + mock_connection.get_connection.return_value = { + "Connection": {"ProviderType": "GitHub"} + } + + def mock_urlopen_side_effect(req, context=None): + raise urllib.error.HTTPError( + url="", code=404, msg="", hdrs={}, fp=None + ) + + mock_urlopen.side_effect = mock_urlopen_side_effect + + from prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private import ( + codepipeline_project_repo_private, + ) + + check = codepipeline_project_repo_private() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"CodePipeline {pipeline_name} source repository {repo_id} is private." + ) + assert result[0].resource_id == pipeline_name + assert result[0].resource_arn == pipeline_arn + assert result[0].resource_tags == [] + assert result[0].region == AWS_REGION + + def test_pipeline_public_github_repo(self): + """Test detection of public GitHub repository in CodePipeline. + Tests that the check correctly identifies a public GitHub repository + when GitHub returns 200. + """ + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider([AWS_REGION]), + ): + codepipeline_client = mock.MagicMock + pipeline_name = "test-pipeline" + pipeline_arn = f"arn:aws:codepipeline:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_name}" + connection_arn = f"arn:aws:codestar-connections:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:connection/test-connection" + repo_id = "prowler-cloud/prowler" + + codepipeline_client.pipelines = { + pipeline_arn: Pipeline( + name=pipeline_name, + arn=pipeline_arn, + region=AWS_REGION, + source=Source( + type="CodeStarSourceConnection", + repository_id=repo_id, + configuration={ + "FullRepositoryId": repo_id, + "ConnectionArn": connection_arn, + }, + ), + tags=[], + ) + } + + with ( + mock.patch( + "prowler.providers.aws.services.codepipeline.codepipeline_service.CodePipeline", + codepipeline_client, + ), + mock.patch( + "prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private.codepipeline_client", + codepipeline_client, + ), + mock.patch("boto3.client") as mock_client, + mock.patch("urllib.request.urlopen") as mock_urlopen, + ): + mock_connection = mock_client.return_value + mock_connection.get_connection.return_value = { + "Connection": {"ProviderType": "GitHub"} + } + + mock_response = mock.MagicMock() + mock_response.getcode.return_value = 200 + mock_response.geturl.return_value = f"https://github.com/{repo_id}" + + def mock_urlopen_side_effect(req, context=None): + if "github.com" in req.get_full_url(): + return mock_response + raise urllib.error.HTTPError( + url="", code=404, msg="", hdrs={}, fp=None + ) + + mock_urlopen.side_effect = mock_urlopen_side_effect + + from prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private import ( + codepipeline_project_repo_private, + ) + + check = codepipeline_project_repo_private() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"CodePipeline {pipeline_name} source repository is public: https://github.com/{repo_id}" + ) + assert result[0].resource_id == pipeline_name + assert result[0].resource_arn == pipeline_arn + assert result[0].resource_tags == [] + assert result[0].region == AWS_REGION + + def test_pipeline_public_gitlab_repo(self): + """Test detection of public GitLab repository in CodePipeline. + Tests that the check correctly identifies a public GitLab repository + when GitLab returns 200 without sign_in redirect. + """ + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider([AWS_REGION]), + ): + codepipeline_client = mock.MagicMock + pipeline_name = "test-pipeline" + pipeline_arn = f"arn:aws:codepipeline:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_name}" + connection_arn = f"arn:aws:codestar-connections:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:connection/test-connection" + repo_id = "prowler-cloud/prowler-private" + + codepipeline_client.pipelines = { + pipeline_arn: Pipeline( + name=pipeline_name, + arn=pipeline_arn, + region=AWS_REGION, + source=Source( + type="CodeStarSourceConnection", + repository_id=repo_id, + configuration={ + "FullRepositoryId": repo_id, + "ConnectionArn": connection_arn, + }, + ), + tags=[], + ) + } + + with ( + mock.patch( + "prowler.providers.aws.services.codepipeline.codepipeline_service.CodePipeline", + codepipeline_client, + ), + mock.patch( + "prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private.codepipeline_client", + codepipeline_client, + ), + mock.patch("boto3.client") as mock_client, + mock.patch("urllib.request.urlopen") as mock_urlopen, + ): + mock_connection = mock_client.return_value + mock_connection.get_connection.return_value = { + "Connection": {"ProviderType": "GitLab"} + } + + mock_response = mock.MagicMock() + mock_response.getcode.return_value = 200 + mock_response.geturl.return_value = f"https://gitlab.com/{repo_id}" + + def mock_urlopen_side_effect(req, context=None): + if "gitlab.com" in req.get_full_url(): + return mock_response + raise urllib.error.HTTPError( + url="", code=404, msg="", hdrs={}, fp=None + ) + + mock_urlopen.side_effect = mock_urlopen_side_effect + + from prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private import ( + codepipeline_project_repo_private, + ) + + check = codepipeline_project_repo_private() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"CodePipeline {pipeline_name} source repository is public: https://gitlab.com/{repo_id}" + ) + assert result[0].resource_id == pipeline_name + assert result[0].resource_arn == pipeline_arn + assert result[0].resource_tags == [] + assert result[0].region == AWS_REGION diff --git a/tests/providers/aws/services/codepipeline/codepipeline_service_test.py b/tests/providers/aws/services/codepipeline/codepipeline_service_test.py new file mode 100644 index 0000000000..d2584e9b65 --- /dev/null +++ b/tests/providers/aws/services/codepipeline/codepipeline_service_test.py @@ -0,0 +1,105 @@ +from unittest.mock import patch + +import botocore +from moto import mock_aws + +from prowler.providers.aws.services.codepipeline.codepipeline_service import ( + CodePipeline, + Pipeline, + Source, +) +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_COMMERCIAL_PARTITION, + AWS_REGION_EU_WEST_1, + set_mocked_aws_provider, +) + +pipeline_name = "test-pipeline" +pipeline_arn = f"arn:{AWS_COMMERCIAL_PARTITION}:codepipeline:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:{pipeline_name}" +source_type = "CodeStarSourceConnection" +repository_id = "prowler-cloud/prowler-private" +connection_arn = f"arn:{AWS_COMMERCIAL_PARTITION}:codestar-connections:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:connection/test" + +# Mocking API calls +make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call(self, operation_name, kwarg): + if operation_name == "ListPipelines": + return {"pipelines": [{"name": pipeline_name}]} + elif operation_name == "GetPipeline": + return { + "pipeline": { + "name": pipeline_name, + "stages": [ + { + "name": "Source", + "actions": [ + { + "name": "Source", + "actionTypeId": { + "category": "Source", + "owner": "AWS", + "provider": source_type, + "version": "1", + }, + "configuration": { + "ConnectionArn": connection_arn, + "FullRepositoryId": repository_id, + }, + } + ], + } + ], + }, + } + elif operation_name == "ListTagsForResource": + return {"tags": [{"key": "Environment", "value": "Test"}]} + return make_api_call(self, operation_name, kwarg) + + +# Mock generate_regional_clients() +def mock_generate_regional_clients(provider, service): + regional_client = provider._session.current_session.client( + service, region_name=AWS_REGION_EU_WEST_1 + ) + regional_client.region = AWS_REGION_EU_WEST_1 + return {AWS_REGION_EU_WEST_1: regional_client} + + +class Test_CodePipeline_Service: + @patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call) + @patch( + "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients", + new=mock_generate_regional_clients, + ) + @mock_aws + def test_codepipeline_service(self): + codepipeline = CodePipeline(set_mocked_aws_provider()) + + assert codepipeline.session.__class__.__name__ == "Session" + assert codepipeline.service == "codepipeline" + + # Test pipeline properties + assert len(codepipeline.pipelines) == 1 + assert isinstance(codepipeline.pipelines, dict) + assert isinstance(codepipeline.pipelines[pipeline_arn], Pipeline) + + pipeline = codepipeline.pipelines[pipeline_arn] + assert pipeline.name == pipeline_name + assert pipeline.arn == pipeline_arn + assert pipeline.region == AWS_REGION_EU_WEST_1 + + # Test source properties + assert isinstance(pipeline.source, Source) + assert pipeline.source.type == source_type + assert pipeline.source.repository_id == repository_id + assert pipeline.source.configuration == { + "ConnectionArn": connection_arn, + "FullRepositoryId": repository_id, + } + + # Test tags + assert pipeline.tags[0]["key"] == "Environment" + assert pipeline.tags[0]["value"] == "Test" diff --git a/tests/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled_test.py b/tests/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled_test.py new file mode 100644 index 0000000000..17016645a7 --- /dev/null +++ b/tests/providers/gcp/services/cloudstorage/cloudstorage_bucket_lifecycle_management_enabled/cloudstorage_bucket_lifecycle_management_enabled_test.py @@ -0,0 +1,223 @@ +from unittest import mock + +from tests.providers.gcp.gcp_fixtures import ( + GCP_PROJECT_ID, + GCP_US_CENTER1_LOCATION, + set_mocked_gcp_provider, +) + + +class TestCloudStorageBucketLifecycleManagementEnabled: + def test_bucket_without_lifecycle_rules(self): + cloudstorage_client = mock.MagicMock() + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_client", + new=cloudstorage_client, + ), + ): + from prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled import ( + cloudstorage_bucket_lifecycle_management_enabled, + ) + from prowler.providers.gcp.services.cloudstorage.cloudstorage_service import ( + Bucket, + ) + + cloudstorage_client.project_ids = [GCP_PROJECT_ID] + cloudstorage_client.region = GCP_US_CENTER1_LOCATION + + cloudstorage_client.buckets = [ + Bucket( + name="no-lifecycle", + id="no-lifecycle", + region=GCP_US_CENTER1_LOCATION, + uniform_bucket_level_access=True, + public=False, + retention_policy=None, + project_id=GCP_PROJECT_ID, + lifecycle_rules=[], + ) + ] + + check = cloudstorage_bucket_lifecycle_management_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Bucket {cloudstorage_client.buckets[0].name} does not have lifecycle management enabled." + ) + assert result[0].resource_id == "no-lifecycle" + assert result[0].resource_name == "no-lifecycle" + assert result[0].location == GCP_US_CENTER1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + + def test_bucket_with_minimal_delete_rule(self): + cloudstorage_client = mock.MagicMock() + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_client", + new=cloudstorage_client, + ), + ): + from prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled import ( + cloudstorage_bucket_lifecycle_management_enabled, + ) + from prowler.providers.gcp.services.cloudstorage.cloudstorage_service import ( + Bucket, + ) + + cloudstorage_client.project_ids = [GCP_PROJECT_ID] + cloudstorage_client.region = GCP_US_CENTER1_LOCATION + + cloudstorage_client.buckets = [ + Bucket( + name="delete-rule", + id="delete-rule", + region=GCP_US_CENTER1_LOCATION, + uniform_bucket_level_access=True, + public=False, + retention_policy=None, + project_id=GCP_PROJECT_ID, + lifecycle_rules=[ + {"action": {"type": "Delete"}, "condition": {"age": 30}} + ], + ) + ] + + check = cloudstorage_bucket_lifecycle_management_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Bucket {cloudstorage_client.buckets[0].name} has lifecycle management enabled with 1 valid rule(s)." + ) + assert result[0].resource_id == "delete-rule" + assert result[0].resource_name == "delete-rule" + assert result[0].location == GCP_US_CENTER1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + + def test_bucket_with_transition_and_delete_rules(self): + cloudstorage_client = mock.MagicMock() + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_client", + new=cloudstorage_client, + ), + ): + from prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled import ( + cloudstorage_bucket_lifecycle_management_enabled, + ) + from prowler.providers.gcp.services.cloudstorage.cloudstorage_service import ( + Bucket, + ) + + cloudstorage_client.project_ids = [GCP_PROJECT_ID] + cloudstorage_client.region = GCP_US_CENTER1_LOCATION + + cloudstorage_client.buckets = [ + Bucket( + name="transition-delete", + id="transition-delete", + region=GCP_US_CENTER1_LOCATION, + uniform_bucket_level_access=True, + public=False, + retention_policy=None, + project_id=GCP_PROJECT_ID, + lifecycle_rules=[ + { + "action": { + "type": "SetStorageClass", + "storageClass": "NEARLINE", + }, + "condition": {"matchesStorageClass": ["STANDARD"]}, + }, + {"action": {"type": "Delete"}, "condition": {"age": 365}}, + ], + ) + ] + + check = cloudstorage_bucket_lifecycle_management_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Bucket {cloudstorage_client.buckets[0].name} has lifecycle management enabled with 2 valid rule(s)." + ) + assert result[0].resource_id == "transition-delete" + assert result[0].resource_name == "transition-delete" + assert result[0].location == GCP_US_CENTER1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + + def test_bucket_with_invalid_lifecycle_rules(self): + cloudstorage_client = mock.MagicMock() + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_client", + new=cloudstorage_client, + ), + ): + from prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_lifecycle_management_enabled.cloudstorage_bucket_lifecycle_management_enabled import ( + cloudstorage_bucket_lifecycle_management_enabled, + ) + from prowler.providers.gcp.services.cloudstorage.cloudstorage_service import ( + Bucket, + ) + + cloudstorage_client.project_ids = [GCP_PROJECT_ID] + cloudstorage_client.region = GCP_US_CENTER1_LOCATION + + cloudstorage_client.buckets = [ + Bucket( + name="invalid-rules", + id="invalid-rules", + region=GCP_US_CENTER1_LOCATION, + uniform_bucket_level_access=True, + public=False, + retention_policy=None, + project_id=GCP_PROJECT_ID, + lifecycle_rules=[ + {"action": {}, "condition": {"age": 30}}, + {"action": {"type": "Delete"}, "condition": {}}, + ], + ) + ] + + check = cloudstorage_bucket_lifecycle_management_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Bucket {cloudstorage_client.buckets[0].name} has lifecycle rules configured but none are valid." + ) + assert result[0].resource_id == "invalid-rules" + assert result[0].resource_name == "invalid-rules" + assert result[0].location == GCP_US_CENTER1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py index 371168fc28..e2b7b2d068 100644 --- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py +++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py @@ -259,3 +259,141 @@ class Test_logging_log_metric_filter_and_alert_for_bucket_permission_changes_ena assert result[0].resource_name == "metric_name" assert result[0].project_id == GCP_PROJECT_ID assert result[0].location == GCP_EU1_LOCATION + + def test_log_metric_filters_with_none_name(self): + """Test that metric with None name uses fallback 'Log Metric Filter'""" + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled import ( + logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled, + ) + + # Create a MagicMock metric object with name=None + metric = MagicMock() + metric.name = None + metric.filter = 'resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"' + metric.project_id = GCP_PROJECT_ID + + logging_client.metrics = [metric] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_name == "Log Metric Filter" + assert ( + result[0].resource_id == "unknown" + ) # resource_id should never be None + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + # When name is None, the 'or' pattern makes it use "unknown" + assert "unknown" in result[0].status_extended + + def test_log_metric_filters_with_missing_name_attribute(self): + """Test that metric without name attribute uses fallback 'Log Metric Filter'""" + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled import ( + logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled, + ) + + # Create a MagicMock metric object without name attribute + metric = MagicMock(spec=["filter", "project_id"]) + metric.filter = 'resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"' + metric.project_id = GCP_PROJECT_ID + + logging_client.metrics = [metric] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_name == "Log Metric Filter" + assert ( + result[0].resource_id == "unknown" + ) # resource_id should never be None + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + + def test_project_not_in_projects_dict(self): + """Test that project not in projects dict uses None and fallback name""" + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled import ( + logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled, + ) + + logging_client.metrics = [] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + # Project is in project_ids but NOT in projects dict + logging_client.projects = {} + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_name == "GCP Project" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py index 4732becb7f..0ea0798e03 100644 --- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py +++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py @@ -259,3 +259,136 @@ class Test_logging_log_metric_filter_and_alert_for_project_ownership_changes_ena assert result[0].resource_name == "metric_name" assert result[0].project_id == GCP_PROJECT_ID assert result[0].location == GCP_EU1_LOCATION + + def test_log_metric_filters_with_none_name(self): + """Test that metric with None name uses fallback 'Log Metric Filter'""" + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled import ( + logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled, + ) + + # Create a MagicMock metric object with name=None + metric = MagicMock() + metric.name = None + metric.filter = '(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")' + metric.project_id = GCP_PROJECT_ID + + logging_client.metrics = [metric] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_name == "Log Metric Filter" + assert result[0].resource_id == "unknown" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + assert "unknown" in result[0].status_extended + + def test_log_metric_filters_with_missing_name_attribute(self): + """Test that metric without name attribute uses fallback 'Log Metric Filter'""" + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled import ( + logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled, + ) + + # Create a MagicMock metric object without name attribute + metric = MagicMock(spec=["filter", "project_id"]) + metric.filter = '(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")' + metric.project_id = GCP_PROJECT_ID + + logging_client.metrics = [metric] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_name == "Log Metric Filter" + assert result[0].resource_id == "unknown" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + + def test_project_not_in_projects_dict(self): + """Test that project not in projects dict uses None and fallback name""" + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled import ( + logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled, + ) + + logging_client.metrics = [] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + # Project is in project_ids but NOT in projects dict + logging_client.projects = {} + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_name == "GCP Project" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION diff --git a/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py b/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py index a2bab6e5cd..b9c6481d22 100644 --- a/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py +++ b/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py @@ -211,3 +211,128 @@ class Test_logging_sink_created: result[0].status_extended == f"There are no logging sinks to export copies of all the log entries in project {GCP_PROJECT_ID}." ) + + def test_project_not_in_projects_dict(self): + """Test that project not in projects dict uses None and fallback name""" + logging_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created.logging_client", + new=logging_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created import ( + logging_sink_created, + ) + + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + logging_client.sinks = [] + # Project is in project_ids but NOT in projects dict + logging_client.projects = {} + + check = logging_sink_created() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_name == "GCP Project" + assert result[0].resource_id == GCP_PROJECT_ID + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + + def test_sink_with_none_name(self): + """Test that sink with None name uses fallback 'Logging Sink'""" + logging_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created.logging_client", + new=logging_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created import ( + logging_sink_created, + ) + + # Create a MagicMock sink object with name=None + sink = MagicMock() + sink.name = None + sink.filter = "all" + sink.project_id = GCP_PROJECT_ID + + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + logging_client.sinks = [sink] + logging_client.projects = { + GCP_PROJECT_ID: GCPProject( + id=GCP_PROJECT_ID, + number="123456789012", + name="test", + labels={}, + lifecycle_state="ACTIVE", + ) + } + + check = logging_sink_created() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].resource_name == "Logging Sink" + assert result[0].resource_id == "unknown" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + assert "unknown" in result[0].status_extended + + def test_sink_with_missing_name_attribute(self): + """Test that sink without name attribute uses fallback 'Logging Sink'""" + logging_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created.logging_client", + new=logging_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created import ( + logging_sink_created, + ) + + # Create a MagicMock sink object without name attribute + sink = MagicMock(spec=["filter", "project_id"]) + sink.filter = "all" + sink.project_id = GCP_PROJECT_ID + + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + logging_client.sinks = [sink] + logging_client.projects = { + GCP_PROJECT_ID: GCPProject( + id=GCP_PROJECT_ID, + number="123456789012", + name="test", + labels={}, + lifecycle_state="ACTIVE", + ) + } + + check = logging_sink_created() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].resource_name == "Logging Sink" + assert result[0].resource_id == "unknown" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION diff --git a/tests/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict_test.py b/tests/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict_test.py new file mode 100644 index 0000000000..c1001a44e1 --- /dev/null +++ b/tests/providers/github/services/organization/organization_default_repository_permission_strict/organization_default_repository_permission_strict_test.py @@ -0,0 +1,201 @@ +from unittest import mock + +from prowler.providers.github.services.organization.organization_service import Org +from tests.providers.github.github_fixtures import set_mocked_github_provider + + +class Test_organization_default_repository_permission_strict: + def test_no_organizations(self): + organization_client = mock.MagicMock + organization_client.organizations = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_github_provider(), + ), + mock.patch( + "prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict.organization_client", + new=organization_client, + ), + ): + from prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict import ( + organization_default_repository_permission_strict, + ) + + check = organization_default_repository_permission_strict() + result = check.execute() + assert len(result) == 0 + + def test_permission_read(self): + organization_client = mock.MagicMock + org_name = "test-organization" + organization_client.organizations = { + 1: Org( + id=1, + name=org_name, + base_permission="read", + ), + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_github_provider(), + ), + mock.patch( + "prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict.organization_client", + new=organization_client, + ), + ): + from prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict import ( + organization_default_repository_permission_strict, + ) + + check = organization_default_repository_permission_strict() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == 1 + assert result[0].resource_name == org_name + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Organization {org_name} base repository permission is 'read', which is strict." + ) + + def test_permission_none(self): + organization_client = mock.MagicMock + org_name = "test-organization" + organization_client.organizations = { + 1: Org( + id=1, + name=org_name, + base_permission="none", + ), + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_github_provider(), + ), + mock.patch( + "prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict.organization_client", + new=organization_client, + ), + ): + from prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict import ( + organization_default_repository_permission_strict, + ) + + check = organization_default_repository_permission_strict() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == 1 + assert result[0].resource_name == org_name + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Organization {org_name} base repository permission is 'none', which is strict." + ) + + def test_permission_write(self): + organization_client = mock.MagicMock + org_name = "test-organization" + organization_client.organizations = { + 1: Org( + id=1, + name=org_name, + base_permission="write", + ), + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_github_provider(), + ), + mock.patch( + "prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict.organization_client", + new=organization_client, + ), + ): + from prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict import ( + organization_default_repository_permission_strict, + ) + + check = organization_default_repository_permission_strict() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == 1 + assert result[0].resource_name == org_name + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Organization {org_name} base repository permission is 'write', which is not strict." + ) + + def test_permission_admin(self): + organization_client = mock.MagicMock + org_name = "test-organization" + organization_client.organizations = { + 1: Org( + id=1, + name=org_name, + base_permission="admin", + ), + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_github_provider(), + ), + mock.patch( + "prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict.organization_client", + new=organization_client, + ), + ): + from prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict import ( + organization_default_repository_permission_strict, + ) + + check = organization_default_repository_permission_strict() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == 1 + assert result[0].resource_name == org_name + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Organization {org_name} base repository permission is 'admin', which is not strict." + ) + + def test_permission_unknown_none_skipped(self): + organization_client = mock.MagicMock + org_name = "test-organization" + organization_client.organizations = { + 1: Org( + id=1, + name=org_name, + base_permission=None, + ), + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_github_provider(), + ), + mock.patch( + "prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict.organization_client", + new=organization_client, + ), + ): + from prowler.providers.github.services.organization.organization_default_repository_permission_strict.organization_default_repository_permission_strict import ( + organization_default_repository_permission_strict, + ) + + check = organization_default_repository_permission_strict() + result = check.execute() + assert len(result) == 0 diff --git a/tests/providers/github/services/organization/organization_service_test.py b/tests/providers/github/services/organization/organization_service_test.py index 45b85198de..22b65e3267 100644 --- a/tests/providers/github/services/organization/organization_service_test.py +++ b/tests/providers/github/services/organization/organization_service_test.py @@ -45,11 +45,13 @@ class Test_Organization_Scoping: self.mock_org1.id = 1 self.mock_org1.login = "test-org1" self.mock_org1.two_factor_requirement_enabled = True + self.mock_org1.default_repository_permission = None self.mock_org2 = MagicMock() self.mock_org2.id = 2 self.mock_org2.login = "test-org2" self.mock_org2.two_factor_requirement_enabled = False + self.mock_org2.default_repository_permission = None self.mock_user = MagicMock() self.mock_user.id = 100 @@ -175,6 +177,35 @@ class Test_Organization_Scoping: assert len(orgs) == 0 + def test_base_permission_extraction(self): + """Test that base_permission is populated from organization's default_repository_permission""" + provider = set_mocked_github_provider() + provider.repositories = [] + provider.organizations = ["test-org1"] + + mock_client = MagicMock() + # Organization with default_repository_permission set to "read" + org_with_perm = MagicMock() + org_with_perm.id = 1 + org_with_perm.login = "test-org1" + org_with_perm.two_factor_requirement_enabled = True + org_with_perm.default_repository_permission = "read" + mock_client.get_organization.return_value = org_with_perm + + with patch( + "prowler.providers.github.services.organization.organization_service.GithubService.__init__" + ): + organization_service = Organization(provider) + organization_service.clients = [mock_client] + organization_service.provider = provider + + orgs = organization_service._list_organizations() + + assert len(orgs) == 1 + assert 1 in orgs + assert orgs[1].name == "test-org1" + assert orgs[1].base_permission == "read" + def test_specific_organization_scoping(self): """Test that only specified organizations are returned""" provider = set_mocked_github_provider() @@ -287,11 +318,13 @@ class Test_Organization_Scoping: mock_owner_org.id = 1 mock_owner_org.login = "owner1" mock_owner_org.two_factor_requirement_enabled = True + mock_owner_org.default_repository_permission = None mock_specific_org = MagicMock() mock_specific_org.id = 2 mock_specific_org.login = "specific-org" mock_specific_org.two_factor_requirement_enabled = False + mock_specific_org.default_repository_permission = None mock_client.get_organization.side_effect = [ mock_owner_org, @@ -393,6 +426,7 @@ class Test_Organization_ErrorHandling: self.mock_org1.id = 1 self.mock_org1.login = "test-org1" self.mock_org1.two_factor_requirement_enabled = True + self.mock_org1.default_repository_permission = None def test_github_api_error_handling(self): """Test that GitHub API errors are handled properly""" diff --git a/tests/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled_test.py b/tests/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled_test.py index aa9ec89bca..b7ac4c2d12 100644 --- a/tests/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled_test.py +++ b/tests/providers/m365/services/entra/entra_admin_users_phishing_resistant_mfa_enabled/entra_admin_users_phishing_resistant_mfa_enabled_test.py @@ -3,7 +3,6 @@ from uuid import uuid4 from prowler.providers.m365.services.entra.entra_service import ( ApplicationsConditions, - AuthenticationStrength, ConditionalAccessGrantControl, ConditionalAccessPolicyState, Conditions, @@ -114,7 +113,7 @@ class Test_entra_admin_users_phishing_resistant_mfa_enabled: grant_controls=GrantControls( built_in_controls=[ConditionalAccessGrantControl.BLOCK], operator=GrantControlOperator.AND, - authentication_strength=AuthenticationStrength.PHISHING_RESISTANT_MFA, + authentication_strength="Phishing-resistant MFA", ), session_controls=SessionControls( persistent_browser=PersistentBrowser( @@ -206,7 +205,7 @@ class Test_entra_admin_users_phishing_resistant_mfa_enabled: grant_controls=GrantControls( built_in_controls=[ConditionalAccessGrantControl.BLOCK], operator=GrantControlOperator.AND, - authentication_strength=AuthenticationStrength.PHISHING_RESISTANT_MFA, + authentication_strength="Phishing-resistant MFA", ), session_controls=SessionControls( persistent_browser=PersistentBrowser( @@ -301,7 +300,7 @@ class Test_entra_admin_users_phishing_resistant_mfa_enabled: grant_controls=GrantControls( built_in_controls=[ConditionalAccessGrantControl.BLOCK], operator=GrantControlOperator.AND, - authentication_strength=AuthenticationStrength.PHISHING_RESISTANT_MFA, + authentication_strength="Phishing-resistant MFA", ), session_controls=SessionControls( persistent_browser=PersistentBrowser( diff --git a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py index 9ff7e31b43..9848507b93 100644 --- a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py +++ b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py @@ -7,7 +7,6 @@ from prowler.providers.m365.services.entra.entra_service import ( AdminConsentPolicy, AdminRoles, ApplicationsConditions, - AuthenticationStrength, AuthorizationPolicy, AuthPolicyRoles, ConditionalAccessGrantControl, @@ -75,7 +74,7 @@ async def mock_entra_get_conditional_access_policies(_): ConditionalAccessGrantControl.COMPLIANT_DEVICE, ], operator=GrantControlOperator.OR, - authentication_strength=AuthenticationStrength.PHISHING_RESISTANT_MFA, + authentication_strength="Phishing-resistant MFA", ), session_controls=SessionControls( persistent_browser=PersistentBrowser( @@ -226,7 +225,7 @@ class Test_Entra_Service: ConditionalAccessGrantControl.COMPLIANT_DEVICE, ], operator=GrantControlOperator.OR, - authentication_strength=AuthenticationStrength.PHISHING_RESISTANT_MFA, + authentication_strength="Phishing-resistant MFA", ), session_controls=SessionControls( persistent_browser=PersistentBrowser( diff --git a/ui/AGENTS.md b/ui/AGENTS.md index c7dacfd8dc..a7316a429f 100644 --- a/ui/AGENTS.md +++ b/ui/AGENTS.md @@ -390,6 +390,7 @@ ui/ ├── types/ # TypeScript type definitions ├── hooks/ # Custom React hooks ├── store/ # Zustand state management +├── tests/ # Playwright E2E tests └── styles/ # Global CSS & Tailwind config ``` @@ -683,13 +684,423 @@ const text = message.parts ### Playwright E2E Tests +**⚠ī¸ MANDATORY: If you have access to Playwright MCP tools, ALWAYS use them to understand the actual application flow before creating any E2E test.** + +- **IF Playwright MCP is available**: Use browser tools to navigate, interact, and understand the real UI behavior FIRST, then create tests +- **IF Playwright MCP is NOT available**: Proceed with test creation based on available documentation and code analysis - Add/update E2E tests for critical flows you modify - Scope: run only affected specs when iterating - Commit snapshot updates only with real UI changes - Determinism: avoid relying on real external services; mock or stub where possible +- **Organization**: Create a folder under `tests/` for each page (e.g., `tests/sign-in/`, `tests/sign-up/`, etc.) +- **File Structure**: Each page folder should contain 3 files: + - `{page-name}-page.ts` - Page Object Model + - `{page-name}.spec.ts` - Test specifications + - `{page-name}.md` - Test documentation +- **Base Class**: `tests/base-page.ts` - Parent class that all `{page-name}-page.ts` files should extend +- **Helpers**: `tests/helpers.ts` - Utility functions and helper methods for tests + +#### Playwright MCP Integration + +**⚠ī¸ CRITICAL WORKFLOW (When Available): If you have access to Playwright MCP browser tools, use them to explore the application BEFORE writing any test code.** + +**Recommended Steps Before Creating Tests (Only if MCP Tools are Available):** + +1. **Navigate to the application** to reach the target page +2. **Take a snapshot** to see the page structure and available elements +3. **Interact with forms and elements** to verify the exact user flow +4. **Take screenshots** to document expected states at each step +5. **Verify page transitions** by navigating through the complete flow to understand all states (loading, success, error) +6. **Document actual selectors** from the snapshots - use the real element references (ref) and labels you observe +7. **Only after exploring** the complete flow manually, create the test code with the exact selectors and steps you verified + +**Why This Matters (When MCP Tools are Available):** + +- ✅ **Precise test creation** - Only include the exact steps needed, no assumptions or guessing +- ✅ **Accurate selectors** - Use the actual DOM structure from real snapshots, not imagined selectors +- ✅ **Real flow validation** - Verify the complete user journey actually works as expected +- ✅ **Avoid over-engineering** - Create minimal tests that focus on what actually exists +- ✅ **Prevent flaky tests** - Tests based on real exploration are more stable and reliable +- ❌ **Never assume** - Don't create tests based on assumptions about how the UI "should" work + +**Benefits:** +- **Precise test creation** - Only include the exact steps needed for the test requirement +- **Accurate selectors** - Use the actual DOM structure to create reliable locators +- **Real flow validation** - Verify the complete user journey works as expected +- **Avoid over-engineering** - Create minimal tests that focus on the specific requirement + +#### Test Creation Guidelines + +**IMPORTANT: Always ask for clarification if the request is ambiguous about scope.** + +**When creating a specific test:** + +- Create only a single `test()` entry implementing the specific functionality described +- Do NOT create the full test suite for this page +- **ALWAYS add the test to the page's main spec file** (e.g., `sign-up.spec.ts`), NOT in a separate file +- **REUSE existing page objects** from other pages when possible (e.g., use existing SignInPage, HomePage, etc.) +- If the page's spec file doesn't exist, create minimal structure: + - `{page-name}-page.ts` - Page Object Model + - `{page-name}.spec.ts` - Test specifications (add your specific test here) +- Focus on the exact requirement without additional test cases +- Do NOT create separate files like `{page-name}-critical-path.spec.ts` or `{page-name}-specific-test.spec.ts` + +**When creating comprehensive page tests:** + +- Create the full test suite with all files (page object, spec, documentation) +- Include multiple test cases covering various scenarios in `{page-name}.spec.ts` +- Follow the complete structure with validation, error handling, accessibility tests +- Create comprehensive documentation for all test cases in `{page-name}.md` + +**File Naming Convention:** + +- ✅ **CORRECT**: `sign-up.spec.ts` (contains all sign-up tests) +- ✅ **CORRECT**: `sign-up-page.ts` (page object) +- ✅ **CORRECT**: `sign-up.md` (documentation for all tests) +- ❌ **WRONG**: `sign-up-critical-path.spec.ts` (separate file for specific test) +- ❌ **WRONG**: `sign-up-validation.spec.ts` (separate file for specific test) + +**Examples:** + +```typescript +// ✅ Specific test request - create only this test +test("User can create account and login successfully",{ + tag: ['@critical', '@e2e', '@signup', '@SIGNUP-E2E-001'] + } async ({ page }) => { + // Implementation for this specific test only +}); + +// ❌ Don't create full suite when only one test is requested +``` + +**Request Examples:** + +- **"Create a test for user sign-up"** → Create only the sign-up test, not the full suite +- **"Generate E2E tests for the login page"** → Create comprehensive test suite with all scenarios +- **"Add a test to verify form validation"** → Add only the validation test to existing spec +- **"Create tests for the home page"** → Create full test suite for home functionality +- **"Create a new test e2e for sign-up"** → Create only the specific test mentioned +- **"Generate comprehensive E2E tests for sign-up"** → Create full test suite + +**Key Phrases to Identify Scope:** + +- **Single Test**: "a test", "one test", "new test", "add test" +- **Full Suite**: "comprehensive tests", "all tests", "test suite", "complete tests", "generate tests" + +#### Page Object Model Pattern + +- **Extend BasePage**: All page objects should extend `BasePage` for common functionality +- **REUSE Existing Page Objects**: Always check for existing page objects before creating new ones +- **Interface Definitions**: Define clear interfaces for form data and credentials +- **Method Organization**: Group methods by functionality (navigation, form interaction, validation, etc.) +- **Locator Strategy**: Use stable selectors (name attributes, labels) over fragile CSS selectors +- **Avoid Code Duplication**: When creating a new page object, verify if there are repeated methods across page objects that should be moved to `BasePage` +- **Shared Utilities**: If utility functions are repeated across tests, create or update `tests/helpers.ts` to centralize them +- **Refactor to BasePage**: Common patterns like form validation, notification checks, or navigation should be extracted to `BasePage` +- **Refactor to Helpers**: Data generation, test setup utilities, or common assertions should be extracted to `tests/helpers.ts` + +#### Page Object Reuse Guidelines + +- **Check existing page objects first**: Look in `tests/` directory for existing page objects +- **Import and reuse**: Use existing page objects like `SignInPage`, `HomePage`, etc. +- **Create page objects when needed**: If a test requires interaction with a page that doesn't have a page object yet, create it following the Page Object Model pattern +- **Only create new page objects** when the page doesn't exist or has unique functionality +- **Example**: For a sign-up test that needs to verify login after signup, reuse `SignInPage` and `HomePage` if they exist, or create them if needed +- **Avoid duplication**: Don't recreate functionality that already exists in other page objects +- **Complete dependencies**: When creating a test that requires multiple page interactions, ensure all necessary page objects exist (create them if they don't) + +#### Code Refactoring Guidelines + +**When to move code to `BasePage`:** + +- ✅ **Navigation helpers** used by multiple pages (e.g., `waitForPageLoad()`, `getCurrentUrl()`) +- ✅ **Common UI interactions** (e.g., clicking notifications, handling modals, theme toggles) +- ✅ **Verification patterns** repeated across pages (e.g., `isVisible()`, `waitForVisible()`) +- ✅ **Error handling** that applies to all pages +- ✅ **Screenshot utilities** for debugging + +**When to move code to `tests/helpers.ts`:** + +- ✅ **Test data generation** (e.g., `generateUniqueEmail()`, `generateTestUser()`) +- ✅ **Setup/teardown utilities** (e.g., `createTestUser()`, `cleanupTestData()`) +- ✅ **Custom assertions** used across tests (e.g., `expectNotificationToContain()`) +- ✅ **API helpers** for test setup (e.g., `seedDatabase()`, `resetState()`) +- ✅ **Time utilities** (e.g., `waitForCondition()`, `retryAction()`) + +**Example - Before Refactoring:** + +```typescript +// ❌ BAD: Repeated code in multiple page objects +export class SignUpPage extends BasePage { + async waitForNotification(): Promise { + await this.page.waitForSelector('[role="status"]'); + } +} + +export class SignInPage extends BasePage { + async waitForNotification(): Promise { + await this.page.waitForSelector('[role="status"]'); + } +} +``` + +**Example - After Refactoring:** + +```typescript +// ✅ GOOD: Move to BasePage +export class BasePage { + async waitForNotification(): Promise { + await this.page.waitForSelector('[role="status"]'); + } + + async verifyNotificationMessage(message: string): Promise { + const notification = this.page.locator('[role="status"]'); + await expect(notification).toContainText(message); + } +} + +// ✅ GOOD: Move to helpers.ts for data generation +export function generateUniqueEmail(): string { + const timestamp = Date.now(); + return `test.user.${timestamp}@example.com`; +} + +export function generateTestUser() { + return { + name: "Test User", + email: generateUniqueEmail(), + password: "TestPassword123!", + }; +} +``` + +**Page Object Reuse Example:** + +```typescript +// ✅ GOOD: Check for existing page objects, create if needed +// 1. Check if SignInPage exists - if not, create it +// 2. Check if HomePage exists - if not, create it +import { SignInPage } from "../sign-in/sign-in-page"; +import { HomePage } from "../home/home-page"; + +test("User can sign up and login", async ({ page }) => { + const signUpPage = new SignUpPage(page); + const signInPage = new SignInPage(page); // REUSE existing (or create if missing) + const homePage = new HomePage(page); // REUSE existing (or create if missing) + + // Use existing functionality + await signUpPage.signUp(userData); + await homePage.verifyPageLoaded(); // REUSE existing method + await homePage.signOut(); // REUSE existing method + await signInPage.login(credentials); // REUSE existing method +}); + +// ❌ BAD: Don't recreate existing functionality in SignUpPage +export class SignUpPage extends BasePage { + // Don't recreate logout functionality + async logout() { + /* ... */ + } // ❌ HomePage already has this + + // Don't recreate login functionality + async login() { + /* ... */ + } // ❌ SignInPage already has this + + // ✅ GOOD: Instead, use composition or delegation + async loginAfterSignUp(credentials: LoginCredentials): Promise { + // Reuse SignInPage methods or delegate to it + const emailField = this.page.getByRole("textbox", { name: "Email*" }); + const passwordField = this.page.getByRole("textbox", { name: "Password*" }); + const loginButton = this.page.getByRole("button", { name: "Log in" }); + + await emailField.fill(credentials.email); + await passwordField.fill(credentials.password); + await loginButton.click(); + } +} +``` + +**Page Object Structure:** + +```typescript +export interface FeatureData { + email: string; + password: string; + // ... other fields +} + +export class FeaturePage extends BasePage { + // Form elements + readonly emailInput: Locator; + readonly passwordInput: Locator; + readonly submitButton: Locator; + + constructor(page: Page) { + super(page); + // Use stable selectors + this.emailInput = page.getByLabel("Email"); + this.passwordInput = page.locator('input[name="password"]'); + this.submitButton = page.getByRole("button", { name: "Submit" }); + } + + async goto(): Promise { + await super.goto("/feature-path"); + } + + async performAction(data: FeatureData): Promise { + await this.emailInput.fill(data.email); + await this.passwordInput.fill(data.password); + await this.submitButton.click(); + } + + async verifyCriticalOutcome(): Promise { + await expect(this.page).toHaveURL("/expected-path"); + // ... verification logic + } +} +``` + +#### Test Structure Best Practices + +- **Page Object Usage**: Use Page Object Models for all page interactions +- **Tag Organization**: Use Playwright tag syntax for test categorization +- **Test IDs**: Include test case IDs in tags for traceability +- **Verification Steps**: Include clear verification steps for each major action + +**Key Elements:** + +- **Page Objects**: All interactions through Page Object Models +- **Clear Tags**: Use `{ tag: ['@priority', '@type', '@feature', '@test-id'] }` syntax +- **Verification**: Explicit verification of critical outcomes + +#### Playwright Selector Best Practices + +When creating locators in Page Objects, follow this priority order for maximum reliability: + +**✅ Primary Selectors (Recommended):** + +- **`getByRole()`**: The best and most robust for all interactive elements (buttons, links, main sections) +- **`getByLabel()`**: The best for form controls that have an associated label + +**⚠ī¸ Secondary Selectors (Use Sparingly):** + +- **`getByText()`**: Use only when the above fail or for static text verification (headings, paragraphs, messages) +- **Others (e.g. `getByTestId()`)**: Use only as a last resort when the above fail or are not applicable + +**Examples:** + +```typescript +// ✅ GOOD - Using getByRole for interactive elements +this.submitButton = page.getByRole("button", { name: "Submit" }); +this.navigationLink = page.getByRole("link", { name: "Dashboard" }); + +// ✅ GOOD - Using getByLabel for form controls +this.emailInput = page.getByLabel("Email"); +this.passwordInput = page.getByLabel("Password"); + +// ⚠ī¸ SPARINGLY - Using getByText only when necessary +this.errorMessage = page.getByText("Invalid credentials"); // Only if no better selector exists +this.pageTitle = page.getByText("Welcome to Prowler"); // Only for static content verification + +// ❌ AVOID - Using fragile selectors when better options exist +this.submitButton = page.locator(".btn-primary"); // Use getByRole instead +this.emailInput = page.locator("#email"); // Use getByLabel instead +``` + +**Tag Syntax Example:** + +```typescript +test( + "Test description", + { tag: ["@critical", "@e2e", "@signup", "@SIGNUP-E2E-001"] }, + async ({ page }) => { + // Test implementation + }, +); +``` + +#### E2E Test Documentation Format + +Each test documentation file (`{page-name}.md`) should follow this structured format: + +```markdown +### E2E Tests: {Feature Name} + +**Suite ID:** `{SUITE-ID}` +**Feature:** {Feature description} + +--- + +## Test Case: `{TEST-ID}` - {Test case title} + +**Priority:** `{critical|high|medium|low}` + +**Tags:** + +- type → @e2e +- feature → @{feature-name} + +**Description/Objective:** {Brief description of what the test validates} + +**Preconditions:** + +- {List of prerequisites for the test to run} +- {Any required data or state} + +### Flow Steps: + +1. {Step 1 description} +2. {Step 2 description} +3. {Step 3 description} + ... + +### Expected Result: + +- {Expected outcome 1} +- {Expected outcome 2} + ... + +### Key verification points: + +- {Key assertion 1} +- {Key assertion 2} +- {Key assertion 3} + +### Notes: + +- {Any additional notes or considerations} +- {Test data requirements or constraints} +``` + +#### Test Documentation Best Practices +- **Suite ID Format**: Use descriptive suite IDs (e.g., `SIGNUP-E2E`) +- **Test ID Format**: Include feature and sequence (e.g., `SIGNUP-E2E-001`) +- **Priority Levels**: Use `critical`, `high`, `medium`, `low` for test prioritization +- **Tag Organization**: Use Playwright tag syntax: `{ tag: ['@priority', '@type', '@feature', '@test-id'] }` +- **Flow Steps**: Number steps clearly and describe user actions +- **Verification Points**: List specific assertions and expected outcomes +- **Preconditions**: Document any required setup or data dependencies +- **Test Data Notes**: Include information about data generation and uniqueness strategies + +**Tag Categories:** +- **Priority**: `@critical`, `@high`, `@medium`, `@low` +- **Type**: `@e2e` +- **Feature**: `@signup`, `@signin`, `@dashboard` +- **Test ID**: `@SIGNUP-E2E-001`, `@LOGIN-E2E-002` + +**IMPORTANT - Keep Documentation Concise:** +- ❌ **DO NOT** include general test running instructions +- ❌ **DO NOT** include file structure explanations +- ❌ **DO NOT** include code examples or tutorials +- ❌ **DO NOT** include extensive troubleshooting sections +- ❌ **DO NOT** include command references or configuration details +- ✅ **DO** focus only on the specific test case: flow, preconditions, expected results, and verification points +- ✅ **DO** keep the documentation under 60 lines when possible +- ✅ **DO** follow the exact format template provided above + ### Component Testing (Future) - - Jest + React Testing Library - Component unit tests - Integration tests for complex flows @@ -770,6 +1181,38 @@ const text = message.parts - Follow The Scope Rule strictly - used by 2+ features = shared, 1 feature = local - Update feature docs and `ui/CHANGELOG.md` when behavior changes +### Documentation Links Pattern (Integrations Only) + +For integration features (e.g., API Keys, SAML, S3) that have dedicated documentation, include "Read the docs" links in both the main card/component and related modals: + +**Main Card Header** (e.g., API Keys card): +```tsx +

+ Manage API keys for programmatic access.{" "} + + Read the docs + +

+``` + +**Modal/Form** (e.g., Create API Key modal): +```tsx +

+ Need help configuring API Keys?{" "} + + Read the docs + +

+``` + +**Rules:** +- **Only apply to integration components** (API Keys, SAML, S3, Security Hub, etc.) +- Use the same documentation URL across related components +- Tailor the helper text to the component context (card = general, modal = action-specific) +- Apply `text-xs text-gray-500` styling for consistency +- Place the link in a `

` tag or description area within the component +- Always use `CustomLink` component for documentation links + ## Environment Configuration ### Required Environment Variables diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 9f0174f4ba..6f1dbbe06e 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -2,7 +2,15 @@ All notable changes to the **Prowler UI** are documented in this file. -## [1.13.0] (Prowler UNRELEASED) +## [1.13.1] (Unreleased) + +### 🔄 Changed + +- Upgrade React to version 19.2.0 [(#9039)](https://github.com/prowler-cloud/prowler/pull/9039) + +--- + +## [1.13.0] (Prowler v5.13.0) ### 🚀 Added @@ -12,6 +20,7 @@ All notable changes to the **Prowler UI** are documented in this file. - React Compiler support for automatic optimization [(#8748)](https://github.com/prowler-cloud/prowler/pull/8748) - Turbopack support for faster development builds [(#8748)](https://github.com/prowler-cloud/prowler/pull/8748) - Add compliance name in compliance detail view [(#8775)](https://github.com/prowler-cloud/prowler/pull/8775) +- PDF reporting for Prowler ThreatScore [(#8867)](https://github.com/prowler-cloud/prowler/pull/8867) - Support C5 compliance framework for the AWS provider [(#8830)](https://github.com/prowler-cloud/prowler/pull/8830) - API key management in user profile [(#8308)](https://github.com/prowler-cloud/prowler/pull/8308) - Refresh access token error handling [(#8864)](https://github.com/prowler-cloud/prowler/pull/8864) diff --git a/ui/actions/scans/scans.ts b/ui/actions/scans/scans.ts index c17f056f3f..6dc3654344 100644 --- a/ui/actions/scans/scans.ts +++ b/ui/actions/scans/scans.ts @@ -268,3 +268,45 @@ export const getComplianceCsv = async ( }; } }; + +export const getThreatScorePdf = async (scanId: string) => { + const headers = await getAuthHeaders({ contentType: false }); + + const url = new URL(`${apiBaseUrl}/scans/${scanId}/threatscore`); + + try { + const response = await fetch(url.toString(), { headers }); + + if (response.status === 202) { + const json = await response.json(); + const taskId = json?.data?.id; + const state = json?.data?.attributes?.state; + return { + pending: true, + state, + taskId, + }; + } + + if (!response.ok) { + const errorData = await response.json(); + throw new Error( + errorData?.errors?.detail || + "Unable to retrieve ThreatScore PDF report. Contact support if the issue continues.", + ); + } + + const arrayBuffer = await response.arrayBuffer(); + const base64 = Buffer.from(arrayBuffer).toString("base64"); + + return { + success: true, + data: base64, + filename: `scan-${scanId}-threatscore.pdf`, + }; + } catch (error) { + return { + error: getErrorMessage(error), + }; + } +}; diff --git a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx index 2ea1bc823b..2b7cfd8cfd 100644 --- a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx +++ b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx @@ -29,6 +29,8 @@ import { } from "@/types/compliance"; import { ScanEntity } from "@/types/scans"; +import { ThreatScoreDownloadButton } from "./threatscore-download-button"; + interface ComplianceDetailSearchParams { complianceId: string; version?: string; @@ -143,13 +145,24 @@ export default async function ComplianceDetail({ )} - +

+
+ +
+ {attributesData?.data?.[0]?.attributes?.framework === + "ProwlerThreatScore" && + selectedScanId && ( +
+ +
+ )} +
{ + const [isDownloading, setIsDownloading] = useState(false); + + const handleDownload = async () => { + setIsDownloading(true); + try { + await downloadThreatScorePdf(scanId, toast); + } finally { + setIsDownloading(false); + } + }; + + return ( + + ); +}; diff --git a/ui/app/(prowler)/compliance/page.tsx b/ui/app/(prowler)/compliance/page.tsx index de94cf0fe2..a4bde8104f 100644 --- a/ui/app/(prowler)/compliance/page.tsx +++ b/ui/app/(prowler)/compliance/page.tsx @@ -1,16 +1,22 @@ export const dynamic = "force-dynamic"; import { Suspense } from "react"; -import { getCompliancesOverview } from "@/actions/compliances"; -import { getComplianceOverviewMetadataInfo } from "@/actions/compliances"; +import { + getComplianceAttributes, + getComplianceOverviewMetadataInfo, + getComplianceRequirements, + getCompliancesOverview, +} from "@/actions/compliances"; import { getScans } from "@/actions/scans"; import { ComplianceCard, ComplianceSkeletonGrid, NoScansAvailable, + ThreatScoreBadge, } from "@/components/compliance"; import { ComplianceHeader } from "@/components/compliance/compliance-header/compliance-header"; import { ContentLayout } from "@/components/ui"; +import { calculateThreatScore } from "@/lib/compliance/threatscore-calculator"; import { ExpandedScanData, ScanEntity, @@ -74,6 +80,7 @@ export default async function Compliance({ }) .filter(Boolean) as ExpandedScanData[]; + // Use scanId from URL, or select the first scan if not provided const selectedScanId = resolvedSearchParams.scanId || expandedScansData[0]?.id || null; const query = (filters["filter[search]"] as string) || ""; @@ -94,6 +101,7 @@ export default async function Compliance({ } : undefined; + // Fetch metadata if we have a selected scan const metadataInfoData = selectedScanId ? await getComplianceOverviewMetadataInfo({ query, @@ -105,14 +113,52 @@ export default async function Compliance({ const uniqueRegions = metadataInfoData?.data?.attributes?.regions || []; + // Fetch ThreatScore data if we have a selected scan + let threatScoreData = null; + if ( + selectedScanId && + typeof selectedScanId === "string" && + selectedScan?.providerInfo?.provider + ) { + const complianceId = `prowler_threatscore_${selectedScan.providerInfo.provider.toLowerCase()}`; + + const [attributesData, requirementsData] = await Promise.all([ + getComplianceAttributes(complianceId), + getComplianceRequirements({ + complianceId, + scanId: selectedScanId, + }), + ]); + + threatScoreData = calculateThreatScore(attributesData, requirementsData); + } + return ( {selectedScanId ? ( <> - +
+
+
+ +
+ {threatScoreData && + typeof selectedScanId === "string" && + selectedScan && ( +
+ +
+ )} +
+
}> - {compliancesData.data.map((compliance: ComplianceOverviewData) => { - const { attributes, id } = compliance; - const { framework, version, requirements_passed, total_requirements } = - attributes; + {compliancesData.data + .filter((compliance: ComplianceOverviewData) => { + // Filter out ProwlerThreatScore from the grid + return compliance.attributes.framework !== "ProwlerThreatScore"; + }) + .map((compliance: ComplianceOverviewData) => { + const { attributes, id } = compliance; + const { + framework, + version, + requirements_passed, + total_requirements, + } = attributes; - return ( - - ); - })} + return ( + + ); + })} ); }; diff --git a/ui/app/(prowler)/new-overview/components/accounts-selector.tsx b/ui/app/(prowler)/new-overview/components/accounts-selector.tsx new file mode 100644 index 0000000000..0f571ae3e0 --- /dev/null +++ b/ui/app/(prowler)/new-overview/components/accounts-selector.tsx @@ -0,0 +1,156 @@ +"use client"; + +import { useRouter, useSearchParams } from "next/navigation"; +import { ReactNode } from "react"; + +import { + AWSProviderBadge, + AzureProviderBadge, + GCPProviderBadge, + GitHubProviderBadge, + KS8ProviderBadge, + M365ProviderBadge, +} from "@/components/icons/providers-badge"; +import { + Select, + SelectContent, + SelectItem, + SelectTrigger, + SelectValue, +} from "@/components/shadcn"; +import type { ProviderProps, ProviderType } from "@/types/providers"; + +const PROVIDER_ICON: Record = { + aws: , + azure: , + gcp: , + kubernetes: , + m365: , + github: , +}; + +interface AccountsSelectorProps { + providers: ProviderProps[]; +} + +export function AccountsSelector({ providers }: AccountsSelectorProps) { + const router = useRouter(); + const searchParams = useSearchParams(); + + const current = searchParams.get("filter[provider_id__in]") || ""; + const selectedTypes = searchParams.get("filter[provider_type__in]") || ""; + const selectedTypesList = selectedTypes + ? selectedTypes.split(",").filter(Boolean) + : []; + const selectedIds = current ? current.split(",").filter(Boolean) : []; + const visibleProviders = providers + .filter((p) => p.attributes.connection?.connected) + .filter((p) => + selectedTypesList.length > 0 + ? selectedTypesList.includes(p.attributes.provider) + : true, + ); + + const handleMultiValueChange = (ids: string[]) => { + const params = new URLSearchParams(searchParams.toString()); + if (ids.length > 0) { + params.set("filter[provider_id__in]", ids.join(",")); + } else { + params.delete("filter[provider_id__in]"); + } + + // Auto-deselect provider types that no longer have any selected accounts + if (selectedTypesList.length > 0) { + // Get provider types of currently selected accounts + const selectedProviders = providers.filter((p) => ids.includes(p.id)); + const selectedProviderTypes = new Set( + selectedProviders.map((p) => p.attributes.provider), + ); + + // Keep only provider types that still have selected accounts + const remainingProviderTypes = selectedTypesList.filter((type) => + selectedProviderTypes.has(type as ProviderType), + ); + + // Update provider_type__in filter + if (remainingProviderTypes.length > 0) { + params.set( + "filter[provider_type__in]", + remainingProviderTypes.join(","), + ); + } else { + params.delete("filter[provider_type__in]"); + } + } + + router.push(`?${params.toString()}`, { scroll: false }); + }; + + const selectedLabel = () => { + if (selectedIds.length === 0) return null; // placeholder visible + if (selectedIds.length === 1) { + const p = providers.find((pr) => pr.id === selectedIds[0]); + const name = p ? p.attributes.alias || p.attributes.uid : selectedIds[0]; + return {name}; + } + return ( + {selectedIds.length} accounts selected + ); + }; + + const filterDescription = + selectedTypesList.length > 0 + ? `Showing accounts for ${selectedTypesList.join(", ")} providers` + : "All connected cloud provider accounts"; + + return ( +
+ + +
+ ); +} diff --git a/ui/app/(prowler)/new-overview/components/provider-type-selector.tsx b/ui/app/(prowler)/new-overview/components/provider-type-selector.tsx new file mode 100644 index 0000000000..25eb6dbbc7 --- /dev/null +++ b/ui/app/(prowler)/new-overview/components/provider-type-selector.tsx @@ -0,0 +1,194 @@ +"use client"; + +import { useRouter, useSearchParams } from "next/navigation"; +import { lazy, Suspense } from "react"; + +import { + Select, + SelectContent, + SelectItem, + SelectTrigger, + SelectValue, +} from "@/components/shadcn"; +import { type ProviderProps, ProviderType } from "@/types/providers"; + +const AWSProviderBadge = lazy(() => + import("@/components/icons/providers-badge").then((m) => ({ + default: m.AWSProviderBadge, + })), +); +const AzureProviderBadge = lazy(() => + import("@/components/icons/providers-badge").then((m) => ({ + default: m.AzureProviderBadge, + })), +); +const GCPProviderBadge = lazy(() => + import("@/components/icons/providers-badge").then((m) => ({ + default: m.GCPProviderBadge, + })), +); +const KS8ProviderBadge = lazy(() => + import("@/components/icons/providers-badge").then((m) => ({ + default: m.KS8ProviderBadge, + })), +); +const M365ProviderBadge = lazy(() => + import("@/components/icons/providers-badge").then((m) => ({ + default: m.M365ProviderBadge, + })), +); +const GitHubProviderBadge = lazy(() => + import("@/components/icons/providers-badge").then((m) => ({ + default: m.GitHubProviderBadge, + })), +); + +type IconProps = { width: number; height: number }; + +const IconPlaceholder = ({ width, height }: IconProps) => ( +
+); + +const PROVIDER_DATA: Record< + ProviderType, + { label: string; icon: React.ComponentType } +> = { + aws: { + label: "Amazon Web Services", + icon: AWSProviderBadge, + }, + azure: { + label: "Microsoft Azure", + icon: AzureProviderBadge, + }, + gcp: { + label: "Google Cloud Platform", + icon: GCPProviderBadge, + }, + kubernetes: { + label: "Kubernetes", + icon: KS8ProviderBadge, + }, + m365: { + label: "Microsoft 365", + icon: M365ProviderBadge, + }, + github: { + label: "GitHub", + icon: GitHubProviderBadge, + }, +}; + +type ProviderTypeSelectorProps = { + providers: ProviderProps[]; +}; + +export const ProviderTypeSelector = ({ + providers, +}: ProviderTypeSelectorProps) => { + const router = useRouter(); + const searchParams = useSearchParams(); + + const currentProviders = searchParams.get("filter[provider_type__in]") || ""; + const selectedTypes = currentProviders + ? currentProviders.split(",").filter(Boolean) + : []; + + const handleMultiValueChange = (values: string[]) => { + const params = new URLSearchParams(searchParams.toString()); + + // Update provider_type__in + if (values.length > 0) { + params.set("filter[provider_type__in]", values.join(",")); + } else { + params.delete("filter[provider_type__in]"); + } + + // Clear account selection when changing provider types + // User should manually select accounts if they want to filter by specific accounts + params.delete("filter[provider_id__in]"); + + router.push(`?${params.toString()}`, { scroll: false }); + }; + + const availableTypes = Array.from( + new Set( + providers + .filter((p) => p.attributes.connection?.connected) + .map((p) => p.attributes.provider), + ), + ) as ProviderType[]; + + const renderIcon = (providerType: ProviderType) => { + const IconComponent = PROVIDER_DATA[providerType].icon; + return ( + }> + + + ); + }; + + const selectedLabel = () => { + if (selectedTypes.length === 0) return null; // placeholder visible + if (selectedTypes.length === 1) { + const providerType = selectedTypes[0] as ProviderType; + return ( + + {renderIcon(providerType)} + {PROVIDER_DATA[providerType].label} + + ); + } + return ( + + {selectedTypes.length} providers selected + + ); + }; + + return ( +
+ + +
+ ); +}; diff --git a/ui/app/(prowler)/new-overview/components/risk-severity-chart.tsx b/ui/app/(prowler)/new-overview/components/risk-severity-chart.tsx new file mode 100644 index 0000000000..3804441b10 --- /dev/null +++ b/ui/app/(prowler)/new-overview/components/risk-severity-chart.tsx @@ -0,0 +1,71 @@ +"use client"; + +import { HorizontalBarChart } from "@/components/graphs/horizontal-bar-chart"; +import { BarDataPoint } from "@/components/graphs/types"; +import { + BaseCard, + CardContent, + CardHeader, + CardTitle, +} from "@/components/shadcn"; +import { calculatePercentage } from "@/lib/utils"; + +interface RiskSeverityChartProps { + critical: number; + high: number; + medium: number; + low: number; + informational: number; +} + +export const RiskSeverityChart = ({ + critical, + high, + medium, + low, + informational, +}: RiskSeverityChartProps) => { + // Calculate total findings + const totalFindings = critical + high + medium + low + informational; + + // Transform data to BarDataPoint format + const chartData: BarDataPoint[] = [ + { + name: "Critical", + value: critical, + percentage: calculatePercentage(critical, totalFindings), + }, + { + name: "High", + value: high, + percentage: calculatePercentage(high, totalFindings), + }, + { + name: "Medium", + value: medium, + percentage: calculatePercentage(medium, totalFindings), + }, + { + name: "Low", + value: low, + percentage: calculatePercentage(low, totalFindings), + }, + { + name: "Info", + value: informational, + percentage: calculatePercentage(informational, totalFindings), + }, + ]; + + return ( + + + Risk Severity + + + + + + + ); +}; diff --git a/ui/app/(prowler)/new-overview/components/status-chart.tsx b/ui/app/(prowler)/new-overview/components/status-chart.tsx new file mode 100644 index 0000000000..10b4736aec --- /dev/null +++ b/ui/app/(prowler)/new-overview/components/status-chart.tsx @@ -0,0 +1,144 @@ +"use client"; + +import { Bell, BellOff, ShieldCheck, TriangleAlert } from "lucide-react"; + +import { DonutChart } from "@/components/graphs/donut-chart"; +import { DonutDataPoint } from "@/components/graphs/types"; +import { + BaseCard, + CardContent, + CardHeader, + CardTitle, + CardVariant, + ResourceStatsCard, + ResourceStatsCardContainer, +} from "@/components/shadcn"; +import { calculatePercentage } from "@/lib/utils"; + +interface StatusChartProps { + failFindingsData: { + total: number; + new: number; + muted: number; + }; + passFindingsData: { + total: number; + new: number; + muted: number; + }; +} + +export const StatusChart = ({ + failFindingsData, + passFindingsData, +}: StatusChartProps) => { + // Calculate total findings + const totalFindings = failFindingsData.total + passFindingsData.total; + + // Calculate percentages + const failPercentage = calculatePercentage( + failFindingsData.total, + totalFindings, + ); + const passPercentage = calculatePercentage( + passFindingsData.total, + totalFindings, + ); + + // Calculate change percentages (new findings as percentage change) + const failChange = calculatePercentage( + failFindingsData.new, + failFindingsData.total, + ); + const passChange = calculatePercentage( + passFindingsData.new, + passFindingsData.total, + ); + + // Mock data for DonutChart + const donutData: DonutDataPoint[] = [ + { + name: "Fail Findings", + value: failFindingsData.total, + color: "#f43f5e", // Rose-500 + percentage: Number(failPercentage), + change: Number(failChange), + }, + { + name: "Pass Findings", + value: passFindingsData.total, + color: "#4ade80", // Green-400 + percentage: Number(passPercentage), + change: Number(passChange), + }, + ]; + + return ( + + + Check Findings + + + +
+ +
+ + + + +
+
+
+ + + + + + ); +}; diff --git a/ui/app/(prowler)/new-overview/page.tsx b/ui/app/(prowler)/new-overview/page.tsx new file mode 100644 index 0000000000..3d732fcf85 --- /dev/null +++ b/ui/app/(prowler)/new-overview/page.tsx @@ -0,0 +1,145 @@ +import { Suspense } from "react"; + +import { + getFindingsBySeverity, + getFindingsByStatus, +} from "@/actions/overview/overview"; +import { getProviders } from "@/actions/providers"; +import { ContentLayout } from "@/components/ui"; +import { SearchParamsProps } from "@/types"; + +import { AccountsSelector } from "./components/accounts-selector"; +import { ProviderTypeSelector } from "./components/provider-type-selector"; +import { RiskSeverityChart } from "./components/risk-severity-chart"; +import { StatusChart } from "./components/status-chart"; + +const FILTER_PREFIX = "filter["; + +// Extract only query params that start with "filter[" for API calls +function pickFilterParams( + params: SearchParamsProps | undefined | null, +): Record { + if (!params) return {}; + return Object.fromEntries( + Object.entries(params).filter(([key]) => key.startsWith(FILTER_PREFIX)), + ); +} + +export default async function NewOverviewPage({ + searchParams, +}: { + searchParams: Promise; +}) { + const resolvedSearchParams = await searchParams; + const providersData = await getProviders({ page: 1, pageSize: 200 }); + + return ( + +
+ + +
+
+ +

Loading...

+
+ } + > + + + + +

Loading...

+
+ } + > + + +
+ + ); +} + +const SSRCheckFindings = async ({ + searchParams, +}: { + searchParams: SearchParamsProps | undefined | null; +}) => { + const filters = pickFilterParams(searchParams); + + const findingsByStatus = await getFindingsByStatus({ filters }); + + if (!findingsByStatus) { + return ( +
+

Failed to load findings data

+
+ ); + } + + const { + fail = 0, + pass = 0, + muted_new = 0, + muted_changed = 0, + fail_new = 0, + pass_new = 0, + } = findingsByStatus?.data?.attributes || {}; + + const mutedTotal = muted_new + muted_changed; + + return ( + + ); +}; + +const SSRRiskSeverityChart = async ({ + searchParams, +}: { + searchParams: SearchParamsProps | undefined | null; +}) => { + const filters = pickFilterParams(searchParams); + + const findingsBySeverity = await getFindingsBySeverity({ filters }); + + if (!findingsBySeverity) { + return ( +
+

Failed to load severity data

+
+ ); + } + + const { + critical = 0, + high = 0, + medium = 0, + low = 0, + informational = 0, + } = findingsBySeverity?.data?.attributes || {}; + + return ( + + ); +}; diff --git a/ui/components.json b/ui/components.json new file mode 100644 index 0000000000..f8da89d768 --- /dev/null +++ b/ui/components.json @@ -0,0 +1,21 @@ +{ + "$schema": "https://ui.shadcn.com/schema.json", + "style": "default", + "rsc": true, + "tsx": true, + "tailwind": { + "config": "", + "css": "styles/globals.css", + "baseColor": "neutral", + "cssVariables": true, + "prefix": "" + }, + "aliases": { + "components": "@/components", + "utils": "@/lib/utils", + "ui": "@/components/shadcn", + "lib": "@/lib", + "hooks": "@/hooks" + }, + "iconLibrary": "lucide" +} diff --git a/ui/components/compliance/compliance-header/data-compliance.tsx b/ui/components/compliance/compliance-header/data-compliance.tsx index 7d29ebfe7d..992dc3d683 100644 --- a/ui/components/compliance/compliance-header/data-compliance.tsx +++ b/ui/components/compliance/compliance-header/data-compliance.tsx @@ -19,11 +19,13 @@ export const DataCompliance = ({ scans }: DataComplianceProps) => { const selectedScanId = scanIdParam || (scans.length > 0 ? scans[0].id : ""); + // Don't auto-push scanId to URL - the server already handles the default scan selection + // This avoids duplicate API calls caused by client-side navigation useEffect(() => { if (!scanIdParam && scans.length > 0) { const params = new URLSearchParams(searchParams); params.set("scanId", scans[0].id); - router.push(`?${params.toString()}`); + router.replace(`?${params.toString()}`, { scroll: false }); } }, [scans, scanIdParam, searchParams, router]); diff --git a/ui/components/compliance/index.ts b/ui/components/compliance/index.ts index 096951a261..4365f4ec65 100644 --- a/ui/components/compliance/index.ts +++ b/ui/components/compliance/index.ts @@ -19,3 +19,5 @@ export * from "./skeletons/compliance-accordion-skeleton"; export * from "./skeletons/compliance-grid-skeleton"; export * from "./skeletons/heatmap-chart-skeleton"; export * from "./skeletons/pie-chart-skeleton"; +export * from "./threatscore-badge"; +export * from "./threatscore-logo"; diff --git a/ui/components/compliance/threatscore-badge.tsx b/ui/components/compliance/threatscore-badge.tsx new file mode 100644 index 0000000000..b9ba9d5b7b --- /dev/null +++ b/ui/components/compliance/threatscore-badge.tsx @@ -0,0 +1,148 @@ +"use client"; + +import { Button } from "@heroui/button"; +import { Card, CardBody } from "@heroui/card"; +import { Progress } from "@heroui/progress"; +import { DownloadIcon, FileTextIcon } from "lucide-react"; +import { useRouter, useSearchParams } from "next/navigation"; +import { useState } from "react"; + +import { ThreatScoreLogo } from "@/components/compliance/threatscore-logo"; +import { toast } from "@/components/ui"; +import { downloadComplianceCsv, downloadThreatScorePdf } from "@/lib/helper"; +import type { ScanEntity } from "@/types/scans"; + +interface ThreatScoreBadgeProps { + score: number; + scanId: string; + provider: string; + selectedScan?: ScanEntity; +} + +export const ThreatScoreBadge = ({ + score, + scanId, + provider, + selectedScan, +}: ThreatScoreBadgeProps) => { + const router = useRouter(); + const searchParams = useSearchParams(); + const [isDownloadingPdf, setIsDownloadingPdf] = useState(false); + const [isDownloadingCsv, setIsDownloadingCsv] = useState(false); + + const complianceId = `prowler_threatscore_${provider.toLowerCase()}`; + + const getScoreColor = (): "success" | "warning" | "danger" => { + if (score >= 80) return "success"; + if (score >= 40) return "warning"; + return "danger"; + }; + + const getTextColor = () => { + if (score >= 80) return "text-success"; + if (score >= 40) return "text-warning"; + return "text-danger"; + }; + + const handleCardClick = () => { + const title = "ProwlerThreatScore"; + const version = "1.0"; + const formattedTitleForUrl = encodeURIComponent(title); + const path = `/compliance/${formattedTitleForUrl}`; + const params = new URLSearchParams(); + + params.set("complianceId", complianceId); + params.set("version", version); + params.set("scanId", scanId); + + if (selectedScan) { + params.set( + "scanData", + JSON.stringify({ + id: selectedScan.id, + providerInfo: selectedScan.providerInfo, + attributes: selectedScan.attributes, + }), + ); + } + + const regionFilter = searchParams.get("filter[region__in]"); + if (regionFilter) { + params.set("filter[region__in]", regionFilter); + } + + router.push(`${path}?${params.toString()}`); + }; + + const handleDownloadPdf = async () => { + setIsDownloadingPdf(true); + try { + await downloadThreatScorePdf(scanId, toast); + } finally { + setIsDownloadingPdf(false); + } + }; + + const handleDownloadCsv = async () => { + setIsDownloadingCsv(true); + try { + await downloadComplianceCsv(scanId, complianceId, toast); + } finally { + setIsDownloadingCsv(false); + } + }; + + return ( + + + +
+ + +
+ + + ); +}; diff --git a/ui/components/compliance/threatscore-logo.tsx b/ui/components/compliance/threatscore-logo.tsx new file mode 100644 index 0000000000..d4b98d4ccc --- /dev/null +++ b/ui/components/compliance/threatscore-logo.tsx @@ -0,0 +1,79 @@ +"use client"; + +import { useTheme } from "next-themes"; +import { useEffect, useState } from "react"; + +export const ThreatScoreLogo = () => { + const { resolvedTheme } = useTheme(); + const [mounted, setMounted] = useState(false); + + // Avoid hydration mismatch by only rendering after mount + useEffect(() => { + setMounted(true); + }, []); + + if (!mounted) { + return
; + } + + const prowlerColor = resolvedTheme === "dark" ? "#fff" : "#000"; + + return ( + + {/* Prowler logo from the new SVG - scaled and positioned to match THREATSCORE size */} + + + + + {/* THREATSCORE text */} + + THREATSCORE + + + {/* Gauge icon - semicircular meter - 1.5x larger */} + + {/* Gauge arcs - drawing from left to right (orange, red, green) */} + + + + + {/* Checkmark */} + + + + ); +}; diff --git a/ui/components/graphs/BarChart.tsx b/ui/components/graphs/BarChart.tsx deleted file mode 100644 index 8ebb7eca3b..0000000000 --- a/ui/components/graphs/BarChart.tsx +++ /dev/null @@ -1,162 +0,0 @@ -"use client"; - -import { - Bar, - BarChart as RechartsBar, - CartesianGrid, - Cell, - ResponsiveContainer, - Tooltip, - XAxis, - YAxis, -} from "recharts"; - -import { ChartTooltip } from "./shared/ChartTooltip"; -import { CHART_COLORS, LAYOUT_OPTIONS } from "./shared/constants"; -import { getSeverityColorByName } from "./shared/utils"; -import { BarDataPoint, LayoutOption } from "./types"; - -interface BarChartProps { - data: BarDataPoint[]; - layout?: LayoutOption; - xLabel?: string; - yLabel?: string; - height?: number; - showValues?: boolean; -} - -const CustomLabel = ({ x, y, width, height, value, data }: any) => { - const percentage = data.percentage; - return ( - - {percentage !== undefined - ? `${percentage}% â€ĸ ${value.toLocaleString()}` - : value.toLocaleString()} - - ); -}; - -export function BarChart({ - data, - layout = LAYOUT_OPTIONS.horizontal, - xLabel, - yLabel, - height = 400, - showValues = true, -}: BarChartProps) { - const isHorizontal = layout === LAYOUT_OPTIONS.horizontal; - - return ( - - - - {isHorizontal ? ( - <> - - - - ) : ( - <> - - - - )} - } /> - ( - - ) - : false - } - > - {data.map((entry, index) => ( - - ))} - - - - ); -} diff --git a/ui/components/graphs/HorizontalBarChart.tsx b/ui/components/graphs/HorizontalBarChart.tsx deleted file mode 100644 index b91e575656..0000000000 --- a/ui/components/graphs/HorizontalBarChart.tsx +++ /dev/null @@ -1,121 +0,0 @@ -"use client"; - -import { Bell } from "lucide-react"; -import { useState } from "react"; - -import { CHART_COLORS, SEVERITY_ORDER } from "./shared/constants"; -import { getSeverityColorByName } from "./shared/utils"; -import { BarDataPoint } from "./types"; - -interface HorizontalBarChartProps { - data: BarDataPoint[]; - height?: number; - title?: string; -} - -export function HorizontalBarChart({ data, title }: HorizontalBarChartProps) { - const [hoveredIndex, setHoveredIndex] = useState(null); - - const sortedData = [...data].sort((a, b) => { - const orderA = SEVERITY_ORDER[a.name as keyof typeof SEVERITY_ORDER] ?? 999; - const orderB = SEVERITY_ORDER[b.name as keyof typeof SEVERITY_ORDER] ?? 999; - return orderA - orderB; - }); - - return ( -
- {title && ( -
-

{title}

-
- )} - -
- {sortedData.map((item, index) => { - const isHovered = hoveredIndex === index; - const isFaded = hoveredIndex !== null && !isHovered; - const barColor = - item.color || - getSeverityColorByName(item.name) || - CHART_COLORS.defaultColor; - - return ( -
setHoveredIndex(index)} - onMouseLeave={() => setHoveredIndex(null)} - > -
- - {item.name} - -
- -
-
-
d.value))) * 100}%`, - backgroundColor: barColor, - opacity: isFaded ? 0.5 : 1, - }} - /> - - {isHovered && ( -
-
-
- - {item.value.toLocaleString()} {item.name} Risk - -
- {item.newFindings !== undefined && ( -
- - - {item.newFindings} New Findings - -
- )} - {item.change !== undefined && ( -

- - {item.change > 0 ? "+" : ""} - {item.change}% - {" "} - Since Last Scan -

- )} -
- )} -
- -
- {item.percentage}% - â€ĸ - {item.value.toLocaleString()} -
-
- ); - })} -
-
- ); -} diff --git a/ui/components/graphs/SankeyChart.tsx b/ui/components/graphs/SankeyChart.tsx deleted file mode 100644 index d9c35cd1df..0000000000 --- a/ui/components/graphs/SankeyChart.tsx +++ /dev/null @@ -1,137 +0,0 @@ -"use client"; - -import { Rectangle, ResponsiveContainer, Sankey, Tooltip } from "recharts"; - -import { CHART_COLORS, SEVERITY_COLORS } from "./shared/constants"; - -interface SankeyNode { - name: string; -} - -interface SankeyLink { - source: number; - target: number; - value: number; -} - -interface SankeyChartProps { - data: { - nodes: SankeyNode[]; - links: SankeyLink[]; - }; - height?: number; -} - -const COLORS: Record = { - Success: "var(--color-success)", - Fail: "var(--color-destructive)", - AWS: "var(--color-orange)", - Azure: "var(--color-cyan)", - Google: "var(--color-red)", - ...SEVERITY_COLORS, -}; - -const CustomTooltip = ({ active, payload }: any) => { - if (active && payload && payload.length) { - const data = payload[0].payload; - return ( -
-

{data.name}

- {data.value && ( -

Value: {data.value}

- )} -
- ); - } - return null; -}; - -const CustomNode = ({ x, y, width, height, payload, containerWidth }: any) => { - const isOut = x + width + 6 > containerWidth; - const nodeName = payload.name; - const color = COLORS[nodeName] || CHART_COLORS.defaultColor; - - return ( - - - - {nodeName} - - - {payload.value} - - - ); -}; - -const CustomLink = (props: any) => { - const { - sourceX, - targetX, - sourceY, - targetY, - sourceControlX, - targetControlX, - linkWidth, - } = props; - - const sourceName = props.payload.source?.name || ""; - const color = COLORS[sourceName] || CHART_COLORS.defaultColor; - - return ( - - - - ); -}; - -export function SankeyChart({ data, height = 400 }: SankeyChartProps) { - return ( - - } - link={} - nodePadding={50} - margin={{ top: 20, right: 160, bottom: 20, left: 160 }} - > - } /> - - - ); -} diff --git a/ui/components/graphs/DonutChart.tsx b/ui/components/graphs/donut-chart.tsx similarity index 54% rename from ui/components/graphs/DonutChart.tsx rename to ui/components/graphs/donut-chart.tsx index 57713cc2f6..b2878fd17d 100644 --- a/ui/components/graphs/DonutChart.tsx +++ b/ui/components/graphs/donut-chart.tsx @@ -5,7 +5,7 @@ import { Cell, Label, Pie, PieChart, Tooltip } from "recharts"; import { ChartConfig, ChartContainer } from "@/components/ui/chart/Chart"; -import { ChartLegend } from "./shared/ChartLegend"; +import { ChartLegend } from "./shared/chart-legend"; import { DonutDataPoint } from "./types"; interface DonutChartProps { @@ -21,32 +21,40 @@ interface DonutChartProps { } const CustomTooltip = ({ active, payload }: any) => { - if (active && payload && payload.length) { - const data = payload[0].payload; - return ( -
-
+ if (!active || !payload || !payload.length) return null; + + const entry = payload[0]; + const name = entry.name; + const percentage = entry.payload?.percentage; + const color = entry.color || entry.payload?.color; + const change = entry.payload?.change; + + return ( +
+
+ {/* Title with color chip */} +
- - {data.percentage}% {data.name} - -
- {data.change !== undefined && ( -

- - {data.change > 0 ? "+" : ""} - {data.change}% - {" "} - Since last scan +

+ {percentage}% {name}

+
+ + {/* Change percentage row */} + {change !== undefined && ( +
+

+ {change > 0 ? "+" : ""} + {change}% Since last scan +

+
)}
- ); - } - return null; +
+ ); }; const CustomLegend = ({ payload }: any) => { @@ -60,8 +68,8 @@ const CustomLegend = ({ payload }: any) => { export function DonutChart({ data, - innerRadius = 80, - outerRadius = 120, + innerRadius = 68, + outerRadius = 86, showLegend = true, centerLabel, }: DonutChartProps) { @@ -87,32 +95,46 @@ export function DonutChart({ change: item.change, })); - const legendPayload = chartData.map((entry) => ({ - value: entry.name, + const total = chartData.reduce((sum, d) => sum + (Number(d.value) || 0), 0); + const isEmpty = total <= 0; + + const emptyData = [ + { + name: "No data", + value: 1, + fill: "var(--chart-border-emphasis)", + color: "var(--chart-border-emphasis)", + percentage: 0, + change: undefined, + }, + ]; + + const legendPayload = (isEmpty ? emptyData : chartData).map((entry) => ({ + value: isEmpty ? "No data" : entry.name, color: entry.color, payload: { - percentage: entry.percentage, + percentage: isEmpty ? 0 : entry.percentage, }, })); return ( -
+ <> - } /> + {!isEmpty && } />} - {chartData.map((entry, index) => { + {(isEmpty ? emptyData : chartData).map((entry, index) => { const opacity = hoveredIndex === null ? 1 : hoveredIndex === index ? 1 : 0.5; return ( @@ -126,14 +148,18 @@ export function DonutChart({ /> ); })} - {centerLabel && ( + {(centerLabel || isEmpty) && ( {showLegend && } -
+ ); } diff --git a/ui/components/graphs/horizontal-bar-chart.tsx b/ui/components/graphs/horizontal-bar-chart.tsx new file mode 100644 index 0000000000..8e826768b6 --- /dev/null +++ b/ui/components/graphs/horizontal-bar-chart.tsx @@ -0,0 +1,164 @@ +"use client"; + +import { Bell } from "lucide-react"; +import { useState } from "react"; + +import { CHART_COLORS, SEVERITY_ORDER } from "./shared/constants"; +import { getSeverityColorByName } from "./shared/utils"; +import { BarDataPoint } from "./types"; + +interface HorizontalBarChartProps { + data: BarDataPoint[]; + height?: number; + title?: string; +} + +export function HorizontalBarChart({ data, title }: HorizontalBarChartProps) { + const [hoveredIndex, setHoveredIndex] = useState(null); + + const total = data.reduce((sum, d) => sum + (Number(d.value) || 0), 0); + const isEmpty = total <= 0; + + const emptyData: BarDataPoint[] = [ + { name: "Critical", value: 1, percentage: 100 }, + { name: "High", value: 1, percentage: 100 }, + { name: "Medium", value: 1, percentage: 100 }, + { name: "Low", value: 1, percentage: 100 }, + ]; + + const sortedData = (isEmpty ? emptyData : [...data]).sort((a, b) => { + const orderA = SEVERITY_ORDER[a.name as keyof typeof SEVERITY_ORDER] ?? 999; + const orderB = SEVERITY_ORDER[b.name as keyof typeof SEVERITY_ORDER] ?? 999; + return orderA - orderB; + }); + + return ( +
+ {title && ( +
+

+ {title} +

+
+ )} + +
+ {sortedData.map((item, index) => { + const isHovered = !isEmpty && hoveredIndex === index; + const isFaded = !isEmpty && hoveredIndex !== null && !isHovered; + const barColor = isEmpty + ? CHART_COLORS.gridLine + : item.color || + getSeverityColorByName(item.name) || + CHART_COLORS.defaultColor; + + return ( +
!isEmpty && setHoveredIndex(index)} + onMouseLeave={() => !isEmpty && setHoveredIndex(null)} + > + {/* Label */} +
+ + {item.name} + +
+ + {/* Bar - flexible */} +
+
+ {(item.value > 0 || isEmpty) && ( +
d.value))) * 100}%`, + backgroundColor: barColor, + opacity: isFaded ? 0.5 : 1, + }} + /> + )} + + {isHovered && ( +
+
+ {/* Title with color chip */} +
+
+

+ {item.value.toLocaleString()} {item.name} Risk +

+
+ + {/* New Findings row */} + {item.newFindings !== undefined && ( +
+ +

+ {item.newFindings} New Findings +

+
+ )} + + {/* Change percentage row */} + {item.change !== undefined && ( +
+

+ {item.change > 0 ? "+" : ""} + {item.change}% Since last scan +

+
+ )} +
+
+ )} +
+ + {/* Percentage and Count */} +
+ + {isEmpty ? "0" : item.percentage}% + + + â€ĸ + + + {isEmpty ? "0" : item.value.toLocaleString()} + +
+
+ ); + })} +
+
+ ); +} diff --git a/ui/components/graphs/index.ts b/ui/components/graphs/index.ts index f0f0e53697..79d9b01e53 100644 --- a/ui/components/graphs/index.ts +++ b/ui/components/graphs/index.ts @@ -1,9 +1,9 @@ -export { BarChart } from "./BarChart"; -export { DonutChart } from "./DonutChart"; -export { HorizontalBarChart } from "./HorizontalBarChart"; -export { LineChart } from "./LineChart"; -export { RadarChart } from "./RadarChart"; -export { RadialChart } from "./RadialChart"; -export { SankeyChart } from "./SankeyChart"; -export { ScatterPlot } from "./ScatterPlot"; -export { ChartLegend, type ChartLegendItem } from "./shared/ChartLegend"; +export { DonutChart } from "./donut-chart"; +export { HorizontalBarChart } from "./horizontal-bar-chart"; +export { LineChart } from "./line-chart"; +export { MapChart, type MapChartData, type MapChartProps } from "./map-chart"; +export { RadarChart } from "./radar-chart"; +export { RadialChart } from "./radial-chart"; +export { SankeyChart } from "./sankey-chart"; +export { ScatterPlot } from "./scatter-plot"; +export { ChartLegend, type ChartLegendItem } from "./shared/chart-legend"; diff --git a/ui/components/graphs/LineChart.tsx b/ui/components/graphs/line-chart.tsx similarity index 82% rename from ui/components/graphs/LineChart.tsx rename to ui/components/graphs/line-chart.tsx index b19c9591f5..daefb55808 100644 --- a/ui/components/graphs/LineChart.tsx +++ b/ui/components/graphs/line-chart.tsx @@ -14,8 +14,8 @@ import { YAxis, } from "recharts"; -import { AlertPill } from "./shared/AlertPill"; -import { ChartLegend } from "./shared/ChartLegend"; +import { AlertPill } from "./shared/alert-pill"; +import { ChartLegend } from "./shared/chart-legend"; import { CHART_COLORS } from "./shared/constants"; import { LineConfig, LineDataPoint } from "./types"; @@ -48,8 +48,19 @@ const CustomLineTooltip = ({ const totalValue = typedPayload.reduce((sum, item) => sum + item.value, 0); return ( -
-

{label}

+
+

+ {label} +

@@ -67,18 +78,29 @@ const CustomLineTooltip = ({ className="h-2 w-2 rounded-full" style={{ backgroundColor: item.stroke }} /> - {item.value} + + {item.value} +
{newFindings !== undefined && (
- - + + {newFindings} New Findings
)} {change !== undefined && typeof change === "number" && ( -

+

{change > 0 ? "+" : ""} {change}% diff --git a/ui/components/graphs/map-chart.tsx b/ui/components/graphs/map-chart.tsx new file mode 100644 index 0000000000..586bb47b25 --- /dev/null +++ b/ui/components/graphs/map-chart.tsx @@ -0,0 +1,479 @@ +"use client"; + +import * as d3 from "d3"; +import type { + Feature, + FeatureCollection, + GeoJsonProperties, + Geometry, +} from "geojson"; +import { AlertTriangle, Info, MapPin } from "lucide-react"; +import { useEffect, useRef, useState } from "react"; +import { feature } from "topojson-client"; +import type { + GeometryCollection, + Objects, + Topology, +} from "topojson-specification"; + +import { HorizontalBarChart } from "./horizontal-bar-chart"; +import { BarDataPoint } from "./types"; + +// Constants +const MAP_CONFIG = { + defaultWidth: 688, + defaultHeight: 400, + pointRadius: 6, + selectedPointRadius: 8, + transitionDuration: 300, +} as const; + +const MAP_COLORS = { + landFill: "var(--chart-border-emphasis)", + landStroke: "var(--chart-border)", + pointDefault: "#DB2B49", + pointSelected: "#86DA26", + pointHover: "#DB2B49", +} as const; + +const RISK_LEVELS = { + LOW_HIGH: "low-high", + HIGH: "high", + CRITICAL: "critical", +} as const; + +type RiskLevel = (typeof RISK_LEVELS)[keyof typeof RISK_LEVELS]; + +interface LocationPoint { + id: string; + name: string; + region: string; + coordinates: [number, number]; + totalFindings: number; + riskLevel: RiskLevel; + severityData: BarDataPoint[]; + change?: number; +} + +export interface MapChartData { + locations: LocationPoint[]; + regions: string[]; +} + +export interface MapChartProps { + data: MapChartData; + height?: number; + onLocationSelect?: (location: LocationPoint | null) => void; +} + +// Utility functions +function createProjection(width: number, height: number) { + return d3 + .geoNaturalEarth1() + .fitExtent( + [ + [1, 1], + [width - 1, height - 1], + ], + { type: "Sphere" }, + ) + .precision(0.2); +} + +async function fetchWorldData(): Promise { + try { + const worldAtlasModule = await import("world-atlas/countries-110m.json"); + const worldData = worldAtlasModule.default || worldAtlasModule; + const topology = worldData as unknown as Topology; + return feature( + topology, + topology.objects.countries as GeometryCollection, + ) as FeatureCollection; + } catch (error) { + console.error("Error loading world map data:", error); + return null; + } +} + +// Helper: Create SVG element +function createSVGElement( + type: string, + attributes: Record, +): T { + const element = document.createElementNS( + "http://www.w3.org/2000/svg", + type, + ) as T; + Object.entries(attributes).forEach(([key, value]) => { + element.setAttribute(key, value); + }); + return element; +} + +// Components +function MapTooltip({ + location, + position, +}: { + location: LocationPoint; + position: { x: number; y: number }; +}) { + const CHART_COLORS = { + tooltipBorder: "var(--chart-border-emphasis)", + tooltipBackground: "var(--chart-background)", + textPrimary: "var(--chart-text-primary)", + textSecondary: "var(--chart-text-secondary)", + }; + + return ( +

+
+ + + {location.name} + +
+
+ + + {location.totalFindings.toLocaleString()} Fail Findings + +
+ {location.change !== undefined && ( +

+ + {location.change > 0 ? "+" : ""} + {location.change}% + {" "} + since last scan +

+ )} +
+ ); +} + +function EmptyState() { + const CHART_COLORS = { + tooltipBorder: "var(--chart-border-emphasis)", + tooltipBackground: "var(--chart-background)", + textSecondary: "var(--chart-text-secondary)", + }; + + return ( +
+
+ +

+ Select a location on the map to view details +

+
+
+ ); +} + +function LoadingState({ height }: { height: number }) { + const CHART_COLORS = { + textSecondary: "var(--chart-text-secondary)", + }; + + return ( +
+
+
+ Loading map... +
+
+
+ ); +} + +export function MapChart({ + data, + height = MAP_CONFIG.defaultHeight, +}: MapChartProps) { + const svgRef = useRef(null); + const containerRef = useRef(null); + const [selectedLocation, setSelectedLocation] = + useState(null); + const [hoveredLocation, setHoveredLocation] = useState( + null, + ); + const [tooltipPosition, setTooltipPosition] = useState<{ + x: number; + y: number; + } | null>(null); + const [worldData, setWorldData] = useState(null); + const [isLoadingMap, setIsLoadingMap] = useState(true); + const [dimensions, setDimensions] = useState<{ + width: number; + height: number; + }>({ + width: MAP_CONFIG.defaultWidth, + height, + }); + + // Fetch world data once on mount + useEffect(() => { + let isMounted = true; + fetchWorldData() + .then((data) => { + if (isMounted && data) setWorldData(data); + }) + .catch(console.error) + .finally(() => { + if (isMounted) setIsLoadingMap(false); + }); + return () => { + isMounted = false; + }; + }, []); + + // Update dimensions on resize + useEffect(() => { + const updateDimensions = () => { + if (containerRef.current) { + setDimensions({ width: containerRef.current.clientWidth, height }); + } + }; + updateDimensions(); + window.addEventListener("resize", updateDimensions); + return () => window.removeEventListener("resize", updateDimensions); + }, [height]); + + // Render the map + useEffect(() => { + if (!svgRef.current || !worldData || isLoadingMap) return; + + const svg = svgRef.current; + const { width, height } = dimensions; + svg.innerHTML = ""; + + const projection = createProjection(width, height); + const path = d3.geoPath().projection(projection); + + // Render countries + const mapGroup = createSVGElement("g", { + class: "map-countries", + }); + worldData.features?.forEach( + (feature: Feature) => { + const pathData = path(feature); + if (pathData) { + const pathElement = createSVGElement("path", { + d: pathData, + fill: MAP_COLORS.landFill, + stroke: MAP_COLORS.landStroke, + "stroke-width": "0.5", + }); + mapGroup.appendChild(pathElement); + } + }, + ); + svg.appendChild(mapGroup); + + // Helper to update tooltip position + const updateTooltip = (e: MouseEvent) => { + const rect = svg.getBoundingClientRect(); + setTooltipPosition({ + x: e.clientX - rect.left, + y: e.clientY - rect.top, + }); + }; + + // Helper to create circle + const createCircle = (location: LocationPoint) => { + const projected = projection(location.coordinates); + if (!projected) return null; + + const [x, y] = projected; + if (x < 0 || x > width || y < 0 || y > height) return null; + + const isSelected = selectedLocation?.id === location.id; + const isHovered = hoveredLocation?.id === location.id; + const classes = ["cursor-pointer"]; + + if (isSelected) classes.push("drop-shadow-[0_0_8px_#86da26]"); + if (isHovered && !isSelected) classes.push("opacity-70"); + + const circle = createSVGElement("circle", { + cx: x.toString(), + cy: y.toString(), + r: (isSelected + ? MAP_CONFIG.selectedPointRadius + : MAP_CONFIG.pointRadius + ).toString(), + fill: isSelected ? MAP_COLORS.pointSelected : MAP_COLORS.pointDefault, + class: classes.join(" "), + }); + + circle.addEventListener("click", () => + setSelectedLocation(isSelected ? null : location), + ); + circle.addEventListener("mouseenter", (e) => { + setHoveredLocation(location); + updateTooltip(e); + }); + circle.addEventListener("mousemove", updateTooltip); + circle.addEventListener("mouseleave", () => { + setHoveredLocation(null); + setTooltipPosition(null); + }); + + return circle; + }; + + // Render points + const pointsGroup = createSVGElement("g", { + class: "threat-points", + }); + + // Unselected points first + data.locations.forEach((location) => { + if (selectedLocation?.id !== location.id) { + const circle = createCircle(location); + if (circle) pointsGroup.appendChild(circle); + } + }); + + // Selected point last (on top) + if (selectedLocation) { + const selectedData = data.locations.find( + (loc) => loc.id === selectedLocation.id, + ); + if (selectedData) { + const circle = createCircle(selectedData); + if (circle) pointsGroup.appendChild(circle); + } + } + + svg.appendChild(pointsGroup); + }, [ + data.locations, + dimensions, + selectedLocation, + hoveredLocation, + worldData, + isLoadingMap, + ]); + + const CHART_COLORS = { + tooltipBorder: "var(--chart-border-emphasis)", + tooltipBackground: "var(--chart-background)", + textPrimary: "var(--chart-text-primary)", + textSecondary: "var(--chart-text-secondary)", + }; + + return ( +
+ {/* Map Section */} +
+

+ Threat Map +

+ +
+ {isLoadingMap ? ( + + ) : ( + <> +
+ + {hoveredLocation && tooltipPosition && ( + + )} +
+
+
+ + {data.locations.length} Locations + +
+ + )} +
+
+ + {/* Details Section */} +
+
+ {selectedLocation ? ( +
+
+
+
+

+ {selectedLocation.name} +

+
+

+ {selectedLocation.totalFindings.toLocaleString()} Total Findings +

+
+ +
+ ) : ( + + )} +
+
+ ); +} diff --git a/ui/components/graphs/map-region-filter.tsx b/ui/components/graphs/map-region-filter.tsx new file mode 100644 index 0000000000..3b483d1c62 --- /dev/null +++ b/ui/components/graphs/map-region-filter.tsx @@ -0,0 +1,50 @@ +"use client"; + +import { + Select, + SelectContent, + SelectItem, + SelectTrigger, + SelectValue, +} from "../ui/select/Select"; + +interface MapRegionFilterProps { + regions: string[]; + selectedRegion: string; + onRegionChange: (region: string) => void; + chartColors: { + tooltipBorder: string; + tooltipBackground: string; + textPrimary: string; + }; +} + +export function MapRegionFilter({ + regions, + selectedRegion, + onRegionChange, + chartColors, +}: MapRegionFilterProps) { + return ( + + ); +} diff --git a/ui/components/graphs/RadarChart.tsx b/ui/components/graphs/radar-chart.tsx similarity index 80% rename from ui/components/graphs/RadarChart.tsx rename to ui/components/graphs/radar-chart.tsx index 462c29dd68..ab3a43e6da 100644 --- a/ui/components/graphs/RadarChart.tsx +++ b/ui/components/graphs/radar-chart.tsx @@ -13,7 +13,7 @@ import { ChartTooltip, } from "@/components/ui/chart/Chart"; -import { AlertPill } from "./shared/AlertPill"; +import { AlertPill } from "./shared/alert-pill"; import { CHART_COLORS } from "./shared/constants"; import { RadarDataPoint } from "./types"; @@ -28,7 +28,7 @@ interface RadarChartProps { const chartConfig = { value: { label: "Findings", - color: "var(--color-magenta)", + color: "var(--chart-radar-primary)", }, } satisfies ChartConfig; @@ -36,15 +36,27 @@ const CustomTooltip = ({ active, payload }: any) => { if (active && payload && payload.length) { const data = payload[0]; return ( -
-

+

+

{data.payload.category}

{data.payload.change !== undefined && ( -

+

{data.payload.change > 0 ? "+" : ""} {data.payload.change}% @@ -84,8 +96,11 @@ const CustomDot = (props: any) => { cx={cx} cy={cy} r={isSelected ? 9 : 6} - fill={isSelected ? "var(--color-success)" : "var(--color-purple-dark)"} + fill={ + isSelected ? "var(--chart-success-color)" : "var(--chart-radar-primary)" + } fillOpacity={1} + className={isSelected ? "drop-shadow-[0_0_8px_#86da26]" : ""} style={{ cursor: onSelectPoint ? "pointer" : "default", pointerEvents: "all", @@ -117,7 +132,7 @@ export function RadarChart({ {percentage}% diff --git a/ui/components/graphs/sankey-chart.tsx b/ui/components/graphs/sankey-chart.tsx new file mode 100644 index 0000000000..58179aadf6 --- /dev/null +++ b/ui/components/graphs/sankey-chart.tsx @@ -0,0 +1,403 @@ +"use client"; + +import { useState } from "react"; +import { Rectangle, ResponsiveContainer, Sankey, Tooltip } from "recharts"; + +import { ChartTooltip } from "./shared/chart-tooltip"; +import { CHART_COLORS } from "./shared/constants"; + +interface SankeyNode { + name: string; + newFindings?: number; + change?: number; +} + +interface SankeyLink { + source: number; + target: number; + value: number; +} + +interface SankeyChartProps { + data: { + nodes: SankeyNode[]; + links: SankeyLink[]; + }; + height?: number; +} + +interface LinkTooltipState { + show: boolean; + x: number; + y: number; + sourceName: string; + targetName: string; + value: number; + color: string; +} + +interface NodeTooltipState { + show: boolean; + x: number; + y: number; + name: string; + value: number; + color: string; + newFindings?: number; + change?: number; +} + +// Note: Using hex colors directly because Recharts SVG fill doesn't resolve CSS variables +const COLORS: Record = { + Success: "#86da26", + Fail: "#db2b49", + AWS: "#ff9900", + Azure: "#00bcd4", + Google: "#EA4335", + Critical: "#971348", + High: "#ff3077", + Medium: "#ff7d19", + Low: "#fdd34f", + Info: "#2e51b2", + Informational: "#2e51b2", +}; + +const CustomTooltip = ({ active, payload }: any) => { + if (active && payload && payload.length) { + const data = payload[0].payload; + return ( +

+

+ {data.name} +

+ {data.value && ( +

+ Value: {data.value} +

+ )} +
+ ); + } + return null; +}; + +const CustomNode = (props: any) => { + const { x, y, width, height, payload, containerWidth } = props; + const isOut = x + width + 6 > containerWidth; + const nodeName = payload.name; + const color = COLORS[nodeName] || CHART_COLORS.defaultColor; + const isHidden = nodeName === ""; + const hasTooltip = !isHidden && payload.newFindings; + + const handleMouseEnter = (e: React.MouseEvent) => { + if (!hasTooltip) return; + + const rect = e.currentTarget.closest("svg") as SVGSVGElement; + if (rect) { + const bbox = rect.getBoundingClientRect(); + props.onNodeHover?.({ + x: e.clientX - bbox.left, + y: e.clientY - bbox.top, + name: nodeName, + value: payload.value, + color, + newFindings: payload.newFindings, + change: payload.change, + }); + } + }; + + const handleMouseMove = (e: React.MouseEvent) => { + if (!hasTooltip) return; + + const rect = e.currentTarget.closest("svg") as SVGSVGElement; + if (rect) { + const bbox = rect.getBoundingClientRect(); + props.onNodeMove?.({ + x: e.clientX - bbox.left, + y: e.clientY - bbox.top, + }); + } + }; + + const handleMouseLeave = () => { + if (!hasTooltip) return; + props.onNodeLeave?.(); + }; + + return ( + + + {!isHidden && ( + <> + + {nodeName} + + + {payload.value} + + + )} + + ); +}; + +const CustomLink = (props: any) => { + const { + sourceX, + targetX, + sourceY, + targetY, + sourceControlX, + targetControlX, + linkWidth, + index, + } = props; + + const sourceName = props.payload.source?.name || ""; + const targetName = props.payload.target?.name || ""; + const value = props.payload.value || 0; + const color = COLORS[sourceName] || CHART_COLORS.defaultColor; + const isHidden = targetName === ""; + + const isHovered = props.hoveredLink !== null && props.hoveredLink === index; + const hasHoveredLink = props.hoveredLink !== null; + + const pathD = ` + M${sourceX},${sourceY + linkWidth / 2} + C${sourceControlX},${sourceY + linkWidth / 2} + ${targetControlX},${targetY + linkWidth / 2} + ${targetX},${targetY + linkWidth / 2} + L${targetX},${targetY - linkWidth / 2} + C${targetControlX},${targetY - linkWidth / 2} + ${sourceControlX},${sourceY - linkWidth / 2} + ${sourceX},${sourceY - linkWidth / 2} + Z + `; + + const getOpacity = () => { + if (isHidden) return "0"; + if (!hasHoveredLink) return "0.4"; + return isHovered ? "0.8" : "0.1"; + }; + + const handleMouseEnter = (e: React.MouseEvent) => { + const rect = e.currentTarget.parentElement?.parentElement + ?.parentElement as unknown as SVGSVGElement; + if (rect) { + const bbox = rect.getBoundingClientRect(); + props.onLinkHover?.(index, { + x: e.clientX - bbox.left, + y: e.clientY - bbox.top, + sourceName, + targetName, + value, + color, + }); + } + }; + + const handleMouseMove = (e: React.MouseEvent) => { + const rect = e.currentTarget.parentElement?.parentElement + ?.parentElement as unknown as SVGSVGElement; + if (rect && isHovered) { + const bbox = rect.getBoundingClientRect(); + props.onLinkMove?.({ + x: e.clientX - bbox.left, + y: e.clientY - bbox.top, + }); + } + }; + + const handleMouseLeave = () => { + props.onLinkLeave?.(); + }; + + return ( + + + + ); +}; + +export function SankeyChart({ data, height = 400 }: SankeyChartProps) { + const [hoveredLink, setHoveredLink] = useState(null); + const [linkTooltip, setLinkTooltip] = useState({ + show: false, + x: 0, + y: 0, + sourceName: "", + targetName: "", + value: 0, + color: "", + }); + + const [nodeTooltip, setNodeTooltip] = useState({ + show: false, + x: 0, + y: 0, + name: "", + value: 0, + color: "", + }); + + const handleLinkHover = ( + index: number, + data: Omit, + ) => { + setHoveredLink(index); + setLinkTooltip({ show: true, ...data }); + }; + + const handleLinkMove = (position: { x: number; y: number }) => { + setLinkTooltip((prev) => ({ + ...prev, + x: position.x, + y: position.y, + })); + }; + + const handleLinkLeave = () => { + setHoveredLink(null); + setLinkTooltip((prev) => ({ ...prev, show: false })); + }; + + const handleNodeHover = (data: Omit) => { + setNodeTooltip({ show: true, ...data }); + }; + + const handleNodeMove = (position: { x: number; y: number }) => { + setNodeTooltip((prev) => ({ + ...prev, + x: position.x, + y: position.y, + })); + }; + + const handleNodeLeave = () => { + setNodeTooltip((prev) => ({ ...prev, show: false })); + }; + + return ( +
+ + + } + link={ + + } + nodePadding={50} + margin={{ top: 20, right: 160, bottom: 20, left: 160 }} + sort={false} + > + } /> + + + {linkTooltip.show && ( +
+ +
+ )} + {nodeTooltip.show && ( +
+ +
+ )} +
+ ); +} diff --git a/ui/components/graphs/ScatterPlot.tsx b/ui/components/graphs/scatter-plot.tsx similarity index 81% rename from ui/components/graphs/ScatterPlot.tsx rename to ui/components/graphs/scatter-plot.tsx index 920f6c0c10..a0725f0dc5 100644 --- a/ui/components/graphs/ScatterPlot.tsx +++ b/ui/components/graphs/scatter-plot.tsx @@ -11,18 +11,11 @@ import { YAxis, } from "recharts"; -import { AlertPill } from "./shared/AlertPill"; -import { ChartLegend } from "./shared/ChartLegend"; +import { AlertPill } from "./shared/alert-pill"; +import { ChartLegend } from "./shared/chart-legend"; import { CHART_COLORS } from "./shared/constants"; import { getSeverityColorByRiskScore } from "./shared/utils"; - -interface ScatterDataPoint { - x: number; - y: number; - provider: string; - name: string; - size?: number; -} +import type { ScatterDataPoint } from "./types"; interface ScatterPlotProps { data: ScatterDataPoint[]; @@ -34,9 +27,9 @@ interface ScatterPlotProps { } const PROVIDER_COLORS = { - AWS: "var(--color-orange)", - Azure: "var(--color-cyan)", - Google: "var(--color-red)", + AWS: "var(--chart-provider-aws)", + Azure: "var(--chart-provider-azure)", + Google: "var(--chart-provider-google)", }; const CustomTooltip = ({ active, payload }: any) => { @@ -45,9 +38,23 @@ const CustomTooltip = ({ active, payload }: any) => { const severityColor = getSeverityColorByRiskScore(data.x); return ( -
-

{data.name}

-

+

+

+ {data.name} +

+

{data.x} Risk Score

@@ -69,7 +76,7 @@ const CustomScatterDot = ({ const isSelected = selectedPoint?.name === payload.name; const size = isSelected ? 18 : 8; const fill = isSelected - ? "var(--color-success)" + ? "#86DA26" : PROVIDER_COLORS[payload.provider as keyof typeof PROVIDER_COLORS] || CHART_COLORS.defaultColor; @@ -79,8 +86,9 @@ const CustomScatterDot = ({ cy={cy} r={size / 2} fill={fill} - stroke={isSelected ? "var(--color-success)" : "transparent"} + stroke={isSelected ? "#86DA26" : "transparent"} strokeWidth={2} + className={isSelected ? "drop-shadow-[0_0_8px_#86da26]" : ""} style={{ cursor: "pointer" }} onClick={() => onSelectPoint?.(payload)} /> diff --git a/ui/components/graphs/shared/AlertPill.tsx b/ui/components/graphs/shared/alert-pill.tsx similarity index 59% rename from ui/components/graphs/shared/AlertPill.tsx rename to ui/components/graphs/shared/alert-pill.tsx index f611b27766..2da8b1903f 100644 --- a/ui/components/graphs/shared/AlertPill.tsx +++ b/ui/components/graphs/shared/alert-pill.tsx @@ -17,13 +17,17 @@ export function AlertPill({ }: AlertPillProps) { return (
-
- +
+ {value} diff --git a/ui/components/graphs/shared/ChartLegend.tsx b/ui/components/graphs/shared/chart-legend.tsx similarity index 59% rename from ui/components/graphs/shared/ChartLegend.tsx rename to ui/components/graphs/shared/chart-legend.tsx index 11066aa54a..2efea3ea85 100644 --- a/ui/components/graphs/shared/ChartLegend.tsx +++ b/ui/components/graphs/shared/chart-legend.tsx @@ -9,14 +9,22 @@ interface ChartLegendProps { export function ChartLegend({ items }: ChartLegendProps) { return ( -
+
{items.map((item, index) => (
- {item.label} + + {item.label} +
))}
diff --git a/ui/components/graphs/shared/ChartTooltip.tsx b/ui/components/graphs/shared/chart-tooltip.tsx similarity index 63% rename from ui/components/graphs/shared/ChartTooltip.tsx rename to ui/components/graphs/shared/chart-tooltip.tsx index 6b4bde27bc..558da987fe 100644 --- a/ui/components/graphs/shared/ChartTooltip.tsx +++ b/ui/components/graphs/shared/chart-tooltip.tsx @@ -3,6 +3,7 @@ import { Bell, VolumeX } from "lucide-react"; import { cn } from "@/lib/utils"; import { TooltipData } from "../types"; +import { CHART_COLORS } from "./constants"; interface ChartTooltipProps { active?: boolean; @@ -27,7 +28,13 @@ export function ChartTooltip({ const color = payload[0].color || data.color; return ( -
+
{showColorIndicator && color && (
)} -

{label || data.name}

+

+ {label || data.name} +

-

+

{typeof data.value === "number" ? data.value.toLocaleString() : data.value} @@ -50,8 +59,8 @@ export function ChartTooltip({ {data.newFindings !== undefined && data.newFindings > 0 && (

- - + + {data.newFindings} New Findings
@@ -59,20 +68,24 @@ export function ChartTooltip({ {data.new !== undefined && data.new > 0 && (
- - {data.new} New + + + {data.new} New +
)} {data.muted !== undefined && data.muted > 0 && (
- - {data.muted} Muted + + + {data.muted} Muted +
)} {data.change !== undefined && ( -

+

{data.change > 0 ? "+" : ""} {data.change}% @@ -97,8 +110,10 @@ export function MultiSeriesChartTooltip({ } return ( -

-

{label}

+
+

+ {label} +

{payload.map((entry: any, index: number) => (
@@ -106,12 +121,14 @@ export function MultiSeriesChartTooltip({ className="h-2 w-2 rounded-full" style={{ backgroundColor: entry.color }} /> - {entry.name}: - + + {entry.name}: + + {entry.value} {entry.payload[`${entry.dataKey}_change`] && ( - + ({entry.payload[`${entry.dataKey}_change`] > 0 ? "+" : ""} {entry.payload[`${entry.dataKey}_change`]}%) diff --git a/ui/components/graphs/shared/constants.ts b/ui/components/graphs/shared/constants.ts index 9ab80b8fa8..4aadd4aac0 100644 --- a/ui/components/graphs/shared/constants.ts +++ b/ui/components/graphs/shared/constants.ts @@ -1,21 +1,33 @@ export const SEVERITY_COLORS = { - Informational: "var(--color-info)", - Low: "var(--color-warning)", - Medium: "var(--color-warning-emphasis)", - High: "var(--color-danger)", - Critical: "var(--color-danger-emphasis)", + Informational: "var(--chart-info)", + Info: "var(--chart-info)", + Low: "var(--chart-warning)", + Medium: "var(--chart-warning-emphasis)", + High: "var(--chart-danger)", + Critical: "var(--chart-danger-emphasis)", +} as const; + +export const PROVIDER_COLORS = { + AWS: "var(--chart-provider-aws)", + Azure: "var(--chart-provider-azure)", + Google: "var(--chart-provider-google)", +} as const; + +export const STATUS_COLORS = { + Success: "var(--chart-success-color)", + Fail: "var(--chart-fail)", } as const; export const CHART_COLORS = { - tooltipBorder: "var(--color-slate-700)", - tooltipBackground: "var(--color-slate-800)", - textPrimary: "var(--color-white)", - textSecondary: "var(--color-slate-400)", - gridLine: "var(--color-slate-700)", + tooltipBorder: "var(--chart-border-emphasis)", + tooltipBackground: "var(--chart-background)", + textPrimary: "var(--chart-text-primary)", + textSecondary: "var(--chart-text-secondary)", + gridLine: "var(--chart-border-emphasis)", backgroundTrack: "rgba(51, 65, 85, 0.5)", // slate-700 with 50% opacity - alertPillBg: "var(--color-alert-pill-bg)", - alertPillText: "var(--color-alert-pill-text)", - defaultColor: "var(--color-slate-500)", // Default fallback color for charts + alertPillBg: "var(--chart-alert-bg)", + alertPillText: "var(--chart-alert-text)", + defaultColor: "#64748b", // slate-500 } as const; export const CHART_DIMENSIONS = { diff --git a/ui/components/graphs/types.ts b/ui/components/graphs/types.ts index 0961a32105..f7a9b02542 100644 --- a/ui/components/graphs/types.ts +++ b/ui/components/graphs/types.ts @@ -36,6 +36,14 @@ export interface RadarDataPoint { change?: number; } +export interface ScatterDataPoint { + x: number; + y: number; + provider: string; + name: string; + size?: number; +} + export interface LineConfig { dataKey: string; color: string; diff --git a/ui/components/primitives.ts b/ui/components/primitives.ts deleted file mode 100644 index 04b1f22594..0000000000 --- a/ui/components/primitives.ts +++ /dev/null @@ -1,53 +0,0 @@ -import { tv } from "tailwind-variants"; - -export const title = tv({ - base: "tracking-tight inline font-semibold", - variants: { - color: { - violet: "from-[#FF1CF7] to-[#b249f8]", - yellow: "from-[#FF705B] to-[#FFB457]", - blue: "from-[#5EA2EF] to-[#0072F5]", - cyan: "from-[#00b7fa] to-[#01cfea]", - green: "from-[#6FEE8D] to-[#17c964]", - pink: "from-[#FF72E1] to-[#F54C7A]", - foreground: "dark:from-[#FFFFFF] dark:to-[#4B4B4B]", - }, - size: { - sm: "text-3xl lg:text-4xl", - md: "text-[2.3rem] lg:text-5xl leading-9", - lg: "text-4xl lg:text-6xl", - }, - fullWidth: { - true: "w-full block", - }, - }, - defaultVariants: { - size: "md", - }, - compoundVariants: [ - { - color: [ - "violet", - "yellow", - "blue", - "cyan", - "green", - "pink", - "foreground", - ], - class: "bg-clip-text text-transparent bg-linear-to-b", - }, - ], -}); - -export const subtitle = tv({ - base: "w-full md:w-1/2 my-2 text-lg lg:text-xl text-default-600 block max-w-full", - variants: { - fullWidth: { - true: "w-full!", - }, - }, - defaultVariants: { - fullWidth: true, - }, -}); diff --git a/ui/components/shadcn/README.md b/ui/components/shadcn/README.md new file mode 100644 index 0000000000..af3bc0348d --- /dev/null +++ b/ui/components/shadcn/README.md @@ -0,0 +1,62 @@ +# shadcn Components + +This directory contains all shadcn/ui based components for the Prowler application. + +## Directory Structure + +Example of a custom component: + +``` +shadcn/ +├── card/ +│ ├── base-card/ +│ │ ├── base-card.tsx +│ ├── card/ +│ │ ├── card.tsx +│ └── resource-stats-card/ +│ ├── resource-stats-card.tsx +│ ├── resource-stats-card.example.tsx +├── index.ts # Barrel exports +└── README.md +``` + +## Usage + +All shadcn components can be imported from `@/components/shadcn`: + +```tsx +import { Card, CardHeader, CardContent } from "@/components/shadcn"; +import { ResourceStatsCard } from "@/components/shadcn"; +``` + +## Adding New shadcn Components + +When adding new shadcn components using the CLI: + +```bash +npx shadcn@latest add [component-name] +``` + +The component will be automatically added to this directory due to the configuration in `components.json`: + +```json +{ + "aliases": { + "ui": "@/components/shadcn" + } +} +``` + +## Component Guidelines + +1. **shadcn base components** - Use as-is from shadcn/ui (e.g., `card.tsx`) +2. **Custom components built on shadcn** - Create in subdirectories (e.g., `resource-stats-card/`) +3. **CVA variants** - Use Class Variance Authority for type-safe variants +4. **Theme support** - Include `dark:` classes for dark/light theme compatibility +5. **TypeScript** - Always export types and use proper typing + +## Resources + +- [shadcn/ui Documentation](https://ui.shadcn.com) +- [CVA Documentation](https://cva.style/docs) +- [Tailwind CSS Documentation](https://tailwindcss.com/docs) diff --git a/ui/components/shadcn/card/base-card/base-card.tsx b/ui/components/shadcn/card/base-card/base-card.tsx new file mode 100644 index 0000000000..946e0cc184 --- /dev/null +++ b/ui/components/shadcn/card/base-card/base-card.tsx @@ -0,0 +1,36 @@ +import { cva, type VariantProps } from "class-variance-authority"; + +import { cn } from "@/lib/utils"; + +import { Card } from "../card"; + +const baseCardVariants = cva("", { + variants: { + variant: { + default: + "border-slate-200 bg-white dark:border-zinc-900 dark:bg-stone-950", + }, + }, + defaultVariants: { + variant: "default", + }, +}); + +interface BaseCardProps + extends React.ComponentProps, + VariantProps {} + +const BaseCard = ({ className, variant, ...props }: BaseCardProps) => { + return ( + + ); +}; + +export { BaseCard }; diff --git a/ui/components/shadcn/card/card.tsx b/ui/components/shadcn/card/card.tsx new file mode 100644 index 0000000000..62f4c66865 --- /dev/null +++ b/ui/components/shadcn/card/card.tsx @@ -0,0 +1,99 @@ +import { cn } from "@/lib/utils"; + +export const CardVariant = { + default: "default", + fail: "fail", + pass: "pass", + warning: "warning", + info: "info", +} as const; + +export type CardVariant = (typeof CardVariant)[keyof typeof CardVariant]; + +function Card({ className, ...props }: React.ComponentProps<"div">) { + return ( +
+ ); +} + +function CardHeader({ className, ...props }: React.ComponentProps<"div">) { + return ( +
+ ); +} + +function CardTitle({ className, ...props }: React.ComponentProps<"div">) { + return ( +
+ ); +} + +function CardDescription({ className, ...props }: React.ComponentProps<"div">) { + return ( +
+ ); +} + +function CardAction({ className, ...props }: React.ComponentProps<"div">) { + return ( +
+ ); +} + +function CardContent({ className, ...props }: React.ComponentProps<"div">) { + return ( +
+ ); +} + +function CardFooter({ className, ...props }: React.ComponentProps<"div">) { + return ( +
+ ); +} + +export { + Card, + CardAction, + CardContent, + CardDescription, + CardFooter, + CardHeader, + CardTitle, +}; diff --git a/ui/components/shadcn/card/resource-stats-card/resource-stats-card-container.tsx b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-container.tsx new file mode 100644 index 0000000000..de27d052ed --- /dev/null +++ b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-container.tsx @@ -0,0 +1,55 @@ +import { cva, type VariantProps } from "class-variance-authority"; + +import { cn } from "@/lib/utils"; + +const containerVariants = cva( + [ + "flex", + "rounded-[12px]", + "border", + "backdrop-blur-[46px]", + "border-slate-300", + "bg-[#F8FAFC80]", + "dark:border-[rgba(38,38,38,0.70)]", + "dark:bg-[rgba(23,23,23,0.50)]", + ], + { + variants: { + padding: { + sm: "px-3 py-2", + md: "px-[19px] py-[9px]", + lg: "px-6 py-3", + none: "p-0", + }, + }, + defaultVariants: { + padding: "md", + }, + }, +); + +export interface ResourceStatsCardContainerProps + extends React.HTMLAttributes, + VariantProps { + ref?: React.Ref; +} + +export const ResourceStatsCardContainer = ({ + className, + children, + padding, + ref, + ...props +}: ResourceStatsCardContainerProps) => { + return ( +
+ {children} +
+ ); +}; + +ResourceStatsCardContainer.displayName = "ResourceStatsCardContainer"; diff --git a/ui/components/shadcn/card/resource-stats-card/resource-stats-card-content.tsx b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-content.tsx new file mode 100644 index 0000000000..e338c5e7b1 --- /dev/null +++ b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-content.tsx @@ -0,0 +1,196 @@ +import { cva } from "class-variance-authority"; +import { LucideIcon } from "lucide-react"; + +import { cn } from "@/lib/utils"; + +import { CardVariant } from "../card"; + +export interface StatItem { + icon: LucideIcon; + label: string; +} + +const variantColors = { + default: "#868994", + fail: "#f54280", + pass: "#4ade80", + warning: "#fbbf24", + info: "#60a5fa", +} as const; + +type BadgeVariant = keyof typeof variantColors; + +const badgeVariants = cva( + ["flex", "items-center", "justify-center", "gap-0.5", "rounded-full"], + { + variants: { + variant: { + [CardVariant.default]: "bg-slate-100 dark:bg-[#535359]", + [CardVariant.fail]: "bg-red-100 dark:bg-[#432232]", + [CardVariant.pass]: "bg-green-100 dark:bg-[#204237]", + [CardVariant.warning]: "bg-amber-100 dark:bg-[#3d3520]", + [CardVariant.info]: "bg-blue-100 dark:bg-[#1e3a5f]", + }, + size: { + sm: "px-1 text-xs", + md: "px-1.5 text-sm", + lg: "px-2 text-base", + }, + }, + defaultVariants: { + variant: CardVariant.fail, + size: "md", + }, + }, +); + +const badgeIconVariants = cva("", { + variants: { + size: { + sm: "h-2.5 w-2.5", + md: "h-3 w-3", + lg: "h-4 w-4", + }, + }, + defaultVariants: { + size: "md", + }, +}); + +const labelTextVariants = cva( + "leading-6 font-semibold text-slate-900 dark:text-zinc-300 whitespace-nowrap", + { + variants: { + size: { + sm: "text-xs", + md: "text-sm", + lg: "text-base", + }, + }, + defaultVariants: { + size: "md", + }, + }, +); + +const statIconVariants = cva("text-slate-600 dark:text-zinc-300", { + variants: { + size: { + sm: "h-2.5 w-2.5", + md: "h-3 w-3", + lg: "h-3.5 w-3.5", + }, + }, + defaultVariants: { + size: "md", + }, +}); + +const statLabelVariants = cva( + "leading-5 font-medium text-slate-700 dark:text-zinc-300", + { + variants: { + size: { + sm: "text-xs", + md: "text-sm", + lg: "text-base", + }, + }, + defaultVariants: { + size: "md", + }, + }, +); + +export interface ResourceStatsCardContentProps + extends React.HTMLAttributes { + badge: { + icon: LucideIcon; + count: number | string; + variant?: CardVariant; + }; + label: string; + stats?: StatItem[]; + accentColor?: string; + size?: "sm" | "md" | "lg"; + ref?: React.Ref; +} + +export const ResourceStatsCardContent = ({ + badge, + label, + stats = [], + accentColor, + size = "md", + className, + ref, + ...props +}: ResourceStatsCardContentProps) => { + const BadgeIcon = badge.icon; + const badgeVariant: BadgeVariant = badge.variant || "fail"; + + // Determine accent line color + const lineColor = accentColor || variantColors[badgeVariant] || "#d4d4d8"; + + return ( +
+ {/* Badge and Label Row */} +
+ {/* Badge */} +
+ + + {badge.count} + +
+ + {/* Label */} + {label} +
+ + {/* Stats Section */} + {stats.length > 0 && ( +
+ {/* Vertical Accent Line */} +
+
+
+ + {/* Stats List */} +
+ {stats.map((stat, index) => { + const StatIcon = stat.icon; + return ( +
+ + + {stat.label} + +
+ ); + })} +
+
+ )} +
+ ); +}; + +ResourceStatsCardContent.displayName = "ResourceStatsCardContent"; diff --git a/ui/components/shadcn/card/resource-stats-card/resource-stats-card-divider.tsx b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-divider.tsx new file mode 100644 index 0000000000..3ec8d57ee4 --- /dev/null +++ b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-divider.tsx @@ -0,0 +1,59 @@ +import { cva, type VariantProps } from "class-variance-authority"; + +import { cn } from "@/lib/utils"; + +const dividerVariants = cva("flex items-center justify-center", { + variants: { + spacing: { + sm: "px-2", + md: "px-[23px]", + lg: "px-8", + }, + orientation: { + vertical: "h-full", + horizontal: "w-full", + }, + }, + defaultVariants: { + spacing: "md", + orientation: "vertical", + }, +}); + +const lineVariants = cva("bg-[rgba(39,39,42,1)]", { + variants: { + orientation: { + vertical: "h-full w-px", + horizontal: "w-full h-px", + }, + }, + defaultVariants: { + orientation: "vertical", + }, +}); + +export interface ResourceStatsCardDividerProps + extends React.HTMLAttributes, + VariantProps { + ref?: React.Ref; +} + +export const ResourceStatsCardDivider = ({ + className, + spacing, + orientation, + ref, + ...props +}: ResourceStatsCardDividerProps) => { + return ( +
+
+
+ ); +}; + +ResourceStatsCardDivider.displayName = "ResourceStatsCardDivider"; diff --git a/ui/components/shadcn/card/resource-stats-card/resource-stats-card-header.tsx b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-header.tsx new file mode 100644 index 0000000000..2a4068e998 --- /dev/null +++ b/ui/components/shadcn/card/resource-stats-card/resource-stats-card-header.tsx @@ -0,0 +1,103 @@ +import { cva, type VariantProps } from "class-variance-authority"; +import { LucideIcon } from "lucide-react"; + +import { cn } from "@/lib/utils"; + +const headerVariants = cva("flex w-full items-center gap-1", { + variants: { + size: { + sm: "", + md: "", + lg: "", + }, + }, + defaultVariants: { + size: "md", + }, +}); + +const iconVariants = cva("text-zinc-300 dark:text-zinc-300", { + variants: { + size: { + sm: "h-3.5 w-3.5", + md: "h-4 w-4", + lg: "h-5 w-5", + }, + }, + defaultVariants: { + size: "md", + }, +}); + +const titleVariants = cva( + "leading-7 font-semibold text-zinc-300 dark:text-zinc-300", + { + variants: { + size: { + sm: "text-sm", + md: "text-base", + lg: "text-lg", + }, + }, + defaultVariants: { + size: "md", + }, + }, +); + +const countVariants = cva( + "leading-4 font-normal text-zinc-300 dark:text-zinc-300", + { + variants: { + size: { + sm: "text-[9px]", + md: "text-[10px]", + lg: "text-xs", + }, + }, + defaultVariants: { + size: "md", + }, + }, +); + +export interface ResourceStatsCardHeaderProps + extends React.HTMLAttributes, + VariantProps { + icon: LucideIcon; + title: string; + resourceCount?: number | string; + ref?: React.Ref; +} + +export const ResourceStatsCardHeader = ({ + icon: Icon, + title, + resourceCount, + size = "md", + className, + ref, + ...props +}: ResourceStatsCardHeaderProps) => { + return ( +
+
+ + {title} +
+ {resourceCount !== undefined && ( + + {typeof resourceCount === "number" + ? `${resourceCount} Resources` + : resourceCount} + + )} +
+ ); +}; + +ResourceStatsCardHeader.displayName = "ResourceStatsCardHeader"; diff --git a/ui/components/shadcn/card/resource-stats-card/resource-stats-card.tsx b/ui/components/shadcn/card/resource-stats-card/resource-stats-card.tsx new file mode 100644 index 0000000000..99d3e7867d --- /dev/null +++ b/ui/components/shadcn/card/resource-stats-card/resource-stats-card.tsx @@ -0,0 +1,162 @@ +import { cva, type VariantProps } from "class-variance-authority"; +import { LucideIcon } from "lucide-react"; + +import { cn } from "@/lib/utils"; + +import { CardVariant } from "../card"; +import { ResourceStatsCardContainer } from "./resource-stats-card-container"; +import type { StatItem } from "./resource-stats-card-content"; +import { ResourceStatsCardContent } from "./resource-stats-card-content"; +import { ResourceStatsCardHeader } from "./resource-stats-card-header"; + +export type { StatItem }; + +// Todo: when the design system is ready, we must use the colors from the design system (semantic colors) +// Variant styles using CVA for type safety and consistency +// Colors are exact HEX values from Figma design system +const cardVariants = cva("", { + variants: { + variant: { + [CardVariant.default]: "", + // Fail variant - rgba(67,34,50) from Figma + [CardVariant.fail]: + "border-[rgba(67,34,50,0.5)] bg-[rgba(67,34,50,0.2)] dark:border-[rgba(67,34,50,0.7)] dark:bg-[rgba(67,34,50,0.3)]", + // Pass variant - rgba(32,66,55) from Figma + [CardVariant.pass]: + "border-[rgba(32,66,55,0.5)] bg-[rgba(32,66,55,0.2)] dark:border-[rgba(32,66,55,0.7)] dark:bg-[rgba(32,66,55,0.3)]", + // Warning variant - rgba(61,53,32) from Figma + [CardVariant.warning]: + "border-[rgba(61,53,32,0.5)] bg-[rgba(61,53,32,0.2)] dark:border-[rgba(61,53,32,0.7)] dark:bg-[rgba(61,53,32,0.3)]", + // Info variant - rgba(30,58,95) from Figma + [CardVariant.info]: + "border-[rgba(30,58,95,0.5)] bg-[rgba(30,58,95,0.2)] dark:border-[rgba(30,58,95,0.7)] dark:bg-[rgba(30,58,95,0.3)]", + }, + size: { + sm: "px-2 py-1.5 gap-1", + md: "px-3 py-2 gap-2", + lg: "px-4 py-3 gap-3", + }, + }, + defaultVariants: { + variant: CardVariant.default, + size: "md", + }, +}); + +export interface ResourceStatsCardProps + extends Omit, "color">, + VariantProps { + // Optional header (icon + title + resource count) + header?: { + icon: LucideIcon; + title: string; + resourceCount?: number | string; + }; + + // Empty state message (when there's no data to display) + emptyState?: { + message: string; + }; + + // Main badge (top section) - optional when using empty state + badge?: { + icon: LucideIcon; + count: number | string; + variant?: CardVariant; + }; + + // Main label - optional when using empty state + label?: string; + + // Vertical accent line color (optional, auto-determined from variant) + accentColor?: string; + + // Sub-statistics array (flexible items) + stats?: StatItem[]; + + // Render without container (no border, background, padding) - useful for composing multiple cards in a custom container + containerless?: boolean; + + // Ref for the root element + ref?: React.Ref; +} + +export const ResourceStatsCard = ({ + header, + emptyState, + badge, + label, + accentColor, + stats = [], + variant = CardVariant.default, + size = "md", + containerless = false, + className, + ref, + ...props +}: ResourceStatsCardProps) => { + // Resolve size to ensure it's not null (CVA can return null but we need a defined value) + const resolvedSize = size || "md"; + + // If containerless, render without outer wrapper + if (containerless) { + return ( +
+ {header && } + {emptyState ? ( +
+

+ {emptyState.message} +

+
+ ) : ( + badge && + label && ( + + ) + )} +
+ ); + } + + // Otherwise, render with container + return ( + + {header && } + {emptyState ? ( +
+

+ {emptyState.message} +

+
+ ) : ( + badge && + label && ( + + ) + )} + + ); +}; + +ResourceStatsCard.displayName = "ResourceStatsCard"; diff --git a/ui/components/shadcn/index.ts b/ui/components/shadcn/index.ts new file mode 100644 index 0000000000..d96af75fe4 --- /dev/null +++ b/ui/components/shadcn/index.ts @@ -0,0 +1,8 @@ +export * from "./card/base-card/base-card"; +export * from "./card/card"; +export * from "./card/resource-stats-card/resource-stats-card"; +export * from "./card/resource-stats-card/resource-stats-card-container"; +export * from "./card/resource-stats-card/resource-stats-card-content"; +export * from "./card/resource-stats-card/resource-stats-card-divider"; +export * from "./card/resource-stats-card/resource-stats-card-header"; +export * from "./select/select"; diff --git a/ui/components/shadcn/select/select.tsx b/ui/components/shadcn/select/select.tsx new file mode 100644 index 0000000000..2d95e91537 --- /dev/null +++ b/ui/components/shadcn/select/select.tsx @@ -0,0 +1,350 @@ +"use client"; + +import * as SelectPrimitive from "@radix-ui/react-select"; +import { CheckIcon, ChevronDownIcon, ChevronUpIcon, X } from "lucide-react"; +import { createContext, useContext, useId } from "react"; + +import { cn } from "@/lib/utils"; + +// Context for managing multi-select state +type SelectContextValue = { + multiple?: boolean; + selectedValues?: string[]; + onMultiValueChange?: (values: string[]) => void; + ariaLabel?: string; + liveRegionId?: string; +}; + +const SelectContext = createContext({}); + +function Select({ + allowDeselect = false, + multiple = false, + value, + onValueChange, + selectedValues = [], + onMultiValueChange, + ariaLabel, + ...props +}: Omit, "onValueChange"> & { + allowDeselect?: boolean; + multiple?: boolean; + selectedValues?: string[]; + onValueChange?: (value: string) => void; + onMultiValueChange?: (values: string[]) => void; + ariaLabel?: string; +}) { + const liveRegionId = useId(); + + const handleValueChange = (nextValue: string) => { + if (multiple && onMultiValueChange) { + // Multi-select: toggle the value + const newValues = selectedValues.includes(nextValue) + ? selectedValues.filter((v) => v !== nextValue) + : [...selectedValues, nextValue]; + onMultiValueChange(newValues); + } else if ( + allowDeselect && + typeof value === "string" && + value === nextValue + ) { + // Single-select with deselect + onValueChange?.(""); + } else { + // Single-select + onValueChange?.(nextValue); + } + }; + + const contextValue = { + multiple, + selectedValues, + onMultiValueChange, + ariaLabel, + liveRegionId, + }; + + return ( + + + {/* Live region for screen reader announcements */} + {multiple && ( +
+ {selectedValues.length > 0 + ? `${selectedValues.length} ${selectedValues.length === 1 ? "item" : "items"} selected` + : "No items selected"} +
+ )} + + ); +} + +function SelectGroup({ + ...props +}: React.ComponentProps) { + return ; +} + +function SelectValue({ + placeholder, + children, + ...props +}: React.ComponentProps) { + const { multiple, selectedValues } = useContext(SelectContext); + + // For multi-select, render custom children or placeholder + if (multiple) { + return ( + + {selectedValues && selectedValues.length > 0 ? children : placeholder} + + ); + } + + // For single-select, use default Radix behavior + return ( + + {children} + + ); +} + +function SelectTrigger({ + className, + size = "default", + children, + ...props +}: React.ComponentProps & { + size?: "sm" | "default"; +}) { + const { multiple, selectedValues, onMultiValueChange, ariaLabel } = + useContext(SelectContext); + const hasSelection = multiple && selectedValues && selectedValues.length > 0; + + const handleClear = (e: React.MouseEvent) => { + e.stopPropagation(); + if (onMultiValueChange) { + onMultiValueChange([]); + } + }; + + const clearButtonLabel = `Clear ${ariaLabel || "selection"}${hasSelection ? ` (${selectedValues.length} selected)` : ""}`; + + return ( + + {children} +
+ {hasSelection && ( + { + if (e.key === "Enter" || e.key === " ") { + e.preventDefault(); + e.stopPropagation(); + handleClear(e as unknown as React.MouseEvent); + } + }} + className="pointer-events-auto cursor-pointer rounded-sm p-0.5 opacity-70 transition-opacity hover:opacity-100 focus:opacity-100 focus:ring-2 focus:ring-slate-600 focus:ring-offset-2 focus:outline-none dark:focus:ring-slate-400" + aria-label={clearButtonLabel} + > + + )} + + +
+ + ); +} + +function SelectContent({ + className, + children, + position = "popper", + align = "center", + ...props +}: React.ComponentProps) { + return ( + + + + + {children} + + + + + ); +} + +function SelectLabel({ + className, + ...props +}: React.ComponentProps) { + return ( + + ); +} + +function SelectItem({ + className, + children, + value, + ...props +}: React.ComponentProps) { + const { multiple, selectedValues } = useContext(SelectContext); + const isSelected = multiple && selectedValues?.includes(value); + + return ( + + + {children} + + + + ); +} + +function SelectSeparator({ + className, + ...props +}: React.ComponentProps) { + return ( + + ); +} + +function SelectScrollUpButton({ + className, + ...props +}: React.ComponentProps) { + return ( + + + + ); +} + +function SelectScrollDownButton({ + className, + ...props +}: React.ComponentProps) { + return ( + + + + ); +} + +export { + Select, + SelectContent, + SelectGroup, + SelectItem, + SelectLabel, + SelectScrollDownButton, + SelectScrollUpButton, + SelectSeparator, + SelectTrigger, + SelectValue, +}; diff --git a/ui/components/ui/chart/Chart.tsx b/ui/components/ui/chart/Chart.tsx index fec25668b6..014fbc009d 100644 --- a/ui/components/ui/chart/Chart.tsx +++ b/ui/components/ui/chart/Chart.tsx @@ -70,6 +70,7 @@ const ChartContainer = React.forwardRef< ); }); + ChartContainer.displayName = "Chart"; const ChartStyle = ({ id, config }: { id: string; config: ChartConfig }) => { @@ -184,7 +185,7 @@ const ChartTooltipContent = React.forwardRef<
diff --git a/ui/components/ui/custom/custom-button.tsx b/ui/components/ui/custom/custom-button.tsx index 19d50ba686..8f71aabf24 100644 --- a/ui/components/ui/custom/custom-button.tsx +++ b/ui/components/ui/custom/custom-button.tsx @@ -86,7 +86,7 @@ export const CustomButton = React.forwardRef< ) => (