From 8faa40dfb6aa3a7bb969e582b00ae05b16a856a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 5 Aug 2024 19:04:49 +0200 Subject: [PATCH] feat(opensearch): Add domain inside VPC case for public domain check (#4570) --- .../services/opensearch/opensearch_service.py | 23 +- ...service_domains_not_publicly_accessible.py | 5 +- ...vice_domains_audit_logging_enabled_test.py | 16 +- ...domains_cloudwatch_logging_enabled_test.py | 26 +- ...domains_encryption_at_rest_enabled_test.py | 16 +- ...ains_https_communications_enforced_test.py | 16 +- ...ins_internal_user_database_enabled_test.py | 16 +- ...ns_node_to_node_encryption_enabled_test.py | 16 +- ...ce_domains_not_publicly_accessible_test.py | 238 +++++++++++++----- ...he_latest_service_software_version_test.py | 16 +- ..._cognito_authentication_for_kibana_test.py | 13 + .../opensearch/opensearch_service_test.py | 7 +- 12 files changed, 301 insertions(+), 107 deletions(-) diff --git a/prowler/providers/aws/services/opensearch/opensearch_service.py b/prowler/providers/aws/services/opensearch/opensearch_service.py index 0bc941ae33..34d3a015ba 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service.py @@ -53,12 +53,9 @@ class OpenSearchService(AWSService): "INDEX_SLOW_LOGS", "AUDIT_LOGS", ]: - if ( - logging_key - in describe_domain["DomainConfig"]["LogPublishingOptions"][ - "Options" - ] - ): + if logging_key in describe_domain["DomainConfig"].get( + "LogPublishingOptions", {} + ).get("Options", {}): domain.logging.append( PublishingLoggingOption( name=logging_key, @@ -91,12 +88,16 @@ class OpenSearchService(AWSService): DomainName=domain.name ) domain.arn = describe_domain["DomainStatus"]["ARN"] - domain.endpoint_vpc = None + domain.vpc_endpoints = None if "Endpoints" in describe_domain["DomainStatus"]: if "vpc" in describe_domain["DomainStatus"]["Endpoints"]: - domain.endpoint_vpc = describe_domain["DomainStatus"][ - "Endpoints" - ]["vpc"] + domain.vpc_endpoints = [ + vpc + for vpc in describe_domain["DomainStatus"][ + "Endpoints" + ].values() + ] + domain.vpc_id = None if "VPCOptions" in describe_domain["DomainStatus"]: domain.vpc_id = describe_domain["DomainStatus"]["VPCOptions"][ @@ -156,7 +157,7 @@ class OpenSearchDomain(BaseModel): region: str arn: str = None logging: list[PublishingLoggingOption] = [] - endpoint_vpc: str = None + vpc_endpoints: list[str] = None vpc_id: str = None access_policy: dict = None cognito_options: bool = None diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py index 3812a5bf3e..8165bf6e4f 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py @@ -17,7 +17,10 @@ class opensearch_service_domains_not_publicly_accessible(Check): report.status_extended = ( f"Opensearch domain {domain.name} does not allow anonymous access." ) - if domain.access_policy: + + if domain.vpc_id: + report.status_extended = f"Opensearch domain {domain.name} is in a VPC, then it is not publicly accessible." + elif domain.access_policy: for statement in domain.access_policy["Statement"]: # look for open policies if ( diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled_test.py index 25a3f63cef..51d4722936 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled_test.py @@ -15,9 +15,13 @@ class Test_opensearch_service_domains_audit_logging_enabled: def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_audit_logging_enabled.opensearch_service_domains_audit_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_audit_logging_enabled.opensearch_service_domains_audit_logging_enabled import ( opensearch_service_domains_audit_logging_enabled, @@ -39,7 +43,10 @@ class Test_opensearch_service_domains_audit_logging_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_audit_logging_enabled.opensearch_service_domains_audit_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_audit_logging_enabled.opensearch_service_domains_audit_logging_enabled import ( opensearch_service_domains_audit_logging_enabled, @@ -68,7 +75,10 @@ class Test_opensearch_service_domains_audit_logging_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_audit_logging_enabled.opensearch_service_domains_audit_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_audit_logging_enabled.opensearch_service_domains_audit_logging_enabled import ( opensearch_service_domains_audit_logging_enabled, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled_test.py index 7001b11798..7454c97916 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled_test.py @@ -15,9 +15,13 @@ class Test_opensearch_service_domains_cloudwatch_logging_enabled: def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled import ( opensearch_service_domains_cloudwatch_logging_enabled, @@ -39,7 +43,10 @@ class Test_opensearch_service_domains_cloudwatch_logging_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled import ( opensearch_service_domains_cloudwatch_logging_enabled, @@ -71,7 +78,10 @@ class Test_opensearch_service_domains_cloudwatch_logging_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled import ( opensearch_service_domains_cloudwatch_logging_enabled, @@ -103,7 +113,10 @@ class Test_opensearch_service_domains_cloudwatch_logging_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled import ( opensearch_service_domains_cloudwatch_logging_enabled, @@ -137,7 +150,10 @@ class Test_opensearch_service_domains_cloudwatch_logging_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_cloudwatch_logging_enabled.opensearch_service_domains_cloudwatch_logging_enabled import ( opensearch_service_domains_cloudwatch_logging_enabled, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled_test.py index e0a485d332..e50fc0fa5e 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled_test.py @@ -14,9 +14,13 @@ class Test_opensearch_service_domains_encryption_at_rest_enabled: def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_encryption_at_rest_enabled.opensearch_service_domains_encryption_at_rest_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_encryption_at_rest_enabled.opensearch_service_domains_encryption_at_rest_enabled import ( opensearch_service_domains_encryption_at_rest_enabled, @@ -41,7 +45,10 @@ class Test_opensearch_service_domains_encryption_at_rest_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_encryption_at_rest_enabled.opensearch_service_domains_encryption_at_rest_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_encryption_at_rest_enabled.opensearch_service_domains_encryption_at_rest_enabled import ( opensearch_service_domains_encryption_at_rest_enabled, @@ -72,7 +79,10 @@ class Test_opensearch_service_domains_encryption_at_rest_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_encryption_at_rest_enabled.opensearch_service_domains_encryption_at_rest_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_encryption_at_rest_enabled.opensearch_service_domains_encryption_at_rest_enabled import ( opensearch_service_domains_encryption_at_rest_enabled, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced_test.py index 0247831629..274c52d77a 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced_test.py @@ -14,9 +14,13 @@ class Test_opensearch_service_domains_https_communications_enforced: def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_https_communications_enforced.opensearch_service_domains_https_communications_enforced.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_https_communications_enforced.opensearch_service_domains_https_communications_enforced import ( opensearch_service_domains_https_communications_enforced, @@ -41,7 +45,10 @@ class Test_opensearch_service_domains_https_communications_enforced: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_https_communications_enforced.opensearch_service_domains_https_communications_enforced.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_https_communications_enforced.opensearch_service_domains_https_communications_enforced import ( opensearch_service_domains_https_communications_enforced, @@ -72,7 +79,10 @@ class Test_opensearch_service_domains_https_communications_enforced: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_https_communications_enforced.opensearch_service_domains_https_communications_enforced.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_https_communications_enforced.opensearch_service_domains_https_communications_enforced import ( opensearch_service_domains_https_communications_enforced, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled_test.py index 4da2fd4d5e..10958327b5 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled_test.py @@ -14,9 +14,13 @@ class Test_opensearch_service_domains_internal_user_database_enabled: def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_internal_user_database_enabled.opensearch_service_domains_internal_user_database_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_internal_user_database_enabled.opensearch_service_domains_internal_user_database_enabled import ( opensearch_service_domains_internal_user_database_enabled, @@ -41,7 +45,10 @@ class Test_opensearch_service_domains_internal_user_database_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_internal_user_database_enabled.opensearch_service_domains_internal_user_database_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_internal_user_database_enabled.opensearch_service_domains_internal_user_database_enabled import ( opensearch_service_domains_internal_user_database_enabled, @@ -73,7 +80,10 @@ class Test_opensearch_service_domains_internal_user_database_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_internal_user_database_enabled.opensearch_service_domains_internal_user_database_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_internal_user_database_enabled.opensearch_service_domains_internal_user_database_enabled import ( opensearch_service_domains_internal_user_database_enabled, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled_test.py index 9745cdad99..fa189dae51 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled_test.py @@ -14,9 +14,13 @@ class Test_opensearch_service_domains_node_to_node_encryption_enabled: def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_service_domains_node_to_node_encryption_enabled import ( opensearch_service_domains_node_to_node_encryption_enabled, @@ -41,7 +45,10 @@ class Test_opensearch_service_domains_node_to_node_encryption_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_service_domains_node_to_node_encryption_enabled import ( opensearch_service_domains_node_to_node_encryption_enabled, @@ -73,7 +80,10 @@ class Test_opensearch_service_domains_node_to_node_encryption_enabled: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_node_to_node_encryption_enabled.opensearch_service_domains_node_to_node_encryption_enabled import ( opensearch_service_domains_node_to_node_encryption_enabled, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible_test.py index 3bedd0ba84..dc6c5514f7 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible_test.py @@ -1,12 +1,16 @@ +from json import dumps from unittest import mock -from prowler.providers.aws.services.opensearch.opensearch_service import ( - OpenSearchDomain, +from boto3 import client +from moto import mock_aws + +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_US_WEST_2, + set_mocked_aws_provider, ) -from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1 domain_name = "test-domain" -domain_arn = f"arn:aws:es:us-west-2:{AWS_ACCOUNT_NUMBER}:domain/{domain_name}" policy_data_restricted = { "Version": "2012-10-17", @@ -72,12 +76,20 @@ policy_data_source_whole_internet = { class Test_opensearch_service_domains_not_publicly_accessible: + @mock_aws def test_no_domains(self): - opensearch_client = mock.MagicMock - opensearch_client.opensearch_domains = [] + aws_provider = set_mocked_aws_provider([AWS_REGION_US_WEST_2]) + + from prowler.providers.aws.services.opensearch.opensearch_service import ( + OpenSearchService, + ) + with mock.patch( - "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible.opensearch_client", + new=OpenSearchService(aws_provider), ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible import ( opensearch_service_domains_not_publicly_accessible, @@ -87,22 +99,29 @@ class Test_opensearch_service_domains_not_publicly_accessible: result = check.execute() assert len(result) == 0 + @mock_aws def test_policy_data_restricted(self): - opensearch_client = mock.MagicMock - opensearch_client.opensearch_domains = [] - opensearch_client.opensearch_domains.append( - OpenSearchDomain( - name=domain_name, - region=AWS_REGION_EU_WEST_1, - arn=domain_arn, - access_policy=policy_data_restricted, - ) + opensearch_client = client("opensearch", region_name=AWS_REGION_US_WEST_2) + domain_arn = opensearch_client.create_domain(DomainName=domain_name)[ + "DomainStatus" + ]["ARN"] + opensearch_client.update_domain_config( + DomainName=domain_name, + AccessPolicies=str(policy_data_restricted), + ) + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_WEST_2]) + + from prowler.providers.aws.services.opensearch.opensearch_service import ( + OpenSearchService, ) - opensearch_client.opensearch_domains[0].logging = [] with mock.patch( - "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible.opensearch_client", + new=OpenSearchService(aws_provider), ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible import ( opensearch_service_domains_not_publicly_accessible, @@ -118,23 +137,32 @@ class Test_opensearch_service_domains_not_publicly_accessible: ) assert result[0].resource_id == domain_name assert result[0].resource_arn == domain_arn + assert result[0].region == AWS_REGION_US_WEST_2 + assert result[0].resource_tags == [] + @mock_aws def test_policy_data_not_restricted_with_principal_AWS(self): - opensearch_client = mock.MagicMock - opensearch_client.opensearch_domains = [] - opensearch_client.opensearch_domains.append( - OpenSearchDomain( - name=domain_name, - region=AWS_REGION_EU_WEST_1, - arn=domain_arn, - access_policy=policy_data_not_restricted, - ) + opensearch_client = client("opensearch", region_name=AWS_REGION_US_WEST_2) + domain_arn = opensearch_client.create_domain(DomainName=domain_name)[ + "DomainStatus" + ]["ARN"] + opensearch_client.update_domain_config( + DomainName=domain_name, + AccessPolicies=dumps(policy_data_not_restricted), + ) + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_WEST_2]) + + from prowler.providers.aws.services.opensearch.opensearch_service import ( + OpenSearchService, ) - opensearch_client.opensearch_domains[0].logging = [] with mock.patch( - "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible.opensearch_client", + new=OpenSearchService(aws_provider), ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible import ( opensearch_service_domains_not_publicly_accessible, @@ -150,23 +178,32 @@ class Test_opensearch_service_domains_not_publicly_accessible: ) assert result[0].resource_id == domain_name assert result[0].resource_arn == domain_arn + assert result[0].region == AWS_REGION_US_WEST_2 + assert result[0].resource_tags == [] + @mock_aws def test_policy_data_not_restricted_with_principal_no_AWS(self): - opensearch_client = mock.MagicMock - opensearch_client.opensearch_domains = [] - opensearch_client.opensearch_domains.append( - OpenSearchDomain( - name=domain_name, - region=AWS_REGION_EU_WEST_1, - arn=domain_arn, - access_policy=policy_data_not_restricted_principal, - ) + opensearch_client = client("opensearch", region_name=AWS_REGION_US_WEST_2) + domain_arn = opensearch_client.create_domain(DomainName=domain_name)[ + "DomainStatus" + ]["ARN"] + opensearch_client.update_domain_config( + DomainName=domain_name, + AccessPolicies=dumps(policy_data_not_restricted_principal), + ) + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_WEST_2]) + + from prowler.providers.aws.services.opensearch.opensearch_service import ( + OpenSearchService, ) - opensearch_client.opensearch_domains[0].logging = [] with mock.patch( - "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible.opensearch_client", + new=OpenSearchService(aws_provider), ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible import ( opensearch_service_domains_not_publicly_accessible, @@ -182,23 +219,32 @@ class Test_opensearch_service_domains_not_publicly_accessible: ) assert result[0].resource_id == domain_name assert result[0].resource_arn == domain_arn + assert result[0].region == AWS_REGION_US_WEST_2 + assert result[0].resource_tags == [] + @mock_aws def test_policy_data_not_restricted_ip_full(self): - opensearch_client = mock.MagicMock - opensearch_client.opensearch_domains = [] - opensearch_client.opensearch_domains.append( - OpenSearchDomain( - name=domain_name, - region=AWS_REGION_EU_WEST_1, - arn=domain_arn, - access_policy=policy_data_source_ip_full, - ) + opensearch_client = client("opensearch", region_name=AWS_REGION_US_WEST_2) + domain_arn = opensearch_client.create_domain(DomainName=domain_name)[ + "DomainStatus" + ]["ARN"] + opensearch_client.update_domain_config( + DomainName=domain_name, + AccessPolicies=dumps(policy_data_source_ip_full), + ) + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_WEST_2]) + + from prowler.providers.aws.services.opensearch.opensearch_service import ( + OpenSearchService, ) - opensearch_client.opensearch_domains[0].logging = [] with mock.patch( - "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible.opensearch_client", + new=OpenSearchService(aws_provider), ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible import ( opensearch_service_domains_not_publicly_accessible, @@ -214,23 +260,32 @@ class Test_opensearch_service_domains_not_publicly_accessible: ) assert result[0].resource_id == domain_name assert result[0].resource_arn == domain_arn + assert result[0].region == AWS_REGION_US_WEST_2 + assert result[0].resource_tags == [] + @mock_aws def test_policy_data_not_restricted_whole_internet(self): - opensearch_client = mock.MagicMock - opensearch_client.opensearch_domains = [] - opensearch_client.opensearch_domains.append( - OpenSearchDomain( - name=domain_name, - region=AWS_REGION_EU_WEST_1, - arn=domain_arn, - access_policy=policy_data_source_whole_internet, - ) + opensearch_client = client("opensearch", region_name=AWS_REGION_US_WEST_2) + domain_arn = opensearch_client.create_domain(DomainName=domain_name)[ + "DomainStatus" + ]["ARN"] + opensearch_client.update_domain_config( + DomainName=domain_name, + AccessPolicies=dumps(policy_data_source_whole_internet), + ) + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_WEST_2]) + + from prowler.providers.aws.services.opensearch.opensearch_service import ( + OpenSearchService, ) - opensearch_client.opensearch_domains[0].logging = [] with mock.patch( - "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible.opensearch_client", + new=OpenSearchService(aws_provider), ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible import ( opensearch_service_domains_not_publicly_accessible, @@ -246,3 +301,50 @@ class Test_opensearch_service_domains_not_publicly_accessible: ) assert result[0].resource_id == domain_name assert result[0].resource_arn == domain_arn + assert result[0].region == AWS_REGION_US_WEST_2 + assert result[0].resource_tags == [] + + def test_domain_inside_vpc(self): + opensearch_client = mock.MagicMock + opensearch_client.opensearch_domains = [] + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_WEST_2]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible.opensearch_client", + new=opensearch_client, + ): + from prowler.providers.aws.services.opensearch.opensearch_service import ( + OpenSearchDomain, + ) + from prowler.providers.aws.services.opensearch.opensearch_service_domains_not_publicly_accessible.opensearch_service_domains_not_publicly_accessible import ( + opensearch_service_domains_not_publicly_accessible, + ) + + opensearch_client.opensearch_domains.append( + OpenSearchDomain( + name=domain_name, + region=AWS_REGION_US_WEST_2, + arn=f"arn:aws:es:{AWS_REGION_US_WEST_2}:{AWS_ACCOUNT_NUMBER}:domain/{domain_name}", + vpc_id="vpc-123456", + ) + ) + + check = opensearch_service_domains_not_publicly_accessible() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Opensearch domain {domain_name} is in a VPC, then it is not publicly accessible." + ) + assert result[0].resource_id == domain_name + assert ( + result[0].resource_arn + == f"arn:aws:es:{AWS_REGION_US_WEST_2}:{AWS_ACCOUNT_NUMBER}:domain/{domain_name}" + ) + assert result[0].region == AWS_REGION_US_WEST_2 + assert result[0].resource_tags == [] diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version_test.py index 7c988fb1a9..d4f24699ab 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version_test.py @@ -14,9 +14,13 @@ class Test_opensearch_service_domains_updated_to_the_latest_service_software_ver def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_service_domains_updated_to_the_latest_service_software_version import ( opensearch_service_domains_updated_to_the_latest_service_software_version, @@ -43,7 +47,10 @@ class Test_opensearch_service_domains_updated_to_the_latest_service_software_ver with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_service_domains_updated_to_the_latest_service_software_version import ( opensearch_service_domains_updated_to_the_latest_service_software_version, @@ -76,7 +83,10 @@ class Test_opensearch_service_domains_updated_to_the_latest_service_software_ver with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", - opensearch_client, + new=opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_updated_to_the_latest_service_software_version.opensearch_service_domains_updated_to_the_latest_service_software_version import ( opensearch_service_domains_updated_to_the_latest_service_software_version, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py index 4e2a412671..7e6eddaf55 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py @@ -13,9 +13,13 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: def test_no_domains(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] + with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana import ( opensearch_service_domains_use_cognito_authentication_for_kibana, @@ -41,6 +45,9 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana import ( opensearch_service_domains_use_cognito_authentication_for_kibana, @@ -74,6 +81,9 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana import ( opensearch_service_domains_use_cognito_authentication_for_kibana, @@ -108,6 +118,9 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", opensearch_client, + ), mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_client", + new=opensearch_client, ): from prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana import ( opensearch_service_domains_use_cognito_authentication_for_kibana, diff --git a/tests/providers/aws/services/opensearch/opensearch_service_test.py b/tests/providers/aws/services/opensearch/opensearch_service_test.py index 80aece7ab7..e752e860f1 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_test.py @@ -159,10 +159,9 @@ class Test_OpenSearchService_Service: assert opensearch.opensearch_domains[0].region == AWS_REGION_EU_WEST_1 assert opensearch.opensearch_domains[0].arn == domain_arn assert opensearch.opensearch_domains[0].access_policy - assert ( - opensearch.opensearch_domains[0].endpoint_vpc - == "vpc-endpoint-h2dsd34efgyghrtguk5gt6j2foh4.us-east-1.es.amazonaws.com" - ) + assert opensearch.opensearch_domains[0].vpc_endpoints == [ + "vpc-endpoint-h2dsd34efgyghrtguk5gt6j2foh4.us-east-1.es.amazonaws.com" + ] assert opensearch.opensearch_domains[0].vpc_id == "test-vpc-id" assert opensearch.opensearch_domains[0].cognito_options assert opensearch.opensearch_domains[0].encryption_at_rest