fix(aws): aws check and metadata fixes (#4251)

Co-authored-by: John Mastron <jmastron@jpl.nasa.gov>
Co-authored-by: Pepe Fagoaga <pepe@prowler.com>

prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.metadata.json

@@ -6,10 +6,10 @@
     "Data Protection"
   ],
   "ServiceName": "ec2",
-  "SubServiceName": "snapshot",
+  "SubServiceName": "volume",
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
   "Severity": "medium",
-  "ResourceType": "AwsEc2Snapshot",
+  "ResourceType": "AwsEc2Volume",
   "Description": "Check if EBS snapshots exists.",
   "Risk": "Ensure that your EBS volumes (available or in-use) have recent snapshots (taken weekly) available for point-in-time recovery for a better, more reliable data backup strategy.",
   "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html",

prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.py

@@ -7,21 +7,23 @@ class ec2_instance_managed_by_ssm(Check):
     def execute(self):
         findings = []
         for instance in ec2_client.instances:
-            if instance.state != "terminated":
-                report = Check_Report_AWS(self.metadata())
-                report.region = instance.region
-                report.resource_arn = instance.arn
-                report.resource_tags = instance.tags
-                report.status = "PASS"
+            report = Check_Report_AWS(self.metadata())
+            report.region = instance.region
+            report.resource_arn = instance.arn
+            report.resource_tags = instance.tags
+            report.status = "PASS"
+            report.status_extended = (
+                f"EC2 Instance {instance.id} is managed by Systems Manager."
+            )
+            report.resource_id = instance.id
+            # instances not running should pass the check
+            if instance.state in ["pending", "terminated", "stopped"]:
+                report.status_extended = f"EC2 Instance {instance.id} is unmanaged by Systems Manager because it is {instance.state}."
+            elif not ssm_client.managed_instances.get(instance.id):
+                report.status = "FAIL"
                 report.status_extended = (
-                    f"EC2 Instance {instance.id} is managed by Systems Manager."
+                    f"EC2 Instance {instance.id} is not managed by Systems Manager."
                 )
-                report.resource_id = instance.id
-                if not ssm_client.managed_instances.get(instance.id):
-                    report.status = "FAIL"
-                    report.status_extended = (
-                        f"EC2 Instance {instance.id} is not managed by Systems Manager."
-                    )
-                findings.append(report)
+            findings.append(report)
 
         return findings

prowler/providers/aws/services/sns/sns_topics_kms_encryption_at_rest_enabled/sns_topics_kms_encryption_at_rest_enabled.metadata.json

@@ -7,7 +7,7 @@
   "SubServiceName": "",
   "ResourceIdTemplate": "arn:aws:sns:region:account-id:topic",
   "Severity": "high",
-  "ResourceType": "AwsSNSTopic",
+  "ResourceType": "AwsSnsTopic",
   "Description": "Ensure there are no SNS Topics unencrypted",
   "Risk": "If not enabled sensitive information at rest is not protected.",
   "RelatedUrl": "https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html",

prowler/providers/aws/services/sns/sns_topics_not_publicly_accessible/sns_topics_not_publicly_accessible.metadata.json

@@ -7,7 +7,7 @@
   "SubServiceName": "",
   "ResourceIdTemplate": "arn:aws:sns:region:account-id:topic",
   "Severity": "high",
-  "ResourceType": "AwsSNSTopic",
+  "ResourceType": "AwsSnsTopic",
   "Description": "Check if SNS topics have policy set as Public",
   "Risk": "Publicly accessible services could expose sensitive data to bad actors.",
   "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/sns-topic-policy.html",

prowler/providers/aws/services/ssm/ssm_service.py

@@ -1,4 +1,5 @@
 import json
+import time
 from enum import Enum
 from typing import Optional
 
@@ -145,6 +146,10 @@ class SSM(AWSService):
                         id=resource_id,
                         region=regional_client.region,
                     )
+                # boto3 does not properly handle throttling exceptions for
+                # ssm:DescribeInstanceInformation when there are large numbers of instances
+                # AWS support recommends manually reducing frequency of requests
+                time.sleep(0.1)
 
         except Exception as error:
             logger.error(

tests/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm_test.py

@@ -157,3 +157,177 @@ class Test_ec2_instance_managed_by_ssm_test:
                 == f"EC2 Instance {instance.id} is managed by Systems Manager."
             )
             assert result[0].resource_id == instance.id
+
+    @mock_aws
+    def test_ec2_instance_managed_by_ssm_running(self):
+        ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1)
+        instances_pending = ec2.create_instances(
+            ImageId=EXAMPLE_AMI_ID,
+            MinCount=2,
+            MaxCount=2,
+            UserData="This is some user_data",
+        )
+        instance_managed = ec2.Instance(instances_pending[0].id)
+        instance_unmanaged = ec2.Instance(instances_pending[1].id)
+        assert instance_managed.state["Name"] == "running"
+        assert instance_unmanaged.state["Name"] == "running"
+
+        ssm_client = mock.MagicMock
+        ssm_client.managed_instances = {
+            instance_managed.id: ManagedInstance(
+                arn=f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:instance/{instance_managed.id}",
+                id=instance_managed.id,
+                region=AWS_REGION_US_EAST_1,
+            )
+        }
+
+        from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.ssm.ssm_service.SSM",
+            new=ssm_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.ssm.ssm_client.ssm_client",
+            new=ssm_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.ec2.ec2_instance_managed_by_ssm.ec2_instance_managed_by_ssm.ec2_client",
+            new=EC2(aws_provider),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.ec2.ec2_instance_managed_by_ssm.ec2_instance_managed_by_ssm import (
+                ec2_instance_managed_by_ssm,
+            )
+
+            check = ec2_instance_managed_by_ssm()
+            results = check.execute()
+
+            assert len(results) == 2
+            for result in results:
+                if result.resource_id == instance_managed.id:
+                    assert result.status == "PASS"
+                    assert result.region == AWS_REGION_US_EAST_1
+                    assert result.resource_tags is None
+                    assert (
+                        result.status_extended
+                        == f"EC2 Instance {instance_managed.id} is managed by Systems Manager."
+                    )
+
+                if result.resource_id == instance_unmanaged.id:
+                    assert result.status == "FAIL"
+                    assert result.region == AWS_REGION_US_EAST_1
+                    assert result.resource_tags is None
+                    assert (
+                        result.status_extended
+                        == f"EC2 Instance {instance_unmanaged.id} is not managed by Systems Manager."
+                    )
+
+    @mock_aws
+    def test_ec2_instance_managed_by_ssm_stopped(self):
+        ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1)
+        instances_pending = ec2.create_instances(
+            ImageId=EXAMPLE_AMI_ID,
+            MinCount=1,
+            MaxCount=1,
+            UserData="This is some user_data",
+        )
+        instances_pending[0].stop()
+        instance = ec2.Instance(instances_pending[0].id)
+        assert instance.state["Name"] == "stopped"
+
+        ssm_client = mock.MagicMock
+        ssm_client.managed_instances = {}
+
+        from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.ssm.ssm_service.SSM",
+            new=ssm_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.ssm.ssm_client.ssm_client",
+            new=ssm_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.ec2.ec2_instance_managed_by_ssm.ec2_instance_managed_by_ssm.ec2_client",
+            new=EC2(aws_provider),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.ec2.ec2_instance_managed_by_ssm.ec2_instance_managed_by_ssm import (
+                ec2_instance_managed_by_ssm,
+            )
+
+            check = ec2_instance_managed_by_ssm()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].resource_tags is None
+            assert (
+                result[0].status_extended
+                == f"EC2 Instance {instance.id} is unmanaged by Systems Manager because it is stopped."
+            )
+
+    @mock_aws
+    def test_ec2_instance_managed_by_ssm_terminated(self):
+        ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1)
+        instances_pending = ec2.create_instances(
+            ImageId=EXAMPLE_AMI_ID,
+            MinCount=1,
+            MaxCount=1,
+            UserData="This is some user_data",
+        )
+        instances_pending[0].terminate()
+        instance = ec2.Instance(instances_pending[0].id)
+        assert instance.state["Name"] == "terminated"
+
+        ssm_client = mock.MagicMock
+        ssm_client.managed_instances = {}
+
+        from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.ssm.ssm_service.SSM",
+            new=ssm_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.ssm.ssm_client.ssm_client",
+            new=ssm_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.ec2.ec2_instance_managed_by_ssm.ec2_instance_managed_by_ssm.ec2_client",
+            new=EC2(aws_provider),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.ec2.ec2_instance_managed_by_ssm.ec2_instance_managed_by_ssm import (
+                ec2_instance_managed_by_ssm,
+            )
+
+            check = ec2_instance_managed_by_ssm()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].resource_tags is None
+            assert (
+                result[0].status_extended
+                == f"EC2 Instance {instance.id} is unmanaged by Systems Manager because it is terminated."
+            )