fix(aws): solve multiple errors (#7440)

Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>

prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py

@@ -16,35 +16,39 @@ class awslambda_function_invoke_api_operations_cloudtrail_logging_enabled(Check)
                 f"Lambda function {function.name} is not recorded by CloudTrail."
             )
             lambda_recorded_cloudtrail = False
-            for trail in cloudtrail_client.trails.values():
-                for data_event in trail.data_events:
-                    # classic event selectors
-                    if not data_event.is_advanced:
-                        if "DataResources" in data_event.event_selector:
-                            for resource in data_event.event_selector["DataResources"]:
-                                if resource["Type"] == "AWS::Lambda::Function" and (
-                                    function.arn in resource["Values"]
-                                    or f"arn:{awslambda_client.audited_partition}:lambda"
-                                    in resource["Values"]
+            if cloudtrail_client.trails:
+                for trail in cloudtrail_client.trails.values():
+                    for data_event in trail.data_events:
+                        # classic event selectors
+                        if not data_event.is_advanced:
+                            if "DataResources" in data_event.event_selector:
+                                for resource in data_event.event_selector[
+                                    "DataResources"
+                                ]:
+                                    if resource["Type"] == "AWS::Lambda::Function" and (
+                                        function.arn in resource["Values"]
+                                        or f"arn:{awslambda_client.audited_partition}:lambda"
+                                        in resource["Values"]
+                                    ):
+                                        lambda_recorded_cloudtrail = True
+                                        break
+                        elif data_event.is_advanced:
+                            for field_selector in data_event.event_selector[
+                                "FieldSelectors"
+                            ]:
+                                if (
+                                    field_selector["Field"] == "resources.type"
+                                    and "AWS::Lambda::Function"
+                                    in field_selector["Equals"]
                                 ):
                                     lambda_recorded_cloudtrail = True
                                     break
-                    elif data_event.is_advanced:
-                        for field_selector in data_event.event_selector[
-                            "FieldSelectors"
-                        ]:
-                            if (
-                                field_selector["Field"] == "resources.type"
-                                and "AWS::Lambda::Function" in field_selector["Equals"]
-                            ):
-                                lambda_recorded_cloudtrail = True
-                                break
+                        if lambda_recorded_cloudtrail:
+                            break
                     if lambda_recorded_cloudtrail:
+                        report.status = "PASS"
+                        report.status_extended = f"Lambda function {function.name} is recorded by CloudTrail trail {trail.name}."
                         break
-                if lambda_recorded_cloudtrail:
-                    report.status = "PASS"
-                    report.status_extended = f"Lambda function {function.name} is recorded by CloudTrail trail {trail.name}."
-                    break
             findings.append(report)
 
         return findings

prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.py

@@ -30,6 +30,6 @@ class cloudformation_stack_cdktoolkit_bootstrap_version(Check):
                         report.status = "FAIL"
                         report.status_extended = f"CloudFormation Stack CDKToolkit has a Bootstrap version {bootstrap_version}, which is less than the recommended version {recommended_cdk_bootstrap_version}."
 
-                findings.append(report)
+                    findings.append(report)
 
         return findings

prowler/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled.py

@@ -9,11 +9,16 @@ class codebuild_project_logging_enabled(Check):
             report = Check_Report_AWS(metadata=self.metadata(), resource=project)
             report.status = "PASS"
 
-            if project.cloudwatch_logs.enabled and project.s3_logs.enabled:
-                report.status_extended = f"CodeBuild project {project.name} has enabled CloudWartch logs in log group {project.cloudwatch_logs.group_name} and S3 logs in bucket {project.s3_logs.bucket_location}."
-            elif project.cloudwatch_logs.enabled:
+            cw_logs_enabled = (
+                project.cloudwatch_logs and project.cloudwatch_logs.enabled
+            )
+            s3_logs_enabled = project.s3_logs and project.s3_logs.enabled
+
+            if cw_logs_enabled and s3_logs_enabled:
+                report.status_extended = f"CodeBuild project {project.name} has enabled CloudWatch logs in log group {project.cloudwatch_logs.group_name} and S3 logs in bucket {project.s3_logs.bucket_location}."
+            elif cw_logs_enabled:
                 report.status_extended = f"CodeBuild project {project.name} has CloudWatch logging enabled in log group {project.cloudwatch_logs.group_name}."
-            elif project.s3_logs.enabled:
+            elif s3_logs_enabled:
                 report.status_extended = f"CodeBuild project {project.name} has S3 logging enabled in bucket {project.s3_logs.bucket_location}."
             else:
                 report.status = "FAIL"

prowler/providers/aws/services/codebuild/codebuild_project_s3_logs_encrypted/codebuild_project_s3_logs_encrypted.py

@@ -6,7 +6,7 @@ class codebuild_project_s3_logs_encrypted(Check):
     def execute(self):
         findings = []
         for project in codebuild_client.projects.values():
-            if project.s3_logs.enabled:
+            if project.s3_logs and project.s3_logs.enabled:
                 report = Check_Report_AWS(metadata=self.metadata(), resource=project)
                 report.status = "PASS"
                 report.status_extended = f"CodeBuild project {project.name} has encrypted S3 logs stored in {project.s3_logs.bucket_location}."

prowler/providers/aws/services/ec2/ec2_service.py

@@ -102,6 +102,7 @@ class EC2(AWSService):
                                     security_groups=[
                                         sg["GroupId"]
                                         for sg in instance.get("SecurityGroups", [])
+                                        if isinstance(sg, dict) and "GroupId" in sg
                                     ],
                                     subnet_id=instance.get("SubnetId", ""),
                                     network_interfaces=enis,

prowler/providers/aws/services/ec2/lib/instance.py

@@ -21,7 +21,9 @@ def get_instance_public_status(
     if instance.public_ip:
         status = f"Instance {instance.id} has {service} exposed to 0.0.0.0/0 on public IP address {instance.public_ip} but it is placed in a private subnet {instance.subnet_id}."
         severity = Severity.high
-        if vpc_subnets[instance.subnet_id].public:
+        if instance.subnet_id not in vpc_subnets:
+            status = f"Instance {instance.id} has {service} exposed to 0.0.0.0/0 on public IP address {instance.public_ip} and it is placed in an unknown subnet {instance.subnet_id}."
+        elif vpc_subnets[instance.subnet_id].public:
             status = f"Instance {instance.id} has {service} exposed to 0.0.0.0/0 on public IP address {instance.public_ip} in public subnet {instance.subnet_id}."
             severity = Severity.critical
 

prowler/providers/aws/services/s3/s3_service.py

@@ -541,9 +541,13 @@ class S3Control(AWSService):
                     block_public_policy=False,
                     restrict_public_buckets=False,
                 )
-            logger.error(
-                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-            )
+                logger.warning(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
 
     def _list_access_points(self, regional_client):
         logger.info("S3 - Listing account access points...")

prowler/providers/aws/services/sagemaker/sagemaker_service.py

@@ -263,9 +263,9 @@ class SageMaker(AWSService):
                 production_variants.append(
                     ProductionVariant(
                         name=production_variant["VariantName"],
-                        initial_instance_count=production_variant[
-                            "InitialInstanceCount"
-                        ],
+                        initial_instance_count=production_variant.get(
+                            "InitialInstanceCount", 0
+                        ),
                     )
                 )
             endpoint_config.production_variants = production_variants

tests/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled_test.py

@@ -212,7 +212,7 @@ class Test_codebuild_project_logging_enabled:
             assert result[0].status == "PASS"
             assert (
                 result[0].status_extended
-                == f"CodeBuild project {project_name} has enabled CloudWartch logs in log group cw-test-group and S3 logs in bucket s3://test-bucket/logs."
+                == f"CodeBuild project {project_name} has enabled CloudWatch logs in log group cw-test-group and S3 logs in bucket s3://test-bucket/logs."
             )
             assert result[0].resource_id == project_name
             assert result[0].resource_arn == project_arn