From 9630f2358569d2659052b3e20c0bc5f8db7d5e76 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Fri, 4 Apr 2025 16:47:08 +0200 Subject: [PATCH] fix(aws): solve multiple errors (#7440) Co-authored-by: Sergio Garcia --- ...i_operations_cloudtrail_logging_enabled.py | 52 ++++++++++--------- ...tion_stack_cdktoolkit_bootstrap_version.py | 2 +- .../codebuild_project_logging_enabled.py | 13 +++-- .../codebuild_project_s3_logs_encrypted.py | 2 +- .../providers/aws/services/ec2/ec2_service.py | 1 + .../aws/services/ec2/lib/instance.py | 4 +- .../providers/aws/services/s3/s3_service.py | 10 ++-- .../services/sagemaker/sagemaker_service.py | 6 +-- .../codebuild_project_logging_enabled_test.py | 2 +- 9 files changed, 54 insertions(+), 38 deletions(-) diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py b/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py index ae828fd1b2..971e7000df 100644 --- a/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py +++ b/prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py @@ -16,35 +16,39 @@ class awslambda_function_invoke_api_operations_cloudtrail_logging_enabled(Check) f"Lambda function {function.name} is not recorded by CloudTrail." ) lambda_recorded_cloudtrail = False - for trail in cloudtrail_client.trails.values(): - for data_event in trail.data_events: - # classic event selectors - if not data_event.is_advanced: - if "DataResources" in data_event.event_selector: - for resource in data_event.event_selector["DataResources"]: - if resource["Type"] == "AWS::Lambda::Function" and ( - function.arn in resource["Values"] - or f"arn:{awslambda_client.audited_partition}:lambda" - in resource["Values"] + if cloudtrail_client.trails: + for trail in cloudtrail_client.trails.values(): + for data_event in trail.data_events: + # classic event selectors + if not data_event.is_advanced: + if "DataResources" in data_event.event_selector: + for resource in data_event.event_selector[ + "DataResources" + ]: + if resource["Type"] == "AWS::Lambda::Function" and ( + function.arn in resource["Values"] + or f"arn:{awslambda_client.audited_partition}:lambda" + in resource["Values"] + ): + lambda_recorded_cloudtrail = True + break + elif data_event.is_advanced: + for field_selector in data_event.event_selector[ + "FieldSelectors" + ]: + if ( + field_selector["Field"] == "resources.type" + and "AWS::Lambda::Function" + in field_selector["Equals"] ): lambda_recorded_cloudtrail = True break - elif data_event.is_advanced: - for field_selector in data_event.event_selector[ - "FieldSelectors" - ]: - if ( - field_selector["Field"] == "resources.type" - and "AWS::Lambda::Function" in field_selector["Equals"] - ): - lambda_recorded_cloudtrail = True - break + if lambda_recorded_cloudtrail: + break if lambda_recorded_cloudtrail: + report.status = "PASS" + report.status_extended = f"Lambda function {function.name} is recorded by CloudTrail trail {trail.name}." break - if lambda_recorded_cloudtrail: - report.status = "PASS" - report.status_extended = f"Lambda function {function.name} is recorded by CloudTrail trail {trail.name}." - break findings.append(report) return findings diff --git a/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.py b/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.py index 13a185255b..562947f074 100644 --- a/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.py +++ b/prowler/providers/aws/services/cloudformation/cloudformation_stack_cdktoolkit_bootstrap_version/cloudformation_stack_cdktoolkit_bootstrap_version.py @@ -30,6 +30,6 @@ class cloudformation_stack_cdktoolkit_bootstrap_version(Check): report.status = "FAIL" report.status_extended = f"CloudFormation Stack CDKToolkit has a Bootstrap version {bootstrap_version}, which is less than the recommended version {recommended_cdk_bootstrap_version}." - findings.append(report) + findings.append(report) return findings diff --git a/prowler/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled.py b/prowler/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled.py index 2bd22e09ee..22892886f2 100644 --- a/prowler/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled.py +++ b/prowler/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled.py @@ -9,11 +9,16 @@ class codebuild_project_logging_enabled(Check): report = Check_Report_AWS(metadata=self.metadata(), resource=project) report.status = "PASS" - if project.cloudwatch_logs.enabled and project.s3_logs.enabled: - report.status_extended = f"CodeBuild project {project.name} has enabled CloudWartch logs in log group {project.cloudwatch_logs.group_name} and S3 logs in bucket {project.s3_logs.bucket_location}." - elif project.cloudwatch_logs.enabled: + cw_logs_enabled = ( + project.cloudwatch_logs and project.cloudwatch_logs.enabled + ) + s3_logs_enabled = project.s3_logs and project.s3_logs.enabled + + if cw_logs_enabled and s3_logs_enabled: + report.status_extended = f"CodeBuild project {project.name} has enabled CloudWatch logs in log group {project.cloudwatch_logs.group_name} and S3 logs in bucket {project.s3_logs.bucket_location}." + elif cw_logs_enabled: report.status_extended = f"CodeBuild project {project.name} has CloudWatch logging enabled in log group {project.cloudwatch_logs.group_name}." - elif project.s3_logs.enabled: + elif s3_logs_enabled: report.status_extended = f"CodeBuild project {project.name} has S3 logging enabled in bucket {project.s3_logs.bucket_location}." else: report.status = "FAIL" diff --git a/prowler/providers/aws/services/codebuild/codebuild_project_s3_logs_encrypted/codebuild_project_s3_logs_encrypted.py b/prowler/providers/aws/services/codebuild/codebuild_project_s3_logs_encrypted/codebuild_project_s3_logs_encrypted.py index 8fe97ebd9a..7bbd128686 100644 --- a/prowler/providers/aws/services/codebuild/codebuild_project_s3_logs_encrypted/codebuild_project_s3_logs_encrypted.py +++ b/prowler/providers/aws/services/codebuild/codebuild_project_s3_logs_encrypted/codebuild_project_s3_logs_encrypted.py @@ -6,7 +6,7 @@ class codebuild_project_s3_logs_encrypted(Check): def execute(self): findings = [] for project in codebuild_client.projects.values(): - if project.s3_logs.enabled: + if project.s3_logs and project.s3_logs.enabled: report = Check_Report_AWS(metadata=self.metadata(), resource=project) report.status = "PASS" report.status_extended = f"CodeBuild project {project.name} has encrypted S3 logs stored in {project.s3_logs.bucket_location}." diff --git a/prowler/providers/aws/services/ec2/ec2_service.py b/prowler/providers/aws/services/ec2/ec2_service.py index 48d1f39660..0da86bb5fc 100644 --- a/prowler/providers/aws/services/ec2/ec2_service.py +++ b/prowler/providers/aws/services/ec2/ec2_service.py @@ -102,6 +102,7 @@ class EC2(AWSService): security_groups=[ sg["GroupId"] for sg in instance.get("SecurityGroups", []) + if isinstance(sg, dict) and "GroupId" in sg ], subnet_id=instance.get("SubnetId", ""), network_interfaces=enis, diff --git a/prowler/providers/aws/services/ec2/lib/instance.py b/prowler/providers/aws/services/ec2/lib/instance.py index bef05ad7c5..90c092e58f 100644 --- a/prowler/providers/aws/services/ec2/lib/instance.py +++ b/prowler/providers/aws/services/ec2/lib/instance.py @@ -21,7 +21,9 @@ def get_instance_public_status( if instance.public_ip: status = f"Instance {instance.id} has {service} exposed to 0.0.0.0/0 on public IP address {instance.public_ip} but it is placed in a private subnet {instance.subnet_id}." severity = Severity.high - if vpc_subnets[instance.subnet_id].public: + if instance.subnet_id not in vpc_subnets: + status = f"Instance {instance.id} has {service} exposed to 0.0.0.0/0 on public IP address {instance.public_ip} and it is placed in an unknown subnet {instance.subnet_id}." + elif vpc_subnets[instance.subnet_id].public: status = f"Instance {instance.id} has {service} exposed to 0.0.0.0/0 on public IP address {instance.public_ip} in public subnet {instance.subnet_id}." severity = Severity.critical diff --git a/prowler/providers/aws/services/s3/s3_service.py b/prowler/providers/aws/services/s3/s3_service.py index c8f7c0343d..4ff091052c 100644 --- a/prowler/providers/aws/services/s3/s3_service.py +++ b/prowler/providers/aws/services/s3/s3_service.py @@ -541,9 +541,13 @@ class S3Control(AWSService): block_public_policy=False, restrict_public_buckets=False, ) - logger.error( - f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" - ) + logger.warning( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + else: + logger.error( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) def _list_access_points(self, regional_client): logger.info("S3 - Listing account access points...") diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_service.py b/prowler/providers/aws/services/sagemaker/sagemaker_service.py index 0ca95f8a2a..8001b742cd 100644 --- a/prowler/providers/aws/services/sagemaker/sagemaker_service.py +++ b/prowler/providers/aws/services/sagemaker/sagemaker_service.py @@ -263,9 +263,9 @@ class SageMaker(AWSService): production_variants.append( ProductionVariant( name=production_variant["VariantName"], - initial_instance_count=production_variant[ - "InitialInstanceCount" - ], + initial_instance_count=production_variant.get( + "InitialInstanceCount", 0 + ), ) ) endpoint_config.production_variants = production_variants diff --git a/tests/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled_test.py b/tests/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled_test.py index df1bf4936b..22b8900198 100644 --- a/tests/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled_test.py +++ b/tests/providers/aws/services/codebuild/codebuild_project_logging_enabled/codebuild_project_logging_enabled_test.py @@ -212,7 +212,7 @@ class Test_codebuild_project_logging_enabled: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"CodeBuild project {project_name} has enabled CloudWartch logs in log group cw-test-group and S3 logs in bucket s3://test-bucket/logs." + == f"CodeBuild project {project_name} has enabled CloudWatch logs in log group cw-test-group and S3 logs in bucket s3://test-bucket/logs." ) assert result[0].resource_id == project_name assert result[0].resource_arn == project_arn