ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(networkfirewall): change network_firewalls from list to dict (#5169)

Browse Source
This commit is contained in:
Hugo Pereira Brito
2024-09-24 18:43:19 +02:00
committed by GitHub
parent 348cea67c0
commit 980b9b4770
6 changed files with 70 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py
+2 -2
View File
@@ -7,11 +7,11 @@ from prowler.providers.aws.services.networkfirewall.networkfirewall_client impor
class networkfirewall_deletion_protection(Check):
def execute(self):
findings = []
for firewall in networkfirewall_client.network_firewalls:
for arn, firewall in networkfirewall_client.network_firewalls.items():
report = Check_Report_AWS(self.metadata())
report.region = firewall.region
report.resource_id = firewall.name
report.resource_arn = firewall.arn
report.resource_arn = arn
report.resource_tags = firewall.tags
report.status = "FAIL"
report.status_extended = f"Network Firewall {firewall.name} does not have deletion protection enabled."
prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py
+1 -1
View File
@@ -17,7 +17,7 @@ class networkfirewall_in_all_vpc(Check):
report.resource_tags = vpc.tags
report.status = "FAIL"
report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} does not have Network Firewall enabled."
for firewall in networkfirewall_client.network_firewalls:
for firewall in networkfirewall_client.network_firewalls.values():
if firewall.vpc_id == vpc.id:
report.status = "PASS"
report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} has Network Firewall enabled."
prowler/providers/aws/services/networkfirewall/networkfirewall_service.py
+29 -21
View File
@@ -10,7 +10,7 @@ class NetworkFirewall(AWSService):
def __init__(self, provider):
# Call AWSService's __init__
super().__init__("network-firewall", provider)
self.network_firewalls = []
self.network_firewalls = {}
self.__threading_call__(self._list_firewalls)
self._describe_firewall()
@@ -27,13 +27,13 @@ class NetworkFirewall(AWSService):
network_firewall["FirewallArn"], self.audit_resources
)
):
self.network_firewalls.append(
Firewall(
arn=network_firewall.get("FirewallArn"),
region=regional_client.region,
name=network_firewall.get("FirewallName"),
)
self.network_firewalls[
network_firewall.get("FirewallArn", "")
] = Firewall(
region=regional_client.region,
name=network_firewall.get("FirewallName"),
)
except Exception as error:
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -42,20 +42,29 @@ class NetworkFirewall(AWSService):
def _describe_firewall(self):
logger.info("Network Firewall - Describe Network Firewalls...")
try:
for network_firewall in self.network_firewalls:
for arn, network_firewall in self.network_firewalls.items():
regional_client = self.regional_clients[network_firewall.region]
describe_firewall = regional_client.describe_firewall(
FirewallArn=network_firewall.arn
)["Firewall"]
network_firewall.policy_arn = describe_firewall.get("FirewallPolicyArn")
network_firewall.vpc_id = describe_firewall.get("VpcId")
network_firewall.tags = describe_firewall.get("Tags")
network_firewall.encryption_type = describe_firewall.get(
"EncryptionConfiguration"
).get("Type")
network_firewall.deletion_protection = describe_firewall.get(
"DeleteProtection"
)
try:
describe_firewall = regional_client.describe_firewall(
FirewallArn=arn,
)["Firewall"]
network_firewall.policy_arn = describe_firewall.get(
"FirewallPolicyArn"
)
network_firewall.vpc_id = describe_firewall.get("VpcId")
network_firewall.tags = describe_firewall.get("Tags", [])
encryption_config = describe_firewall.get(
"EncryptionConfiguration", {}
)
network_firewall.encryption_type = encryption_config.get("Type")
network_firewall.deletion_protection = describe_firewall.get(
"DeleteProtection", False
)
except Exception as error:
logger.error(
f"Error describing firewall {network_firewall.arn} in region {network_firewall.region}: "
f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
except Exception as error:
logger.error(
f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
@@ -63,7 +72,6 @@ class NetworkFirewall(AWSService):
class Firewall(BaseModel):
arn: str
name: str
region: str
policy_arn: str = None
tests/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection_test.py
+9 -12
View File
@@ -19,7 +19,7 @@ class Test_networkfirewall_deletion_protection:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = []
networkfirewall_client.network_firewalls = {}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
@@ -41,15 +41,14 @@ class Test_networkfirewall_deletion_protection:
assert len(result) == 0
def Test_networkfirewall_deletion_protection_disabled(self):
def test_networkfirewall_deletion_protection_disabled(self):
networkfirewall_client = mock.MagicMock
networkfirewall_client.provider = set_mocked_aws_provider(
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = [
Firewall(
arn=FIREWALL_ARN,
networkfirewall_client.network_firewalls = {
FIREWALL_ARN: Firewall(
name=FIREWALL_NAME,
region=AWS_REGION_US_EAST_1,
policy_arn=POLICY_ARN,
@@ -58,8 +57,7 @@ class Test_networkfirewall_deletion_protection:
encryption_type="CUSTOMER_KMS",
deletion_protection=False,
)
]
}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
with mock.patch(
@@ -89,15 +87,14 @@ class Test_networkfirewall_deletion_protection:
assert result[0].resource_tags == []
assert result[0].resource_arn == FIREWALL_ARN
def Test_networkfirewall_deletion_protection_enabled(self):
def test_networkfirewall_deletion_protection_enabled(self):
networkfirewall_client = mock.MagicMock
networkfirewall_client.provider = set_mocked_aws_provider(
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = [
Firewall(
arn=FIREWALL_ARN,
networkfirewall_client.network_firewalls = {
FIREWALL_ARN: Firewall(
name=FIREWALL_NAME,
region=AWS_REGION_US_EAST_1,
policy_arn=POLICY_ARN,
@@ -106,7 +103,7 @@ class Test_networkfirewall_deletion_protection:
encryption_type="CUSTOMER_KMS",
deletion_protection=True,
)
]
}
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
tests/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc_test.py
+11 -13
View File
@@ -20,7 +20,7 @@ class Test_networkfirewall_in_all_vpc:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = []
networkfirewall_client.network_firewalls = {}
vpc_client = mock.MagicMock
vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
vpc_client.region = AWS_REGION_US_EAST_1
@@ -56,9 +56,8 @@ class Test_networkfirewall_in_all_vpc:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = [
Firewall(
arn=FIREWALL_ARN,
networkfirewall_client.network_firewalls = {
FIREWALL_ARN: Firewall(
name=FIREWALL_NAME,
region=AWS_REGION_US_EAST_1,
policy_arn=POLICY_ARN,
@@ -67,7 +66,7 @@ class Test_networkfirewall_in_all_vpc:
encryption_type="CUSTOMER_KMS",
deletion_protection=True,
)
]
}
vpc_client = mock.MagicMock
vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
vpc_client.region = AWS_REGION_US_EAST_1
@@ -139,7 +138,7 @@ class Test_networkfirewall_in_all_vpc:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = []
networkfirewall_client.network_firewalls = {}
vpc_client = mock.MagicMock
vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
vpc_client.region = AWS_REGION_US_EAST_1
@@ -211,7 +210,7 @@ class Test_networkfirewall_in_all_vpc:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = []
networkfirewall_client.network_firewalls = {}
vpc_client = mock.MagicMock
vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
@@ -284,9 +283,8 @@ class Test_networkfirewall_in_all_vpc:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = [
Firewall(
arn=FIREWALL_ARN,
networkfirewall_client.network_firewalls = {
FIREWALL_ARN: Firewall(
name=FIREWALL_NAME,
region=AWS_REGION_US_EAST_1,
policy_arn=POLICY_ARN,
@@ -295,7 +293,7 @@ class Test_networkfirewall_in_all_vpc:
encryption_type="CUSTOMER_KMS",
deletion_protection=True,
)
]
}
vpc_client = mock.MagicMock
vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
vpc_client.region = AWS_REGION_US_EAST_1
@@ -405,7 +403,7 @@ class Test_networkfirewall_in_all_vpc:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = []
networkfirewall_client.network_firewalls = {}
vpc_client = mock.MagicMock
vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
vpc_client.region = AWS_REGION_US_EAST_1
@@ -469,7 +467,7 @@ class Test_networkfirewall_in_all_vpc:
[AWS_REGION_US_EAST_1]
)
networkfirewall_client.region = AWS_REGION_US_EAST_1
networkfirewall_client.network_firewalls = []
networkfirewall_client.network_firewalls = {}
vpc_client = mock.MagicMock
vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
vpc_client.region = AWS_REGION_US_EAST_1
tests/providers/aws/services/networkfirewall/networkfirewall_service_test.py
+18 -11
View File
@@ -80,21 +80,28 @@ class Test_NetworkFirewall_Service:
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
networkfirewall = NetworkFirewall(aws_provider)
assert len(networkfirewall.network_firewalls) == 1
assert networkfirewall.network_firewalls[0].arn == FIREWALL_ARN
assert networkfirewall.network_firewalls[0].region == AWS_REGION_US_EAST_1
assert networkfirewall.network_firewalls[0].name == FIREWALL_NAME
assert (
networkfirewall.network_firewalls[FIREWALL_ARN].region
== AWS_REGION_US_EAST_1
)
assert networkfirewall.network_firewalls[FIREWALL_ARN].name == FIREWALL_NAME
def test_describe_firewall(self):
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
networkfirewall = NetworkFirewall(aws_provider)
assert len(networkfirewall.network_firewalls) == 1
assert networkfirewall.network_firewalls[0].arn == FIREWALL_ARN
assert networkfirewall.network_firewalls[0].region == AWS_REGION_US_EAST_1
assert networkfirewall.network_firewalls[0].name == FIREWALL_NAME
assert networkfirewall.network_firewalls[0].policy_arn == POLICY_ARN
assert networkfirewall.network_firewalls[0].vpc_id == VPC_ID
assert networkfirewall.network_firewalls[0].tags == [
assert (
networkfirewall.network_firewalls[FIREWALL_ARN].region
== AWS_REGION_US_EAST_1
)
assert networkfirewall.network_firewalls[FIREWALL_ARN].name == FIREWALL_NAME
assert networkfirewall.network_firewalls[FIREWALL_ARN].policy_arn == POLICY_ARN
assert networkfirewall.network_firewalls[FIREWALL_ARN].vpc_id == VPC_ID
assert networkfirewall.network_firewalls[FIREWALL_ARN].tags == [
{"Key": "test_tag", "Value": "test_value"}
]
assert networkfirewall.network_firewalls[0].encryption_type == "CUSTOMER_KMS"
assert networkfirewall.network_firewalls[0].deletion_protection
assert (
networkfirewall.network_firewalls[FIREWALL_ARN].encryption_type
== "CUSTOMER_KMS"
)
assert networkfirewall.network_firewalls[FIREWALL_ARN].deletion_protection