From 980b9b47708d275ab5f5fefbddba26f1a2002c38 Mon Sep 17 00:00:00 2001 From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> Date: Tue, 24 Sep 2024 18:43:19 +0200 Subject: [PATCH] feat(networkfirewall): change `network_firewalls` from list to dict (#5169) --- .../networkfirewall_deletion_protection.py | 4 +- .../networkfirewall_in_all_vpc.py | 2 +- .../networkfirewall_service.py | 50 +++++++++++-------- ...etworkfirewall_deletion_protection_test.py | 21 ++++---- .../networkfirewall_in_all_vpc_test.py | 24 ++++----- .../networkfirewall_service_test.py | 29 +++++++---- 6 files changed, 70 insertions(+), 60 deletions(-) diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py index 991105e120..bf3cfa808d 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py @@ -7,11 +7,11 @@ from prowler.providers.aws.services.networkfirewall.networkfirewall_client impor class networkfirewall_deletion_protection(Check): def execute(self): findings = [] - for firewall in networkfirewall_client.network_firewalls: + for arn, firewall in networkfirewall_client.network_firewalls.items(): report = Check_Report_AWS(self.metadata()) report.region = firewall.region report.resource_id = firewall.name - report.resource_arn = firewall.arn + report.resource_arn = arn report.resource_tags = firewall.tags report.status = "FAIL" report.status_extended = f"Network Firewall {firewall.name} does not have deletion protection enabled." diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py index 6e68988f4f..94b9eac18f 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py @@ -17,7 +17,7 @@ class networkfirewall_in_all_vpc(Check): report.resource_tags = vpc.tags report.status = "FAIL" report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} does not have Network Firewall enabled." - for firewall in networkfirewall_client.network_firewalls: + for firewall in networkfirewall_client.network_firewalls.values(): if firewall.vpc_id == vpc.id: report.status = "PASS" report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} has Network Firewall enabled." diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_service.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_service.py index f6a4bb56ee..e012fec142 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_service.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_service.py @@ -10,7 +10,7 @@ class NetworkFirewall(AWSService): def __init__(self, provider): # Call AWSService's __init__ super().__init__("network-firewall", provider) - self.network_firewalls = [] + self.network_firewalls = {} self.__threading_call__(self._list_firewalls) self._describe_firewall() @@ -27,13 +27,13 @@ class NetworkFirewall(AWSService): network_firewall["FirewallArn"], self.audit_resources ) ): - self.network_firewalls.append( - Firewall( - arn=network_firewall.get("FirewallArn"), - region=regional_client.region, - name=network_firewall.get("FirewallName"), - ) + self.network_firewalls[ + network_firewall.get("FirewallArn", "") + ] = Firewall( + region=regional_client.region, + name=network_firewall.get("FirewallName"), ) + except Exception as error: logger.error( f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" @@ -42,20 +42,29 @@ class NetworkFirewall(AWSService): def _describe_firewall(self): logger.info("Network Firewall - Describe Network Firewalls...") try: - for network_firewall in self.network_firewalls: + for arn, network_firewall in self.network_firewalls.items(): regional_client = self.regional_clients[network_firewall.region] - describe_firewall = regional_client.describe_firewall( - FirewallArn=network_firewall.arn - )["Firewall"] - network_firewall.policy_arn = describe_firewall.get("FirewallPolicyArn") - network_firewall.vpc_id = describe_firewall.get("VpcId") - network_firewall.tags = describe_firewall.get("Tags") - network_firewall.encryption_type = describe_firewall.get( - "EncryptionConfiguration" - ).get("Type") - network_firewall.deletion_protection = describe_firewall.get( - "DeleteProtection" - ) + try: + describe_firewall = regional_client.describe_firewall( + FirewallArn=arn, + )["Firewall"] + network_firewall.policy_arn = describe_firewall.get( + "FirewallPolicyArn" + ) + network_firewall.vpc_id = describe_firewall.get("VpcId") + network_firewall.tags = describe_firewall.get("Tags", []) + encryption_config = describe_firewall.get( + "EncryptionConfiguration", {} + ) + network_firewall.encryption_type = encryption_config.get("Type") + network_firewall.deletion_protection = describe_firewall.get( + "DeleteProtection", False + ) + except Exception as error: + logger.error( + f"Error describing firewall {network_firewall.arn} in region {network_firewall.region}: " + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) except Exception as error: logger.error( f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}" @@ -63,7 +72,6 @@ class NetworkFirewall(AWSService): class Firewall(BaseModel): - arn: str name: str region: str policy_arn: str = None diff --git a/tests/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection_test.py b/tests/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection_test.py index 984834761b..715ca1083d 100644 --- a/tests/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection_test.py +++ b/tests/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection_test.py @@ -19,7 +19,7 @@ class Test_networkfirewall_deletion_protection: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [] + networkfirewall_client.network_firewalls = {} aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) @@ -41,15 +41,14 @@ class Test_networkfirewall_deletion_protection: assert len(result) == 0 - def Test_networkfirewall_deletion_protection_disabled(self): + def test_networkfirewall_deletion_protection_disabled(self): networkfirewall_client = mock.MagicMock networkfirewall_client.provider = set_mocked_aws_provider( [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [ - Firewall( - arn=FIREWALL_ARN, + networkfirewall_client.network_firewalls = { + FIREWALL_ARN: Firewall( name=FIREWALL_NAME, region=AWS_REGION_US_EAST_1, policy_arn=POLICY_ARN, @@ -58,8 +57,7 @@ class Test_networkfirewall_deletion_protection: encryption_type="CUSTOMER_KMS", deletion_protection=False, ) - ] - + } aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) with mock.patch( @@ -89,15 +87,14 @@ class Test_networkfirewall_deletion_protection: assert result[0].resource_tags == [] assert result[0].resource_arn == FIREWALL_ARN - def Test_networkfirewall_deletion_protection_enabled(self): + def test_networkfirewall_deletion_protection_enabled(self): networkfirewall_client = mock.MagicMock networkfirewall_client.provider = set_mocked_aws_provider( [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [ - Firewall( - arn=FIREWALL_ARN, + networkfirewall_client.network_firewalls = { + FIREWALL_ARN: Firewall( name=FIREWALL_NAME, region=AWS_REGION_US_EAST_1, policy_arn=POLICY_ARN, @@ -106,7 +103,7 @@ class Test_networkfirewall_deletion_protection: encryption_type="CUSTOMER_KMS", deletion_protection=True, ) - ] + } aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) diff --git a/tests/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc_test.py b/tests/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc_test.py index d995975f0f..1a94a16199 100644 --- a/tests/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc_test.py +++ b/tests/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc_test.py @@ -20,7 +20,7 @@ class Test_networkfirewall_in_all_vpc: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [] + networkfirewall_client.network_firewalls = {} vpc_client = mock.MagicMock vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) vpc_client.region = AWS_REGION_US_EAST_1 @@ -56,9 +56,8 @@ class Test_networkfirewall_in_all_vpc: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [ - Firewall( - arn=FIREWALL_ARN, + networkfirewall_client.network_firewalls = { + FIREWALL_ARN: Firewall( name=FIREWALL_NAME, region=AWS_REGION_US_EAST_1, policy_arn=POLICY_ARN, @@ -67,7 +66,7 @@ class Test_networkfirewall_in_all_vpc: encryption_type="CUSTOMER_KMS", deletion_protection=True, ) - ] + } vpc_client = mock.MagicMock vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) vpc_client.region = AWS_REGION_US_EAST_1 @@ -139,7 +138,7 @@ class Test_networkfirewall_in_all_vpc: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [] + networkfirewall_client.network_firewalls = {} vpc_client = mock.MagicMock vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) vpc_client.region = AWS_REGION_US_EAST_1 @@ -211,7 +210,7 @@ class Test_networkfirewall_in_all_vpc: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [] + networkfirewall_client.network_firewalls = {} vpc_client = mock.MagicMock vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) @@ -284,9 +283,8 @@ class Test_networkfirewall_in_all_vpc: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [ - Firewall( - arn=FIREWALL_ARN, + networkfirewall_client.network_firewalls = { + FIREWALL_ARN: Firewall( name=FIREWALL_NAME, region=AWS_REGION_US_EAST_1, policy_arn=POLICY_ARN, @@ -295,7 +293,7 @@ class Test_networkfirewall_in_all_vpc: encryption_type="CUSTOMER_KMS", deletion_protection=True, ) - ] + } vpc_client = mock.MagicMock vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) vpc_client.region = AWS_REGION_US_EAST_1 @@ -405,7 +403,7 @@ class Test_networkfirewall_in_all_vpc: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [] + networkfirewall_client.network_firewalls = {} vpc_client = mock.MagicMock vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) vpc_client.region = AWS_REGION_US_EAST_1 @@ -469,7 +467,7 @@ class Test_networkfirewall_in_all_vpc: [AWS_REGION_US_EAST_1] ) networkfirewall_client.region = AWS_REGION_US_EAST_1 - networkfirewall_client.network_firewalls = [] + networkfirewall_client.network_firewalls = {} vpc_client = mock.MagicMock vpc_client.provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) vpc_client.region = AWS_REGION_US_EAST_1 diff --git a/tests/providers/aws/services/networkfirewall/networkfirewall_service_test.py b/tests/providers/aws/services/networkfirewall/networkfirewall_service_test.py index b65f39a7f2..e30de7ed69 100644 --- a/tests/providers/aws/services/networkfirewall/networkfirewall_service_test.py +++ b/tests/providers/aws/services/networkfirewall/networkfirewall_service_test.py @@ -80,21 +80,28 @@ class Test_NetworkFirewall_Service: aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) networkfirewall = NetworkFirewall(aws_provider) assert len(networkfirewall.network_firewalls) == 1 - assert networkfirewall.network_firewalls[0].arn == FIREWALL_ARN - assert networkfirewall.network_firewalls[0].region == AWS_REGION_US_EAST_1 - assert networkfirewall.network_firewalls[0].name == FIREWALL_NAME + assert ( + networkfirewall.network_firewalls[FIREWALL_ARN].region + == AWS_REGION_US_EAST_1 + ) + assert networkfirewall.network_firewalls[FIREWALL_ARN].name == FIREWALL_NAME def test_describe_firewall(self): aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) networkfirewall = NetworkFirewall(aws_provider) assert len(networkfirewall.network_firewalls) == 1 - assert networkfirewall.network_firewalls[0].arn == FIREWALL_ARN - assert networkfirewall.network_firewalls[0].region == AWS_REGION_US_EAST_1 - assert networkfirewall.network_firewalls[0].name == FIREWALL_NAME - assert networkfirewall.network_firewalls[0].policy_arn == POLICY_ARN - assert networkfirewall.network_firewalls[0].vpc_id == VPC_ID - assert networkfirewall.network_firewalls[0].tags == [ + assert ( + networkfirewall.network_firewalls[FIREWALL_ARN].region + == AWS_REGION_US_EAST_1 + ) + assert networkfirewall.network_firewalls[FIREWALL_ARN].name == FIREWALL_NAME + assert networkfirewall.network_firewalls[FIREWALL_ARN].policy_arn == POLICY_ARN + assert networkfirewall.network_firewalls[FIREWALL_ARN].vpc_id == VPC_ID + assert networkfirewall.network_firewalls[FIREWALL_ARN].tags == [ {"Key": "test_tag", "Value": "test_value"} ] - assert networkfirewall.network_firewalls[0].encryption_type == "CUSTOMER_KMS" - assert networkfirewall.network_firewalls[0].deletion_protection + assert ( + networkfirewall.network_firewalls[FIREWALL_ARN].encryption_type + == "CUSTOMER_KMS" + ) + assert networkfirewall.network_firewalls[FIREWALL_ARN].deletion_protection