ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cloudwatch): if log group exists but there's no alarm the resource is the log group

Browse Source
This commit is contained in:
Andoni A.
2025-04-08 20:32:54 +02:00
parent e0e9f3e7c8
commit 9914bc2017
5 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/cloudwatch/lib/metric_filters.py
+4
View File
@@ -27,6 +27,10 @@ def check_cloudwatch_log_metric_filter(
)
report.status = "FAIL"
report.status_extended = f"CloudWatch log group {metric_filter.log_group.name} found with metric filter {metric_filter.name} but no alarms associated."
report.check_metadata.ResourceIdTemplate = (
"arn:partition:logs:region:account-id:log-group:log-group-name"
)
report.check_metadata.ResourceType = "AwsLogsLogGroup"
# 3. Check if there is an alarm for the metric
for alarm in metric_alarms:
if alarm.metric == metric_filter.metric:
tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py
+7
View File
@@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_no_log_group(self):
@@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_with_log_group(self):
@@ -216,6 +218,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric(self):
@@ -309,6 +312,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
@@ -413,6 +417,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
@@ -517,6 +522,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
@@ -621,6 +627,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_access_denied(self):
tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py
+7
View File
@@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_no_log_group(self):
@@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_with_log_group(self):
@@ -216,6 +218,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric(self):
@@ -307,6 +310,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
@@ -410,6 +414,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
@@ -513,6 +518,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
@@ -616,3 +622,4 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].resource_tags == [{}]
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py
+6
View File
@@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_no_log_group(self):
@@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_with_log_group(self):
@@ -302,6 +304,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
@@ -400,6 +403,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
@@ -498,6 +502,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
@@ -596,3 +601,4 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py
+7
View File
@@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_no_log_group(self):
@@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_with_log_group(self):
@@ -216,6 +218,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account"
)
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].check_metadata.ResourceType == "AwsAccount"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric(self):
@@ -302,6 +305,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
@@ -400,6 +404,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
@@ -498,6 +503,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"
@mock_aws
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
@@ -596,3 +602,4 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
== f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
)
assert result[0].region == AWS_REGION_US_EAST_1
assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"