diff --git a/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py b/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py index 84d70b4083..6368568a30 100644 --- a/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py +++ b/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py @@ -27,6 +27,10 @@ def check_cloudwatch_log_metric_filter( ) report.status = "FAIL" report.status_extended = f"CloudWatch log group {metric_filter.log_group.name} found with metric filter {metric_filter.name} but no alarms associated." + report.check_metadata.ResourceIdTemplate = ( + "arn:partition:logs:region:account-id:log-group:log-group-name" + ) + report.check_metadata.ResourceType = "AwsLogsLogGroup" # 3. Check if there is an alarm for the metric for alarm in metric_alarms: if alarm.metric == metric_filter.metric: diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py index 704a01c26f..c10869d072 100644 --- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py +++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py @@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_no_log_group(self): @@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_with_log_group(self): @@ -216,6 +218,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric(self): @@ -309,6 +312,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self): @@ -413,6 +417,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self): @@ -517,6 +522,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self): @@ -621,6 +627,7 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_access_denied(self): diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py index 2ac31cde25..c2e4c316de 100644 --- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py +++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py @@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_no_log_group(self): @@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_with_log_group(self): @@ -216,6 +218,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric(self): @@ -307,6 +310,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self): @@ -410,6 +414,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self): @@ -513,6 +518,7 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self): @@ -616,3 +622,4 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured: ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [{}] + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py index 17edbf852c..4f5786c882 100644 --- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py +++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py @@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_no_log_group(self): @@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_with_log_group(self): @@ -302,6 +304,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self): @@ -400,6 +403,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self): @@ -498,6 +502,7 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self): @@ -596,3 +601,4 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py index 00e5c3932c..29b439ecec 100644 --- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py +++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py @@ -74,6 +74,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_no_log_group(self): @@ -142,6 +143,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_with_log_group(self): @@ -216,6 +218,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured: == f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].check_metadata.ResourceType == "AwsAccount" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric(self): @@ -302,6 +305,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self): @@ -400,6 +404,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self): @@ -498,6 +503,7 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup" @mock_aws def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self): @@ -596,3 +602,4 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured: == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*" ) assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].check_metadata.ResourceType == "AwsLogsLogGroup"