diff --git a/tests/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled_test.py b/tests/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled_test.py index 89b3ce5b77..3db3dd4d6f 100644 --- a/tests/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled_test.py +++ b/tests/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled_test.py @@ -1,4 +1,3 @@ -from re import search from unittest import mock from prowler.providers.aws.services.ecr.ecr_service import ( @@ -109,7 +108,10 @@ class Test_ecr_registry_scan_images_on_push_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "PASS" - assert search("with scan on push", result[0].status_extended) + assert ( + result[0].status_extended + == f"ECR registry {AWS_ACCOUNT_NUMBER} has BASIC scan with scan on push enabled." + ) assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert ( result[0].resource_arn @@ -160,9 +162,9 @@ class Test_ecr_registry_scan_images_on_push_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search( - "scanning with scan on push but with repository filters", - result[0].status_extended, + assert ( + result[0].status_extended + == f"ECR registry {AWS_ACCOUNT_NUMBER} has BASIC scanning with scan on push but with repository filters." ) assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert ( @@ -209,7 +211,10 @@ class Test_ecr_registry_scan_images_on_push_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search("scanning without scan on push", result[0].status_extended) + assert ( + result[0].status_extended + == f"ECR registry {AWS_ACCOUNT_NUMBER} has BASIC scanning without scan on push enabled." + ) assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert ( result[0].resource_arn diff --git a/tests/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled_test.py b/tests/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled_test.py index 3bdaf808ba..9052639d0c 100644 --- a/tests/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled_test.py +++ b/tests/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled_test.py @@ -1,4 +1,3 @@ -from re import search from unittest import mock from boto3 import client @@ -40,7 +39,10 @@ class Test_efs_have_backup_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "PASS" - assert search("has backup enabled", result[0].status_extended) + assert ( + result[0].status_extended + == f"EFS {file_system['FileSystemId']} has backup enabled." + ) assert result[0].resource_id == file_system["FileSystemId"] assert ( result[0].resource_arn @@ -73,7 +75,10 @@ class Test_efs_have_backup_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search("does not have backup enabled", result[0].status_extended) + assert ( + result[0].status_extended + == f"EFS {file_system['FileSystemId']} does not have backup enabled." + ) assert result[0].resource_id == file_system["FileSystemId"] assert ( result[0].resource_arn @@ -106,7 +111,10 @@ class Test_efs_have_backup_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search("does not have backup enabled", result[0].status_extended) + assert ( + result[0].status_extended + == f"EFS {file_system['FileSystemId']} does not have backup enabled." + ) assert result[0].resource_id == file_system["FileSystemId"] assert ( result[0].resource_arn diff --git a/tests/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled_test.py b/tests/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled_test.py index ee52928b70..24e0945559 100644 --- a/tests/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled_test.py +++ b/tests/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled_test.py @@ -1,4 +1,3 @@ -from re import search from unittest import mock from prowler.providers.aws.services.eks.eks_service import EKSCluster @@ -50,9 +49,9 @@ class Test_eks_cluster_kms_cmk_encryption_in_secrets_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search( - "does not have encryption for Kubernetes secrets", - result[0].status_extended, + assert ( + result[0].status_extended + == f"EKS cluster {cluster_name} does not have encryption for Kubernetes secrets." ) assert result[0].resource_id == cluster_name assert result[0].resource_arn == cluster_arn @@ -81,8 +80,9 @@ class Test_eks_cluster_kms_cmk_encryption_in_secrets_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "PASS" - assert search( - "has encryption for Kubernetes secrets", result[0].status_extended + assert ( + result[0].status_extended + == f"EKS cluster {cluster_name} has encryption for Kubernetes secrets." ) assert result[0].resource_id == cluster_name assert result[0].resource_arn == cluster_arn diff --git a/tests/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled_test.py b/tests/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled_test.py index bfb55ff918..9c0d1bf2aa 100644 --- a/tests/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled_test.py +++ b/tests/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled_test.py @@ -1,4 +1,3 @@ -from re import search from unittest import mock from prowler.providers.aws.services.eks.eks_service import ( @@ -29,7 +28,7 @@ class Test_eks_control_plane_logging_all_types_enabled: result = check.execute() assert len(result) == 0 - def test_control_plane_not_loggging(self): + def test_control_plane_not_logging(self): eks_client = mock.MagicMock eks_client.clusters = [] eks_client.clusters.append( @@ -40,6 +39,15 @@ class Test_eks_control_plane_logging_all_types_enabled: logging=None, ) ) + eks_client.audit_config = { + "eks_required_log_types": [ + "api", + "audit", + "authenticator", + "controllerManager", + "scheduler", + ] + } with mock.patch( "prowler.providers.aws.services.eks.eks_service.EKS", @@ -53,14 +61,14 @@ class Test_eks_control_plane_logging_all_types_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search( - "Control plane logging is not enabled for EKS cluster", - result[0].status_extended, + assert ( + result[0].status_extended + == f"Control plane logging is not enabled for EKS cluster {cluster_name}. Required log types: api, audit, authenticator, controllerManager, scheduler." ) assert result[0].resource_id == cluster_name assert result[0].resource_arn == cluster_arn - def test_control_plane_incomplete_loggging(self): + def test_control_plane_incomplete_logging(self): eks_client = mock.MagicMock eks_client.clusters = [] eks_client.clusters.append( @@ -96,14 +104,14 @@ class Test_eks_control_plane_logging_all_types_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search( - "Control plane logging is enabled but not all required log types are enabled for EKS cluster cluster_test. Required log types: api, audit, authenticator, controllerManager, scheduler. Enabled log types: api, audit, authenticator, controllerManager.", - result[0].status_extended, + assert ( + result[0].status_extended + == f"Control plane logging is enabled but not all required log types are enabled for EKS cluster {cluster_name}. Required log types: api, audit, authenticator, controllerManager, scheduler. Enabled log types: api, audit, authenticator, controllerManager." ) assert result[0].resource_id == cluster_name assert result[0].resource_arn == cluster_arn - def test_control_plane_complete_loggging(self): + def test_control_plane_complete_logging(self): eks_client = mock.MagicMock eks_client.clusters = [] eks_client.clusters.append( @@ -145,9 +153,9 @@ class Test_eks_control_plane_logging_all_types_enabled: result = check.execute() assert len(result) == 1 assert result[0].status == "PASS" - assert search( - "Control plane logging and all required log types are enabled for EKS cluster", - result[0].status_extended, + assert ( + result[0].status_extended + == f"Control plane logging and all required log types are enabled for EKS cluster {cluster_name}." ) assert result[0].resource_id == cluster_name assert result[0].resource_arn == cluster_arn