diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py index 3d2eefa3b7..178a6748a6 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip.py @@ -8,19 +8,20 @@ class autoscaling_group_launch_configuration_no_public_ip(Check): def execute(self): findings = [] for group in autoscaling_client.groups: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags - report.status = "PASS" - report.status_extended = f"Autoscaling group {group.name} does not have an associated launch configuration assigning a public IP address." - for lc in autoscaling_client.launch_configurations.values(): - if lc.name == group.launch_configuration_name and lc.public_ip: - report.status = "FAIL" - report.status_extended = f"Autoscaling group {group.name} has an associated launch configuration assigning a public IP address." + if lc.name == group.launch_configuration_name: + report = Check_Report_AWS(self.metadata()) + report.region = group.region + report.resource_id = group.name + report.resource_arn = group.arn + report.resource_tags = group.tags + report.status = "PASS" + report.status_extended = f"Autoscaling group {group.name} does not have an associated launch configuration assigning a public IP address." - findings.append(report) + if lc.public_ip: + report.status = "FAIL" + report.status_extended = f"Autoscaling group {group.name} has an associated launch configuration assigning a public IP address." + + findings.append(report) return findings diff --git a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py index b27e4c9a52..5d79ba42d9 100644 --- a/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py +++ b/prowler/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2.py @@ -8,20 +8,17 @@ class autoscaling_group_launch_configuration_requires_imdsv2(Check): def execute(self): findings = [] for group in autoscaling_client.groups: - report = Check_Report_AWS(self.metadata()) - report.region = group.region - report.resource_id = group.name - report.resource_arn = group.arn - report.resource_tags = group.tags - report.status = "FAIL" - report.status_extended = ( - f"Autoscaling group {group.name} has IMDSv2 disabled or not required." - ) - for ( launch_configuration ) in autoscaling_client.launch_configurations.values(): if launch_configuration.name == group.launch_configuration_name: + report = Check_Report_AWS(self.metadata()) + report.region = group.region + report.resource_id = group.name + report.resource_arn = group.arn + report.resource_tags = group.tags + report.status = "FAIL" + report.status_extended = f"Autoscaling group {group.name} has IMDSv2 disabled or not required." if ( launch_configuration.http_endpoint == "enabled" and launch_configuration.http_tokens == "required" @@ -32,6 +29,6 @@ class autoscaling_group_launch_configuration_requires_imdsv2(Check): report.status = "PASS" report.status_extended = f"Autoscaling group {group.name} has metadata service disabled." - findings.append(report) + findings.append(report) return findings diff --git a/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip_test.py b/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip_test.py index 7362e3ad7c..a911e0169d 100644 --- a/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip_test.py +++ b/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_no_public_ip/autoscaling_group_launch_configuration_no_public_ip_test.py @@ -171,10 +171,6 @@ class Test_autoscaling_group_launch_configuration_no_public_ip: AvailabilityZones=["us-east-1a", "us-east-1b"], ) - autoscaling_group_arn = autoscaling_client.describe_auto_scaling_groups( - AutoScalingGroupNames=[autoscaling_group_name] - )["AutoScalingGroups"][0]["AutoScalingGroupARN"] - from prowler.providers.aws.services.autoscaling.autoscaling_service import ( AutoScaling, ) @@ -196,12 +192,4 @@ class Test_autoscaling_group_launch_configuration_no_public_ip: check = autoscaling_group_launch_configuration_no_public_ip() result = check.execute() - assert len(result) == 1 - assert result[0].status == "PASS" - assert ( - result[0].status_extended - == f"Autoscaling group {autoscaling_group_name} does not have an associated launch configuration assigning a public IP address." - ) - assert result[0].resource_id == autoscaling_group_name - assert result[0].resource_tags == [] - assert result[0].resource_arn == autoscaling_group_arn + assert len(result) == 0 diff --git a/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2_test.py b/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2_test.py index b1f769626f..a9239a3ed1 100644 --- a/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2_test.py +++ b/tests/providers/aws/services/autoscaling/autoscaling_group_launch_configuration_requires_imdsv2/autoscaling_group_launch_configuration_requires_imdsv2_test.py @@ -119,10 +119,6 @@ class Test_autoscaling_group_launch_configuration_requires_imdsv2: AvailabilityZones=["us-east-1a", "us-east-1b"], ) - autoscaling_group_arn = autoscaling_client.describe_auto_scaling_groups( - AutoScalingGroupNames=[autoscaling_group_name] - )["AutoScalingGroups"][0]["AutoScalingGroupARN"] - from prowler.providers.aws.services.autoscaling.autoscaling_service import ( AutoScaling, ) @@ -144,15 +140,7 @@ class Test_autoscaling_group_launch_configuration_requires_imdsv2: check = autoscaling_group_launch_configuration_requires_imdsv2() result = check.execute() - assert len(result) == 1 - assert result[0].status == "FAIL" - assert ( - result[0].status_extended - == f"Autoscaling group {autoscaling_group_name} has IMDSv2 disabled or not required." - ) - assert result[0].resource_id == autoscaling_group_name - assert result[0].resource_tags == [] - assert result[0].resource_arn == autoscaling_group_arn + assert len(result) == 0 @mock_aws def test_groups_with_imdsv2_disabled(self):