From affd36bc481462ba342556411997fb69775ecebd Mon Sep 17 00:00:00 2001 From: "Andoni A." <14891798+andoniaf@users.noreply.github.com> Date: Mon, 7 Apr 2025 16:09:43 +0200 Subject: [PATCH] fix(ec2): resource arn should be the account --- .../ec2_ebs_default_encryption.py | 2 +- prowler/providers/aws/services/ec2/ec2_service.py | 5 +++++ .../ec2_ebs_default_encryption_test.py | 11 ++++++----- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py b/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py index f2e9950ae2..dc32adfec0 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py @@ -10,7 +10,7 @@ class ec2_ebs_default_encryption(Check): report = Check_Report_AWS( metadata=self.metadata(), resource=ebs_encryption ) - report.resource_arn = ec2_client._get_volume_arn_template( + report.resource_arn = ec2_client._get_account_arn_template( ebs_encryption.region ) report.resource_id = ec2_client.audited_account diff --git a/prowler/providers/aws/services/ec2/ec2_service.py b/prowler/providers/aws/services/ec2/ec2_service.py index 0da86bb5fc..fa6ed0b338 100644 --- a/prowler/providers/aws/services/ec2/ec2_service.py +++ b/prowler/providers/aws/services/ec2/ec2_service.py @@ -59,6 +59,11 @@ class EC2(AWSService): f"arn:{self.audited_partition}:ec2:{region}:{self.audited_account}:volume" ) + def _get_account_arn_template(self, region): + return ( + f"arn:{self.audited_partition}:ec2:{region}:{self.audited_account}:account" + ) + def _describe_instances(self, regional_client): try: describe_instances_paginator = regional_client.get_paginator( diff --git a/tests/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption_test.py b/tests/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption_test.py index 5bca87b485..65c9b3c669 100644 --- a/tests/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption_test.py +++ b/tests/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption_test.py @@ -55,7 +55,7 @@ class Test_ec2_ebs_default_encryption: assert result.resource_id == AWS_ACCOUNT_NUMBER assert ( result.resource_arn - == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:volume" + == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account" ) if result.region == AWS_REGION_EU_WEST_1: assert result.status == "FAIL" @@ -66,7 +66,7 @@ class Test_ec2_ebs_default_encryption: assert result.resource_id == AWS_ACCOUNT_NUMBER assert ( result.resource_arn - == f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:volume" + == f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) @mock_aws @@ -97,6 +97,7 @@ class Test_ec2_ebs_default_encryption: # One result per region assert len(results) == 2 + print(results) for result in results: if result.region == AWS_REGION_US_EAST_1: assert result.status == "FAIL" @@ -107,7 +108,7 @@ class Test_ec2_ebs_default_encryption: assert result.resource_id == AWS_ACCOUNT_NUMBER assert ( result.resource_arn - == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:volume" + == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account" ) if result.region == AWS_REGION_EU_WEST_1: assert result.status == "FAIL" @@ -118,7 +119,7 @@ class Test_ec2_ebs_default_encryption: assert result.resource_id == AWS_ACCOUNT_NUMBER assert ( result.resource_arn - == f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:volume" + == f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" ) @mock_aws @@ -191,5 +192,5 @@ class Test_ec2_ebs_default_encryption: assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert ( result[0].resource_arn - == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:volume" + == f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:account" )