diff --git a/docs/developer-guide/checks.md b/docs/developer-guide/checks.md index 3acbb14dfe..e0545781cd 100644 --- a/docs/developer-guide/checks.md +++ b/docs/developer-guide/checks.md @@ -164,10 +164,12 @@ All the checks MUST fill the `report.resource_id` and `report.resource_arn` with - AWS Account --> Account Number `123456789012` - AWS Resource --> Resource ID / Name - Root resource --> `` + - Unknown resource --> `unknown` - Resource ARN -- `report.resource_arn` - AWS Account --> Root ARN `arn:aws:iam::123456789012:root` - AWS Resource --> Resource ARN - Root resource --> Resource Type ARN `f"arn:{service_client.audited_partition}::{service_client.region}:{service_client.audited_account}:"` + - Unknown Resource --> `arn:{service_client.audited_partition}:{service_name}:{service_client.region}:{service_client.audited_account}:unknown` - GCP - Resource ID -- `report.resource_id` - GCP Resource --> Resource ID diff --git a/prowler/providers/aws/lib/service/service.py b/prowler/providers/aws/lib/service/service.py index 2aaca3e394..e2cec05fd0 100644 --- a/prowler/providers/aws/lib/service/service.py +++ b/prowler/providers/aws/lib/service/service.py @@ -101,3 +101,16 @@ class AWSService: except Exception: # Handle exceptions if necessary pass # Replace 'pass' with any additional exception handling logic. Currently handled within the called function + + def get_unknown_arn(self, region: str = None) -> str: + """ + Generate an unknown ARN for the service + Args: + region (str): The region to get the unknown ARN for. + Returns: + str: The unknown ARN for the region. + Examples: + >>> service.get_unknown_arn("us-east-1") + "arn:aws:service:us-east-1:0123456789012:unknown" + """ + return f"arn:{self.audited_partition}:{self.service}:{f'{region}' if region else ''}:{self.audited_account}:unknown" diff --git a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_service.py b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_service.py index 9f1d976fef..e33fb1838d 100644 --- a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_service.py +++ b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_service.py @@ -43,8 +43,8 @@ class AccessAnalyzer(AWSService): if analyzer_count == 0: self.analyzers.append( Analyzer( - arn=self.audited_account_arn, - name=self.audited_account, + arn=self.get_unknown_arn(regional_client.region), + name="unknown", status="NOT_AVAILABLE", tags=[], type="", diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py index 7edabcf3ce..4a48e8f66d 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.py @@ -8,8 +8,10 @@ class bedrock_model_invocation_logging_enabled(Check): for region, logging in bedrock_client.logging_configurations.items(): report = Check_Report_AWS(self.metadata()) report.region = region - report.resource_id = bedrock_client.audited_account - report.resource_arn = bedrock_client.audited_account_arn + report.resource_id = "unknown" + report.resource_arn = ( + bedrock_client._get_model_invocation_logging_arn_template(region) + ) report.status = "FAIL" report.status_extended = "Bedrock Model Invocation Logging is disabled." if logging.enabled: diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py index 76ca16cba2..6c85a68632 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py +++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.py @@ -13,8 +13,10 @@ class bedrock_model_invocation_logs_encryption_enabled(Check): cloudwatch_encryption = True report = Check_Report_AWS(self.metadata()) report.region = region - report.resource_id = bedrock_client.audited_account - report.resource_arn = bedrock_client.audited_account_arn + report.resource_id = "unknown" + report.resource_arn = ( + bedrock_client._get_model_invocation_logging_arn_template(region) + ) report.status = "PASS" report.status_extended = "Bedrock Model Invocation logs are encrypted." if logging.s3_bucket: diff --git a/prowler/providers/aws/services/bedrock/bedrock_service.py b/prowler/providers/aws/services/bedrock/bedrock_service.py index 60ecb9c065..118e0cb8ae 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_service.py +++ b/prowler/providers/aws/services/bedrock/bedrock_service.py @@ -18,6 +18,13 @@ class Bedrock(AWSService): self.__threading_call__(self._get_guardrail, self.guardrails.values()) self.__threading_call__(self._list_tags_for_resource, self.guardrails.values()) + def _get_model_invocation_logging_arn_template(self, region): + return ( + f"arn:{self.audited_partition}:bedrock:{region}:{self.audited_account}:model-invocation-logging" + if region + else f"arn:{self.audited_partition}:bedrock:{self.region}:{self.audited_account}:model-invocation-logging" + ) + def _get_model_invocation_logging_configuration(self, regional_client): logger.info("Bedrock - Getting Model Invocation Logging Configuration...") try: diff --git a/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py b/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py index 79ac46334d..7621411eb9 100644 --- a/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py +++ b/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py @@ -20,8 +20,10 @@ class directconnect_connection_redundancy(Check): for region, connections in regions.items(): report = Check_Report_AWS(self.metadata()) report.region = region - report.resource_arn = directconnect_client.audited_account_arn - report.resource_id = directconnect_client.audited_account + report.resource_arn = directconnect_client._get_connection_arn_template( + region + ) + report.resource_id = "unknown" if connections["Connections"] == 1: report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/directconnect/directconnect_service.py b/prowler/providers/aws/services/directconnect/directconnect_service.py index aa652f9963..3f79087523 100644 --- a/prowler/providers/aws/services/directconnect/directconnect_service.py +++ b/prowler/providers/aws/services/directconnect/directconnect_service.py @@ -18,6 +18,13 @@ class DirectConnect(AWSService): self.__threading_call__(self._describe_connections) self.__threading_call__(self._describe_vifs) + def _get_connection_arn_template(self, region): + return ( + f"arn:{self.audited_partition}:directconnect:{region}:{self.audited_account}:dxcon" + if region + else f"arn:{self.audited_partition}:directconnect:{self.region}:{self.audited_account}:dxcon" + ) + def _describe_connections(self, regional_client): """List DirectConnect(s) in the given region. diff --git a/prowler/providers/aws/services/guardduty/guardduty_service.py b/prowler/providers/aws/services/guardduty/guardduty_service.py index c83833cef2..c3569bc1bc 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_service.py +++ b/prowler/providers/aws/services/guardduty/guardduty_service.py @@ -42,8 +42,8 @@ class GuardDuty(AWSService): if not detectors: self.detectors.append( Detector( - id=self.audited_account, - arn=self.audited_account_arn, + id="unknown", + arn=self.get_unknown_arn(regional_client.region), region=regional_client.region, enabled_in_account=False, ) diff --git a/prowler/providers/aws/services/organizations/organizations_service.py b/prowler/providers/aws/services/organizations/organizations_service.py index 32852df4d5..b3580fbebd 100644 --- a/prowler/providers/aws/services/organizations/organizations_service.py +++ b/prowler/providers/aws/services/organizations/organizations_service.py @@ -44,8 +44,8 @@ class Organizations(AWSService): == "AWSOrganizationsNotInUseException" ): self.organization = Organization( - arn=self.audited_account_arn, - id="AWS Organization", + arn=self.get_unknown_arn(), + id="unknown", status="NOT_AVAILABLE", master_id="", ) @@ -67,8 +67,8 @@ class Organizations(AWSService): ) else: self.organization = Organization( - arn=self.audited_account_arn, - id="AWS Organization", + arn=self.get_unknown_arn(), + id="unknown", status="NOT_AVAILABLE", master_id="", ) diff --git a/prowler/providers/aws/services/securityhub/securityhub_service.py b/prowler/providers/aws/services/securityhub/securityhub_service.py index b3050e0afe..6ff57e3363 100644 --- a/prowler/providers/aws/services/securityhub/securityhub_service.py +++ b/prowler/providers/aws/services/securityhub/securityhub_service.py @@ -28,7 +28,7 @@ class SecurityHub(AWSService): self.securityhubs.append( SecurityHubHub( arn=self.audited_account_arn, - id="Security Hub", + id="unknown", status="NOT_AVAILABLE", standards="", integrations="", @@ -73,8 +73,8 @@ class SecurityHub(AWSService): # SecurityHub is filtered self.securityhubs.append( SecurityHubHub( - arn=self.audited_account_arn, - id="Security Hub", + arn=self.get_unknown_arn(regional_client.region), + id="unknown", status="NOT_AVAILABLE", standards="", integrations="", diff --git a/tests/providers/aws/lib/service/service_test.py b/tests/providers/aws/lib/service/service_test.py index f43408d5ee..e2eb29d631 100644 --- a/tests/providers/aws/lib/service/service_test.py +++ b/tests/providers/aws/lib/service/service_test.py @@ -90,3 +90,34 @@ class TestAWSService: check_id, "arn:aws:ec2:eu-central-1:123456789:security-group/sg-87654321", ) + + def test_AWSService_get_unknown_arn(self): + service_name = "s3" + provider = set_mocked_aws_provider() + service = AWSService(service_name, provider) + + assert ( + service.get_unknown_arn(region="eu-west-1") + == f"arn:aws:{service_name}:eu-west-1:{AWS_ACCOUNT_NUMBER}:unknown" + ) + + def test_AWSService_get_unknown_arn_cn_partition(self): + service_name = "s3" + provider = set_mocked_aws_provider() + service = AWSService(service_name, provider) + service.audited_partition = "aws-cn" + + assert ( + service.get_unknown_arn(region="eu-west-1") + == f"arn:{service.audited_partition}:{service_name}:eu-west-1:{AWS_ACCOUNT_NUMBER}:unknown" + ) + + def test_AWSService_get_unknown_arn_no_region(self): + service_name = "s3" + provider = set_mocked_aws_provider() + service = AWSService(service_name, provider) + + assert ( + service.get_unknown_arn() + == f"arn:aws:{service_name}::{AWS_ACCOUNT_NUMBER}:unknown" + ) diff --git a/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py b/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py index 8588ef5e3d..f8a6bf3fd3 100644 --- a/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py +++ b/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py @@ -34,6 +34,11 @@ class Test_accessanalyzer_enabled: # Include analyzers to check accessanalyzer_client = mock.MagicMock accessanalyzer_client.region = AWS_REGION_1 + accessanalyzer_client.audited_partition = "aws" + accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER + accessanalyzer_client.get_unknown_arn = ( + lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:unknown" + ) accessanalyzer_client.analyzers = [ Analyzer( arn=AWS_ACCOUNT_ARN, @@ -47,6 +52,9 @@ class Test_accessanalyzer_enabled: with mock.patch( "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", accessanalyzer_client, + ), mock.patch( + "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn", + return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:unknown", ): from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import ( accessanalyzer_enabled, @@ -61,8 +69,8 @@ class Test_accessanalyzer_enabled: result[0].status_extended == f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "123456789012" + assert result[0].resource_arn == "arn:aws:iam::123456789012:root" assert result[0].region == AWS_REGION_1 assert result[0].resource_tags == [] @@ -71,6 +79,11 @@ class Test_accessanalyzer_enabled: accessanalyzer_client = mock.MagicMock accessanalyzer_client.region = AWS_REGION_2 accessanalyzer_client.audit_config = {"mute_non_default_regions": True} + accessanalyzer_client.audited_partition = "aws" + accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER + accessanalyzer_client.get_unknown_arn = ( + lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:unknown" + ) accessanalyzer_client.analyzers = [ Analyzer( arn=AWS_ACCOUNT_ARN, @@ -84,6 +97,9 @@ class Test_accessanalyzer_enabled: with mock.patch( "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", accessanalyzer_client, + ), mock.patch( + "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn", + return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:unknown", ): from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import ( accessanalyzer_enabled, @@ -99,14 +115,19 @@ class Test_accessanalyzer_enabled: result[0].status_extended == f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "123456789012" + assert result[0].resource_arn == "arn:aws:iam::123456789012:root" assert result[0].region == AWS_REGION_1 assert result[0].resource_tags == [] def test_two_analyzers(self): accessanalyzer_client = mock.MagicMock accessanalyzer_client.region = AWS_REGION_1 + accessanalyzer_client.audited_partition = "aws" + accessanalyzer_client.audited_account = AWS_ACCOUNT_NUMBER + accessanalyzer_client.get_unknown_arn = ( + lambda x: f"arn:aws:accessanalyzer:{x}:{AWS_ACCOUNT_NUMBER}:unknown" + ) accessanalyzer_client.analyzers = [ Analyzer( arn=AWS_ACCOUNT_ARN, @@ -130,6 +151,9 @@ class Test_accessanalyzer_enabled: with mock.patch( "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer", new=accessanalyzer_client, + ), mock.patch( + "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.AccessAnalyzer.get_unknown_arn", + return_value="arn:aws:accessanalyzer:eu-west-1:123456789012:unknown", ): # Test Check from prowler.providers.aws.services.accessanalyzer.accessanalyzer_enabled.accessanalyzer_enabled import ( @@ -146,8 +170,8 @@ class Test_accessanalyzer_enabled: result[0].status_extended == f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "123456789012" + assert result[0].resource_arn == "arn:aws:iam::123456789012:root" assert result[0].resource_tags == [] assert result[0].region == AWS_REGION_1 diff --git a/tests/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled_test.py b/tests/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled_test.py index 9d934f69bc..b41e741d0f 100644 --- a/tests/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled_test.py +++ b/tests/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled_test.py @@ -4,8 +4,6 @@ from boto3 import client from moto import mock_aws from tests.providers.aws.utils import ( - AWS_ACCOUNT_ARN, - AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1, set_mocked_aws_provider, @@ -41,16 +39,22 @@ class Test_bedrock_model_invocation_logging_enabled: result[0].status_extended == "Bedrock Model Invocation Logging is disabled." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == f"arn:aws:bedrock:{result[0].region}:123456789012:model-invocation-logging" + ) assert result[0].resource_tags == [] assert result[1].status == "FAIL" assert ( result[1].status_extended == "Bedrock Model Invocation Logging is disabled." ) - assert result[1].resource_id == AWS_ACCOUNT_NUMBER - assert result[1].resource_arn == AWS_ACCOUNT_ARN + assert result[1].resource_id == "unknown" + assert ( + result[1].resource_arn + == f"arn:aws:bedrock:{result[1].region}:123456789012:model-invocation-logging" + ) assert result[1].resource_tags == [] @mock_aws @@ -95,8 +99,11 @@ class Test_bedrock_model_invocation_logging_enabled: result[0].status_extended == "Bedrock Model Invocation Logging is enabled in CloudWatch Log Group: Test and S3 Bucket: testconfigbucket." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] @@ -135,8 +142,11 @@ class Test_bedrock_model_invocation_logging_enabled: result[0].status_extended == "Bedrock Model Invocation Logging is enabled in S3 Bucket: testconfigbucket." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] @@ -176,7 +186,10 @@ class Test_bedrock_model_invocation_logging_enabled: result[0].status_extended == "Bedrock Model Invocation Logging is enabled in CloudWatch Log Group: Test." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] diff --git a/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py b/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py index d215b62b9a..eb96b19701 100644 --- a/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py +++ b/tests/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled_test.py @@ -3,12 +3,7 @@ from unittest import mock from boto3 import client from moto import mock_aws -from tests.providers.aws.utils import ( - AWS_ACCOUNT_ARN, - AWS_ACCOUNT_NUMBER, - AWS_REGION_US_EAST_1, - set_mocked_aws_provider, -) +from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider class Test_bedrock_model_invocation_logs_encryption_enabled: @@ -96,8 +91,11 @@ class Test_bedrock_model_invocation_logs_encryption_enabled: result[0].status_extended == "Bedrock Model Invocation logs are not encrypted in S3 bucket: testconfigbucket and CloudWatch Log Group: Test." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] @@ -146,8 +144,11 @@ class Test_bedrock_model_invocation_logs_encryption_enabled: result[0].status_extended == "Bedrock Model Invocation logs are not encrypted in S3 bucket: testconfigbucket." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] @@ -198,8 +199,11 @@ class Test_bedrock_model_invocation_logs_encryption_enabled: result[0].status_extended == "Bedrock Model Invocation logs are not encrypted in CloudWatch Log Group: Test." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] @@ -270,8 +274,11 @@ class Test_bedrock_model_invocation_logs_encryption_enabled: result[0].status_extended == "Bedrock Model Invocation logs are encrypted." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] @@ -333,8 +340,11 @@ class Test_bedrock_model_invocation_logs_encryption_enabled: result[0].status_extended == "Bedrock Model Invocation logs are encrypted." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] @@ -385,7 +395,10 @@ class Test_bedrock_model_invocation_logs_encryption_enabled: result[0].status_extended == "Bedrock Model Invocation logs are encrypted." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:bedrock:us-east-1:123456789012:model-invocation-logging" + ) assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_tags == [] diff --git a/tests/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy_test.py b/tests/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy_test.py index 557bf08b42..faf43ba088 100644 --- a/tests/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy_test.py +++ b/tests/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy_test.py @@ -30,6 +30,9 @@ class Test_directconnect_connection_redundancy: dx_client.audited_account_arn = ( f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}" ) + dx_client._get_connection_arn_template = ( + lambda x: f"arn:aws:directconnect:{x}:{AWS_ACCOUNT_NUMBER}:connection" + ) dx_client.region = AWS_REGION_EU_WEST_1 dx_client.connections = {} dx_client.connections = { @@ -43,6 +46,9 @@ class Test_directconnect_connection_redundancy: with mock.patch( "prowler.providers.aws.services.directconnect.directconnect_service.DirectConnect", new=dx_client, + ), mock.patch( + "prowler.providers.aws.services.directconnect.directconnect_service.DirectConnect._get_connection_arn_template", + return_value=f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:connection", ): # Test Check from prowler.providers.aws.services.directconnect.directconnect_connection_redundancy.directconnect_connection_redundancy import ( @@ -58,10 +64,10 @@ class Test_directconnect_connection_redundancy: result[0].status_extended == "There is only one Direct Connect connection." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER + assert result[0].resource_id == "unknown" assert ( result[0].resource_arn - == f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}" + == f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:connection" ) assert result[0].region == AWS_REGION_EU_WEST_1 @@ -71,6 +77,9 @@ class Test_directconnect_connection_redundancy: dx_client.audited_account_arn = ( f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}" ) + dx_client._get_connection_arn_template = ( + lambda x: f"arn:aws:directconnect:{x}:{AWS_ACCOUNT_NUMBER}:connection" + ) dx_client.region = AWS_REGION_EU_WEST_1 dx_client.connections = {} dx_client.connections = { @@ -90,6 +99,9 @@ class Test_directconnect_connection_redundancy: with mock.patch( "prowler.providers.aws.services.directconnect.directconnect_service.DirectConnect", new=dx_client, + ), mock.patch( + "prowler.providers.aws.services.directconnect.directconnect_service.DirectConnect._get_connection_arn_template", + return_value=f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:connection", ): # Test Check from prowler.providers.aws.services.directconnect.directconnect_connection_redundancy.directconnect_connection_redundancy import ( @@ -105,10 +117,10 @@ class Test_directconnect_connection_redundancy: result[0].status_extended == "There is only one location Ashburn used by all the Direct Connect connections." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER + assert result[0].resource_id == "unknown" assert ( result[0].resource_arn - == f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}" + == f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:connection" ) assert result[0].region == AWS_REGION_EU_WEST_1 @@ -118,6 +130,9 @@ class Test_directconnect_connection_redundancy: dx_client.audited_account_arn = ( f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}" ) + dx_client._get_connection_arn_template = ( + lambda x: f"arn:aws:directconnect:{x}:{AWS_ACCOUNT_NUMBER}:connection" + ) dx_client.region = AWS_REGION_EU_WEST_1 dx_client.connections = {} dx_client.connections = { @@ -137,6 +152,9 @@ class Test_directconnect_connection_redundancy: with mock.patch( "prowler.providers.aws.services.directconnect.directconnect_service.DirectConnect", new=dx_client, + ), mock.patch( + "prowler.providers.aws.services.directconnect.directconnect_service.DirectConnect._get_connection_arn_template", + return_value=f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:connection", ): # Test Check from prowler.providers.aws.services.directconnect.directconnect_connection_redundancy.directconnect_connection_redundancy import ( @@ -152,9 +170,9 @@ class Test_directconnect_connection_redundancy: result[0].status_extended == "There are 2 Direct Connect connections across 2 locations." ) - assert result[0].resource_id == AWS_ACCOUNT_NUMBER + assert result[0].resource_id == "unknown" assert ( result[0].resource_arn - == f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}" + == f"arn:aws:directconnect:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:connection" ) assert result[0].region == AWS_REGION_EU_WEST_1 diff --git a/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py b/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py index a7dd4871a9..87fb82808b 100644 --- a/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py +++ b/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py @@ -119,9 +119,7 @@ nTTxU4a7x1naFxzYXK1iQ1vMARKMjDb19QEJIEJKZlDK4uS7yMlf1nFS check = iam_check_saml_providers_sts() result = check.execute() assert result[0].status == "FAIL" - assert result[0].resource_id == AWS_ACCOUNT_NUMBER - assert ( - result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" - ) + assert result[0].resource_id == "123456789012" + assert result[0].resource_arn == "arn:aws:iam::123456789012:root" assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].status_extended == "No SAML Providers found." diff --git a/tests/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations_test.py b/tests/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations_test.py index fc7b444a12..d2deed3553 100644 --- a/tests/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations_test.py +++ b/tests/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations_test.py @@ -6,11 +6,7 @@ from moto import mock_aws from prowler.providers.aws.services.organizations.organizations_service import ( Organizations, ) -from tests.providers.aws.utils import ( - AWS_ACCOUNT_ARN, - AWS_REGION_EU_WEST_1, - set_mocked_aws_provider, -) +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider class Test_organizations_account_part_of_organizations: @@ -42,8 +38,11 @@ class Test_organizations_account_part_of_organizations: result[0].status_extended == "AWS Organizations is not in-use for this AWS Account." ) - assert result[0].resource_id == "AWS Organization" - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:organizations::123456789012:unknown" + ) assert result[0].region == AWS_REGION_EU_WEST_1 @mock_aws diff --git a/tests/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy_test.py b/tests/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy_test.py index 0219041c5f..a583ac2265 100644 --- a/tests/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy_test.py +++ b/tests/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy_test.py @@ -4,19 +4,17 @@ from prowler.providers.aws.services.organizations.organizations_service import ( Organization, Policy, ) -from tests.providers.aws.utils import ( - AWS_ACCOUNT_ARN, - AWS_REGION_EU_WEST_1, - set_mocked_aws_provider, -) +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider class Test_organizations_tags_policies_enabled_and_attached: def test_organization_no_organization(self): organizations_client = mock.MagicMock organizations_client.region = AWS_REGION_EU_WEST_1 + organizations_client.audited_partition = "aws" + organizations_client.audited_account = "0123456789012" organizations_client.organization = Organization( - arn=AWS_ACCOUNT_ARN, + arn="arn:aws:organizations:eu-west-1:0123456789012:unknown", id="AWS Organization", status="NOT_AVAILABLE", master_id="", @@ -47,12 +45,17 @@ class Test_organizations_tags_policies_enabled_and_attached: == "AWS Organizations is not in-use for this AWS Account." ) assert result[0].resource_id == "AWS Organization" - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert ( + result[0].resource_arn + == "arn:aws:organizations:eu-west-1:0123456789012:unknown" + ) assert result[0].region == AWS_REGION_EU_WEST_1 def test_organization_with_AI_optout_no_policies(self): organizations_client = mock.MagicMock organizations_client.region = AWS_REGION_EU_WEST_1 + organizations_client.audited_partition = "aws" + organizations_client.audited_account = "0123456789012" organizations_client.organization = Organization( id="o-1234567890", arn="arn:aws:organizations::1234567890:organization/o-1234567890", @@ -96,6 +99,11 @@ class Test_organizations_tags_policies_enabled_and_attached: def test_organization_with_AI_optout_policy(self): organizations_client = mock.MagicMock organizations_client.region = AWS_REGION_EU_WEST_1 + organizations_client.audited_partition = "aws" + organizations_client.audited_account = "0123456789012" + organizations_client.get_unknown_arn = ( + lambda x: f"arn:aws:organizations:{x}:0123456789012:unknown" + ) organizations_client.organization = Organization( id="o-1234567890", arn="arn:aws:organizations::1234567890:organization/o-1234567890", @@ -129,6 +137,9 @@ class Test_organizations_tags_policies_enabled_and_attached: with mock.patch( "prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client", new=organizations_client, + ), mock.patch( + "prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client.get_unknown_arn", + return_value="arn:aws:organizations:eu-west-1:0123456789012:unknown", ): # Test Check from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import ( @@ -154,6 +165,8 @@ class Test_organizations_tags_policies_enabled_and_attached: def test_organization_with_AI_optout_policy_no_content(self): organizations_client = mock.MagicMock organizations_client.region = AWS_REGION_EU_WEST_1 + organizations_client.audited_partition = "aws" + organizations_client.audited_account = "0123456789012" organizations_client.organization = Organization( id="o-1234567890", arn="arn:aws:organizations::1234567890:organization/o-1234567890", diff --git a/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py b/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py index 85c910b4d0..8289ed99c7 100644 --- a/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py +++ b/tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py @@ -7,7 +7,6 @@ from prowler.providers.aws.services.organizations.organizations_service import ( Organizations, ) from tests.providers.aws.utils import ( - AWS_ACCOUNT_ARN, AWS_REGION_EU_CENTRAL_1, AWS_REGION_EU_WEST_1, set_mocked_aws_provider, @@ -49,8 +48,11 @@ class Test_organizations_scp_check_deny_regions: result[0].status_extended == "AWS Organizations is not in-use for this AWS Account." ) - assert result[0].resource_id == "AWS Organization" - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert result[0].resource_id == "unknown" + assert ( + result[0].resource_arn + == "arn:aws:organizations::123456789012:unknown" + ) assert result[0].region == AWS_REGION_EU_WEST_1 @mock_aws @@ -84,7 +86,11 @@ class Test_organizations_scp_check_deny_regions: assert len(result) == 1 assert result[0].status == "FAIL" assert result[0].resource_id == response["Organization"]["Id"] - assert result[0].resource_arn == response["Organization"]["Arn"] + # Using this because there is no way to get the ARN of the organization + assert ( + "arn:aws:organizations::123456789012:organization/o-" + in result[0].resource_arn + ) assert ( result[0].status_extended == f"AWS Organization {org_id} has SCP policies but don't restrict AWS Regions." @@ -176,7 +182,10 @@ class Test_organizations_scp_check_deny_regions: assert len(result) == 1 assert result[0].status == "FAIL" assert result[0].resource_id == response["Organization"]["Id"] - assert result[0].resource_arn == response["Organization"]["Arn"] + assert ( + "arn:aws:organizations::123456789012:organization/o-" + in result[0].resource_arn + ) assert ( result[0].status_extended == f"AWS Organization {org_id} has SCP policies {policy_id} restricting some AWS Regions, but not all the configured ones, please check config." diff --git a/tests/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached_test.py b/tests/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached_test.py index 4c2cf4def7..9e045c9116 100644 --- a/tests/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached_test.py +++ b/tests/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached_test.py @@ -4,19 +4,17 @@ from prowler.providers.aws.services.organizations.organizations_service import ( Organization, Policy, ) -from tests.providers.aws.utils import ( - AWS_ACCOUNT_ARN, - AWS_REGION_EU_WEST_1, - set_mocked_aws_provider, -) +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider class Test_organizations_tags_policies_enabled_and_attached: def test_organization_no_organization(self): organizations_client = mock.MagicMock organizations_client.region = AWS_REGION_EU_WEST_1 + organizations_client.audited_partition = "aws" + organizations_client.audited_account = "0123456789012" organizations_client.organization = Organization( - arn=AWS_ACCOUNT_ARN, + arn="arn:aws:organizations::1234567890:organization/o-1234567890", id="AWS Organization", status="NOT_AVAILABLE", master_id="", @@ -47,12 +45,17 @@ class Test_organizations_tags_policies_enabled_and_attached: == "AWS Organizations is not in-use for this AWS Account." ) assert result[0].resource_id == "AWS Organization" - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert ( + result[0].resource_arn + == "arn:aws:organizations::1234567890:organization/o-1234567890" + ) assert result[0].region == AWS_REGION_EU_WEST_1 def test_organization_with_tag_policies_not_attached(self): organizations_client = mock.MagicMock organizations_client.region = AWS_REGION_EU_WEST_1 + organizations_client.audited_partition = "aws" + organizations_client.audited_account = "0123456789012" organizations_client.organization = Organization( id="o-1234567890", arn="arn:aws:organizations::1234567890:organization/o-1234567890", @@ -107,6 +110,9 @@ class Test_organizations_tags_policies_enabled_and_attached: def test_organization_with_tag_policies_attached(self): organizations_client = mock.MagicMock organizations_client.region = AWS_REGION_EU_WEST_1 + organizations_client.get_unknown_arn = ( + lambda x: f"arn:aws:organizations:{x}:0123456789012:unknown" + ) organizations_client.organization = Organization( id="o-1234567890", arn="arn:aws:organizations::1234567890:organization/o-1234567890", @@ -136,6 +142,9 @@ class Test_organizations_tags_policies_enabled_and_attached: with mock.patch( "prowler.providers.aws.services.organizations.organizations_tags_policies_enabled_and_attached.organizations_tags_policies_enabled_and_attached.organizations_client", new=organizations_client, + ), mock.patch( + "prowler.providers.aws.services.organizations.organizations_tags_policies_enabled_and_attached.organizations_tags_policies_enabled_and_attached.organizations_client.get_unknown_arn", + return_value="arn:aws:organizations:eu-west-1:0123456789012:unknown", ): # Test Check from prowler.providers.aws.services.organizations.organizations_tags_policies_enabled_and_attached.organizations_tags_policies_enabled_and_attached import ( diff --git a/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py b/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py index 8d601ae7cc..6215bdb418 100644 --- a/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py +++ b/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py @@ -3,16 +3,19 @@ from unittest import mock from prowler.providers.aws.services.securityhub.securityhub_service import ( SecurityHubHub, ) -from tests.providers.aws.utils import AWS_ACCOUNT_ARN, AWS_REGION_EU_WEST_1 +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1 class Test_securityhub_enabled: def test_securityhub_hub_inactive(self): securityhub_client = mock.MagicMock securityhub_client.region = AWS_REGION_EU_WEST_1 + securityhub_client.get_unknown_arn = ( + lambda x: f"arn:aws:securityhub:{x}:0123456789012:unknown" + ) securityhub_client.securityhubs = [ SecurityHubHub( - arn=AWS_ACCOUNT_ARN, + arn=f"arn:aws:securityhub:{AWS_REGION_EU_WEST_1}:0123456789012:unknown", id="Security Hub", status="NOT_AVAILABLE", standards="", @@ -24,6 +27,9 @@ class Test_securityhub_enabled: with mock.patch( "prowler.providers.aws.services.securityhub.securityhub_service.SecurityHub", new=securityhub_client, + ), mock.patch( + "prowler.providers.aws.services.securityhub.securityhub_service.SecurityHub.get_unknown_arn", + return_value="arn:aws:securityhub:eu-west-1:0123456789012:unknown", ): # Test Check from prowler.providers.aws.services.securityhub.securityhub_enabled.securityhub_enabled import ( @@ -36,7 +42,10 @@ class Test_securityhub_enabled: assert result[0].status == "FAIL" assert result[0].status_extended == "Security Hub is not enabled." assert result[0].resource_id == "Security Hub" - assert result[0].resource_arn == AWS_ACCOUNT_ARN + assert ( + result[0].resource_arn + == "arn:aws:securityhub:eu-west-1:0123456789012:unknown" + ) assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_tags == [{"test_key": "test_value"}] @@ -119,6 +128,8 @@ class Test_securityhub_enabled: def test_securityhub_hub_active_without_integrations_or_standards(self): securityhub_client = mock.MagicMock securityhub_client.region = AWS_REGION_EU_WEST_1 + securityhub_client.audited_partition = "aws" + securityhub_client.audited_account = "0123456789012" securityhub_client.securityhubs = [ SecurityHubHub( arn="arn:aws:securityhub:us-east-1:0123456789012:hub/default", @@ -159,6 +170,8 @@ class Test_securityhub_enabled: securityhub_client = mock.MagicMock securityhub_client.audit_config = {"mute_non_default_regions": True} securityhub_client.region = AWS_REGION_EU_WEST_1 + securityhub_client.audited_partition = "aws" + securityhub_client.audited_account = "0123456789012" securityhub_client.securityhubs = [ SecurityHubHub( arn="arn:aws:securityhub:us-east-1:0123456789012:hub/default",