diff --git a/prowler/__main__.py b/prowler/__main__.py index f63f0e670d..eaced6a1f6 100644 --- a/prowler/__main__.py +++ b/prowler/__main__.py @@ -185,10 +185,13 @@ def prowler(): checks_to_execute = sorted(checks_to_execute) # Parse Mute List + mutelist_file = "" if hasattr(args, "mutelist_file"): mutelist_file = global_provider.get_mutelist(args.mutelist_file) # Set output options based on the selected provider + + # TODO: this is going to be removed an include in the Provider as a new common object audit_output_options = set_provider_output_options( provider, args, global_provider.identity, mutelist_file, bulk_checks_metadata ) diff --git a/prowler/providers/aws/aws_provider.py b/prowler/providers/aws/aws_provider.py index 0fe9467d3c..1dcf1bf384 100644 --- a/prowler/providers/aws/aws_provider.py +++ b/prowler/providers/aws/aws_provider.py @@ -41,7 +41,6 @@ from prowler.providers.common.provider import Provider class AwsProvider(Provider): - provider: str = "aws" session: AWSSession = AWSSession( session=None, session_config=None, original_session=None ) @@ -85,6 +84,7 @@ class AwsProvider(Provider): def __init__(self, arguments: Namespace): logger.info("Setting AWS provider ...") + self.provider = "aws" # Parse input arguments # Assume Role Options input_role = getattr(arguments, "role", None) diff --git a/prowler/providers/aws/services/cognito/cognito_idp_client.py b/prowler/providers/aws/services/cognito/cognito_idp_client.py index f71f16aff5..230570b0b0 100644 --- a/prowler/providers/aws/services/cognito/cognito_idp_client.py +++ b/prowler/providers/aws/services/cognito/cognito_idp_client.py @@ -1,4 +1,4 @@ -from prowler.providers.aws.lib.audit_info.audit_info import current_audit_info from prowler.providers.aws.services.cognito.cognito_service import CognitoIDP +from prowler.providers.common.common import get_global_provider -cognito_idp_client = CognitoIDP(current_audit_info) +cognito_idp_client = CognitoIDP(get_global_provider()) diff --git a/prowler/providers/aws/services/cognito/cognito_service.py b/prowler/providers/aws/services/cognito/cognito_service.py index 735846de0b..64ca1fb80e 100644 --- a/prowler/providers/aws/services/cognito/cognito_service.py +++ b/prowler/providers/aws/services/cognito/cognito_service.py @@ -10,8 +10,8 @@ from prowler.providers.aws.lib.service.service import AWSService ################## CognitoIDP class CognitoIDP(AWSService): - def __init__(self, audit_info): - super().__init__("cognito-idp", audit_info) + def __init__(self, provider): + super().__init__("cognito-idp", provider) self.user_pools = {} self.__threading_call__(self.__list_user_pools__) self.__describe_user_pools__() diff --git a/prowler/providers/azure/azure_provider.py b/prowler/providers/azure/azure_provider.py index 60fb8bf20a..2a0899b911 100644 --- a/prowler/providers/azure/azure_provider.py +++ b/prowler/providers/azure/azure_provider.py @@ -1,52 +1,117 @@ import asyncio import sys from os import getenv +from typing import Any, Optional import requests from azure.identity import DefaultAzureCredential, InteractiveBrowserCredential from azure.mgmt.subscription import SubscriptionClient +from colorama import Fore, Style from msgraph import GraphServiceClient from prowler.lib.logger import logger -from prowler.providers.azure.lib.audit_info.models import AzureIdentityInfo from prowler.providers.azure.lib.regions.regions import get_regions_config +from prowler.providers.azure.models import AzureIdentityInfo, AzureRegionConfig +from prowler.providers.common.provider import Provider -class Azure_Provider: - def __init__( - self, - az_cli_auth: bool, - sp_env_auth: bool, - browser_auth: bool, - managed_entity_auth: bool, - subscription_ids: list, - tenant_id: str, - region: str, - ): - logger.info("Instantiating Azure Provider ...") - self.region_config = self.__get_region_config__(region) - self.credentials = self.__get_credentials__( +class AzureProvider(Provider): + session: DefaultAzureCredential + identity: AzureIdentityInfo + audit_resources: Optional[Any] + audit_metadata: Optional[Any] + audit_config: dict + region_config: AzureRegionConfig + + def __init__(self, arguments): + logger.info("Setting Azure provider ...") + self.provider = "azure" + subscription_ids = arguments.subscription_ids + + logger.info("Checking if any credentials mode is set ...") + az_cli_auth = arguments.az_cli_auth + sp_env_auth = arguments.sp_env_auth + browser_auth = arguments.browser_auth + managed_entity_auth = arguments.managed_identity_auth + tenant_id = arguments.tenant_id + + logger.info("Checking if region is different than default one") + region = arguments.azure_region + self.validate_arguments( az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id ) - self.identity = self.__get_identity_info__( - self.credentials, + self.region_config = self.setup_region_config(region) + self.session = self.setup_session( + az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id + ) + self.identity = self.setup_identity( az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, subscription_ids, ) + if not arguments.only_logs: + self.print_credentials() - def __get_region_config__(self, region): - return get_regions_config(region) + # TODO: should we keep this here or within the identity? + self.locations = self.get_locations(self.session, self.region_config) + # TODO: move this to the providers, pending for AWS, GCP, AZURE and K8s + self.audit_config = {} - def __get_credentials__( + def validate_arguments( + self, az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id + ): + if ( + not az_cli_auth + and not sp_env_auth + and not browser_auth + and not managed_entity_auth + ): + raise SystemExit( + "Azure provider requires at least one authentication method set: [--az-cli-auth | --sp-env-auth | --browser-auth | --managed-identity-auth]" + ) + elif browser_auth and not tenant_id: + raise SystemExit( + "Azure Tenant ID (--tenant-id) is required for browser authentication mode" + ) + # There is no need to handle that since it won't get here + elif not browser_auth and tenant_id: + raise SystemExit( + "Azure Tenant ID (--tenant-id) is required only for browser authentication mode" + ) + + def setup_region_config(self, region): + config = get_regions_config(region) + return AzureRegionConfig( + name=region, + authority=config["authority"], + base_url=config["base_url"], + credential_scopes=config["credential_scopes"], + ) + + def print_credentials(self): + printed_subscriptions = [] + for key, value in self.identity.subscriptions.items(): + intermediate = key + ": " + value + printed_subscriptions.append(intermediate) + report = f""" +This report is being generated using the identity below: + +Azure Tenant IDs: {Fore.YELLOW}[{" ".join(self.identity.tenant_ids)}]{Style.RESET_ALL} Azure Tenant Domain: {Fore.YELLOW}[{self.identity.domain}]{Style.RESET_ALL} Azure Region: {Fore.YELLOW}[{self.region_config.name}]{Style.RESET_ALL} +Azure Subscriptions: {Fore.YELLOW}{printed_subscriptions}{Style.RESET_ALL} +Azure Identity Type: {Fore.YELLOW}[{self.identity.identity_type}]{Style.RESET_ALL} Azure Identity ID: {Fore.YELLOW}[{self.identity.identity_id}]{Style.RESET_ALL} +""" + print(report) + + # TODO: setup_session or setup_credentials? + def setup_session( self, az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id ): # Browser auth creds cannot be set with DefaultAzureCredentials() if not browser_auth: if sp_env_auth: - self.__check_sp_creds_env_vars__() + self.__check_service_principal_creds_env_vars__() try: # Since the input vars come as True when it is wanted to be used, we need to inverse it since # DefaultAzureCredential sets the auth method excluding the others @@ -61,7 +126,7 @@ class Azure_Provider: # Azure Auth using PowerShell is not supported exclude_powershell_credential=True, # set Authority of a Microsoft Entra endpoint - authority=self.region_config["authority"], + authority=self.region_config.authority, ) except Exception as error: logger.critical("Failed to retrieve azure credentials") @@ -81,7 +146,7 @@ class Azure_Provider: return credentials - def __check_sp_creds_env_vars__(self): + def __check_service_principal_creds_env_vars__(self): logger.info( "Azure provider: checking service principal environment variables ..." ) @@ -92,15 +157,16 @@ class Azure_Provider: ) sys.exit(1) - def __get_identity_info__( + def setup_identity( self, - credentials, az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, subscription_ids, ): + credentials = self.session + # TODO: fill this object with real values not default and set to none identity = AzureIdentityInfo() # If credentials comes from service principal or browser, if the required permissions are assigned @@ -153,7 +219,6 @@ class Azure_Provider: ) asyncio.run(get_azure_identity()) - # Managed identities only can be assigned resource, resource group and subscription scope permissions elif managed_entity_auth: identity.identity_id = "Default Managed Identity ID" @@ -167,8 +232,8 @@ class Azure_Provider: ) subscriptions_client = SubscriptionClient( credential=credentials, - base_url=self.region_config["base_url"], - credential_scopes=self.region_config["credential_scopes"], + base_url=self.region_config.base_url, + credential_scopes=self.region_config.credential_scopes, ) if not subscription_ids: logger.info("Scanning all the Azure subscriptions...") @@ -206,22 +271,13 @@ class Azure_Provider: return identity - def get_credentials(self): - return self.credentials - - def get_identity(self): - return self.identity - - def get_region_config(self): - return self.region_config - def get_locations(self, credentials, region_config): locations = None if credentials and region_config: subscriptions_client = SubscriptionClient( credential=credentials, - base_url=region_config["base_url"], - credential_scopes=region_config["credential_scopes"], + base_url=region_config.base_url, + credential_scopes=region_config.credential_scopes, ) list_subscriptions = subscriptions_client.subscriptions.list() list_subscriptions_ids = [ diff --git a/prowler/providers/azure/azure_provider_new.py b/prowler/providers/azure/azure_provider_new.py deleted file mode 100644 index d52e24f749..0000000000 --- a/prowler/providers/azure/azure_provider_new.py +++ /dev/null @@ -1,270 +0,0 @@ -import sys -from os import getenv -from typing import Any, Optional - -from azure.identity import DefaultAzureCredential, InteractiveBrowserCredential -from azure.mgmt.subscription import SubscriptionClient -from colorama import Fore, Style -from msgraph.core import GraphClient -from pydantic import BaseModel - -from prowler.lib.logger import logger -from prowler.providers.azure.lib.regions.regions import get_regions_config -from prowler.providers.common.provider import Provider - - -class AzureIdentityInfo(BaseModel): - identity_id: str = "" - identity_type: str = "" - tenant_ids: list[str] = [] - domain: str = "Unknown tenant domain (missing AAD permissions)" - subscriptions: dict = {} - - -class AzureRegionConfig(BaseModel): - name: str = "" - authority: str = None - base_url: str = "" - credential_scopes: list = [] - - -class AzureProvider(Provider): - session: DefaultAzureCredential - identity: AzureIdentityInfo - audit_resources: Optional[Any] - audit_metadata: Optional[Any] - audit_config: dict - region_config: AzureRegionConfig - - def __init__(self, arguments): - logger.info("Setting Azure provider ...") - subscription_ids = arguments.subscription_ids - - logger.info("Checking if any credentials mode is set ...") - az_cli_auth = arguments.az_cli_auth - sp_env_auth = arguments.sp_env_auth - browser_auth = arguments.browser_auth - managed_entity_auth = arguments.managed_identity_auth - tenant_id = arguments.tenant_id - - logger.info("Checking if region is different than default one") - region = arguments.azure_region - self.validate_arguments( - az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id - ) - self.region_config = self.setup_region_config(region) - self.session = self.setup_session( - az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id - ) - self.identity = self.setup_identity( - az_cli_auth, - sp_env_auth, - browser_auth, - managed_entity_auth, - subscription_ids, - ) - if not arguments.only_logs: - self.print_credentials() - - def validate_arguments( - self, az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id - ): - if ( - not az_cli_auth - and not sp_env_auth - and not browser_auth - and not managed_entity_auth - ): - raise Exception( - "Azure provider requires at least one authentication method set: [--az-cli-auth | --sp-env-auth | --browser-auth | --managed-identity-auth]" - ) - if (not browser_auth and tenant_id) or (browser_auth and not tenant_id): - raise Exception( - "Azure Tenant ID (--tenant-id) is required only for browser authentication mode" - ) - - def setup_region_config(self, region): - config = get_regions_config(region) - return AzureRegionConfig( - name=region, - authority=config["authority"], - base_url=config["base_url"], - credential_scopes=config["credential_scopes"], - ) - - def print_credentials(self): - printed_subscriptions = [] - for key, value in self.identity.subscriptions.items(): - intermediate = key + " : " + value - printed_subscriptions.append(intermediate) - report = f""" -This report is being generated using the identity below: - -Azure Tenant IDs: {Fore.YELLOW}[{" ".join(self.identity.tenant_ids)}]{Style.RESET_ALL} Azure Tenant Domain: {Fore.YELLOW}[{self.identity.domain}]{Style.RESET_ALL} Azure Region: {Fore.YELLOW}[{self.region_config.name}]{Style.RESET_ALL} -Azure Subscriptions: {Fore.YELLOW}{printed_subscriptions}{Style.RESET_ALL} -Azure Identity Type: {Fore.YELLOW}[{self.identity.identity_type}]{Style.RESET_ALL} Azure Identity ID: {Fore.YELLOW}[{self.identity.identity_id}]{Style.RESET_ALL} -""" - print(report) - - def setup_session( - self, az_cli_auth, sp_env_auth, browser_auth, managed_entity_auth, tenant_id - ): - # Browser auth creds cannot be set with DefaultAzureCredentials() - if not browser_auth: - if sp_env_auth: - self.__check_service_principal_creds_env_vars__() - try: - # Since the input vars come as True when it is wanted to be used, we need to inverse it since - # DefaultAzureCredential sets the auth method excluding the others - credentials = DefaultAzureCredential( - exclude_environment_credential=not sp_env_auth, - exclude_cli_credential=not az_cli_auth, - exclude_managed_identity_credential=not managed_entity_auth, - # Azure Auth using Visual Studio is not supported - exclude_visual_studio_code_credential=True, - # Azure Auth using Shared Token Cache is not supported - exclude_shared_token_cache_credential=True, - # Azure Auth using PowerShell is not supported - exclude_powershell_credential=True, - # set Authority of a Microsoft Entra endpoint - authority=self.region_config.authority, - ) - except Exception as error: - logger.critical("Failed to retrieve azure credentials") - logger.critical( - f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" - ) - sys.exit(1) - else: - try: - credentials = InteractiveBrowserCredential(tenant_id=tenant_id) - except Exception as error: - logger.critical("Failed to retrieve azure credentials") - logger.critical( - f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" - ) - sys.exit(1) - - return credentials - - def __check_service_principal_creds_env_vars__(self): - logger.info( - "Azure provider: checking service principal environment variables ..." - ) - for env_var in ["AZURE_CLIENT_ID", "AZURE_TENANT_ID", "AZURE_CLIENT_SECRET"]: - if not getenv(env_var): - logger.critical( - f"Azure provider: Missing environment variable {env_var} needed to autenticate against Azure" - ) - sys.exit(1) - - def setup_identity( - self, - az_cli_auth, - sp_env_auth, - browser_auth, - managed_entity_auth, - subscription_ids, - ): - credentials = self.session - identity = AzureIdentityInfo() - - # If credentials comes from service principal or browser, if the required permissions are assigned - # the identity can access AAD and retrieve the tenant domain name. - # With cli also should be possible but right now it does not work, azure python package issue is coming - # At the time of writting this with az cli creds is not working, despite that is included - if sp_env_auth or browser_auth or az_cli_auth: - # Trying to recover tenant domain info - try: - logger.info( - "Trying to retrieve tenant domain from AAD to populate identity structure ..." - ) - client = GraphClient(credential=credentials) - domain_result = client.get("/domains").json() - if "value" in domain_result: - if "id" in domain_result["value"][0]: - identity.domain = domain_result["value"][0]["id"] - except Exception as error: - logger.error( - "Provided identity does not have permissions to access AAD to retrieve tenant domain" - ) - logger.error( - f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" - ) - # since that exception is not considered as critical, we keep filling another identity fields - if sp_env_auth: - # The id of the sp can be retrieved from environment variables - identity.identity_id = getenv("AZURE_CLIENT_ID") - identity.identity_type = "Service Principal" - # Same here, if user can access AAD, some fields are retrieved if not, default value, for az cli - # should work but it doesn't, pending issue - else: - identity.identity_id = "Unknown user id (Missing AAD permissions)" - identity.identity_type = "User" - try: - logger.info( - "Trying to retrieve user information from AAD to populate identity structure ..." - ) - client = GraphClient(credential=credentials) - user_name = client.get("/me").json() - if "userPrincipalName" in user_name: - identity.identity_id = user_name - - except Exception as error: - logger.error( - "Provided identity does not have permissions to access AAD to retrieve user's metadata" - ) - logger.error( - f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" - ) - # Managed identities only can be assigned resource, resource group and subscription scope permissions - elif managed_entity_auth: - identity.identity_id = "Default Managed Identity ID" - identity.identity_type = "Managed Identity" - # Pending extracting info from managed identity - - # once we have populated the id, type, and domain fields, time to retrieve the subscriptions and finally the tenants - try: - logger.info( - "Trying to subscriptions and tenant ids to populate identity structure ..." - ) - subscriptions_client = SubscriptionClient( - credential=credentials, - base_url=self.region_config.base_url, - credential_scopes=self.region_config.credential_scopes, - ) - if not subscription_ids: - logger.info("Scanning all the Azure subscriptions...") - for subscription in subscriptions_client.subscriptions.list(): - identity.subscriptions.update( - {subscription.display_name: subscription.subscription_id} - ) - else: - logger.info("Scanning the subscriptions passed as argument ...") - for id in subscription_ids: - subscription = subscriptions_client.subscriptions.get( - subscription_id=id - ) - identity.subscriptions.update({subscription.display_name: id}) - - # If there are no subscriptions listed -> checks are not going to be run against any resource - if not identity.subscriptions: - logger.critical( - "It was not possible to retrieve any subscriptions, please check your permission assignments" - ) - sys.exit(1) - - tenants = subscriptions_client.tenants.list() - for tenant in tenants: - identity.tenant_ids.append(tenant.tenant_id) - # This error is critical, since it implies something is wrong with the credentials provided - except Exception as error: - logger.critical( - "Error with credentials provided getting subscriptions and tenants to scan" - ) - logger.critical( - f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" - ) - sys.exit(1) - - return identity diff --git a/prowler/providers/azure/lib/service/service.py b/prowler/providers/azure/lib/service/service.py index 1dde43d75b..146b2961f4 100644 --- a/prowler/providers/azure/lib/service/service.py +++ b/prowler/providers/azure/lib/service/service.py @@ -1,5 +1,5 @@ from prowler.lib.logger import logger -from prowler.providers.azure.azure_provider_new import AzureProvider +from prowler.providers.azure.azure_provider import AzureProvider class AzureService: @@ -16,9 +16,7 @@ class AzureService: ) self.subscriptions = provider.identity.subscriptions - # TODO: review locations self.locations = provider.locations - self.audit_config = provider.audit_config def __set_clients__(self, subscriptions, session, service, region_config): diff --git a/prowler/providers/azure/models.py b/prowler/providers/azure/models.py new file mode 100644 index 0000000000..21a47b1744 --- /dev/null +++ b/prowler/providers/azure/models.py @@ -0,0 +1,17 @@ +from pydantic import BaseModel + + +class AzureIdentityInfo(BaseModel): + identity_id: str = "" + identity_type: str = "" + tenant_ids: list[str] = [] + domain: str = "Unknown tenant domain (missing AAD permissions)" + subscriptions: dict = {} + locations: dict = {} + + +class AzureRegionConfig(BaseModel): + name: str = "" + authority: str = None + base_url: str = "" + credential_scopes: list = [] diff --git a/prowler/providers/azure/services/app/app_client.py b/prowler/providers/azure/services/app/app_client.py index 6b7627f9fc..06e938fa0a 100644 --- a/prowler/providers/azure/services/app/app_client.py +++ b/prowler/providers/azure/services/app/app_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.app.app_service import App +from prowler.providers.common.common import get_global_provider -app_client = App(azure_audit_info) +app_client = App(get_global_provider()) diff --git a/prowler/providers/azure/services/app/app_service.py b/prowler/providers/azure/services/app/app_service.py index b11d906bff..b5e5911471 100644 --- a/prowler/providers/azure/services/app/app_service.py +++ b/prowler/providers/azure/services/app/app_service.py @@ -4,14 +4,14 @@ from azure.mgmt.web import WebSiteManagementClient from azure.mgmt.web.models import ManagedServiceIdentity, SiteConfigResource from prowler.lib.logger import logger -from prowler.providers.azure.lib.audit_info.models import Azure_Audit_Info +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## App class App(AzureService): - def __init__(self, audit_info: Azure_Audit_Info): - super().__init__(WebSiteManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(WebSiteManagementClient, provider) self.apps = self.__get_apps__() def __get_apps__(self): diff --git a/prowler/providers/azure/services/appinsights/appinsights_client.py b/prowler/providers/azure/services/appinsights/appinsights_client.py index ed3cc15d43..e2f39b573b 100644 --- a/prowler/providers/azure/services/appinsights/appinsights_client.py +++ b/prowler/providers/azure/services/appinsights/appinsights_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.appinsights.appinsights_service import AppInsights +from prowler.providers.common.common import get_global_provider -appinsights_client = AppInsights(azure_audit_info) +appinsights_client = AppInsights(get_global_provider()) diff --git a/prowler/providers/azure/services/appinsights/appinsights_service.py b/prowler/providers/azure/services/appinsights/appinsights_service.py index dc3140b0b6..0e7697f3e9 100644 --- a/prowler/providers/azure/services/appinsights/appinsights_service.py +++ b/prowler/providers/azure/services/appinsights/appinsights_service.py @@ -3,14 +3,14 @@ from dataclasses import dataclass from azure.mgmt.applicationinsights import ApplicationInsightsManagementClient from prowler.lib.logger import logger -from prowler.providers.azure.lib.audit_info.models import Azure_Audit_Info +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## AppInsights class AppInsights(AzureService): - def __init__(self, audit_info: Azure_Audit_Info): - super().__init__(ApplicationInsightsManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(ApplicationInsightsManagementClient, provider) self.components = self.__get_components__() def __get_components__(self): diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_client.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_client.py index 8fb122669b..c8fbff3f5e 100644 --- a/prowler/providers/azure/services/cosmosdb/cosmosdb_client.py +++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.cosmosdb.cosmosdb_service import CosmosDB +from prowler.providers.common.common import get_global_provider -cosmosdb_client = CosmosDB(azure_audit_info) +cosmosdb_client = CosmosDB(get_global_provider()) diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py index a4e3229d05..aab39d5612 100644 --- a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py +++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py @@ -4,12 +4,13 @@ from azure.mgmt.cosmosdb import CosmosDBManagementClient from azure.mgmt.cosmosdb.models import PrivateEndpointConnection from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService class CosmosDB(AzureService): - def __init__(self, audit_info): - super().__init__(CosmosDBManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(CosmosDBManagementClient, provider) self.accounts = self.__get_accounts__() def __get_accounts__(self): diff --git a/prowler/providers/azure/services/defender/defender_service.py b/prowler/providers/azure/services/defender/defender_service.py index deea4c50f4..ed94497ff8 100644 --- a/prowler/providers/azure/services/defender/defender_service.py +++ b/prowler/providers/azure/services/defender/defender_service.py @@ -5,12 +5,13 @@ from azure.mgmt.security import SecurityCenter from pydantic import BaseModel from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## Defender class Defender(AzureService): - def __init__(self, provider): + def __init__(self, provider: AzureProvider): super().__init__(SecurityCenter, provider) self.pricings = self.__get_pricings__() diff --git a/prowler/providers/azure/services/iam/iam_service.py b/prowler/providers/azure/services/iam/iam_service.py index 1c6cfc54e8..21a5a1075b 100644 --- a/prowler/providers/azure/services/iam/iam_service.py +++ b/prowler/providers/azure/services/iam/iam_service.py @@ -4,12 +4,13 @@ from azure.mgmt.authorization import AuthorizationManagementClient from azure.mgmt.authorization.v2022_04_01.models import Permission from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## IAM class IAM(AzureService): - def __init__(self, provider): + def __init__(self, provider: AzureProvider): super().__init__(AuthorizationManagementClient, provider) self.roles, self.custom_roles = self.__get_roles__() diff --git a/prowler/providers/azure/services/keyvault/keyvault_client.py b/prowler/providers/azure/services/keyvault/keyvault_client.py index ecb0af426d..ce0667cf4d 100644 --- a/prowler/providers/azure/services/keyvault/keyvault_client.py +++ b/prowler/providers/azure/services/keyvault/keyvault_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.keyvault.keyvault_service import KeyVault +from prowler.providers.common.common import get_global_provider -keyvault_client = KeyVault(azure_audit_info) +keyvault_client = KeyVault(get_global_provider()) diff --git a/prowler/providers/azure/services/keyvault/keyvault_service.py b/prowler/providers/azure/services/keyvault/keyvault_service.py index 209a5fb8ad..be9c29f155 100644 --- a/prowler/providers/azure/services/keyvault/keyvault_service.py +++ b/prowler/providers/azure/services/keyvault/keyvault_service.py @@ -10,16 +10,18 @@ from azure.mgmt.keyvault.v2023_07_01.models import ( ) from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## Storage class KeyVault(AzureService): - def __init__(self, audit_info): - super().__init__(KeyVaultManagementClient, audit_info) - self.key_vaults = self.__get_key_vaults__(audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(KeyVaultManagementClient, provider) + # TODO: review this credentials assignment + self.key_vaults = self.__get_key_vaults__(provider) - def __get_key_vaults__(self, audit_info): + def __get_key_vaults__(self, provider): logger.info("KeyVault - Getting key_vaults...") key_vaults = {} for subscription, client in self.clients.items(): @@ -33,7 +35,7 @@ class KeyVault(AzureService): resource_group, keyvault_name ).properties keys = self.__get_keys__( - subscription, resource_group, keyvault_name, audit_info + subscription, resource_group, keyvault_name, provider ) secrets = self.__get_secrets__( subscription, resource_group, keyvault_name @@ -55,7 +57,7 @@ class KeyVault(AzureService): ) return key_vaults - def __get_keys__(self, subscription, resource_group, keyvault_name, audit_info): + def __get_keys__(self, subscription, resource_group, keyvault_name, provider): logger.info(f"KeyVault - Getting keys for {keyvault_name}...") keys = [] try: @@ -79,7 +81,8 @@ class KeyVault(AzureService): try: key_client = KeyClient( vault_url=f"https://{keyvault_name}.vault.azure.net/", - credential=audit_info.credentials, + # TODO: review the following line + credential=provider.session, ) properties = key_client.list_properties_of_keys() for prop in properties: @@ -88,6 +91,7 @@ class KeyVault(AzureService): if key.name == prop.name: key.rotation_policy = policy + # TODO: handle different errors here since we are catching all HTTP Errors here except HttpResponseError: logger.error( f"Subscription name: {subscription} -- has no access policy configured for keyvault {keyvault_name}" diff --git a/prowler/providers/azure/services/monitor/monitor_client.py b/prowler/providers/azure/services/monitor/monitor_client.py index 92759620d0..88a2c5d7c9 100644 --- a/prowler/providers/azure/services/monitor/monitor_client.py +++ b/prowler/providers/azure/services/monitor/monitor_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.monitor.monitor_service import Monitor +from prowler.providers.common.common import get_global_provider -monitor_client = Monitor(azure_audit_info) +monitor_client = Monitor(get_global_provider()) diff --git a/prowler/providers/azure/services/monitor/monitor_service.py b/prowler/providers/azure/services/monitor/monitor_service.py index 4359ed53fa..b6b39a3c40 100644 --- a/prowler/providers/azure/services/monitor/monitor_service.py +++ b/prowler/providers/azure/services/monitor/monitor_service.py @@ -4,13 +4,14 @@ from azure.mgmt.monitor import MonitorManagementClient from azure.mgmt.monitor.models import LogSettings from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## Monitor class Monitor(AzureService): - def __init__(self, audit_info): - super().__init__(MonitorManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(MonitorManagementClient, provider) self.diagnostics_settings = self.__get_diagnostics_settings__() diff --git a/prowler/providers/azure/services/mysql/mysql_client.py b/prowler/providers/azure/services/mysql/mysql_client.py index df48ca3569..3b23a11645 100644 --- a/prowler/providers/azure/services/mysql/mysql_client.py +++ b/prowler/providers/azure/services/mysql/mysql_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.mysql.mysql_service import MySQL +from prowler.providers.common.common import get_global_provider -mysql_client = MySQL(azure_audit_info) +mysql_client = MySQL(get_global_provider()) diff --git a/prowler/providers/azure/services/mysql/mysql_service.py b/prowler/providers/azure/services/mysql/mysql_service.py index 465c8511cc..80e2ddb3c3 100644 --- a/prowler/providers/azure/services/mysql/mysql_service.py +++ b/prowler/providers/azure/services/mysql/mysql_service.py @@ -3,13 +3,14 @@ from dataclasses import dataclass from azure.mgmt.rdbms.mysql_flexibleservers import MySQLManagementClient from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## MySQL class MySQL(AzureService): - def __init__(self, audit_info): - super().__init__(MySQLManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(MySQLManagementClient, provider) self.flexible_servers = self.__get_flexible_servers__() diff --git a/prowler/providers/azure/services/network/network_client.py b/prowler/providers/azure/services/network/network_client.py index 09632b9c64..840deb5039 100644 --- a/prowler/providers/azure/services/network/network_client.py +++ b/prowler/providers/azure/services/network/network_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.network.network_service import Network +from prowler.providers.common.common import get_global_provider -network_client = Network(azure_audit_info) +network_client = Network(get_global_provider()) diff --git a/prowler/providers/azure/services/network/network_service.py b/prowler/providers/azure/services/network/network_service.py index 1a7d55c8b3..285fb2dea4 100644 --- a/prowler/providers/azure/services/network/network_service.py +++ b/prowler/providers/azure/services/network/network_service.py @@ -3,13 +3,14 @@ from dataclasses import dataclass from azure.mgmt.network import NetworkManagementClient from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## SQLServer class Network(AzureService): - def __init__(self, audit_info): - super().__init__(NetworkManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(NetworkManagementClient, provider) self.security_groups = self.__get_security_groups__() self.bastion_hosts = self.__get_bastion_hosts__() self.network_watchers = self.__get_network_watchers__() diff --git a/prowler/providers/azure/services/policy/policy_client.py b/prowler/providers/azure/services/policy/policy_client.py index 5297921292..fd752a26db 100644 --- a/prowler/providers/azure/services/policy/policy_client.py +++ b/prowler/providers/azure/services/policy/policy_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.policy.policy_service import Policy +from prowler.providers.common.common import get_global_provider -policy_client = Policy(azure_audit_info) +policy_client = Policy(get_global_provider()) diff --git a/prowler/providers/azure/services/policy/policy_service.py b/prowler/providers/azure/services/policy/policy_service.py index af3e4fe673..dbdd36daeb 100644 --- a/prowler/providers/azure/services/policy/policy_service.py +++ b/prowler/providers/azure/services/policy/policy_service.py @@ -3,14 +3,14 @@ from dataclasses import dataclass from azure.mgmt.resource.policy import PolicyClient from prowler.lib.logger import logger -from prowler.providers.azure.lib.audit_info.models import Azure_Audit_Info +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## Policy class Policy(AzureService): - def __init__(self, audit_info: Azure_Audit_Info): - super().__init__(PolicyClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(PolicyClient, provider) self.policy_assigments = self.__get_policy_assigments__() def __get_policy_assigments__(self): diff --git a/prowler/providers/azure/services/postgresql/postgresql_client.py b/prowler/providers/azure/services/postgresql/postgresql_client.py index 2c94582130..024fb223bc 100644 --- a/prowler/providers/azure/services/postgresql/postgresql_client.py +++ b/prowler/providers/azure/services/postgresql/postgresql_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.postgresql.postgresql_service import PostgreSQL +from prowler.providers.common.common import get_global_provider -postgresql_client = PostgreSQL(azure_audit_info) +postgresql_client = PostgreSQL(get_global_provider()) diff --git a/prowler/providers/azure/services/postgresql/postgresql_service.py b/prowler/providers/azure/services/postgresql/postgresql_service.py index 7a93e0e3db..78662e46aa 100644 --- a/prowler/providers/azure/services/postgresql/postgresql_service.py +++ b/prowler/providers/azure/services/postgresql/postgresql_service.py @@ -3,12 +3,13 @@ from dataclasses import dataclass from azure.mgmt.rdbms.postgresql_flexibleservers import PostgreSQLManagementClient from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService class PostgreSQL(AzureService): - def __init__(self, audit_info): - super().__init__(PostgreSQLManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(PostgreSQLManagementClient, provider) self.flexible_servers = self.__get_flexible_servers__() def __get_flexible_servers__(self): diff --git a/prowler/providers/azure/services/sqlserver/sqlserver_service.py b/prowler/providers/azure/services/sqlserver/sqlserver_service.py index 386cdeeca1..a668518534 100644 --- a/prowler/providers/azure/services/sqlserver/sqlserver_service.py +++ b/prowler/providers/azure/services/sqlserver/sqlserver_service.py @@ -12,12 +12,13 @@ from azure.mgmt.sql.models import ( ) from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## SQLServer class SQLServer(AzureService): - def __init__(self, provider): + def __init__(self, provider: AzureProvider): super().__init__(SqlManagementClient, provider) self.sql_servers = self.__get_sql_servers__() diff --git a/prowler/providers/azure/services/storage/storage_service.py b/prowler/providers/azure/services/storage/storage_service.py index 1e4c9f67f3..55f73bae09 100644 --- a/prowler/providers/azure/services/storage/storage_service.py +++ b/prowler/providers/azure/services/storage/storage_service.py @@ -8,12 +8,13 @@ from azure.mgmt.storage.v2022_09_01.models import ( ) from prowler.lib.logger import logger +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## Storage class Storage(AzureService): - def __init__(self, provider): + def __init__(self, provider: AzureProvider): super().__init__(StorageManagementClient, provider) self.storage_accounts = self.__get_storage_accounts__() self.__get_blob_properties__() diff --git a/prowler/providers/azure/services/vm/vm_client.py b/prowler/providers/azure/services/vm/vm_client.py index 33bde5b1b2..2d1c7da927 100644 --- a/prowler/providers/azure/services/vm/vm_client.py +++ b/prowler/providers/azure/services/vm/vm_client.py @@ -1,4 +1,4 @@ -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info from prowler.providers.azure.services.vm.vm_service import VirtualMachines +from prowler.providers.common.common import get_global_provider -vm_client = VirtualMachines(azure_audit_info) +vm_client = VirtualMachines(get_global_provider()) diff --git a/prowler/providers/azure/services/vm/vm_service.py b/prowler/providers/azure/services/vm/vm_service.py index 4a84f7cb8f..c923600f47 100644 --- a/prowler/providers/azure/services/vm/vm_service.py +++ b/prowler/providers/azure/services/vm/vm_service.py @@ -4,14 +4,14 @@ from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.compute.models import StorageProfile from prowler.lib.logger import logger -from prowler.providers.azure.lib.audit_info.models import Azure_Audit_Info +from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService ########################## VirtualMachines class VirtualMachines(AzureService): - def __init__(self, audit_info: Azure_Audit_Info): - super().__init__(ComputeManagementClient, audit_info) + def __init__(self, provider: AzureProvider): + super().__init__(ComputeManagementClient, provider) self.virtual_machines = self.__get_virtual_machines__() self.disks = self.__get_disks__() diff --git a/prowler/providers/common/audit_info.py b/prowler/providers/common/audit_info.py index c9f4effd37..18e789330e 100644 --- a/prowler/providers/common/audit_info.py +++ b/prowler/providers/common/audit_info.py @@ -4,13 +4,6 @@ from colorama import Fore, Style from prowler.config.config import load_and_validate_config_file from prowler.lib.logger import logger -from prowler.providers.azure.azure_provider import Azure_Provider -from prowler.providers.azure.lib.audit_info.audit_info import azure_audit_info -from prowler.providers.azure.lib.audit_info.models import ( - Azure_Audit_Info, - AzureRegionConfig, -) -from prowler.providers.azure.lib.exception.exception import AzureException from prowler.providers.gcp.gcp_provider import GCP_Provider from prowler.providers.gcp.lib.audit_info.audit_info import gcp_audit_info from prowler.providers.gcp.lib.audit_info.models import GCP_Audit_Info @@ -48,19 +41,19 @@ Kubernetes Cluster: {Fore.YELLOW}[{cluster_name}]{Style.RESET_ALL} User: {Fore. """ print(report) - def print_azure_credentials(self, audit_info: Azure_Audit_Info): - printed_subscriptions = [] - for key, value in audit_info.identity.subscriptions.items(): - intermediate = f"{key} : {value}" - printed_subscriptions.append(intermediate) - report = f""" -This report is being generated using the identity below: + # def print_azure_credentials(self, audit_info: Azure_Audit_Info): + # printed_subscriptions = [] + # for key, value in audit_info.identity.subscriptions.items(): + # intermediate = f"{key} : {value}" + # printed_subscriptions.append(intermediate) + # report = f""" + # This report is being generated using the identity below: -Azure Tenant IDs: {Fore.YELLOW}[{" ".join(audit_info.identity.tenant_ids)}]{Style.RESET_ALL} Azure Tenant Domain: {Fore.YELLOW}[{audit_info.identity.domain}]{Style.RESET_ALL} Azure Region: {Fore.YELLOW}[{audit_info.azure_region_config.name}]{Style.RESET_ALL} -Azure Subscriptions: {Fore.YELLOW}{printed_subscriptions}{Style.RESET_ALL} -Azure Identity Type: {Fore.YELLOW}[{audit_info.identity.identity_type}]{Style.RESET_ALL} Azure Identity ID: {Fore.YELLOW}[{audit_info.identity.identity_id}]{Style.RESET_ALL} -""" - print(report) + # Azure Tenant IDs: {Fore.YELLOW}[{" ".join(audit_info.identity.tenant_ids)}]{Style.RESET_ALL} Azure Tenant Domain: {Fore.YELLOW}[{audit_info.identity.domain}]{Style.RESET_ALL} Azure Region: {Fore.YELLOW}[{audit_info.azure_region_config.name}]{Style.RESET_ALL} + # Azure Subscriptions: {Fore.YELLOW}{printed_subscriptions}{Style.RESET_ALL} + # Azure Identity Type: {Fore.YELLOW}[{audit_info.identity.identity_type}]{Style.RESET_ALL} Azure Identity ID: {Fore.YELLOW}[{audit_info.identity.identity_id}]{Style.RESET_ALL} + # """ + # print(report) # TODO: remove if not needed, but not now :) # def set_aws_audit_info(self, arguments) -> AWS_Audit_Info: @@ -303,64 +296,64 @@ Azure Identity Type: {Fore.YELLOW}[{audit_info.identity.identity_type}]{Style.RE # f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" # ) # sys.exit(1) + # TODO: remove if not needed, but not now :) + # def set_azure_audit_info(self, arguments) -> Azure_Audit_Info: + # """ + # set_azure_audit_info returns the Azure_Audit_Info + # """ + # logger.info("Setting Azure session ...") + # subscription_ids = arguments.get("subscription_ids") - def set_azure_audit_info(self, arguments) -> Azure_Audit_Info: - """ - set_azure_audit_info returns the Azure_Audit_Info - """ - logger.info("Setting Azure session ...") - subscription_ids = arguments.get("subscription_ids") + # logger.info("Checking if any credentials mode is set ...") + # az_cli_auth = arguments.get("az_cli_auth") + # sp_env_auth = arguments.get("sp_env_auth") + # browser_auth = arguments.get("browser_auth") + # managed_entity_auth = arguments.get("managed_entity_auth") + # tenant_id = arguments.get("tenant_id") - logger.info("Checking if any credentials mode is set ...") - az_cli_auth = arguments.get("az_cli_auth") - sp_env_auth = arguments.get("sp_env_auth") - browser_auth = arguments.get("browser_auth") - managed_entity_auth = arguments.get("managed_entity_auth") - tenant_id = arguments.get("tenant_id") + # logger.info("Checking if region is different than default one") + # region = arguments.get("azure_region") - logger.info("Checking if region is different than default one") - region = arguments.get("azure_region") + # if ( + # not az_cli_auth + # and not sp_env_auth + # and not browser_auth + # and not managed_entity_auth + # ): + # raise AzureException( + # "Azure provider requires at least one authentication method set: [--az-cli-auth | --sp-env-auth | --browser-auth | --managed-identity-auth]" + # ) + # if (not browser_auth and tenant_id) or (browser_auth and not tenant_id): + # raise AzureException( + # "Azure Tenant ID (--tenant-id) is required only for browser authentication mode" + # ) - if ( - not az_cli_auth - and not sp_env_auth - and not browser_auth - and not managed_entity_auth - ): - raise AzureException( - "Azure provider requires at least one authentication method set: [--az-cli-auth | --sp-env-auth | --browser-auth | --managed-identity-auth]" - ) - if (not browser_auth and tenant_id) or (browser_auth and not tenant_id): - raise AzureException( - "Azure Tenant ID (--tenant-id) is required only for browser authentication mode" - ) + # azure_provider = Azure_Provider( + # az_cli_auth, + # sp_env_auth, + # browser_auth, + # managed_entity_auth, + # subscription_ids, + # tenant_id, + # region, + # ) + # azure_audit_info.credentials = azure_provider.get_credentials() + # azure_audit_info.identity = azure_provider.get_identity() + # region_config = azure_provider.get_region_config() + # azure_audit_info.azure_region_config = AzureRegionConfig( + # name=region, + # authority=region_config["authority"], + # base_url=region_config["base_url"], + # credential_scopes=region_config["credential_scopes"], + # ) + # azure_audit_info.locations = azure_provider.get_locations( + # azure_audit_info.credentials, region_config + # ) - azure_provider = Azure_Provider( - az_cli_auth, - sp_env_auth, - browser_auth, - managed_entity_auth, - subscription_ids, - tenant_id, - region, - ) - azure_audit_info.credentials = azure_provider.get_credentials() - azure_audit_info.identity = azure_provider.get_identity() - region_config = azure_provider.get_region_config() - azure_audit_info.azure_region_config = AzureRegionConfig( - name=region, - authority=region_config["authority"], - base_url=region_config["base_url"], - credential_scopes=region_config["credential_scopes"], - ) - azure_audit_info.locations = azure_provider.get_locations( - azure_audit_info.credentials, region_config - ) + # if not arguments.get("only_logs"): + # self.print_azure_credentials(get_global_provider()) - if not arguments.get("only_logs"): - self.print_azure_credentials(azure_audit_info) - - return azure_audit_info + # return azure_audit_info def set_gcp_audit_info(self, arguments) -> GCP_Audit_Info: """ @@ -417,6 +410,7 @@ def set_provider_audit_info(provider: str, arguments: dict): provider_audit_info = getattr(Audit_Info(), provider_set_audit_info)(arguments) # Set the audit configuration from the config file + # TODO: move this to the providers provider_audit_info.audit_config = load_and_validate_config_file( provider, arguments["config_file"] ) diff --git a/prowler/providers/common/outputs.py b/prowler/providers/common/outputs.py index 5748020548..90ba012639 100644 --- a/prowler/providers/common/outputs.py +++ b/prowler/providers/common/outputs.py @@ -4,7 +4,7 @@ from dataclasses import dataclass from os import makedirs from os.path import isdir -from prowler.config.config import change_config_var, output_file_timestamp +from prowler.config.config import output_file_timestamp from prowler.lib.logger import logger @@ -76,28 +76,28 @@ class Provider_Output_Options: class Azure_Output_Options(Provider_Output_Options): - def __init__(self, arguments, audit_info, mutelist_file, bulk_checks_metadata): + def __init__(self, arguments, identity, mutelist_file, bulk_checks_metadata): # First call Provider_Output_Options init super().__init__(arguments, mutelist_file, bulk_checks_metadata) # Confire Shodan API - if arguments.shodan: - audit_info = change_config_var( - "shodan_api_key", arguments.shodan, audit_info - ) + # TODO: review shodan for the new AWS provider + # if arguments.shodan: + # audit_info = change_config_var( + # "shodan_api_key", arguments.shodan, audit_info + # ) # Check if custom output filename was input, if not, set the default if ( not hasattr(arguments, "output_filename") or arguments.output_filename is None ): - if ( - audit_info.identity.domain - != "Unknown tenant domain (missing AAD permissions)" - ): - self.output_filename = f"prowler-output-{audit_info.identity.domain}-{output_file_timestamp}" + if identity.domain != "Unknown tenant domain (missing AAD permissions)": + self.output_filename = ( + f"prowler-output-{identity.domain}-{output_file_timestamp}" + ) else: - self.output_filename = f"prowler-output-{'-'.join(audit_info.identity.tenant_ids)}-{output_file_timestamp}" + self.output_filename = f"prowler-output-{'-'.join(identity.tenant_ids)}-{output_file_timestamp}" else: self.output_filename = arguments.output_filename diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py index 80924db7b9..6b4b392d66 100644 --- a/prowler/providers/common/provider.py +++ b/prowler/providers/common/provider.py @@ -12,3 +12,10 @@ class Provider(ABC): def validate_arguments(self): pass + + def get_checks_to_execute_by_audit_resources(self): + """ + get_checks_to_execute_by_audit_resources returns a set of checks based on the input resources to scan. + + This is a fallback that returns None if the service has not implemented this function. + """ diff --git a/prowler/providers/gcp/services/gke/gke_service.py b/prowler/providers/gcp/services/gke/gke_service.py index e657e3d642..df3110ce0a 100644 --- a/prowler/providers/gcp/services/gke/gke_service.py +++ b/prowler/providers/gcp/services/gke/gke_service.py @@ -6,7 +6,7 @@ from prowler.providers.gcp.lib.service.service import GCPService ################## GKE class GKE(GCPService): - def __init__(self, audit_info): + def __init__(self, provider): super().__init__("container", audit_info, api_version="v1beta1") self.locations = [] self.__get_locations__()