diff --git a/api/src/backend/config/settings/sentry.py b/api/src/backend/config/settings/sentry.py index f6ac512cf2..89c77feba5 100644 --- a/api/src/backend/config/settings/sentry.py +++ b/api/src/backend/config/settings/sentry.py @@ -33,6 +33,10 @@ IGNORED_EXCEPTIONS = [ "ValidationException", "AWSSecretAccessKeyInvalidError", "InvalidAction", + "InvalidRequestException", + "RequestExpired", + "ConnectionClosedError", + "HTTPSConnectionPool", "Pool is closed", # The following comes from urllib3: eu-west-1 -- HTTPClientError[126]: An HTTP Client raised an unhandled exception: AWSHTTPSConnectionPool(host='hostname.s3.eu-west-1.amazonaws.com', port=443): Pool is closed. # Authentication Errors from GCP "ClientAuthenticationError", @@ -41,6 +45,8 @@ IGNORED_EXCEPTIONS = [ "Permission denied to get service", "API has not been used in project", "HttpError 404 when requesting", + "HttpError 403 when requesting", + "HttpError 400 when requesting", "GCPNoAccesibleProjectsError", # Authentication Errors from Azure "ClientAuthenticationError", diff --git a/prowler/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access.py b/prowler/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access.py index 2b4e00c8d3..275d36da26 100644 --- a/prowler/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access.py +++ b/prowler/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access.py @@ -19,7 +19,8 @@ class redshift_cluster_public_access(Check): report.status_extended = f"Redshift Cluster {cluster.id} has the endpoint {cluster.endpoint_address} set as publicly accessible but is not publicly exposed." # 2. Check if Redshift Cluster is in a public subnet if any( - subnet in vpc_client.subnets and vpc_client.subnets[subnet].public + subnet in vpc_client.vpc_subnets + and vpc_client.vpc_subnets[subnet].public for subnet in cluster.subnets ): report.status_extended = f"Redshift Cluster {cluster.id} has the endpoint {cluster.endpoint_address} set as publicly accessible in a public subnet but is not publicly exposed." diff --git a/prowler/providers/azure/services/containerregistry/containerregistry_service.py b/prowler/providers/azure/services/containerregistry/containerregistry_service.py index 287d18203f..e0004429f0 100644 --- a/prowler/providers/azure/services/containerregistry/containerregistry_service.py +++ b/prowler/providers/azure/services/containerregistry/containerregistry_service.py @@ -46,9 +46,6 @@ class ContainerRegistry(AzureService): admin_user_enabled=getattr( registry, "admin_user_enabled", False ), - network_rule_set=getattr( - registry, "network_rule_set", None - ), monitor_diagnostic_settings=self._get_registry_monitor_settings( registry.name, resource_group, subscription ), diff --git a/prowler/providers/azure/services/keyvault/keyvault_service.py b/prowler/providers/azure/services/keyvault/keyvault_service.py index 3a2cc1bf69..ccee275282 100644 --- a/prowler/providers/azure/services/keyvault/keyvault_service.py +++ b/prowler/providers/azure/services/keyvault/keyvault_service.py @@ -53,10 +53,13 @@ class KeyVault(AzureService): ), private_endpoint_connections=[ PrivateEndpointConnection(id=conn.id) - for conn in getattr( - keyvault_properties, - "private_endpoint_connections", - [], + for conn in ( + getattr( + keyvault_properties, + "private_endpoint_connections", + [], + ) + or [] ) ], enable_soft_delete=getattr( diff --git a/prowler/providers/azure/services/monitor/monitor_service.py b/prowler/providers/azure/services/monitor/monitor_service.py index c0239e467b..7f5b9c8232 100644 --- a/prowler/providers/azure/services/monitor/monitor_service.py +++ b/prowler/providers/azure/services/monitor/monitor_service.py @@ -53,7 +53,7 @@ class Monitor(AzureService): category_group=log_settings.category_group, enabled=log_settings.enabled, ) - for log_settings in getattr(setting, "logs", []) + for log_settings in (getattr(setting, "logs", []) or []) ], storage_account_id=setting.storage_account_id, ) diff --git a/prowler/providers/azure/services/network/network_service.py b/prowler/providers/azure/services/network/network_service.py index fb9af1af3a..c6464133da 100644 --- a/prowler/providers/azure/services/network/network_service.py +++ b/prowler/providers/azure/services/network/network_service.py @@ -1,6 +1,8 @@ +import re from dataclasses import dataclass from typing import List, Optional +from azure.core.exceptions import ResourceNotFoundError from azure.mgmt.network import NetworkManagementClient from prowler.lib.logger import logger @@ -64,14 +66,22 @@ class Network(AzureService): network_watchers.update({subscription: []}) network_watchers_list = client.network_watchers.list_all() for network_watcher in network_watchers_list: - flow_logs = self._get_flow_logs(subscription, network_watcher.name) + flow_logs = self._get_flow_logs( + subscription, network_watcher.name, network_watcher.id + ) network_watchers[subscription].append( NetworkWatcher( id=network_watcher.id, name=network_watcher.name, location=network_watcher.location, flow_logs=[ - FlowLog(id=flow_log.id) for flow_log in flow_logs + FlowLog( + id=flow_log.id, + name=flow_log.name, + enabled=flow_log.properties.enabled, + retention_policy=flow_log.properties.retentionPolicy, + ) + for flow_log in flow_logs ], ) ) @@ -82,12 +92,29 @@ class Network(AzureService): ) return network_watchers - def _get_flow_logs(self, subscription, network_watcher_name): + def _get_flow_logs(self, subscription, network_watcher_name, network_watcher_id): logger.info("Network - Getting Flow Logs...") client = self.clients[subscription] - resource_group = "NetworkWatcherRG" - flow_logs = client.flow_logs.list(resource_group, network_watcher_name) - return flow_logs + match = re.search(r"/resourceGroups/(?P[^/]+)/", network_watcher_id) + if not match: + logger.error( + f"Could not extract resource group from ID: {network_watcher_id}" + ) + return [] + resource_group = match.group("rg") + try: + flow_logs = client.flow_logs.list(resource_group, network_watcher_name) + return flow_logs + except ResourceNotFoundError as error: + logger.warning( + f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return [] + except Exception as error: + logger.error( + f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return [] def _get_bastion_hosts(self): logger.info("Network - Getting Bastion Hosts...") diff --git a/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_log_retention_policy_lock/cloudstorage_bucket_log_retention_policy_lock.py b/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_log_retention_policy_lock/cloudstorage_bucket_log_retention_policy_lock.py index c712ac0e0a..180dc6462f 100644 --- a/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_log_retention_policy_lock/cloudstorage_bucket_log_retention_policy_lock.py +++ b/prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_log_retention_policy_lock/cloudstorage_bucket_log_retention_policy_lock.py @@ -23,7 +23,7 @@ class cloudstorage_bucket_log_retention_policy_lock(Check): if bucket.retention_policy: report.status = "FAIL" report.status_extended = f"Log Sink Bucket {bucket.name} has no Retention Policy but without Bucket Lock." - if bucket.retention_policy["isLocked"]: + if bucket.retention_policy.get("isLocked", False): report.status = "PASS" report.status_extended = f"Log Sink Bucket {bucket.name} has a Retention Policy with Bucket Lock." findings.append(report) diff --git a/tests/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access_test.py b/tests/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access_test.py index 816f52489a..9e7f9dc103 100644 --- a/tests/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access_test.py +++ b/tests/providers/aws/services/redshift/redshift_cluster_public_access/redshift_cluster_public_access_test.py @@ -206,7 +206,7 @@ class Test_redshift_cluster_public_access: ) ) vpc_client = mock.MagicMock - vpc_client.subnets = {"subnet-123456": mock.MagicMock(public=True)} + vpc_client.vpc_subnets = {"subnet-123456": mock.MagicMock(public=True)} ec2_client = mock.MagicMock aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) @@ -260,7 +260,7 @@ class Test_redshift_cluster_public_access: ) ) vpc_client = mock.MagicMock - vpc_client.subnets = {"subnet-123456": mock.MagicMock(public=True)} + vpc_client.vpc_subnets = {"subnet-123456": mock.MagicMock(public=True)} ec2_client = mock.MagicMock ec2_client.security_groups = { f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:security-group/sg-123456": mock.MagicMock(