diff --git a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json index 8a72a496b7..f6ddccd6b5 100644 --- a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json +++ b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json @@ -1288,7 +1288,7 @@ ], "Attributes": [ { - "Section": "2 etcd", + "Section": "2 Etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Configure TLS encryption for the etcd service.", @@ -1310,7 +1310,7 @@ ], "Attributes": [ { - "Section": "2 etcd", + "Section": "2 Etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Enable client authentication on etcd service.", @@ -1332,7 +1332,7 @@ ], "Attributes": [ { - "Section": "2 etcd", + "Section": "2 Etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not use self-signed certificates for TLS.", @@ -1354,7 +1354,7 @@ ], "Attributes": [ { - "Section": "2 etcd", + "Section": "2 Etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "etcd should be configured to make use of TLS encryption for peer connections.", @@ -1376,7 +1376,7 @@ ], "Attributes": [ { - "Section": "2 etcd", + "Section": "2 Etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "etcd should be configured for peer authentication.", @@ -1398,7 +1398,7 @@ ], "Attributes": [ { - "Section": "2 etcd", + "Section": "2 Etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not use automatically generated self-signed certificates for TLS connections between peers.", @@ -1420,7 +1420,7 @@ ], "Attributes": [ { - "Section": "2 etcd", + "Section": "2 Etcd", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Use a different certificate authority for etcd from the one used for Kubernetes.", @@ -2634,7 +2634,7 @@ ], "Attributes": [ { - "Section": "5.4", + "Section": "5.4 Secrets Management", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Kubernetes supports mounting secrets as data volumes or as environment variables. Minimize the use of environment variable secrets.", diff --git a/prowler/lib/check/compliance.py b/prowler/lib/check/compliance.py index 21932406cb..b191f1f8a3 100644 --- a/prowler/lib/check/compliance.py +++ b/prowler/lib/check/compliance.py @@ -34,6 +34,7 @@ def update_checks_metadata_with_compliance( # Save it into the check's metadata bulk_checks_metadata[check].Compliance = check_compliance + check_compliance = [] # Add requirements of Manual Controls for framework in bulk_compliance_frameworks.values(): for requirement in framework.Requirements: @@ -70,7 +71,6 @@ def update_checks_metadata_with_compliance( "Recommendation": {"Text": "", "Url": ""}, }, "Categories": [], - "Tags": {}, "DependsOn": [], "RelatedTo": [], "Notes": "", diff --git a/prowler/lib/outputs/outputs.py b/prowler/lib/outputs/outputs.py index 250df04507..d37a7433aa 100644 --- a/prowler/lib/outputs/outputs.py +++ b/prowler/lib/outputs/outputs.py @@ -89,16 +89,17 @@ def report(check_findings, provider): available_compliance_frameworks ) ) - fill_compliance( + + add_manual_controls( output_options, - finding, provider, file_descriptors, input_compliance_frameworks, ) - add_manual_controls( + fill_compliance( output_options, + finding, provider, file_descriptors, input_compliance_frameworks, diff --git a/tests/lib/check/compliance_check_test.py b/tests/lib/check/compliance_check_test.py new file mode 100644 index 0000000000..634a11de6b --- /dev/null +++ b/tests/lib/check/compliance_check_test.py @@ -0,0 +1,193 @@ +from prowler.lib.check.compliance import update_checks_metadata_with_compliance +from prowler.lib.check.compliance_models import ( + CIS_Requirement_Attribute, + CIS_Requirement_Attribute_AssessmentStatus, + CIS_Requirement_Attribute_Profile, + Compliance_Base_Model, + Compliance_Requirement, +) +from prowler.lib.check.models import Check_Metadata_Model + + +class TestCompliance: + provider = "aws" + + def get_custom_framework(self): + return { + "framework1": Compliance_Base_Model( + Framework="Framework1", + Provider="Provider1", + Version="1.0", + Description="Framework 1 Description", + Requirements=[ + Compliance_Requirement( + Id="1.1.1", + Description="description", + Attributes=[ + CIS_Requirement_Attribute( + Section="1. Identity", + Profile=CIS_Requirement_Attribute_Profile("Level 1"), + AssessmentStatus=CIS_Requirement_Attribute_AssessmentStatus( + "Manual" + ), + Description="Description", + RationaleStatement="Rationale", + ImpactStatement="Impact", + RemediationProcedure="Remediation", + AuditProcedure="Audit", + AdditionalInformation="Additional", + References="References", + ) + ], + Checks=["check1", "check2"], + ), + # Manual requirement + Compliance_Requirement( + Id="1.1.2", + Description="description", + Attributes=[ + CIS_Requirement_Attribute( + Section="1. Identity", + Profile=CIS_Requirement_Attribute_Profile("Level 1"), + AssessmentStatus=CIS_Requirement_Attribute_AssessmentStatus( + "Manual" + ), + Description="Description", + RationaleStatement="Rationale", + ImpactStatement="Impact", + RemediationProcedure="Remediation", + AuditProcedure="Audit", + AdditionalInformation="Additional", + References="References", + ) + ], + Checks=[], + ), + ], + ) + } + + def get_custom_check_metadata(self): + return { + "check1": Check_Metadata_Model( + Provider="aws", + CheckID="check1", + CheckTitle="Check 1", + CheckType=["type1"], + ServiceName="service1", + SubServiceName="subservice1", + ResourceIdTemplate="template1", + Severity="high", + ResourceType="resource1", + Description="Description 1", + Risk="risk1", + RelatedUrl="url1", + Remediation={ + "Code": { + "CLI": "cli1", + "NativeIaC": "native1", + "Other": "other1", + "Terraform": "terraform1", + }, + "Recommendation": {"Text": "text1", "Url": "url1"}, + }, + Categories=["categoryone"], + DependsOn=["dependency1"], + RelatedTo=["related1"], + Notes="notes1", + Compliance=[], + ), + "check2": Check_Metadata_Model( + Provider="aws", + CheckID="check2", + CheckTitle="Check 2", + CheckType=["type2"], + ServiceName="service2", + SubServiceName="subservice2", + ResourceIdTemplate="template2", + Severity="medium", + ResourceType="resource2", + Description="Description 2", + Risk="risk2", + RelatedUrl="url2", + Remediation={ + "Code": { + "CLI": "cli2", + "NativeIaC": "native2", + "Other": "other2", + "Terraform": "terraform2", + }, + "Recommendation": {"Text": "text2", "Url": "url2"}, + }, + Categories=["categorytwo"], + DependsOn=["dependency2"], + RelatedTo=["related2"], + Notes="notes2", + Compliance=[], + ), + } + + def test_update_checks_metadata(self): + bulk_compliance_frameworks = self.get_custom_framework() + bulk_checks_metadata = self.get_custom_check_metadata() + + updated_metadata = update_checks_metadata_with_compliance( + bulk_compliance_frameworks, bulk_checks_metadata + ) + + assert "check1" in updated_metadata + assert "check2" in updated_metadata + assert "manual_check" in updated_metadata + + manual_compliance = updated_metadata["manual_check"].Compliance[0] + check1_compliance = updated_metadata["check1"].Compliance[0] + + assert len(updated_metadata["manual_check"].Compliance) == 1 + assert len(updated_metadata["check1"].Compliance) == 1 + + assert manual_compliance.Framework == "Framework1" + assert manual_compliance.Provider == "Provider1" + assert manual_compliance.Version == "1.0" + assert manual_compliance.Description == "Framework 1 Description" + assert len(manual_compliance.Requirements) == 1 + + manual_requirement = manual_compliance.Requirements[0] + assert manual_requirement.Id == "1.1.2" + assert manual_requirement.Description == "description" + assert len(manual_requirement.Attributes) == 1 + + manual_attribute = manual_requirement.Attributes[0] + assert manual_attribute.Section == "1. Identity" + assert manual_attribute.Profile == "Level 1" + assert manual_attribute.AssessmentStatus == "Manual" + assert manual_attribute.Description == "Description" + assert manual_attribute.RationaleStatement == "Rationale" + assert manual_attribute.ImpactStatement == "Impact" + assert manual_attribute.RemediationProcedure == "Remediation" + assert manual_attribute.AuditProcedure == "Audit" + assert manual_attribute.AdditionalInformation == "Additional" + assert manual_attribute.References == "References" + + assert len(updated_metadata["check1"].Compliance) == 1 + assert check1_compliance.Framework == "Framework1" + assert check1_compliance.Provider == "Provider1" + assert check1_compliance.Version == "1.0" + assert check1_compliance.Description == "Framework 1 Description" + assert len(check1_compliance.Requirements) == 1 + + check1_requirement = check1_compliance.Requirements[0] + assert check1_requirement.Id == "1.1.1" + assert check1_requirement.Description == "description" + assert len(check1_requirement.Attributes) == 1 + + check1_attribute = check1_requirement.Attributes[0] + assert check1_attribute.Section == "1. Identity" + assert check1_attribute.Profile == "Level 1" + assert check1_attribute.AssessmentStatus == "Manual" + assert check1_attribute.Description == "Description" + assert check1_attribute.RationaleStatement == "Rationale" + assert check1_attribute.ImpactStatement == "Impact" + assert check1_attribute.RemediationProcedure == "Remediation" + assert check1_attribute.AuditProcedure == "Audit" + assert check1_attribute.AdditionalInformation == "Additional" + assert check1_attribute.References == "References"