From d4bc6d753169aeecbcf8afb51acb565395932b22 Mon Sep 17 00:00:00 2001 From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> Date: Thu, 15 Jan 2026 09:31:27 +0100 Subject: [PATCH 1/8] feat(cloudflare): Add TLS/SSL, records and email security checks for zones (#9424) Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> --- .github/labeler.yml | 15 +- docs/introduction.mdx | 1 + .../cloudflare/getting-started-cloudflare.mdx | 4 + prowler/CHANGELOG.md | 1 + .../cloudflare/cloudflare_provider.py | 10 +- .../cloudflare/services/dns/__init__.py | 0 .../cloudflare/services/dns/dns_client.py | 4 + .../cloudflare/services/dns/dns_service.py | 64 ++ .../__init__.py | 0 ...matic_https_rewrites_enabled.metadata.json | 36 + .../zone_automatic_https_rewrites_enabled.py | 45 ++ .../zone_dnssec_enabled.metadata.json | 1 + .../__init__.py | 0 ...ne_email_obfuscation_enabled.metadata.json | 36 + .../zone_email_obfuscation_enabled.py | 43 ++ .../zone_hsts_enabled.metadata.json | 1 + .../zone_https_redirect_enabled.metadata.json | 4 +- .../zone_min_tls_version_secure.metadata.json | 1 + .../zone/zone_record_caa_exists/__init__.py | 0 .../zone_record_caa_exists.metadata.json | 36 + .../zone_record_caa_exists.py | 82 +++ .../zone/zone_record_dkim_exists/__init__.py | 0 .../zone_record_dkim_exists.metadata.json | 36 + .../zone_record_dkim_exists.py | 116 ++++ .../zone/zone_record_dmarc_exists/__init__.py | 0 .../zone_record_dmarc_exists.metadata.json | 36 + .../zone_record_dmarc_exists.py | 88 +++ .../zone/zone_record_spf_exists/__init__.py | 0 .../zone_record_spf_exists.metadata.json | 36 + .../zone_record_spf_exists.py | 68 ++ .../__init__.py | 0 ...curity_under_attack_disabled.metadata.json | 37 + .../zone_security_under_attack_disabled.py | 47 ++ .../cloudflare/services/zone/zone_service.py | 27 +- .../zone_ssl_strict.metadata.json | 1 + .../zone/zone_tls_1_3_enabled/__init__.py | 0 .../zone_tls_1_3_enabled.metadata.json | 36 + .../zone_tls_1_3_enabled.py | 39 ++ .../zone_universal_ssl_enabled/__init__.py | 0 .../zone_universal_ssl_enabled.metadata.json | 36 + .../zone_universal_ssl_enabled.py | 42 ++ .../cloudflare/cloudflare_provider_test.py | 8 +- .../services/dns/dns_service_test.py | 119 ++++ ...e_automatic_https_rewrites_enabled_test.py | 143 ++++ .../zone_email_obfuscation_enabled_test.py | 139 ++++ .../zone_record_caa_exists_test.py | 323 +++++++++ .../zone_record_dkim_exists_test.py | 646 ++++++++++++++++++ .../zone_record_dmarc_exists_test.py | 417 +++++++++++ .../zone_record_spf_exists_test.py | 315 +++++++++ ...one_security_under_attack_disabled_test.py | 210 ++++++ .../zone_tls_1_3_enabled_test.py | 173 +++++ .../zone_universal_ssl_enabled_test.py | 111 +++ 52 files changed, 3613 insertions(+), 20 deletions(-) create mode 100644 prowler/providers/cloudflare/services/dns/__init__.py create mode 100644 prowler/providers/cloudflare/services/dns/dns_client.py create mode 100644 prowler/providers/cloudflare/services/dns/dns_service.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_caa_exists/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_spf_exists/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/__init__.py create mode 100644 prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.metadata.json create mode 100644 prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.py create mode 100644 tests/providers/cloudflare/services/dns/dns_service_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled_test.py create mode 100644 tests/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled_test.py diff --git a/.github/labeler.yml b/.github/labeler.yml index fa2c7981f9..7e87c1a6a3 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -46,12 +46,17 @@ provider/oci: - changed-files: - any-glob-to-any-file: "prowler/providers/oraclecloud/**" - any-glob-to-any-file: "tests/providers/oraclecloud/**" - + provider/alibabacloud: - changed-files: - any-glob-to-any-file: "prowler/providers/alibabacloud/**" - any-glob-to-any-file: "tests/providers/alibabacloud/**" +provider/cloudflare: + - changed-files: + - any-glob-to-any-file: "prowler/providers/cloudflare/**" + - any-glob-to-any-file: "tests/providers/cloudflare/**" + github_actions: - changed-files: - any-glob-to-any-file: ".github/workflows/*" @@ -67,15 +72,21 @@ mutelist: - any-glob-to-any-file: "prowler/providers/azure/lib/mutelist/**" - any-glob-to-any-file: "prowler/providers/gcp/lib/mutelist/**" - any-glob-to-any-file: "prowler/providers/kubernetes/lib/mutelist/**" + - any-glob-to-any-file: "prowler/providers/m365/lib/mutelist/**" - any-glob-to-any-file: "prowler/providers/mongodbatlas/lib/mutelist/**" + - any-glob-to-any-file: "prowler/providers/oraclecloud/lib/mutelist/**" + - any-glob-to-any-file: "prowler/providers/alibabacloud/lib/mutelist/**" + - any-glob-to-any-file: "prowler/providers/cloudflare/lib/mutelist/**" - any-glob-to-any-file: "tests/lib/mutelist/**" - any-glob-to-any-file: "tests/providers/aws/lib/mutelist/**" - any-glob-to-any-file: "tests/providers/azure/lib/mutelist/**" - any-glob-to-any-file: "tests/providers/gcp/lib/mutelist/**" - any-glob-to-any-file: "tests/providers/kubernetes/lib/mutelist/**" + - any-glob-to-any-file: "tests/providers/m365/lib/mutelist/**" - any-glob-to-any-file: "tests/providers/mongodbatlas/lib/mutelist/**" - - any-glob-to-any-file: "tests/providers/oci/lib/mutelist/**" + - any-glob-to-any-file: "tests/providers/oraclecloud/lib/mutelist/**" - any-glob-to-any-file: "tests/providers/alibabacloud/lib/mutelist/**" + - any-glob-to-any-file: "tests/providers/cloudflare/lib/mutelist/**" integration/s3: - changed-files: diff --git a/docs/introduction.mdx b/docs/introduction.mdx index 928a527a88..6d62c07e5b 100644 --- a/docs/introduction.mdx +++ b/docs/introduction.mdx @@ -32,6 +32,7 @@ The supported providers right now are: | [M365](/user-guide/providers/microsoft365/getting-started-m365) | Official | Tenants | UI, API, CLI | | [Github](/user-guide/providers/github/getting-started-github) | Official | Organizations / Repositories | UI, API, CLI | | [Oracle Cloud](/user-guide/providers/oci/getting-started-oci) | Official | Tenancies / Compartments | UI, API, CLI | +| [Cloudflare](/user-guide/providers/cloudflare/getting-started-cloudflare) | Official | Accounts | CLI | | [Infra as Code](/user-guide/providers/iac/getting-started-iac) | Official | Repositories | UI, API, CLI | | [MongoDB Atlas](/user-guide/providers/mongodbatlas/getting-started-mongodbatlas) | Official | Organizations | UI, API, CLI | | [LLM](/user-guide/providers/llm/getting-started-llm) | Official | Models | CLI | diff --git a/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx b/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx index e32258eda3..77a7a36f04 100644 --- a/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx +++ b/docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx @@ -2,6 +2,10 @@ title: 'Getting Started with Cloudflare' --- +import { VersionBadge } from "/snippets/version-badge.mdx"; + + + Prowler for Cloudflare allows you to scan your Cloudflare zones for security misconfigurations, including SSL/TLS settings, DNSSEC, HSTS, and more. ## Prerequisites diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index dca740ab56..a8c306af67 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -18,6 +18,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - `Cloudflare` provider with critical security checks [(#9423)](https://github.com/prowler-cloud/prowler/pull/9423) - `compute_instance_single_network_interface` check for GCP provider [(#9702)](https://github.com/prowler-cloud/prowler/pull/9702) - `compute_image_not_publicly_shared` check for GCP provider [(#9718)](https://github.com/prowler-cloud/prowler/pull/9718) +- `TLS/SSL`, `records` and `email` checks for `zone` service [(#9424)](https://github.com/prowler-cloud/prowler/pull/9424) - `compute_snapshot_not_outdated` check for GCP provider [(#9774)](https://github.com/prowler-cloud/prowler/pull/9774) - CIS 1.12 compliance framework for Kubernetes [(#9778)](https://github.com/prowler-cloud/prowler/pull/9778) - CIS 6.0 for M365 provider [(#9779)](https://github.com/prowler-cloud/prowler/pull/9779) diff --git a/prowler/providers/cloudflare/cloudflare_provider.py b/prowler/providers/cloudflare/cloudflare_provider.py index 5529d6d02b..0dddcdb8d4 100644 --- a/prowler/providers/cloudflare/cloudflare_provider.py +++ b/prowler/providers/cloudflare/cloudflare_provider.py @@ -35,12 +35,12 @@ class CloudflareProvider(Provider): _audit_config: dict _fixer_config: dict _mutelist: CloudflareMutelist - _filter_zone: set[str] | None + _filter_zones: set[str] | None audit_metadata: Audit_Metadata def __init__( self, - filter_zone: Iterable[str] | None = None, + filter_zones: Iterable[str] | None = None, config_path: str = None, config_content: dict | None = None, fixer_config: dict = {}, @@ -72,7 +72,7 @@ class CloudflareProvider(Provider): self._mutelist = CloudflareMutelist(mutelist_path=mutelist_path) # Store zone filter for filtering resources across services - self._filter_zone = set(filter_zone) if filter_zone else None + self._filter_zones = set(filter_zones) if filter_zones else None Provider.set_global_provider(self) @@ -101,9 +101,9 @@ class CloudflareProvider(Provider): return self._mutelist @property - def filter_zone(self) -> set[str] | None: + def filter_zones(self) -> set[str] | None: """Zone filter from --region argument to filter resources.""" - return self._filter_zone + return self._filter_zones @property def accounts(self) -> list[CloudflareAccount]: diff --git a/prowler/providers/cloudflare/services/dns/__init__.py b/prowler/providers/cloudflare/services/dns/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/dns/dns_client.py b/prowler/providers/cloudflare/services/dns/dns_client.py new file mode 100644 index 0000000000..70062519db --- /dev/null +++ b/prowler/providers/cloudflare/services/dns/dns_client.py @@ -0,0 +1,4 @@ +from prowler.providers.cloudflare.services.dns.dns_service import DNS +from prowler.providers.common.provider import Provider + +dns_client = DNS(Provider.get_global_provider()) diff --git a/prowler/providers/cloudflare/services/dns/dns_service.py b/prowler/providers/cloudflare/services/dns/dns_service.py new file mode 100644 index 0000000000..309ee31366 --- /dev/null +++ b/prowler/providers/cloudflare/services/dns/dns_service.py @@ -0,0 +1,64 @@ +from typing import Optional + +from pydantic import BaseModel + +from prowler.lib.logger import logger +from prowler.providers.cloudflare.lib.service.service import CloudflareService +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class DNS(CloudflareService): + """Retrieve Cloudflare DNS records for all zones.""" + + def __init__(self, provider): + super().__init__(__class__.__name__, provider) + self.records: list["CloudflareDNSRecord"] = [] + self._list_dns_records() + + def _list_dns_records(self) -> None: + """List DNS records for all zones.""" + logger.info("DNS - Listing DNS records...") + try: + for zone in zone_client.zones.values(): + seen_record_ids: set[str] = set() + try: + for record in self.client.dns.records.list(zone_id=zone.id): + record_id = getattr(record, "id", None) + # Prevent infinite loop + if record_id in seen_record_ids: + break + seen_record_ids.add(record_id) + + self.records.append( + CloudflareDNSRecord( + id=record_id, + zone_id=zone.id, + zone_name=zone.name, + name=getattr(record, "name", None), + type=getattr(record, "type", None), + content=getattr(record, "content", ""), + ttl=getattr(record, "ttl", None), + proxied=getattr(record, "proxied", False), + ) + ) + except Exception as error: + logger.error( + f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + + +class CloudflareDNSRecord(BaseModel): + """Cloudflare DNS record representation.""" + + id: str + zone_id: str + zone_name: str + name: Optional[str] = None + type: Optional[str] = None + content: str = "" + ttl: Optional[int] = None + proxied: bool = False diff --git a/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/__init__.py b/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.metadata.json new file mode 100644 index 0000000000..2625a2f6e1 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_automatic_https_rewrites_enabled", + "CheckTitle": "Automatic HTTPS Rewrites is enabled", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **Automatic HTTPS Rewrites** configuration by checking if it is enabled to automatically rewrite insecure HTTP links to HTTPS, resolving **mixed content issues** and enhancing site security.", + "Risk": "Without **Automatic HTTPS Rewrites**, pages may contain mixed content where HTTP resources load over HTTPS pages.\n- **Confidentiality**: insecure resources can be intercepted and modified by attackers\n- **Integrity**: browsers block or warn about mixed content, indicating potential tampering\n- **User Experience**: security warnings degrade trust and some browsers block mixed content entirely", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/automatic-https-rewrites/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to Automatic HTTPS Rewrites\n4. Toggle the setting to On\n5. Verify that your site loads correctly without mixed content warnings", + "Terraform": "```hcl\n# Enable Automatic HTTPS Rewrites to fix mixed content\nresource \"cloudflare_zone_settings_override\" \"https_rewrites\" {\n zone_id = \"\"\n settings {\n automatic_https_rewrites = \"on\" # Critical: automatically rewrites HTTP URLs to HTTPS\n }\n}\n```" + }, + "Recommendation": { + "Text": "Enable **Automatic HTTPS Rewrites** as part of a comprehensive HTTPS strategy.\n- Automatically fixes mixed content by rewriting HTTP URLs to HTTPS\n- Combine with **Always Use HTTPS** and **HSTS** for defense in depth\n- Works best when all resources are available over HTTPS\n- Monitor for resources that cannot be rewritten and fix them at the source", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_automatic_https_rewrites_enabled" + } + }, + "Categories": [ + "encryption" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "This feature works best when combined with Always Use HTTPS to ensure the entire site is served over HTTPS. Some resources may not be rewritable if they don't support HTTPS." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.py b/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.py new file mode 100644 index 0000000000..6dc491062f --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled.py @@ -0,0 +1,45 @@ +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_automatic_https_rewrites_enabled(Check): + """Ensure that Automatic HTTPS Rewrites is enabled for Cloudflare zones. + + Automatic HTTPS Rewrites automatically rewrites insecure HTTP links to HTTPS, + resolving mixed content issues and enhancing site security. This feature scans + HTML responses and rewrites HTTP URLs to HTTPS for resources that are known to + be available over a secure connection, preventing mixed content warnings. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the Automatic HTTPS Rewrites enabled check. + + Iterates through all Cloudflare zones and verifies that Automatic HTTPS + Rewrites is enabled. This setting automatically fixes mixed content issues + by rewriting HTTP links to HTTPS where possible. + + Returns: + A list of CheckReportCloudflare objects with PASS status if Automatic + HTTPS Rewrites is enabled, or FAIL status if it is disabled for the zone. + """ + findings = [] + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + automatic_https_rewrites = ( + zone.settings.automatic_https_rewrites or "" + ).lower() + if automatic_https_rewrites == "on": + report.status = "PASS" + report.status_extended = ( + f"Automatic HTTPS Rewrites is enabled for zone {zone.name}." + ) + else: + report.status = "FAIL" + report.status_extended = ( + f"Automatic HTTPS Rewrites is not enabled for zone {zone.name}." + ) + findings.append(report) + return findings diff --git a/prowler/providers/cloudflare/services/zone/zone_dnssec_enabled/zone_dnssec_enabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_dnssec_enabled/zone_dnssec_enabled.metadata.json index ad37033033..a72f7a6fd7 100644 --- a/prowler/providers/cloudflare/services/zone/zone_dnssec_enabled/zone_dnssec_enabled.metadata.json +++ b/prowler/providers/cloudflare/services/zone/zone_dnssec_enabled/zone_dnssec_enabled.metadata.json @@ -8,6 +8,7 @@ "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Zone", + "ResourceGroup": "network", "Description": "**Cloudflare zones** are assessed for **DNSSEC** configuration by checking if it is enabled to **cryptographically sign DNS responses** and protect against DNS spoofing and cache poisoning attacks.", "Risk": "Without **DNSSEC**, DNS responses can be spoofed or modified by attackers.\n- **Confidentiality**: users can be redirected to malicious sites that harvest credentials\n- **Integrity**: DNS hijacking enables man-in-the-middle attacks and content modification\n- **Availability**: cache poisoning can cause denial of service by directing traffic to non-existent servers", "RelatedUrl": "", diff --git a/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/__init__.py b/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.metadata.json new file mode 100644 index 0000000000..be8b51f627 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_email_obfuscation_enabled", + "CheckTitle": "Email Obfuscation is enabled", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "low", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **Email Obfuscation** (Scrape Shield) configuration by checking if it is enabled to protect email addresses on the website from **automated harvesting** by bots and spammers.", + "Risk": "Without **Email Obfuscation**, email addresses displayed on your website can be harvested by bots.\n- **Confidentiality**: harvested emails become targets for spam and phishing campaigns\n- **Integrity**: employees may fall victim to targeted social engineering attacks\n- **Availability**: increased spam volume can overwhelm email systems", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/waf/tools/scrape-shield/email-address-obfuscation/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to Scrape Shield (or Security > Settings in newer UI)\n3. Scroll to Email Address Obfuscation\n4. Toggle the setting to On\n5. Verify that email addresses still work correctly for human visitors", + "Terraform": "```hcl\n# Enable Email Obfuscation to protect against email harvesting\nresource \"cloudflare_zone_settings_override\" \"email_obfuscation\" {\n zone_id = \"\"\n settings {\n email_obfuscation = \"on\" # Critical: hides email addresses from automated scrapers\n }\n}\n```" + }, + "Recommendation": { + "Text": "Enable **Email Obfuscation** as part of anti-scraping protections.\n- Automatically encodes email addresses to prevent bot harvesting\n- Email addresses remain visible and clickable for human visitors\n- Works with mailto: links and plain text email addresses\n- Part of the Scrape Shield feature set for comprehensive protection", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_email_obfuscation_enabled" + } + }, + "Categories": [ + "internet-exposed" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "Email Obfuscation automatically hides email addresses from bots while keeping them visible and clickable for human visitors. May not work with JavaScript-rendered email addresses." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.py b/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.py new file mode 100644 index 0000000000..4009378c82 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled.py @@ -0,0 +1,43 @@ +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_email_obfuscation_enabled(Check): + """Ensure that Email Obfuscation is enabled for Cloudflare zones. + + Email Obfuscation is part of Cloudflare's Scrape Shield suite that protects + email addresses displayed on websites from automated harvesting by bots and + spammers. It encrypts email addresses in the HTML source while keeping them + visible to human visitors, reducing spam and protecting user privacy. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the Email Obfuscation enabled check. + + Iterates through all Cloudflare zones and verifies that Email Obfuscation + is enabled. This feature helps prevent email harvesting by obfuscating + email addresses in the page source. + + Returns: + A list of CheckReportCloudflare objects with PASS status if Email + Obfuscation is enabled, or FAIL status if it is disabled for the zone. + """ + findings = [] + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + email_obfuscation = (zone.settings.email_obfuscation or "").lower() + if email_obfuscation == "on": + report.status = "PASS" + report.status_extended = ( + f"Email Obfuscation is enabled for zone {zone.name}." + ) + else: + report.status = "FAIL" + report.status_extended = ( + f"Email Obfuscation is not enabled for zone {zone.name}." + ) + findings.append(report) + return findings diff --git a/prowler/providers/cloudflare/services/zone/zone_hsts_enabled/zone_hsts_enabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_hsts_enabled/zone_hsts_enabled.metadata.json index 87db1522be..16888fb30b 100644 --- a/prowler/providers/cloudflare/services/zone/zone_hsts_enabled/zone_hsts_enabled.metadata.json +++ b/prowler/providers/cloudflare/services/zone/zone_hsts_enabled/zone_hsts_enabled.metadata.json @@ -8,6 +8,7 @@ "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Zone", + "ResourceGroup": "network", "Description": "**Cloudflare zones** are assessed for **HTTP Strict Transport Security (HSTS)** by checking if it is enabled with a `max-age` of at least **6 months** (15768000 seconds) and **includes subdomains** to instruct browsers to always use HTTPS across the entire domain.", "Risk": "Without **HSTS**, browsers may initially connect over HTTP before redirecting to HTTPS.\n- **Confidentiality**: creates a window for SSL stripping attacks where attackers downgrade connections to unencrypted HTTP\n- **Integrity**: first request can be intercepted and modified before HTTPS redirect\n- **Session hijacking**: cookies and credentials may be captured during initial HTTP request", "RelatedUrl": "", diff --git a/prowler/providers/cloudflare/services/zone/zone_https_redirect_enabled/zone_https_redirect_enabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_https_redirect_enabled/zone_https_redirect_enabled.metadata.json index aa78dc6fa7..c529a98d6a 100644 --- a/prowler/providers/cloudflare/services/zone/zone_https_redirect_enabled/zone_https_redirect_enabled.metadata.json +++ b/prowler/providers/cloudflare/services/zone/zone_https_redirect_enabled/zone_https_redirect_enabled.metadata.json @@ -8,12 +8,12 @@ "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Zone", + "ResourceGroup": "network", "Description": "**Cloudflare zones** are assessed for **Always Use HTTPS** setting by checking if it is enabled to automatically redirect all **HTTP requests to HTTPS**, enforcing encrypted transport for all visitors.", "Risk": "Without **automatic HTTPS redirects**, users may access resources over unencrypted HTTP.\n- **Confidentiality**: traffic can be intercepted and read by attackers on the network path\n- **Integrity**: HTTP responses can be modified in transit (content injection, malware insertion)\n- **Authentication**: session cookies and credentials may be transmitted in plaintext", "RelatedUrl": "", "AdditionalURLs": [ - "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/", - "https://developers.cloudflare.com/terraform/tutorial/configure-https-settings/" + "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/" ], "Remediation": { "Code": { diff --git a/prowler/providers/cloudflare/services/zone/zone_min_tls_version_secure/zone_min_tls_version_secure.metadata.json b/prowler/providers/cloudflare/services/zone/zone_min_tls_version_secure/zone_min_tls_version_secure.metadata.json index 93c9bf3d5d..af89341222 100644 --- a/prowler/providers/cloudflare/services/zone/zone_min_tls_version_secure/zone_min_tls_version_secure.metadata.json +++ b/prowler/providers/cloudflare/services/zone/zone_min_tls_version_secure/zone_min_tls_version_secure.metadata.json @@ -8,6 +8,7 @@ "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Zone", + "ResourceGroup": "network", "Description": "**Cloudflare zones** are assessed for **minimum TLS version** configuration by checking if the version is set to at least `TLS 1.2` to ensure connections use **secure, modern cryptographic protocols**.", "Risk": "Allowing **legacy TLS versions** (1.0, 1.1) exposes connections to known protocol vulnerabilities.\n- **Confidentiality**: BEAST, POODLE, and weak cipher suites can be exploited for traffic decryption\n- **Compliance**: TLS 1.0/1.1 are deprecated by PCI-DSS, NIST, and major browsers\n- **Integrity**: downgrade attacks can force weaker encryption that is susceptible to tampering", "RelatedUrl": "", diff --git a/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/__init__.py b/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.metadata.json b/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.metadata.json new file mode 100644 index 0000000000..07e9181831 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_record_caa_exists", + "CheckTitle": "CAA record exists with issue or issuewild tag", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "low", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **CAA (Certificate Authority Authorization)** DNS records by checking if they exist with **`issue` or `issuewild` tags** that specify which **certificate authorities** are permitted to issue SSL/TLS certificates for the domain.", + "Risk": "Without **CAA** records or without `issue`/`issuewild` tags, any certificate authority can issue certificates for your domain.\n- **Confidentiality**: unauthorized certificates enable man-in-the-middle attacks\n- **Integrity**: attackers can impersonate your domain with fraudulently obtained certificates\n- **Trust**: CA compromise or social engineering can result in unauthorized certificate issuance\n- **Missing tags**: CAA records without `issue` or `issuewild` tags (e.g., only `iodef`) do not restrict certificate issuance", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/ssl/edge-certificates/caa-records/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. Click Add record\n4. Select CAA as the record type\n5. Enter @ for the Name field\n6. Set flags to 0, tag to issue, and value to your authorized CA (e.g., letsencrypt.org)\n7. Click Save\n8. Optionally add issuewild records to control wildcard certificate issuance", + "Terraform": "```hcl\n# Create CAA record to restrict certificate issuance\nresource \"cloudflare_record\" \"caa_issue\" {\n zone_id = \"\"\n name = \"@\"\n type = \"CAA\"\n data {\n flags = \"0\"\n tag = \"issue\" # Restricts which CAs can issue regular certificates\n value = \"letsencrypt.org\" # Specify your authorized certificate authority\n }\n}\n\n# Create CAA record to restrict wildcard certificate issuance\nresource \"cloudflare_record\" \"caa_issuewild\" {\n zone_id = \"\"\n name = \"@\"\n type = \"CAA\"\n data {\n flags = \"0\"\n tag = \"issuewild\" # Restricts which CAs can issue wildcard certificates\n value = \"letsencrypt.org\"\n }\n}\n```" + }, + "Recommendation": { + "Text": "Add **CAA records** with `issue` or `issuewild` tags specifying authorized certificate authorities.\n- `issue` tag: authorizes CAs for regular (non-wildcard) certificates\n- `issuewild` tag: authorizes CAs for wildcard certificates specifically\n- Use `issue \";\"` to block all certificate issuance (for domains that should never have certificates)\n- Use `iodef` tag to receive reports of policy violations (optional, for monitoring)\n- All CAs are required to check CAA records before issuing certificates", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_record_caa_exists" + } + }, + "Categories": [ + "encryption" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "CAA records help prevent unauthorized SSL/TLS certificate issuance. This check verifies both existence and that the record contains issue or issuewild tags. Records with only iodef tag will fail this check." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.py b/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.py new file mode 100644 index 0000000000..2f9275cb91 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.py @@ -0,0 +1,82 @@ +import re + +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.dns.dns_client import dns_client +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_record_caa_exists(Check): + """Ensure that CAA record exists with certificate issuance restrictions. + + CAA (Certificate Authority Authorization) is a DNS record type that allows + domain owners to specify which certificate authorities (CAs) are permitted + to issue SSL/TLS certificates for their domain. This check verifies that CAA + records exist with "issue" or "issuewild" tags that explicitly authorize + specific CAs, preventing unauthorized certificate issuance and reducing the + risk of man-in-the-middle attacks from fraudulent certificates. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the CAA record exists check. + + Iterates through all Cloudflare zones and verifies CAA configuration. + The check validates two conditions: + 1. CAA records exist for the zone + 2. At least one record has an "issue" or "issuewild" tag specifying authorized CAs + + Returns: + A list of CheckReportCloudflare objects with PASS status if CAA + records with issuance restrictions exist, or FAIL status if no CAA + records are found or they lack proper issue/issuewild tags. + """ + findings = [] + + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + + # CAA records restrict which CAs can issue certificates + caa_records = [ + record + for record in dns_client.records + if record.zone_id == zone.id and record.type == "CAA" + ] + + if not caa_records: + report.status = "FAIL" + report.status_extended = f"No CAA record found for zone {zone.name}." + else: + # Check if CAA records have issue or issuewild tags with CA specified + issue_records = [ + record + for record in caa_records + if self._has_issue_tag_with_ca(record.content) + ] + + records_str = ", ".join(record.name for record in caa_records) + + if issue_records: + report.status = "PASS" + report.status_extended = f"CAA record with certificate issuance restrictions exists for zone {zone.name}: {records_str}." + else: + report.status = "FAIL" + report.status_extended = f"CAA record exists for zone {zone.name} but does not specify authorized CAs with issue or issuewild tags: {records_str}." + + findings.append(report) + + return findings + + def _has_issue_tag_with_ca(self, content: str) -> bool: + """Check if CAA record has issue or issuewild tag with a CA specified. + + CAA content format: "flags tag value" e.g., "0 issue letsencrypt.org" + """ + # Strip quotes that may be present from Cloudflare API + content_lower = content.strip('"').lower() + # Match issue or issuewild tag followed by a value (CA name or ";" to block all) + # Format: "0 issue letsencrypt.org" or "0 issuewild ;" or "0 issue \"digicert.com\"" + issue_match = re.search(r"\bissue\b", content_lower) + issuewild_match = re.search(r"\bissuewild\b", content_lower) + return bool(issue_match or issuewild_match) diff --git a/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/__init__.py b/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.metadata.json b/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.metadata.json new file mode 100644 index 0000000000..a8811febbf --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_record_dkim_exists", + "CheckTitle": "DKIM record exists with valid public key", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **DKIM (DomainKeys Identified Mail)** records by checking if TXT records exist at `*._domainkey` subdomains containing a **cryptographically valid public key** in the `p=` parameter used to **verify email signatures**.", + "Risk": "Without **DKIM** or with a revoked/empty public key, email recipients cannot verify that messages were sent by authorized servers.\n- **Confidentiality**: attackers can forge emails appearing to come from your domain\n- **Integrity**: no cryptographic proof that email content hasn't been modified in transit\n- **Reputation**: DMARC policies relying on DKIM will fail, affecting email deliverability\n- **Revoked keys**: A DKIM record with `p=` empty (e.g., `p=;`) indicates a revoked key that cannot authenticate emails", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Generate DKIM keys using your email provider or mail server\n2. Log in to the Cloudflare dashboard and select your account and domain\n3. Go to DNS > Records\n4. Click Add record\n5. Select TXT as the record type\n6. Enter selector._domainkey for the Name field (e.g., google._domainkey)\n7. Enter the DKIM public key record provided by your email service (must include p= with actual key)\n8. Click Save", + "Terraform": "```hcl\n# Create DKIM record for email authentication\nresource \"cloudflare_record\" \"dkim\" {\n zone_id = \"\"\n name = \"google._domainkey\" # Selector varies by email provider\n type = \"TXT\"\n content = \"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4...\" # Must contain valid public key\n ttl = 3600\n}\n```" + }, + "Recommendation": { + "Text": "Configure **DKIM records** with valid public keys from your email provider.\n- Each email service requires its own DKIM selector (e.g., google._domainkey for Google Workspace)\n- The `p=` parameter must contain the actual public key, not be empty\n- An empty `p=` value indicates a revoked key and will fail this check\n- DKIM works alongside SPF and DMARC for comprehensive email authentication\n- Rotate DKIM keys periodically for enhanced security\n- Use 2048-bit keys for stronger cryptographic protection", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_record_dkim_exists" + } + }, + "Categories": [ + "email-security" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "DKIM records are TXT records at *._domainkey subdomains starting with 'v=DKIM1'. This check uses cryptographic validation to verify that the p= parameter contains a real DER-encoded public key, not just non-empty Base64. Revoked keys, invalid Base64, or malformed keys will fail this check." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.py b/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.py new file mode 100644 index 0000000000..3ecf725d44 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.py @@ -0,0 +1,116 @@ +import base64 +import re + +from cryptography.hazmat.primitives.serialization import load_der_public_key + +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.dns.dns_client import dns_client +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_record_dkim_exists(Check): + """Ensure that DKIM record exists with valid public key for Cloudflare zones. + + DKIM (DomainKeys Identified Mail) is an email authentication method that allows + the receiver to verify that an email was sent by the domain owner and was not + modified in transit. This check verifies that DKIM records exist at *._domainkey + subdomains containing "v=DKIM1" with a cryptographically valid public key in the + p= parameter that can be used to verify email signatures. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the DKIM record exists check. + + Iterates through all Cloudflare zones and verifies DKIM configuration. + The check validates three conditions: + 1. A DKIM record exists (TXT record at *._domainkey with "v=DKIM1") + 2. The record contains a p= parameter with a public key + 3. The public key is cryptographically valid (valid Base64 and DER format) + + Returns: + A list of CheckReportCloudflare objects with PASS status if a DKIM + record with valid public key exists, or FAIL status if no DKIM record + is found or the public key is invalid/missing. + """ + findings = [] + + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + + # DKIM records are TXT records at *._domainkey subdomain containing "v=DKIM1" + dkim_records = [ + record + for record in dns_client.records + if record.zone_id == zone.id + and record.type == "TXT" + and record.name + and "_domainkey" in record.name + and "V=DKIM1" + in record.content.replace('" "', "").replace('"', "").upper() + ] + + if not dkim_records: + report.status = "FAIL" + report.status_extended = f"No DKIM record found for zone {zone.name}." + else: + # Check if DKIM records have a valid public key + valid_key_records = [ + record + for record in dkim_records + if self._has_valid_public_key(record.content) + ] + + records_str = ", ".join(record.name for record in dkim_records) + + if valid_key_records: + report.status = "PASS" + report.status_extended = f"DKIM record with valid public key exists for zone {zone.name}: {records_str}." + else: + report.status = "FAIL" + report.status_extended = f"DKIM record exists for zone {zone.name} but has invalid or missing public key: {records_str}." + + findings.append(report) + + return findings + + def _has_valid_public_key(self, content: str) -> bool: + """Check if DKIM record has a valid public key. + + Validates that: + 1. The p= parameter exists and is not empty + 2. The key is valid Base64 + 3. The key can be loaded as a valid DER-encoded public key + """ + # Cloudflare API may return TXT records with quotes, and long records + # may be split into multiple quoted strings like: "part1" "part2" + # First remove '" "' to join split parts, then remove remaining quotes + content = content.replace('" "', "").replace('"', "") + + # Extract the public key value from p= parameter + match = re.search(r"p\s*=\s*([^;\s]*)", content, re.IGNORECASE) + if not match: + return False + + key_value = match.group(1) + + # Empty key means revoked + if not key_value: + return False + + try: + # Add padding if necessary for Base64 decoding + padding = 4 - (len(key_value) % 4) + if padding != 4: + key_value += "=" * padding + + # Decode Base64 to get DER-encoded key + der_key = base64.b64decode(key_value, validate=True) + + # Try to load as a public key using cryptography library + load_der_public_key(der_key) + return True + except Exception: + return False diff --git a/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/__init__.py b/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.metadata.json b/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.metadata.json new file mode 100644 index 0000000000..2aa572da36 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_record_dmarc_exists", + "CheckTitle": "DMARC record exists with enforcement policy (p=reject or p=quarantine)", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **DMARC (Domain-based Message Authentication, Reporting, and Conformance)** records by checking if a TXT record exists at `_dmarc` subdomain with an **enforcement policy (`p=reject` or `p=quarantine`)** to actively block or quarantine spoofed emails.", + "Risk": "Without **DMARC** or with a monitoring-only policy (`p=none`), there is no active protection against email spoofing.\n- **Confidentiality**: attackers can spoof emails for phishing campaigns to steal credentials\n- **Integrity**: no visibility into email authentication failures or abuse attempts\n- **Reputation**: domain reputation damage from spoofed emails sent in your name\n- **Monitoring-only policy**: `p=none` only generates reports but does not block or quarantine spoofed emails, providing no real protection", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. Click Add record\n4. Select TXT as the record type\n5. Enter _dmarc for the Name field\n6. Enter your DMARC policy with enforcement (e.g., v=DMARC1; p=reject; rua=mailto:dmarc@example.com)\n7. Click Save", + "Terraform": "```hcl\n# Create DMARC record with enforcement policy\nresource \"cloudflare_record\" \"dmarc\" {\n zone_id = \"\"\n name = \"_dmarc\"\n type = \"TXT\"\n content = \"v=DMARC1; p=reject; rua=mailto:dmarc@example.com\" # Use p=reject or p=quarantine for enforcement\n ttl = 3600\n}\n```" + }, + "Recommendation": { + "Text": "Implement **DMARC** with an enforcement policy (`p=reject` or `p=quarantine`).\n- `p=reject`: receiving servers should reject emails that fail authentication\n- `p=quarantine`: receiving servers should send suspicious emails to spam folder\n- `p=none`: only monitoring, provides no protection (will fail this check)\n- Ensure SPF and DKIM are properly configured before enabling enforcement\n- Configure `rua` to receive aggregate reports on authentication results\n- Use `pct` parameter to gradually roll out enforcement (e.g., `pct=10` for 10% of emails)", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_record_dmarc_exists" + } + }, + "Categories": [ + "email-security" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "DMARC records are TXT records at _dmarc subdomain starting with 'v=DMARC1'. This check verifies both existence and enforcement policy (p=reject or p=quarantine). Monitoring-only policy (p=none) will fail this check." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.py b/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.py new file mode 100644 index 0000000000..bf894a2bf1 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.py @@ -0,0 +1,88 @@ +import re + +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.dns.dns_client import dns_client +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_record_dmarc_exists(Check): + """Ensure that DMARC record exists with enforcement policy for Cloudflare zones. + + DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an + email authentication protocol that builds on SPF and DKIM. It allows domain + owners to specify how receiving mail servers should handle emails that fail + authentication checks. This check verifies that a DMARC record exists at the + _dmarc subdomain with an enforcement policy (p=reject or p=quarantine) to + actively block or quarantine spoofed emails, not just monitor them (p=none). + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the DMARC record exists check. + + Iterates through all Cloudflare zones and verifies DMARC configuration. + The check validates two conditions: + 1. A DMARC record exists (TXT record at _dmarc subdomain with "v=DMARC1") + 2. The record uses an enforcement policy (p=reject or p=quarantine) + + Returns: + A list of CheckReportCloudflare objects with PASS status if a DMARC + record with enforcement policy exists, or FAIL status if no DMARC + record is found or it uses monitoring-only policy (p=none). + """ + findings = [] + + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + + # DMARC records are TXT records at _dmarc subdomain starting with "v=DMARC1" + dmarc_records = [ + record + for record in dns_client.records + if record.zone_id == zone.id + and record.type == "TXT" + and record.name + and record.name.startswith("_dmarc") + and "V=DMARC1" in record.content.strip('"').upper() + ] + + if not dmarc_records: + report.status = "FAIL" + report.status_extended = f"No DMARC record found for zone {zone.name}." + else: + # Check if DMARC uses enforcement policy (p=reject or p=quarantine) vs monitoring (p=none) + enforcement_records = [ + record + for record in dmarc_records + if self._get_policy_value(record.content) + in ("reject", "quarantine") + ] + + records_str = ", ".join(record.name for record in dmarc_records) + + if enforcement_records: + # Get the actual policy value from the first enforcement record + policy = self._get_policy_value(enforcement_records[0].content) + report.status = "PASS" + report.status_extended = f"DMARC record with enforcement policy p={policy} exists for zone {zone.name}: {records_str}." + else: + # Get the actual policy value to show in the message + policy = self._get_policy_value(dmarc_records[0].content) or "none" + report.status = "FAIL" + report.status_extended = f"DMARC record exists for zone {zone.name} but uses monitoring-only policy p={policy}: {records_str}." + + findings.append(report) + + return findings + + def _get_policy_value(self, content: str) -> str | None: + """Extract the DMARC policy value (reject, quarantine, or none).""" + # Strip quotes that may be present from Cloudflare API + content_clean = content.strip('"') + # Match p= (with optional spaces around =) + match = re.search(r"p\s*=\s*(\w+)", content_clean, re.IGNORECASE) + if match: + return match.group(1).lower() + return None diff --git a/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/__init__.py b/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.metadata.json b/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.metadata.json new file mode 100644 index 0000000000..07e2d4ee5f --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_record_spf_exists", + "CheckTitle": "SPF record exists with strict policy (-all)", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **SPF (Sender Policy Framework)** records by checking if a TXT record exists that specifies which mail servers are **authorized to send email** on behalf of the domain, and verifies that the record uses a **strict policy (`-all`)** to reject unauthorized senders.", + "Risk": "Without **SPF** or with a permissive policy (`~all`, `?all`, `+all`), attackers can forge emails appearing to come from your domain.\n- **Confidentiality**: phishing attacks can harvest sensitive information from recipients who trust spoofed emails\n- **Integrity**: brand reputation damage from fraudulent emails sent in your name\n- **Availability**: email deliverability issues as receiving servers may reject or quarantine legitimate emails\n- **Permissive policies**: `~all` (softfail) only marks emails as suspicious but does not reject them, `?all` (neutral) provides no protection", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. Click Add record\n4. Select TXT as the record type\n5. Enter @ for the Name field\n6. Enter your SPF record with strict policy (e.g., v=spf1 include:_spf.google.com -all)\n7. Click Save", + "Terraform": "```hcl\n# Create SPF record for email authentication with strict policy\nresource \"cloudflare_record\" \"spf\" {\n zone_id = \"\"\n name = \"@\"\n type = \"TXT\"\n content = \"v=spf1 include:_spf.google.com -all\" # Use -all for strict enforcement\n ttl = 3600\n}\n```" + }, + "Recommendation": { + "Text": "Configure **SPF records** with strict policy (`-all`) listing authorized mail servers.\n- SPF records start with `v=spf1` and define authorized senders\n- Use `-all` (hardfail) to reject emails from unauthorized servers\n- Avoid `~all` (softfail) in production as it only marks suspicious emails but does not reject them\n- Use `include:` to authorize third-party mail services\n- Combine with **DKIM** and **DMARC** for comprehensive email authentication\n- Test SPF records using online validators before deployment", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_record_spf_exists" + } + }, + "Categories": [ + "email-security" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "SPF records start with 'v=spf1' and define authorized mail servers. This check verifies both existence and strict policy (-all). Permissive policies like ~all (softfail) or ?all (neutral) will fail this check." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.py b/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.py new file mode 100644 index 0000000000..861a0c82ab --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.py @@ -0,0 +1,68 @@ +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.dns.dns_client import dns_client +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_record_spf_exists(Check): + """Ensure that SPF record exists with strict policy for Cloudflare zones. + + SPF (Sender Policy Framework) is an email authentication method that specifies + which mail servers are authorized to send email on behalf of the domain. This + check verifies that an SPF record exists as a TXT record starting with "v=spf1" + and uses the strict policy qualifier "-all" to instruct receiving servers to + reject emails from unauthorized sources. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the SPF record exists check. + + Iterates through all Cloudflare zones and verifies SPF configuration. + The check validates two conditions: + 1. An SPF record exists (TXT record starting with "v=spf1") + 2. The record uses strict policy "-all" (not ~all, ?all, or +all) + + Returns: + A list of CheckReportCloudflare objects with PASS status if an SPF + record with strict policy exists, or FAIL status if no SPF record + is found or it uses a permissive policy. + """ + findings = [] + + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + + # SPF records are TXT records starting with "v=spf1" + spf_records = [ + record + for record in dns_client.records + if record.zone_id == zone.id + and record.type == "TXT" + and record.content.strip('"').startswith("v=spf1") + ] + + if not spf_records: + report.status = "FAIL" + report.status_extended = f"No SPF record found for zone {zone.name}." + else: + # Check if SPF uses strict policy (-all) vs permissive (~all, ?all, +all) + strict_records = [ + record + for record in spf_records + if record.content.strip('"').rstrip().endswith("-all") + ] + + records_str = ", ".join(record.name for record in spf_records) + + if strict_records: + report.status = "PASS" + report.status_extended = f"SPF record with strict policy -all exists for zone {zone.name}: {records_str}." + else: + report.status = "FAIL" + report.status_extended = f"SPF record exists for zone {zone.name} but does not use strict policy -all: {records_str}." + + findings.append(report) + + return findings diff --git a/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/__init__.py b/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.metadata.json new file mode 100644 index 0000000000..405b88180f --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.metadata.json @@ -0,0 +1,37 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_security_under_attack_disabled", + "CheckTitle": "Under Attack Mode is disabled during normal operations", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "low", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **Under Attack Mode** configuration by checking if it is disabled during normal operations, as this mode performs additional security checks including an **interstitial JavaScript challenge page** that significantly impacts user experience.", + "Risk": "Keeping **Under Attack Mode** permanently enabled causes operational issues.\n- **Availability**: all visitors face a 5-second interstitial challenge page before accessing the site\n- **Accessibility**: visitors without JavaScript support cannot access the site at all\n- **User Experience**: legitimate users experience unnecessary delays and third-party analytics show degraded performance", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/", + "https://developers.cloudflare.com/waf/tools/security-level/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to Security > Settings\n3. Under 'Under Attack Mode', toggle it OFF\n4. Consider setting Security Level to 'High' for continued protection without the interstitial", + "Terraform": "```hcl\n# Set security level to high instead of under_attack\nresource \"cloudflare_zone_settings_override\" \"security_settings\" {\n zone_id = \"\"\n settings {\n security_level = \"high\" # Use high instead of under_attack for normal operations\n }\n}\n```" + }, + "Recommendation": { + "Text": "Disable **Under Attack Mode** when not actively under a DDoS attack.\n- Use it only as a **last resort** during active layer 7 DDoS attacks\n- For ongoing protection, use **Security Level** settings (Low, Medium, High)\n- Configure specific **WAF rules** for targeted protection without impacting all users", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_security_under_attack_disabled" + } + }, + "Categories": [ + "internet-exposed" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "Under Attack Mode is designed as a temporary measure during active attacks. The interstitial challenge page validates visitors using JavaScript, blocking automated attacks while allowing legitimate users through after a brief delay." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.py b/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.py new file mode 100644 index 0000000000..e0dbf9b455 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled.py @@ -0,0 +1,47 @@ +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_security_under_attack_disabled(Check): + """Ensure that Under Attack Mode is disabled during normal operations. + + Under Attack Mode is a DDoS mitigation feature that performs additional + security checks including an interstitial JavaScript challenge page for all + visitors. While effective during active attacks, it significantly impacts + user experience and should only be enabled temporarily during actual DDoS + incidents, not as a permanent security measure. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the Under Attack Mode disabled check. + + Iterates through all Cloudflare zones and verifies that the security + level is not set to "under_attack". Having this mode permanently enabled + indicates either an ongoing attack or misconfiguration that degrades + user experience unnecessarily. + + Returns: + A list of CheckReportCloudflare objects with PASS status if Under + Attack Mode is disabled, or FAIL status if it is currently enabled. + """ + findings = [] + + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + security_level = (zone.settings.security_level or "").lower() + + if security_level == "under_attack": + report.status = "FAIL" + report.status_extended = ( + f"Zone {zone.name} has Under Attack Mode enabled." + ) + else: + report.status = "PASS" + report.status_extended = ( + f"Zone {zone.name} does not have Under Attack Mode enabled." + ) + findings.append(report) + return findings diff --git a/prowler/providers/cloudflare/services/zone/zone_service.py b/prowler/providers/cloudflare/services/zone/zone_service.py index 8b274fcc92..ce93664b23 100644 --- a/prowler/providers/cloudflare/services/zone/zone_service.py +++ b/prowler/providers/cloudflare/services/zone/zone_service.py @@ -16,12 +16,13 @@ class Zone(CloudflareService): self._list_zones() self._get_zones_settings() self._get_zones_dnssec() + self._get_zones_universal_ssl() def _list_zones(self) -> None: """List all Cloudflare zones with their basic information.""" logger.info("Zone - Listing zones...") audited_accounts = self.provider.identity.audited_accounts - filter_zone = self.provider.filter_zone + filter_zones = self.provider.filter_zones seen_zone_ids: set[str] = set() try: @@ -43,9 +44,9 @@ class Zone(CloudflareService): # Apply zone filter if specified via --region if ( - filter_zone - and zone_id not in filter_zone - and zone_name not in filter_zone + filter_zones + and zone_id not in filter_zones + and zone_name not in filter_zones ): continue @@ -107,6 +108,20 @@ class Zone(CloudflareService): f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + def _get_zones_universal_ssl(self) -> None: + """Get Universal SSL settings for all zones.""" + logger.info("Zones - Getting Universal SSL settings...") + for zone in self.zones.values(): + try: + universal_ssl = self.client.ssl.universal.settings.get(zone_id=zone.id) + zone.settings.universal_ssl_enabled = getattr( + universal_ssl, "enabled", False + ) + except Exception as error: + logger.error( + f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + def _get_zone_setting(self, zone_id: str, setting_id: str): """Get a single zone setting by ID.""" try: @@ -127,7 +142,6 @@ class Zone(CloudflareService): "ssl", "tls_1_3", "automatic_https_rewrites", - "universal_ssl", "security_header", "waf", "security_level", @@ -148,7 +162,6 @@ class Zone(CloudflareService): ssl_encryption_mode=settings.get("ssl"), tls_1_3=settings.get("tls_1_3"), automatic_https_rewrites=settings.get("automatic_https_rewrites"), - universal_ssl=settings.get("universal_ssl"), strict_transport_security=self._get_strict_transport_security( settings.get("security_header") ), @@ -210,7 +223,7 @@ class CloudflareZoneSettings(BaseModel): ssl_encryption_mode: Optional[str] = None tls_1_3: Optional[str] = None automatic_https_rewrites: Optional[str] = None - universal_ssl: Optional[str] = None + universal_ssl_enabled: bool = False # HSTS settings strict_transport_security: StrictTransportSecurity = Field( default_factory=StrictTransportSecurity diff --git a/prowler/providers/cloudflare/services/zone/zone_ssl_strict/zone_ssl_strict.metadata.json b/prowler/providers/cloudflare/services/zone/zone_ssl_strict/zone_ssl_strict.metadata.json index 86cd5c4125..d236895198 100644 --- a/prowler/providers/cloudflare/services/zone/zone_ssl_strict/zone_ssl_strict.metadata.json +++ b/prowler/providers/cloudflare/services/zone/zone_ssl_strict/zone_ssl_strict.metadata.json @@ -8,6 +8,7 @@ "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Zone", + "ResourceGroup": "network", "Description": "**Cloudflare zones** are assessed for **SSL/TLS encryption mode** by checking if the mode is set to `Full (Strict)` to ensure **end-to-end encryption** with certificate validation.", "Risk": "Without **strict SSL mode**, traffic between Cloudflare and origin may use unvalidated or unencrypted connections.\n- **Confidentiality**: sensitive data can be intercepted in transit via man-in-the-middle attacks\n- **Integrity**: responses can be modified without detection between Cloudflare and origin\n- **Compliance**: may violate PCI-DSS, HIPAA, and other regulatory requirements for encrypted transport", "RelatedUrl": "", diff --git a/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/__init__.py b/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.metadata.json new file mode 100644 index 0000000000..5dba1a8de8 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_tls_1_3_enabled", + "CheckTitle": "TLS 1.3 is enabled", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **TLS 1.3** configuration by checking if it is enabled to benefit from **improved security** through simplified cipher suites and **faster handshakes** with zero round-trip time resumption.", + "Risk": "Without **TLS 1.3**, connections use older TLS versions with less secure characteristics.\n- **Confidentiality**: legacy TLS versions have more complex cipher negotiations that may expose weaknesses\n- **Integrity**: older protocols lack protection against downgrade attacks that TLS 1.3 provides\n- **Performance**: slower handshakes impact user experience and increase latency", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to TLS 1.3\n4. Toggle the setting to On\n5. Verify that your clients support TLS 1.3 (all modern browsers do)", + "Terraform": "```hcl\n# Enable TLS 1.3 for improved security and performance\nresource \"cloudflare_zone_settings_override\" \"tls_settings\" {\n zone_id = \"\"\n settings {\n tls_1_3 = \"on\" # Critical: enables most secure TLS version with faster handshakes\n }\n}\n```" + }, + "Recommendation": { + "Text": "Enable **TLS 1.3** to provide the most secure and efficient TLS connections.\n- All modern browsers support TLS 1.3 ensuring broad compatibility\n- TLS 1.3 removes obsolete cryptographic algorithms\n- Zero round-trip time (0-RTT) resumption improves performance\n- Combine with minimum TLS version set to 1.2 or higher", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_tls_1_3_enabled" + } + }, + "Categories": [ + "encryption" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "TLS 1.3 is enabled by default on Cloudflare but should be verified. It provides security improvements and performance benefits through simplified handshakes." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.py b/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.py new file mode 100644 index 0000000000..7f9671b408 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.py @@ -0,0 +1,39 @@ +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_tls_1_3_enabled(Check): + """Ensure that TLS 1.3 is enabled for Cloudflare zones. + + TLS 1.3 provides improved security through simplified cipher suites and + faster handshakes with zero round-trip time (0-RTT) resumption. It removes + outdated cryptographic algorithms, reduces handshake latency, and provides + better forward secrecy compared to previous TLS versions. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the TLS 1.3 enabled check. + + Iterates through all Cloudflare zones and verifies that TLS 1.3 is + enabled. The check accepts both "on" (standard TLS 1.3) and "zrt" + (TLS 1.3 with 0-RTT) as valid enabled states. + + Returns: + A list of CheckReportCloudflare objects with PASS status if TLS 1.3 + is enabled, or FAIL status if it is disabled for the zone. + """ + findings = [] + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + tls_1_3 = (zone.settings.tls_1_3 or "").lower() + if tls_1_3 in ["on", "zrt"]: + report.status = "PASS" + report.status_extended = f"TLS 1.3 is enabled for zone {zone.name}." + else: + report.status = "FAIL" + report.status_extended = f"TLS 1.3 is not enabled for zone {zone.name}." + findings.append(report) + return findings diff --git a/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/__init__.py b/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.metadata.json b/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.metadata.json new file mode 100644 index 0000000000..fde6ef3322 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.metadata.json @@ -0,0 +1,36 @@ +{ + "Provider": "cloudflare", + "CheckID": "zone_universal_ssl_enabled", + "CheckTitle": "Universal SSL is enabled", + "CheckType": [], + "ServiceName": "zone", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Zone", + "ResourceGroup": "network", + "Description": "**Cloudflare zones** are assessed for **Universal SSL** configuration by checking if it is enabled to provide **free SSL/TLS certificates** for the domain and its subdomains, enabling secure HTTPS connections.", + "Risk": "Without **Universal SSL**, visitors cannot establish HTTPS connections to your site.\n- **Confidentiality**: all traffic is unencrypted and vulnerable to interception and eavesdropping\n- **Integrity**: HTTP responses can be modified in transit by attackers (content injection, malware)\n- **Trust**: browsers display security warnings degrading user trust and experience", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/" + ], + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to Universal SSL\n4. Ensure the status shows Active\n5. If disabled, click Enable Universal SSL\n6. Wait for certificate issuance (typically within 24 hours for new domains)", + "Terraform": "```hcl\n# Note: Universal SSL is enabled by default on Cloudflare\n# To explicitly manage SSL settings, use zone_settings_override\nresource \"cloudflare_zone_settings_override\" \"ssl_settings\" {\n zone_id = \"\"\n settings {\n ssl = \"full\" # Critical: enables SSL/TLS encryption\n }\n}\n```" + }, + "Recommendation": { + "Text": "Enable **Universal SSL** to provide HTTPS capability for your domain.\n- Universal SSL is the foundation for transport security\n- Required before implementing HSTS or other HTTPS-dependent features\n- Cloudflare automatically renews certificates before expiration\n- Consider upgrading to Advanced Certificate Manager for additional control", + "Url": "https://hub.prowler.com/checks/cloudflare/zone_universal_ssl_enabled" + } + }, + "Categories": [ + "encryption" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "Universal SSL is enabled by default for all Cloudflare zones. If it was previously disabled, re-enabling may take up to 24 hours for certificate issuance." +} diff --git a/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.py b/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.py new file mode 100644 index 0000000000..30b0c80037 --- /dev/null +++ b/prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.py @@ -0,0 +1,42 @@ +from prowler.lib.check.models import Check, CheckReportCloudflare +from prowler.providers.cloudflare.services.zone.zone_client import zone_client + + +class zone_universal_ssl_enabled(Check): + """Ensure that Universal SSL is enabled for Cloudflare zones. + + Universal SSL provides free SSL/TLS certificates for the domain and its + subdomains, enabling secure HTTPS connections without requiring manual + certificate management. This feature automatically provisions and renews + certificates, ensuring continuous protection for web traffic. + """ + + def execute(self) -> list[CheckReportCloudflare]: + """Execute the Universal SSL enabled check. + + Iterates through all Cloudflare zones and verifies that Universal SSL + is enabled. Universal SSL provides automatic certificate provisioning + and management for the zone and its subdomains. + + Returns: + A list of CheckReportCloudflare objects with PASS status if Universal + SSL is enabled, or FAIL status if it is disabled for the zone. + """ + findings = [] + for zone in zone_client.zones.values(): + report = CheckReportCloudflare( + metadata=self.metadata(), + resource=zone, + ) + if zone.settings.universal_ssl_enabled: + report.status = "PASS" + report.status_extended = ( + f"Universal SSL is enabled for zone {zone.name}." + ) + else: + report.status = "FAIL" + report.status_extended = ( + f"Universal SSL is not enabled for zone {zone.name}." + ) + findings.append(report) + return findings diff --git a/tests/providers/cloudflare/cloudflare_provider_test.py b/tests/providers/cloudflare/cloudflare_provider_test.py index e5591ba36f..57bdade5fb 100644 --- a/tests/providers/cloudflare/cloudflare_provider_test.py +++ b/tests/providers/cloudflare/cloudflare_provider_test.py @@ -169,7 +169,7 @@ class TestCloudflareProvider: with pytest.raises(CloudflareCredentialsError): CloudflareProvider() - def test_cloudflare_provider_with_filter_zone(self): + def test_cloudflare_provider_with_filter_zones(self): with ( patch( "prowler.providers.cloudflare.cloudflare_provider.CloudflareProvider.setup_session", @@ -196,10 +196,10 @@ class TestCloudflareProvider: ), ), ): - filter_zone = ["zone1", "zone2"] - provider = CloudflareProvider(filter_zone=filter_zone) + filter_zones = ["zone1", "zone2"] + provider = CloudflareProvider(filter_zones=filter_zones) - assert provider.filter_zone == set(filter_zone) + assert provider.filter_zones == set(filter_zones) def test_cloudflare_provider_properties(self): with ( diff --git a/tests/providers/cloudflare/services/dns/dns_service_test.py b/tests/providers/cloudflare/services/dns/dns_service_test.py new file mode 100644 index 0000000000..c4e30c5d56 --- /dev/null +++ b/tests/providers/cloudflare/services/dns/dns_service_test.py @@ -0,0 +1,119 @@ +from typing import Optional + +from pydantic import BaseModel + +from tests.providers.cloudflare.cloudflare_fixtures import ZONE_ID, ZONE_NAME + + +class CloudflareDNSRecord(BaseModel): + """Cloudflare DNS record representation for testing.""" + + id: str + zone_id: str + zone_name: str + name: Optional[str] = None + type: Optional[str] = None + content: str = "" + ttl: Optional[int] = None + proxied: bool = False + + +class TestDNSService: + def test_cloudflare_dns_record_model(self): + record = CloudflareDNSRecord( + id="record-123", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name="www.example.com", + type="A", + content="192.0.2.1", + ttl=3600, + proxied=True, + ) + + assert record.id == "record-123" + assert record.zone_id == ZONE_ID + assert record.zone_name == ZONE_NAME + assert record.name == "www.example.com" + assert record.type == "A" + assert record.content == "192.0.2.1" + assert record.ttl == 3600 + assert record.proxied is True + + def test_cloudflare_dns_record_defaults(self): + record = CloudflareDNSRecord( + id="record-123", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + ) + + assert record.id == "record-123" + assert record.zone_id == ZONE_ID + assert record.zone_name == ZONE_NAME + assert record.name is None + assert record.type is None + assert record.content == "" + assert record.ttl is None + assert record.proxied is False + + def test_cloudflare_dns_record_txt(self): + record = CloudflareDNSRecord( + id="record-txt", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="TXT", + content="v=spf1 include:_spf.google.com ~all", + ttl=1, + proxied=False, + ) + + assert record.type == "TXT" + assert "v=spf1" in record.content + assert record.proxied is False + + def test_cloudflare_dns_record_cname(self): + record = CloudflareDNSRecord( + id="record-cname", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name="www.example.com", + type="CNAME", + content="example.com", + ttl=3600, + proxied=True, + ) + + assert record.type == "CNAME" + assert record.content == "example.com" + assert record.proxied is True + + def test_cloudflare_dns_record_mx(self): + record = CloudflareDNSRecord( + id="record-mx", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="MX", + content="10 mail.example.com", + ttl=3600, + proxied=False, + ) + + assert record.type == "MX" + assert "mail.example.com" in record.content + + def test_cloudflare_dns_record_caa(self): + record = CloudflareDNSRecord( + id="record-caa", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="CAA", + content='0 issue "letsencrypt.org"', + ttl=3600, + proxied=False, + ) + + assert record.type == "CAA" + assert "letsencrypt.org" in record.content diff --git a/tests/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled_test.py b/tests/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled_test.py new file mode 100644 index 0000000000..2cacb15796 --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_automatic_https_rewrites_enabled/zone_automatic_https_rewrites_enabled_test.py @@ -0,0 +1,143 @@ +from unittest import mock + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class Test_zone_automatic_https_rewrites_enabled: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled import ( + zone_automatic_https_rewrites_enabled, + ) + + check = zone_automatic_https_rewrites_enabled() + result = check.execute() + assert len(result) == 0 + + def test_zone_automatic_https_rewrites_enabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + automatic_https_rewrites="on", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled import ( + zone_automatic_https_rewrites_enabled, + ) + + check = zone_automatic_https_rewrites_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert "Automatic HTTPS Rewrites is enabled" in result[0].status_extended + + def test_zone_automatic_https_rewrites_disabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + automatic_https_rewrites="off", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled import ( + zone_automatic_https_rewrites_enabled, + ) + + check = zone_automatic_https_rewrites_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + "Automatic HTTPS Rewrites is not enabled" in result[0].status_extended + ) + + def test_zone_automatic_https_rewrites_none(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + automatic_https_rewrites=None, + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_automatic_https_rewrites_enabled.zone_automatic_https_rewrites_enabled import ( + zone_automatic_https_rewrites_enabled, + ) + + check = zone_automatic_https_rewrites_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + "Automatic HTTPS Rewrites is not enabled" in result[0].status_extended + ) diff --git a/tests/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled_test.py b/tests/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled_test.py new file mode 100644 index 0000000000..dfe3aec33a --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_email_obfuscation_enabled/zone_email_obfuscation_enabled_test.py @@ -0,0 +1,139 @@ +from unittest import mock + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class Test_zone_email_obfuscation_enabled: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled import ( + zone_email_obfuscation_enabled, + ) + + check = zone_email_obfuscation_enabled() + result = check.execute() + assert len(result) == 0 + + def test_zone_email_obfuscation_enabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + email_obfuscation="on", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled import ( + zone_email_obfuscation_enabled, + ) + + check = zone_email_obfuscation_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert "Email Obfuscation is enabled" in result[0].status_extended + + def test_zone_email_obfuscation_disabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + email_obfuscation="off", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled import ( + zone_email_obfuscation_enabled, + ) + + check = zone_email_obfuscation_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "Email Obfuscation is not enabled" in result[0].status_extended + + def test_zone_email_obfuscation_none(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + email_obfuscation=None, + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_email_obfuscation_enabled.zone_email_obfuscation_enabled import ( + zone_email_obfuscation_enabled, + ) + + check = zone_email_obfuscation_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "Email Obfuscation is not enabled" in result[0].status_extended diff --git a/tests/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists_test.py b/tests/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists_test.py new file mode 100644 index 0000000000..a2e7914d86 --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists_test.py @@ -0,0 +1,323 @@ +from typing import Optional +from unittest import mock + +from pydantic import BaseModel + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class CloudflareDNSRecord(BaseModel): + """Cloudflare DNS record representation for testing.""" + + id: str + zone_id: str + zone_name: str + name: Optional[str] = None + type: Optional[str] = None + content: str = "" + ttl: Optional[int] = None + proxied: bool = False + + +class Test_zone_record_caa_exists: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + dns_client = mock.MagicMock + dns_client.records = [] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists import ( + zone_record_caa_exists, + ) + + check = zone_record_caa_exists() + result = check.execute() + assert len(result) == 0 + + def test_zone_with_caa_record_issue_tag(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="CAA", + content='0 issue "letsencrypt.org"', + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists import ( + zone_record_caa_exists, + ) + + check = zone_record_caa_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"CAA record with certificate issuance restrictions exists for zone {ZONE_NAME}: {ZONE_NAME}." + ) + + def test_zone_with_multiple_caa_records(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="CAA", + content='0 issue "letsencrypt.org"', + ), + CloudflareDNSRecord( + id="record-2", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="CAA", + content='0 issuewild ";"', + ), + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists import ( + zone_record_caa_exists, + ) + + check = zone_record_caa_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"CAA record with certificate issuance restrictions exists for zone {ZONE_NAME}: {ZONE_NAME}, {ZONE_NAME}." + ) + + def test_zone_with_caa_record_only_iodef(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="CAA", + content='0 iodef "mailto:security@example.com"', + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists import ( + zone_record_caa_exists, + ) + + check = zone_record_caa_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"CAA record exists for zone {ZONE_NAME} but does not specify authorized CAs with issue or issuewild tags: {ZONE_NAME}." + ) + + def test_zone_without_caa_record(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="A", + content="192.0.2.1", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists import ( + zone_record_caa_exists, + ) + + check = zone_record_caa_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No CAA record found for zone {ZONE_NAME}." + ) + + def test_zone_with_caa_record_for_different_zone(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id="other-zone-id", + zone_name="other.com", + name="other.com", + type="CAA", + content='0 issue "letsencrypt.org"', + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_caa_exists.zone_record_caa_exists import ( + zone_record_caa_exists, + ) + + check = zone_record_caa_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No CAA record found for zone {ZONE_NAME}." + ) diff --git a/tests/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists_test.py b/tests/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists_test.py new file mode 100644 index 0000000000..6930551993 --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists_test.py @@ -0,0 +1,646 @@ +from typing import Optional +from unittest import mock + +from pydantic import BaseModel + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class CloudflareDNSRecord(BaseModel): + """Cloudflare DNS record representation for testing.""" + + id: str + zone_id: str + zone_name: str + name: Optional[str] = None + type: Optional[str] = None + content: str = "" + ttl: Optional[int] = None + proxied: bool = False + + +# Valid DKIM public key for testing (real RSA 2048-bit key in DER SubjectPublicKeyInfo format) +# This is a complete valid RSA public key that can be loaded by cryptography library +VALID_DKIM_KEY = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp4czBy2GlDrezAtyoKtrqZYpTLMsuJz1HjV0wZ/yIpClhKp5f8xGlAJuxOjxWokz5SoyW/XpmUtIPkFYwj90jlvUVkFhh9Q81BlJ/0DmhNnmIOs9MnVzgnLiUfNv06NQeKg3d65reCWNjEyrb1fDP6U4ePKM/lunTQc5CbHEUnSnU43vXpUO8v1TYb6OGeAKhumfVSdXFBF905c43/sqkt2QeRMabIoWPkYlSI0KSV0qhNpcRtOdfntFSyPljwa7iNVLlV9AckdL4+abOiy8zuYW0GDF5/1Jgl/Xbdab2M70AXuFnYldq6EgkhvyyiGEm7/15H5STgKxp8idarb6XQIDAQAB" + + +class Test_zone_record_dkim_exists: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + dns_client = mock.MagicMock + dns_client.records = [] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 0 + + def test_zone_with_dkim_record_valid_key(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + content=f"v=DKIM1; k=rsa; p={VALID_DKIM_KEY}", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DKIM record with valid public key exists for zone {ZONE_NAME}: google._domainkey.{ZONE_NAME}." + ) + + def test_zone_with_multiple_dkim_records(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + content=f"v=DKIM1; k=rsa; p={VALID_DKIM_KEY}", + ), + CloudflareDNSRecord( + id="record-2", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"selector1._domainkey.{ZONE_NAME}", + type="TXT", + content=f"v=DKIM1; k=rsa; p={VALID_DKIM_KEY}", + ), + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DKIM record with valid public key exists for zone {ZONE_NAME}: google._domainkey.{ZONE_NAME}, selector1._domainkey.{ZONE_NAME}." + ) + + def test_zone_with_dkim_record_revoked_key(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + content="v=DKIM1; k=rsa; p=", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"DKIM record exists for zone {ZONE_NAME} but has invalid or missing public key: google._domainkey.{ZONE_NAME}." + ) + + def test_zone_with_dkim_record_invalid_key_not_real_public_key(self): + """Test that valid Base64 that is not a real public key fails.""" + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + # Valid Base64 but not a valid DER-encoded public key + content="v=DKIM1; k=rsa; p=SGVsbG9Xb3JsZFRoaXNJc05vdEFWYWxpZFB1YmxpY0tleUJ1dEl0SXNWYWxpZEJhc2U2NA==", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"DKIM record exists for zone {ZONE_NAME} but has invalid or missing public key: google._domainkey.{ZONE_NAME}." + ) + + def test_zone_with_dkim_record_invalid_base64(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + # Invalid Base64 - contains characters not valid in Base64 and is long enough + content="v=DKIM1; k=rsa; p=ThisIsNotValidBase64!!!@@@###$$$%%%^^^&&&***Because_It_Contains_Invalid_Characters_And_Is_Long_Enough_To_Pass_Length_Check", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"DKIM record exists for zone {ZONE_NAME} but has invalid or missing public key: google._domainkey.{ZONE_NAME}." + ) + + def test_zone_without_dkim_record(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="A", + content="192.0.2.1", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No DKIM record found for zone {ZONE_NAME}." + ) + + def test_zone_with_domainkey_but_not_dkim(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + content="some other txt record", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No DKIM record found for zone {ZONE_NAME}." + ) + + def test_zone_with_dkim_record_lowercase(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"default._domainkey.{ZONE_NAME}", + type="TXT", + content=f"v=dkim1; k=rsa; p={VALID_DKIM_KEY}", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DKIM record with valid public key exists for zone {ZONE_NAME}: default._domainkey.{ZONE_NAME}." + ) + + def test_zone_with_dkim_record_different_zone(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id="other-zone-id", + zone_name="other.com", + name="google._domainkey.other.com", + type="TXT", + content=f"v=DKIM1; k=rsa; p={VALID_DKIM_KEY}", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No DKIM record found for zone {ZONE_NAME}." + ) + + def test_zone_with_dkim_record_quoted_content(self): + """Test that DKIM records with quoted content from Cloudflare API work.""" + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + # Cloudflare API returns content wrapped in quotes + content=f'"v=DKIM1; k=rsa; p={VALID_DKIM_KEY}"', + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DKIM record with valid public key exists for zone {ZONE_NAME}: google._domainkey.{ZONE_NAME}." + ) + + def test_zone_with_dkim_record_split_quoted_content(self): + """Test that long DKIM records split into multiple quoted strings work.""" + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + # Split the key to simulate how Cloudflare returns long TXT records + # The split happens in the middle of the p= value with '" "' between parts + key_part1 = VALID_DKIM_KEY[:200] + key_part2 = VALID_DKIM_KEY[200:] + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"google._domainkey.{ZONE_NAME}", + type="TXT", + # Cloudflare splits long TXT records with '" "' between parts + content=f'v=DKIM1; k=rsa; p={key_part1}" "{key_part2}', + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dkim_exists.zone_record_dkim_exists import ( + zone_record_dkim_exists, + ) + + check = zone_record_dkim_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DKIM record with valid public key exists for zone {ZONE_NAME}: google._domainkey.{ZONE_NAME}." + ) diff --git a/tests/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists_test.py b/tests/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists_test.py new file mode 100644 index 0000000000..d01fa36a9e --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists_test.py @@ -0,0 +1,417 @@ +from typing import Optional +from unittest import mock + +from pydantic import BaseModel + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class CloudflareDNSRecord(BaseModel): + """Cloudflare DNS record representation for testing.""" + + id: str + zone_id: str + zone_name: str + name: Optional[str] = None + type: Optional[str] = None + content: str = "" + ttl: Optional[int] = None + proxied: bool = False + + +class Test_zone_record_dmarc_exists: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + dns_client = mock.MagicMock + dns_client.records = [] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 0 + + def test_zone_with_dmarc_record_reject_policy(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"_dmarc.{ZONE_NAME}", + type="TXT", + content="v=DMARC1; p=reject; rua=mailto:dmarc@example.com", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DMARC record with enforcement policy p=reject exists for zone {ZONE_NAME}: _dmarc.{ZONE_NAME}." + ) + + def test_zone_with_dmarc_record_quarantine_policy(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"_dmarc.{ZONE_NAME}", + type="TXT", + content="v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DMARC record with enforcement policy p=quarantine exists for zone {ZONE_NAME}: _dmarc.{ZONE_NAME}." + ) + + def test_zone_with_dmarc_record_none_policy(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"_dmarc.{ZONE_NAME}", + type="TXT", + content="v=DMARC1; p=none; rua=mailto:dmarc@example.com", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"DMARC record exists for zone {ZONE_NAME} but uses monitoring-only policy p=none: _dmarc.{ZONE_NAME}." + ) + + def test_zone_without_dmarc_record(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="A", + content="192.0.2.1", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No DMARC record found for zone {ZONE_NAME}." + ) + + def test_zone_with_txt_record_but_not_dmarc(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"_dmarc.{ZONE_NAME}", + type="TXT", + content="some other txt record", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No DMARC record found for zone {ZONE_NAME}." + ) + + def test_zone_with_dmarc_record_lowercase(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=f"_dmarc.{ZONE_NAME}", + type="TXT", + content="v=dmarc1; p=reject; rua=mailto:dmarc@example.com", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"DMARC record with enforcement policy p=reject exists for zone {ZONE_NAME}: _dmarc.{ZONE_NAME}." + ) + + def test_zone_with_dmarc_record_different_zone(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id="other-zone-id", + zone_name="other.com", + name="_dmarc.other.com", + type="TXT", + content="v=DMARC1; p=reject", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_dmarc_exists.zone_record_dmarc_exists import ( + zone_record_dmarc_exists, + ) + + check = zone_record_dmarc_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No DMARC record found for zone {ZONE_NAME}." + ) diff --git a/tests/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists_test.py b/tests/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists_test.py new file mode 100644 index 0000000000..8543f68954 --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists_test.py @@ -0,0 +1,315 @@ +from typing import Optional +from unittest import mock + +from pydantic import BaseModel + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class CloudflareDNSRecord(BaseModel): + """Cloudflare DNS record representation for testing.""" + + id: str + zone_id: str + zone_name: str + name: Optional[str] = None + type: Optional[str] = None + content: str = "" + ttl: Optional[int] = None + proxied: bool = False + + +class Test_zone_record_spf_exists: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + dns_client = mock.MagicMock + dns_client.records = [] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists import ( + zone_record_spf_exists, + ) + + check = zone_record_spf_exists() + result = check.execute() + assert len(result) == 0 + + def test_zone_with_spf_record_strict_policy(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="TXT", + content="v=spf1 include:_spf.google.com -all", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists import ( + zone_record_spf_exists, + ) + + check = zone_record_spf_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"SPF record with strict policy -all exists for zone {ZONE_NAME}: {ZONE_NAME}." + ) + + def test_zone_with_spf_record_permissive_policy(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="TXT", + content="v=spf1 include:_spf.google.com ~all", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists import ( + zone_record_spf_exists, + ) + + check = zone_record_spf_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"SPF record exists for zone {ZONE_NAME} but does not use strict policy -all: {ZONE_NAME}." + ) + + def test_zone_without_spf_record(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="A", + content="192.0.2.1", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists import ( + zone_record_spf_exists, + ) + + check = zone_record_spf_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No SPF record found for zone {ZONE_NAME}." + ) + + def test_zone_with_txt_record_but_not_spf(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id=ZONE_ID, + zone_name=ZONE_NAME, + name=ZONE_NAME, + type="TXT", + content="google-site-verification=abc123", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists import ( + zone_record_spf_exists, + ) + + check = zone_record_spf_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No SPF record found for zone {ZONE_NAME}." + ) + + def test_zone_with_spf_record_different_zone(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings(), + ) + } + + dns_client = mock.MagicMock + dns_client.records = [ + CloudflareDNSRecord( + id="record-1", + zone_id="other-zone-id", + zone_name="other.com", + name="other.com", + type="TXT", + content="v=spf1 include:_spf.google.com -all", + ) + ] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.zone_client", + new=zone_client, + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists.dns_client", + new=dns_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_record_spf_exists.zone_record_spf_exists import ( + zone_record_spf_exists, + ) + + check = zone_record_spf_exists() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"No SPF record found for zone {ZONE_NAME}." + ) diff --git a/tests/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled_test.py b/tests/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled_test.py new file mode 100644 index 0000000000..e9cccd4992 --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_security_under_attack_disabled/zone_security_under_attack_disabled_test.py @@ -0,0 +1,210 @@ +from unittest import mock + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class Test_zone_security_under_attack_disabled: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled import ( + zone_security_under_attack_disabled, + ) + + check = zone_security_under_attack_disabled() + result = check.execute() + assert len(result) == 0 + + def test_zone_under_attack_mode_enabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + security_level="under_attack", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled import ( + zone_security_under_attack_disabled, + ) + + check = zone_security_under_attack_disabled() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Zone {ZONE_NAME} has Under Attack Mode enabled." + ) + + def test_zone_security_level_high(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + security_level="high", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled import ( + zone_security_under_attack_disabled, + ) + + check = zone_security_under_attack_disabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Zone {ZONE_NAME} does not have Under Attack Mode enabled." + ) + + def test_zone_security_level_medium(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + security_level="medium", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled import ( + zone_security_under_attack_disabled, + ) + + check = zone_security_under_attack_disabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_zone_security_level_low(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + security_level="low", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled import ( + zone_security_under_attack_disabled, + ) + + check = zone_security_under_attack_disabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_zone_security_level_none(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + security_level=None, + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_security_under_attack_disabled.zone_security_under_attack_disabled import ( + zone_security_under_attack_disabled, + ) + + check = zone_security_under_attack_disabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" diff --git a/tests/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled_test.py b/tests/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled_test.py new file mode 100644 index 0000000000..70a02b34fd --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled_test.py @@ -0,0 +1,173 @@ +from unittest import mock + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class Test_zone_tls_1_3_enabled: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled import ( + zone_tls_1_3_enabled, + ) + + check = zone_tls_1_3_enabled() + result = check.execute() + assert len(result) == 0 + + def test_zone_tls_1_3_enabled_on(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + tls_1_3="on", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled import ( + zone_tls_1_3_enabled, + ) + + check = zone_tls_1_3_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert "TLS 1.3 is enabled" in result[0].status_extended + + def test_zone_tls_1_3_enabled_zrt(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + tls_1_3="zrt", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled import ( + zone_tls_1_3_enabled, + ) + + check = zone_tls_1_3_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert "TLS 1.3 is enabled" in result[0].status_extended + + def test_zone_tls_1_3_disabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + tls_1_3="off", + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled import ( + zone_tls_1_3_enabled, + ) + + check = zone_tls_1_3_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "TLS 1.3 is not enabled" in result[0].status_extended + + def test_zone_tls_1_3_none(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + tls_1_3=None, + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_tls_1_3_enabled.zone_tls_1_3_enabled import ( + zone_tls_1_3_enabled, + ) + + check = zone_tls_1_3_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "TLS 1.3 is not enabled" in result[0].status_extended diff --git a/tests/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled_test.py b/tests/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled_test.py new file mode 100644 index 0000000000..dfa804181c --- /dev/null +++ b/tests/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled_test.py @@ -0,0 +1,111 @@ +from unittest import mock + +from prowler.providers.cloudflare.services.zone.zone_service import ( + CloudflareZone, + CloudflareZoneSettings, +) +from tests.providers.cloudflare.cloudflare_fixtures import ( + ZONE_ID, + ZONE_NAME, + set_mocked_cloudflare_provider, +) + + +class Test_zone_universal_ssl_enabled: + def test_no_zones(self): + zone_client = mock.MagicMock + zone_client.zones = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_universal_ssl_enabled.zone_universal_ssl_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_universal_ssl_enabled.zone_universal_ssl_enabled import ( + zone_universal_ssl_enabled, + ) + + check = zone_universal_ssl_enabled() + result = check.execute() + assert len(result) == 0 + + def test_zone_universal_ssl_enabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + universal_ssl_enabled=True, + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_universal_ssl_enabled.zone_universal_ssl_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_universal_ssl_enabled.zone_universal_ssl_enabled import ( + zone_universal_ssl_enabled, + ) + + check = zone_universal_ssl_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].resource_id == ZONE_ID + assert result[0].resource_name == ZONE_NAME + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Universal SSL is enabled for zone {ZONE_NAME}." + ) + + def test_zone_universal_ssl_disabled(self): + zone_client = mock.MagicMock + zone_client.zones = { + ZONE_ID: CloudflareZone( + id=ZONE_ID, + name=ZONE_NAME, + status="active", + paused=False, + settings=CloudflareZoneSettings( + universal_ssl_enabled=False, + ), + ) + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_cloudflare_provider(), + ), + mock.patch( + "prowler.providers.cloudflare.services.zone.zone_universal_ssl_enabled.zone_universal_ssl_enabled.zone_client", + new=zone_client, + ), + ): + from prowler.providers.cloudflare.services.zone.zone_universal_ssl_enabled.zone_universal_ssl_enabled import ( + zone_universal_ssl_enabled, + ) + + check = zone_universal_ssl_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Universal SSL is not enabled for zone {ZONE_NAME}." + ) From 28978f6db6f9e19601461d1c7a3f307cf8188d51 Mon Sep 17 00:00:00 2001 From: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> Date: Thu, 15 Jan 2026 11:29:23 +0100 Subject: [PATCH 2/8] fix(oci): pass provider UID to update credentials forms (#9746) --- ui/CHANGELOG.md | 8 ++ .../update-credentials/page.tsx | 38 ++++++++- .../forms/update-via-credentials-form.tsx | 3 + .../workflow/forms/update-via-role-form.tsx | 3 + .../update-via-service-account-key-form.tsx | 3 + ui/tests/providers/providers-page.ts | 67 +++++++++++++-- ui/tests/providers/providers.md | 58 +++++++++++++ ui/tests/providers/providers.spec.ts | 84 +++++++++++++++++++ 8 files changed, 253 insertions(+), 11 deletions(-) diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index cfacff8de8..4a5ac26495 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -21,6 +21,14 @@ All notable changes to the **Prowler UI** are documented in this file. --- +## [1.16.2] (Prowler v5.16.2) (UNRELEASED) + +### 🐞 Fixed + +- OCI update credentials form failing silently due to missing provider UID [(#9746)](https://github.com/prowler-cloud/prowler/pull/9746) + +--- + ## [1.16.1] (Prowler v5.16.1) ### 🔄 Changed diff --git a/ui/app/(prowler)/providers/(set-up-provider)/update-credentials/page.tsx b/ui/app/(prowler)/providers/(set-up-provider)/update-credentials/page.tsx index 91afadbc6e..cd6af05043 100644 --- a/ui/app/(prowler)/providers/(set-up-provider)/update-credentials/page.tsx +++ b/ui/app/(prowler)/providers/(set-up-provider)/update-credentials/page.tsx @@ -1,5 +1,7 @@ +import { redirect } from "next/navigation"; import React from "react"; +import { getProvider } from "@/actions/providers/providers"; import { CredentialsUpdateInfo } from "@/components/providers"; import { UpdateViaCredentialsForm, @@ -20,9 +22,24 @@ interface Props { export default async function UpdateCredentialsPage({ searchParams }: Props) { const resolvedSearchParams = await searchParams; - const { type: providerType, via } = resolvedSearchParams; + const { type: providerType, via, id: providerId } = resolvedSearchParams; + + if (!providerId) { + redirect("/providers"); + } + const formType = getProviderFormType(providerType, via); + const formData = new FormData(); + formData.append("id", providerId); + const providerResponse = await getProvider(formData); + + if (providerResponse?.errors) { + redirect("/providers"); + } + + const providerUid = providerResponse?.data?.attributes?.uid; + switch (formType) { case "selector": return ( @@ -30,14 +47,27 @@ export default async function UpdateCredentialsPage({ searchParams }: Props) { ); case "credentials": - return ; + return ( + + ); case "role": - return ; + return ( + + ); case "service-account": return ( - + ); default: diff --git a/ui/components/providers/workflow/forms/update-via-credentials-form.tsx b/ui/components/providers/workflow/forms/update-via-credentials-form.tsx index 613882b381..f838b71478 100644 --- a/ui/components/providers/workflow/forms/update-via-credentials-form.tsx +++ b/ui/components/providers/workflow/forms/update-via-credentials-form.tsx @@ -7,8 +7,10 @@ import { BaseCredentialsForm } from "./base-credentials-form"; export const UpdateViaCredentialsForm = ({ searchParams, + providerUid, }: { searchParams: { type: string; id: string; secretId?: string }; + providerUid?: string; }) => { const providerType = searchParams.type as ProviderType; const providerId = searchParams.id; @@ -24,6 +26,7 @@ export const UpdateViaCredentialsForm = ({ { const providerType = searchParams.type as ProviderType; const providerId = searchParams.id; @@ -24,6 +26,7 @@ export const UpdateViaRoleForm = ({ { const providerType = searchParams.type as ProviderType; const providerId = searchParams.id; @@ -24,6 +26,7 @@ export const UpdateViaServiceAccountForm = ({ = [ - { name: "Next" }, // Try the "Next" button - { name: "Save" }, // Try the "Save" button + const candidates: Array<{ name: string | RegExp; exact?: boolean }> = [ + { name: "Next", exact: true }, // Try the "Next" button (exact match to avoid Next.js dev tools) + { name: "Save", exact: true }, // Try the "Save" button { name: "Launch scan" }, // Try the "Launch scan" button { name: /Continue|Proceed/i }, // Try "Continue" or "Proceed" (case-insensitive) ]; // Try each candidate name and click it if found for (const candidate of candidates) { - const btn = this.page.getByRole("button", { - name: candidate.name, - }); + // Exclude Next.js dev tools button by filtering out buttons with aria-haspopup attribute + const btn = this.page + .getByRole("button", { + name: candidate.name, + exact: candidate.exact, + }) + .and(this.page.locator(":not([aria-haspopup])")); if (await btn.count()) { await btn.click(); @@ -847,7 +851,7 @@ export class ProvidersPage extends BasePage { } async verifyOCICredentialsPageLoaded(): Promise { - // Verify the OCI credentials page is loaded + // Verify the OCI credentials page is loaded (add flow - all fields visible) await this.verifyPageHasProwlerTitle(); await expect(this.ociTenancyIdInput).toBeVisible(); @@ -857,6 +861,17 @@ export class ProvidersPage extends BasePage { await expect(this.ociRegionInput).toBeVisible(); } + async verifyOCIUpdateCredentialsPageLoaded(): Promise { + // Verify the OCI update credentials page is loaded + // Note: Tenancy OCID is hidden in update flow (auto-populated from provider UID) + + await this.verifyPageHasProwlerTitle(); + await expect(this.ociUserIdInput).toBeVisible(); + await expect(this.ociFingerprintInput).toBeVisible(); + await expect(this.ociKeyContentInput).toBeVisible(); + await expect(this.ociRegionInput).toBeVisible(); + } + async verifyPageLoaded(): Promise { // Verify the providers page is loaded @@ -995,4 +1010,42 @@ export class ProvidersPage extends BasePage { throw new Error(`Invalid authentication method: ${method}`); } } + + async clickProviderRowActions(providerUid: string): Promise { + // Click the actions dropdown for a specific provider row + const row = this.providersTable.locator("tbody tr", { + hasText: providerUid, + }); + await expect(row).toBeVisible(); + + // Click the dropdown trigger - it's the last button in the row (after the copy button) + const actionsButton = row.locator("button").last(); + await actionsButton.click(); + } + + async clickUpdateCredentials(providerUid: string): Promise { + // Click update credentials for a specific provider + await this.clickProviderRowActions(providerUid); + + // Wait for dropdown menu to stabilize and click Update Credentials + const updateCredentialsOption = this.page.getByRole("menuitem", { + name: /Update Credentials/i, + }); + await expect(updateCredentialsOption).toBeVisible(); + // Wait a bit for the menu to stabilize before clicking + await this.page.waitForTimeout(100); + await updateCredentialsOption.click({ force: true }); + } + + async verifyUpdateCredentialsPageLoaded(): Promise { + // Verify the update credentials page is loaded + await this.verifyPageHasProwlerTitle(); + await expect(this.page).toHaveURL(/\/providers\/update-credentials/); + } + + async verifyTestConnectionPageLoaded(): Promise { + // Verify the test connection page is loaded + await this.verifyPageHasProwlerTitle(); + await expect(this.page).toHaveURL(/\/providers\/test-connection/); + } } diff --git a/ui/tests/providers/providers.md b/ui/tests/providers/providers.md index 67977b61e4..f58d9edc19 100644 --- a/ui/tests/providers/providers.md +++ b/ui/tests/providers/providers.md @@ -708,3 +708,61 @@ - Provider cleanup performed before each test to ensure clean state - Requires valid OCI account with API Key set up - API Key credential type is automatically used for OCI providers + +--- + +## Test Case: `PROVIDER-E2E-013` - Update OCI Provider Credentials + +**Priority:** `normal` + +**Tags:** + +- type → @e2e, @serial +- feature → @providers +- provider → @oci + +**Description/Objective:** Validates the complete flow of updating credentials for an existing OCI provider. This test verifies that the provider UID is correctly passed to the update credentials form, which is required for OCI credential validation. + +**Preconditions:** + +- Admin user authentication required (admin.auth.setup setup) +- Environment variables configured: E2E_OCI_TENANCY_ID, E2E_OCI_USER_ID, E2E_OCI_FINGERPRINT, E2E_OCI_KEY_CONTENT, E2E_OCI_REGION +- An OCI provider with the specified Tenancy ID must already exist (run PROVIDER-E2E-012 first) +- This test must be run serially and never in parallel with other tests + +### Flow Steps: + +1. Navigate to providers page +2. Verify OCI provider exists in the table +3. Click row actions menu for the OCI provider +4. Click "Update Credentials" option +5. Verify update credentials page is loaded +6. Verify OCI credentials form fields are visible (confirms providerUid is loaded) +7. Fill OCI credentials (user ID, fingerprint, key content, region) +8. Click Next to submit +9. Verify successful navigation to test connection page + +### Expected Result: + +- Update credentials page loads successfully +- OCI credentials form is displayed with all required fields +- Provider UID is correctly passed to the form (hidden field populated) +- Credentials can be updated and submitted +- User is redirected to test connection page after successful update + +### Key verification points: + +- Provider page loads correctly +- OCI provider row is visible in providers table +- Row actions dropdown opens and displays "Update Credentials" option +- Update credentials page URL contains correct parameters +- OCI credentials form displays all fields (tenancy ID, user ID, fingerprint, key content, region) +- Form submission succeeds (no silent failures due to missing provider UID) +- Successful redirect to test connection page + +### Notes: + +- Test uses same environment variables as PROVIDER-E2E-012 (add OCI provider) +- Requires PROVIDER-E2E-012 to be run first to create the OCI provider +- This test validates the fix for OCI update credentials form failing silently due to missing provider UID +- The provider UID is required for OCI credential validation (tenancy field auto-populated from UID) diff --git a/ui/tests/providers/providers.spec.ts b/ui/tests/providers/providers.spec.ts index 865ee0cc4d..07da089891 100644 --- a/ui/tests/providers/providers.spec.ts +++ b/ui/tests/providers/providers.spec.ts @@ -1139,3 +1139,87 @@ test.describe("Add Provider", () => { ); }); }); + +test.describe("Update Provider Credentials", () => { + test.describe.serial("Update OCI Provider Credentials", () => { + let providersPage: ProvidersPage; + + // Test data from environment variables (same as add OCI provider test) + const tenancyId = process.env.E2E_OCI_TENANCY_ID; + const userId = process.env.E2E_OCI_USER_ID; + const fingerprint = process.env.E2E_OCI_FINGERPRINT; + const keyContent = process.env.E2E_OCI_KEY_CONTENT; + const region = process.env.E2E_OCI_REGION; + + // Validate required environment variables + if (!tenancyId || !userId || !fingerprint || !keyContent || !region) { + throw new Error( + "E2E_OCI_TENANCY_ID, E2E_OCI_USER_ID, E2E_OCI_FINGERPRINT, E2E_OCI_KEY_CONTENT, and E2E_OCI_REGION environment variables are not set", + ); + } + + // Setup before each test + test.beforeEach(async ({ page }) => { + providersPage = new ProvidersPage(page); + }); + + // Use admin authentication for provider management + test.use({ storageState: "playwright/.auth/admin_user.json" }); + + test( + "should update OCI provider credentials successfully", + { + tag: [ + "@e2e", + "@providers", + "@oci", + "@serial", + "@PROVIDER-E2E-013", + ], + }, + async () => { + // Prepare updated credentials + const ociCredentials: OCIProviderCredential = { + type: OCI_CREDENTIAL_OPTIONS.OCI_API_KEY, + tenancyId: tenancyId, + userId: userId, + fingerprint: fingerprint, + keyContent: keyContent, + region: region, + }; + + // Navigate to providers page + await providersPage.goto(); + await providersPage.verifyPageLoaded(); + + // Verify OCI provider exists in the table + const providerExists = + await providersPage.verifySingleRowForProviderUID(tenancyId); + if (!providerExists) { + throw new Error( + `OCI provider with tenancy ID ${tenancyId} not found. Run the add OCI provider test first.`, + ); + } + + // Click update credentials for the OCI provider + await providersPage.clickUpdateCredentials(tenancyId); + + // Verify update credentials page is loaded + await providersPage.verifyUpdateCredentialsPageLoaded(); + + // Verify OCI credentials form fields are visible (confirms providerUid is loaded) + // Note: Tenancy OCID is hidden in update flow (auto-populated from provider UID) + await providersPage.verifyOCIUpdateCredentialsPageLoaded(); + + // Fill updated credentials + await providersPage.fillOCICredentials(ociCredentials); + + // Click Next to submit + await providersPage.clickNext(); + + // Verify successful navigation to test connection page + await providersPage.verifyTestConnectionPageLoaded(); + }, + ); + }); +}); From 76cda6d7776473ba83efa54ea2dff1299b17a6c1 Mon Sep 17 00:00:00 2001 From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com> Date: Thu, 15 Jan 2026 12:15:06 +0100 Subject: [PATCH 3/8] feat(ui): new findings view (#9794) --- ui/app/(prowler)/findings/page.tsx | 28 +-- .../_components/simple/mute-rules-columns.tsx | 6 +- .../filters/clear-filters-button.tsx | 45 +++- ui/components/filters/filter-controls.tsx | 5 +- .../findings/table/column-findings.tsx | 17 ++ .../findings/table/finding-detail.tsx | 6 +- .../invitations/invitation-details.tsx | 20 +- .../invitations/table/column-invitations.tsx | 4 +- .../table/column-new-findings-to-date.tsx | 230 +----------------- ui/components/roles/table/column-roles.tsx | 4 +- ui/components/ui/entities/date-with-time.tsx | 4 +- .../ui/table/data-table-column-header.tsx | 15 +- ui/components/ui/table/table.tsx | 2 +- .../users/profile/user-basic-info-card.tsx | 6 +- ui/components/users/table/column-users.tsx | 4 +- 15 files changed, 109 insertions(+), 287 deletions(-) diff --git a/ui/app/(prowler)/findings/page.tsx b/ui/app/(prowler)/findings/page.tsx index 0818356f31..3c30c63576 100644 --- a/ui/app/(prowler)/findings/page.tsx +++ b/ui/app/(prowler)/findings/page.tsx @@ -1,4 +1,3 @@ -import { Spacer } from "@heroui/spacer"; import { Suspense } from "react"; import { @@ -84,19 +83,20 @@ export default async function Findings({ return ( - - +
+ +
}> diff --git a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx index 7bd06fb1ec..929f69eea2 100644 --- a/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx +++ b/ui/app/(prowler)/mutelist/_components/simple/mute-rules-columns.tsx @@ -91,11 +91,7 @@ export const createMuteRulesColumns = ( }, { id: "actions", - header: () => ( -
- Actions -
- ), + header: () => null, cell: ({ row }) => { return ( { + const router = useRouter(); + const pathname = usePathname(); const searchParams = useSearchParams(); - const { clearAllFilters, hasFilters } = useUrlFilters(); - // Count active filters (excluding search) - const filterCount = Array.from(searchParams.keys()).filter( - (key) => key.startsWith("filter[") && key !== "filter[search]", - ).length; + // Get active filters (excluding search and muted) + const activeFilters = Array.from(searchParams.keys()).filter( + (key) => key.startsWith("filter[") && !EXCLUDED_FILTERS.includes(key), + ); - if (!hasFilters()) { + const filterCount = activeFilters.length; + + // Clear all filters except excluded ones (muted, search) + const clearFiltersPreservingExcluded = useCallback(() => { + const params = new URLSearchParams(searchParams.toString()); + Array.from(params.keys()).forEach((key) => { + if ( + (key.startsWith("filter[") && !EXCLUDED_FILTERS.includes(key)) || + key === "sort" + ) { + params.delete(key); + } + }); + params.delete("page"); + router.push(`${pathname}?${params.toString()}`, { scroll: false }); + }, [router, searchParams, pathname]); + + // Only show button if there are filters other than the excluded ones + if (filterCount === 0) { return null; } const displayText = showCount ? `Clear Filters (${filterCount})` : text; return ( - diff --git a/ui/components/filters/filter-controls.tsx b/ui/components/filters/filter-controls.tsx index 5099f05a2a..d00e5da8a1 100644 --- a/ui/components/filters/filter-controls.tsx +++ b/ui/components/filters/filter-controls.tsx @@ -1,7 +1,5 @@ "use client"; -import { Spacer } from "@heroui/spacer"; - import { FilterOption } from "@/types"; import { DataTableFilterCustom } from "../ui/table"; @@ -32,7 +30,7 @@ export const FilterControls = ({ customFilters, }: FilterControlsProps) => { return ( -
+
{search && } @@ -45,7 +43,6 @@ export const FilterControls = ({
{customFilters && customFilters.length > 0 && ( <> - )} diff --git a/ui/components/findings/table/column-findings.tsx b/ui/components/findings/table/column-findings.tsx index dca9087745..8f5470ac57 100644 --- a/ui/components/findings/table/column-findings.tsx +++ b/ui/components/findings/table/column-findings.tsx @@ -256,6 +256,23 @@ export function getColumnFindings( }, enableSorting: false, }, + // Region column + { + accessorKey: "region", + header: ({ column }) => ( + + ), + cell: ({ row }) => { + const region = getResourceData(row, "region"); + const regionText = typeof region === "string" ? region : "-"; + return ( +

+ {regionText} +

+ ); + }, + enableSorting: false, + }, // TODO: PROWLER-379 - Enable Impacted Resources column when backend supports grouped findings // { // accessorKey: "impactedResources", diff --git a/ui/components/findings/table/finding-detail.tsx b/ui/components/findings/table/finding-detail.tsx index 62a2b17c37..48f1e9560b 100644 --- a/ui/components/findings/table/finding-detail.tsx +++ b/ui/components/findings/table/finding-detail.tsx @@ -147,7 +147,8 @@ export const FindingDetail = ({ {/* Row 3: First Seen */}
- + Time: +
@@ -188,6 +189,9 @@ export const FindingDetail = ({ + + +
{attributes.status === "FAIL" && ( diff --git a/ui/components/invitations/invitation-details.tsx b/ui/components/invitations/invitation-details.tsx index c7b0c7b23f..38d831bbfa 100644 --- a/ui/components/invitations/invitation-details.tsx +++ b/ui/components/invitations/invitation-details.tsx @@ -34,12 +34,14 @@ const InfoField = ({ label: string; children: React.ReactNode; }) => ( -
+
{label} -
- {children} +
+ + {children} +
); @@ -87,18 +89,18 @@ export const InvitationDetails = ({ attributes }: InvitationDetailsProps) => { Share this link with the user: -
+
-

- {invitationLink} -

+

{invitationLink}
diff --git a/ui/components/invitations/table/column-invitations.tsx b/ui/components/invitations/table/column-invitations.tsx index 597712170e..2af64ef6fd 100644 --- a/ui/components/invitations/table/column-invitations.tsx +++ b/ui/components/invitations/table/column-invitations.tsx @@ -77,9 +77,7 @@ export const ColumnsInvitation: ColumnDef[] = [ }, { accessorKey: "actions", - header: ({ column }) => ( - - ), + header: () => null, id: "actions", cell: ({ row }) => { const roles = row.original.roles; diff --git a/ui/components/overview/new-findings-table/table/column-new-findings-to-date.tsx b/ui/components/overview/new-findings-table/table/column-new-findings-to-date.tsx index a71acfba64..94eeca391d 100644 --- a/ui/components/overview/new-findings-table/table/column-new-findings-to-date.tsx +++ b/ui/components/overview/new-findings-table/table/column-new-findings-to-date.tsx @@ -1,227 +1,13 @@ "use client"; -import { ColumnDef } from "@tanstack/react-table"; -import { Database } from "lucide-react"; -import { useSearchParams } from "next/navigation"; +import { ColumnDef, RowSelectionState } from "@tanstack/react-table"; -import { Muted } from "@/components/findings/muted"; -import { DataTableRowDetails } from "@/components/findings/table"; -import { DeltaIndicator } from "@/components/findings/table/delta-indicator"; -import { InfoIcon } from "@/components/icons"; -import { - DateWithTime, - EntityInfo, - SnippetChip, -} from "@/components/ui/entities"; -import { TriggerSheet } from "@/components/ui/sheet"; -import { - DataTableColumnHeader, - SeverityBadge, - StatusFindingBadge, -} from "@/components/ui/table"; -import { FindingProps, ProviderType } from "@/types"; +import { getColumnFindings } from "@/components/findings/table/column-findings"; +import { FindingProps } from "@/types"; -const getFindingsData = (row: { original: FindingProps }) => { - return row.original; -}; +const baseColumns: ColumnDef[] = getColumnFindings( + {} as RowSelectionState, + 0, +).filter((column) => column.id !== "select" && column.id !== "actions"); -const getFindingsMetadata = (row: { original: FindingProps }) => { - return row.original.attributes.check_metadata; -}; - -const getResourceData = ( - row: { original: FindingProps }, - field: keyof FindingProps["relationships"]["resource"]["attributes"], -) => { - return ( - row.original.relationships?.resource?.attributes?.[field] || - `No ${field} found in resource` - ); -}; - -const getProviderData = ( - row: { original: FindingProps }, - field: keyof FindingProps["relationships"]["provider"]["attributes"], -) => { - return ( - row.original.relationships?.provider?.attributes?.[field] || - `No ${field} found in provider` - ); -}; - -const FindingDetailsCell = ({ row }: { row: any }) => { - const searchParams = useSearchParams(); - const findingId = searchParams.get("id"); - const isOpen = findingId === row.original.id; - - return ( -
- - } - title="Finding Details" - description="View the finding details" - defaultOpen={isOpen} - > - - -
- ); -}; - -export const ColumnNewFindingsToDate: ColumnDef[] = [ - { - id: "moreInfo", - header: ({ column }) => ( - - ), - cell: ({ row }) => , - enableSorting: false, - }, - { - accessorKey: "check", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const { checktitle } = getFindingsMetadata(row); - const { - attributes: { muted, muted_reason }, - } = getFindingsData(row); - const { delta } = row.original.attributes; - return ( -
-
- {delta === "new" || delta === "changed" ? ( - - ) : ( -
- )} -

- {checktitle} -

-
- - - -
- ); - }, - enableSorting: false, - }, - { - accessorKey: "resourceName", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const resourceName = getResourceData(row, "name"); - - return ( - `...${value.slice(-10)}`} - icon={} - /> - ); - }, - enableSorting: false, - }, - { - accessorKey: "severity", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const { - attributes: { severity }, - } = getFindingsData(row); - return ; - }, - enableSorting: false, - }, - { - accessorKey: "status", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const { - attributes: { status }, - } = getFindingsData(row); - - return ; - }, - enableSorting: false, - }, - { - accessorKey: "updated_at", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const { - attributes: { updated_at }, - } = getFindingsData(row); - return ( -
- -
- ); - }, - enableSorting: false, - }, - { - accessorKey: "region", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const region = getResourceData(row, "region"); - - return ( -
- {typeof region === "string" ? region : "Invalid region"} -
- ); - }, - enableSorting: false, - }, - { - accessorKey: "service", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const { servicename } = getFindingsMetadata(row); - return

{servicename}

; - }, - enableSorting: false, - }, - { - accessorKey: "cloudProvider", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const provider = getProviderData(row, "provider"); - const alias = getProviderData(row, "alias"); - const uid = getProviderData(row, "uid"); - - return ( - <> - - - ); - }, - enableSorting: false, - }, -]; +export const ColumnNewFindingsToDate: ColumnDef[] = baseColumns; diff --git a/ui/components/roles/table/column-roles.tsx b/ui/components/roles/table/column-roles.tsx index 7faf340aa9..d65be6f253 100644 --- a/ui/components/roles/table/column-roles.tsx +++ b/ui/components/roles/table/column-roles.tsx @@ -105,9 +105,7 @@ export const ColumnsRoles: ColumnDef[] = [ }, { accessorKey: "actions", - header: ({ column }) => ( - - ), + header: () => null, id: "actions", cell: ({ row }) => { return ; diff --git a/ui/components/ui/entities/date-with-time.tsx b/ui/components/ui/entities/date-with-time.tsx index 74d80a9f57..817a170646 100644 --- a/ui/components/ui/entities/date-with-time.tsx +++ b/ui/components/ui/entities/date-with-time.tsx @@ -36,8 +36,8 @@ export const DateWithTime = ({ return (
diff --git a/ui/components/ui/table/data-table-column-header.tsx b/ui/components/ui/table/data-table-column-header.tsx index 49ebd74bd4..9ac799af9d 100644 --- a/ui/components/ui/table/data-table-column-header.tsx +++ b/ui/components/ui/table/data-table-column-header.tsx @@ -9,7 +9,6 @@ import { ArrowUpIcon, ChevronsLeftRightIcon, } from "@/components/icons"; -import { Button } from "@/components/shadcn"; interface DataTableColumnHeaderProps extends HTMLAttributes { @@ -74,23 +73,25 @@ export const DataTableColumnHeader = ({ ); }; + const baseClassName = + "text-text-neutral-primary flex h-8 items-center text-left align-middle text-sm font-semibold whitespace-nowrap outline-none -ml-px"; + if (!column.getCanSort()) { return ( -
+
{title}
); } return ( - + ); }; diff --git a/ui/components/ui/table/table.tsx b/ui/components/ui/table/table.tsx index 9dff392a8f..c9bceda8ad 100644 --- a/ui/components/ui/table/table.tsx +++ b/ui/components/ui/table/table.tsx @@ -85,7 +85,7 @@ const TableHead = forwardRef< className={cn( "bg-bg-neutral-tertiary border-border-neutral-tertiary text-text-neutral-secondary border-y backdrop-blur-[46px]", "h-11 px-1.5 text-left align-middle text-xs font-medium whitespace-nowrap outline-none", - "first:rounded-l-full first:border-l first:pl-1", + "first:rounded-l-full first:border-l first:pl-3", "last:rounded-r-full last:border-r last:pr-3", "data-[hover=true]:text-foreground-400 data-[focus-visible=true]:outline-focus", "data-[focus-visible=true]:z-10 data-[focus-visible=true]:outline-2 data-[focus-visible=true]:outline-offset-2", diff --git a/ui/components/users/profile/user-basic-info-card.tsx b/ui/components/users/profile/user-basic-info-card.tsx index 7451eba818..fa3376ad84 100644 --- a/ui/components/users/profile/user-basic-info-card.tsx +++ b/ui/components/users/profile/user-basic-info-card.tsx @@ -9,8 +9,8 @@ import { UserDataWithRoles } from "@/types/users"; const TenantIdCopy = ({ id }: { id: string }) => { return ( -
- +
+
); }; @@ -48,7 +48,7 @@ export const UserBasicInfoCard = ({
-
+
{tenantId ? ( diff --git a/ui/components/users/table/column-users.tsx b/ui/components/users/table/column-users.tsx index c7632a0f9a..fc599eb13e 100644 --- a/ui/components/users/table/column-users.tsx +++ b/ui/components/users/table/column-users.tsx @@ -75,9 +75,7 @@ export const ColumnsUser: ColumnDef[] = [ { accessorKey: "actions", - header: ({ column }) => ( - - ), + header: () => null, id: "actions", cell: ({ row }) => { const roles = row.original.roles; From c8bc0576ea8604649c863c3d024b4a9d128b37c1 Mon Sep 17 00:00:00 2001 From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com> Date: Thu, 15 Jan 2026 12:37:16 +0100 Subject: [PATCH 4/8] feat: implement compliance watchlist (#9786) --- ui/CHANGELOG.md | 1 + .../compliance-watchlist.adapter.ts | 72 +++++++++++++++++++ .../compliance-watchlist.ts | 31 ++++++++ .../compliance-watchlist.types.ts | 24 +++++++ .../overview/compliance-watchlist/index.ts | 9 +++ .../_components/compliance-watchlist.tsx | 13 ++-- .../watchlist/_components/watchlist-card.tsx | 35 +++++---- .../watchlist/compliance-watchlist.ssr.tsx | 31 ++++---- ui/app/(prowler)/page.tsx | 36 ++++++---- ui/lib/categories.ts | 32 +++++++-- 10 files changed, 229 insertions(+), 55 deletions(-) create mode 100644 ui/actions/overview/compliance-watchlist/compliance-watchlist.adapter.ts create mode 100644 ui/actions/overview/compliance-watchlist/compliance-watchlist.ts create mode 100644 ui/actions/overview/compliance-watchlist/compliance-watchlist.types.ts create mode 100644 ui/actions/overview/compliance-watchlist/index.ts diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 4a5ac26495..8a75c50312 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -13,6 +13,7 @@ All notable changes to the **Prowler UI** are documented in this file. ### 🔄 Changed +- Integrate Compliance Watchlist with new `/overviews/compliance-watchlist` endpoint [(#9786)](https://github.com/prowler-cloud/prowler/pull/9786) - Refactor ScatterPlot as reusable generic component with TypeScript generics [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) - Swap Risk Plot axes: X = Fail Findings, Y = Prowler ThreatScore [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) - Remove duplicate scan_id filter badge from Findings page [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) diff --git a/ui/actions/overview/compliance-watchlist/compliance-watchlist.adapter.ts b/ui/actions/overview/compliance-watchlist/compliance-watchlist.adapter.ts new file mode 100644 index 0000000000..bc8005edf4 --- /dev/null +++ b/ui/actions/overview/compliance-watchlist/compliance-watchlist.adapter.ts @@ -0,0 +1,72 @@ +import { getComplianceIcon } from "@/components/icons/compliance/IconCompliance"; +import { formatLabel } from "@/lib/categories"; + +import { ComplianceWatchlistResponse } from "./compliance-watchlist.types"; + +export interface EnrichedComplianceWatchlistItem { + id: string; + complianceId: string; + label: string; + icon: ReturnType; + score: number; + requirementsPassed: number; + requirementsFailed: number; + requirementsManual: number; + totalRequirements: number; +} + +/** + * Formats compliance_id into a human-readable label + * e.g., "aws_account_security_onboarding_aws" → "AWS Account Security Onboarding" + * + * Uses the shared formatLabel utility from lib/categories.ts which handles: + * - Acronyms (≤3 chars like AWS, CIS, ISO, PCI, SOC, etc.) + * - Special cases (4+ char acronyms like GDPR, HIPAA, NIST, etc.) + * - Version patterns (e.g., "v1", "v2") + */ +function formatComplianceLabel(complianceId: string): string { + // Remove trailing provider suffix (e.g., "_aws", "_gcp", "_azure") + const withoutProvider = complianceId + .replace(/_aws$/i, "") + .replace(/_gcp$/i, "") + .replace(/_azure$/i, "") + .replace(/_kubernetes$/i, ""); + + return formatLabel(withoutProvider, "_"); +} + +export function adaptComplianceWatchlistResponse( + response: ComplianceWatchlistResponse | undefined, +): EnrichedComplianceWatchlistItem[] { + if (!response?.data) { + return []; + } + + return response.data.map((item) => { + const { + compliance_id, + requirements_passed, + requirements_failed, + requirements_manual, + total_requirements, + } = item.attributes; + + // Defensive conversion: API types are number but JSON parsing edge cases may return strings + const totalReqs = Number(total_requirements) || 0; + const passedReqs = Number(requirements_passed) || 0; + const score = + totalReqs > 0 ? Math.round((passedReqs / totalReqs) * 100) : 0; + + return { + id: item.id, + complianceId: compliance_id, + label: formatComplianceLabel(compliance_id), + icon: getComplianceIcon(compliance_id), + score, + requirementsPassed: requirements_passed, + requirementsFailed: requirements_failed, + requirementsManual: requirements_manual, + totalRequirements: total_requirements, + }; + }); +} diff --git a/ui/actions/overview/compliance-watchlist/compliance-watchlist.ts b/ui/actions/overview/compliance-watchlist/compliance-watchlist.ts new file mode 100644 index 0000000000..647ee99e45 --- /dev/null +++ b/ui/actions/overview/compliance-watchlist/compliance-watchlist.ts @@ -0,0 +1,31 @@ +"use server"; + +import { apiBaseUrl, getAuthHeaders } from "@/lib"; +import { handleApiResponse } from "@/lib/server-actions-helper"; + +import { ComplianceWatchlistResponse } from "./compliance-watchlist.types"; + +export const getComplianceWatchlist = async ({ + filters = {}, +}: { + filters?: Record; +} = {}): Promise => { + const headers = await getAuthHeaders({ contentType: false }); + const url = new URL(`${apiBaseUrl}/overviews/compliance-watchlist`); + + // Append filter parameters (provider_id, provider_type, etc.) + // Exclude filter[search] as this endpoint doesn't support text search + Object.entries(filters).forEach(([key, value]) => { + if (key !== "filter[search]" && value !== undefined) { + url.searchParams.append(key, String(value)); + } + }); + + try { + const response = await fetch(url.toString(), { headers }); + return handleApiResponse(response); + } catch (error) { + console.error("Error fetching compliance watchlist:", error); + return undefined; + } +}; diff --git a/ui/actions/overview/compliance-watchlist/compliance-watchlist.types.ts b/ui/actions/overview/compliance-watchlist/compliance-watchlist.types.ts new file mode 100644 index 0000000000..de3c01f05a --- /dev/null +++ b/ui/actions/overview/compliance-watchlist/compliance-watchlist.types.ts @@ -0,0 +1,24 @@ +const COMPLIANCE_WATCHLIST_OVERVIEW_TYPE = { + WATCHLIST_OVERVIEW: "compliance-watchlist-overviews", +} as const; + +type ComplianceWatchlistOverviewType = + (typeof COMPLIANCE_WATCHLIST_OVERVIEW_TYPE)[keyof typeof COMPLIANCE_WATCHLIST_OVERVIEW_TYPE]; + +export interface ComplianceWatchlistOverviewAttributes { + compliance_id: string; + requirements_passed: number; + requirements_failed: number; + requirements_manual: number; + total_requirements: number; +} + +export interface ComplianceWatchlistOverview { + type: ComplianceWatchlistOverviewType; + id: string; + attributes: ComplianceWatchlistOverviewAttributes; +} + +export interface ComplianceWatchlistResponse { + data: ComplianceWatchlistOverview[]; +} diff --git a/ui/actions/overview/compliance-watchlist/index.ts b/ui/actions/overview/compliance-watchlist/index.ts new file mode 100644 index 0000000000..f7943ced53 --- /dev/null +++ b/ui/actions/overview/compliance-watchlist/index.ts @@ -0,0 +1,9 @@ +export { getComplianceWatchlist } from "./compliance-watchlist"; +export { + adaptComplianceWatchlistResponse, + type EnrichedComplianceWatchlistItem, +} from "./compliance-watchlist.adapter"; +export type { + ComplianceWatchlistOverview, + ComplianceWatchlistResponse, +} from "./compliance-watchlist.types"; diff --git a/ui/app/(prowler)/_overview/watchlist/_components/compliance-watchlist.tsx b/ui/app/(prowler)/_overview/watchlist/_components/compliance-watchlist.tsx index 49e3109e9c..e59ab4e915 100644 --- a/ui/app/(prowler)/_overview/watchlist/_components/compliance-watchlist.tsx +++ b/ui/app/(prowler)/_overview/watchlist/_components/compliance-watchlist.tsx @@ -14,11 +14,16 @@ export interface ComplianceData { score: number; } +// Display 7 items to match the card's min-height (405px) without scrolling +const ITEMS_TO_DISPLAY = 7; + export const ComplianceWatchlist = ({ items }: { items: ComplianceData[] }) => { const [isAsc, setIsAsc] = useState(true); + // Sort all items and take top 7 based on current sort order const sortedItems = [...items] .sort((a, b) => (isAsc ? a.score - b.score : b.score - a.score)) + .slice(0, ITEMS_TO_DISPLAY) .map((item) => ({ key: item.id, icon: item.icon ? ( @@ -41,7 +46,7 @@ export const ComplianceWatchlist = ({ items }: { items: ComplianceData[] }) => { { descendingLabel="Sort by lowest score" /> } + // TODO: Enable full emptyState with description once API endpoint is implemented + // Full emptyState: { message: "...", description: "to add compliance frameworks to your watchlist.", linkText: "Compliance Dashboard" } emptyState={{ - message: "This space is looking empty.", - description: "to add compliance frameworks to your watchlist.", - linkText: "Compliance Dashboard", + message: "No compliance data available.", }} /> ); diff --git a/ui/app/(prowler)/_overview/watchlist/_components/watchlist-card.tsx b/ui/app/(prowler)/_overview/watchlist/_components/watchlist-card.tsx index a74f4b493e..3d6aeebd8a 100644 --- a/ui/app/(prowler)/_overview/watchlist/_components/watchlist-card.tsx +++ b/ui/app/(prowler)/_overview/watchlist/_components/watchlist-card.tsx @@ -85,12 +85,15 @@ export const WatchlistCard = ({ const isEmpty = items.length === 0; return ( - +
{title} {headerAction}
- + {isEmpty ? (
{/* Icon and message */} @@ -102,19 +105,15 @@ export const WatchlistCard = ({
{/* Description with link */} -

- {emptyState?.description && ctaHref && ( - <> - Visit the{" "} - {" "} - {emptyState.description} - - )} -

+ {emptyState?.description && ctaHref && ( +

+ Visit the{" "} + {" "} + {emptyState.description} +

+ )}
) : ( <> @@ -149,7 +148,7 @@ export const WatchlistCard = ({ } }} className={cn( - "flex h-[54px] items-center justify-between gap-2 px-3 py-[11px]", + "flex h-[54px] min-w-0 items-center justify-between gap-2 px-3 py-[11px]", !isLast && "border-border-neutral-tertiary border-b", isClickable && "hover:bg-bg-neutral-tertiary cursor-pointer", @@ -161,10 +160,10 @@ export const WatchlistCard = ({
)} -

+

{item.label}

-
+

{ const filters = pickFilterParams(searchParams); + const response = await getComplianceWatchlist({ filters }); + const enrichedData = adaptComplianceWatchlistResponse(response); - const response = await getCompliancesOverview({ filters }); - const { data } = adaptComplianceOverviewsResponse(response); - - // Filter out ProwlerThreatScore and limit to 5 items - const items = data - .filter((item) => item.framework !== "ProwlerThreatScore") - .slice(0, 5) - .map((compliance) => ({ - id: compliance.id, - framework: compliance.framework, - label: compliance.label, - icon: compliance.icon, - score: compliance.score, + // Filter out ProwlerThreatScore and pass all items to client + // Client handles sorting and limiting to display count + const items = enrichedData + .filter((item) => !item.complianceId.toLowerCase().includes("threatscore")) + .map((item) => ({ + id: item.id, + framework: item.complianceId, + label: item.label, + icon: item.icon, + score: item.score, })); return ; diff --git a/ui/app/(prowler)/page.tsx b/ui/app/(prowler)/page.tsx index 245fae9ef6..ff9d761d35 100644 --- a/ui/app/(prowler)/page.tsx +++ b/ui/app/(prowler)/page.tsx @@ -24,6 +24,7 @@ import { import { StatusChartSkeleton } from "./_overview/status-chart"; import { ThreatScoreSkeleton, ThreatScoreSSR } from "./_overview/threat-score"; import { + ComplianceWatchlistSSR, ServiceWatchlistSSR, WatchlistCardSkeleton, } from "./_overview/watchlist"; @@ -57,19 +58,30 @@ export default async function Home({

-
- }> - - -
-
- }> - - - }> - - + {/* Watchlists: stacked on mobile, row on tablet, stacked on desktop */} +
+
+ }> + + +
+
+ }> + + +
+
+ + {/* Charts column: Attack Surface on top, Findings Over Time below */} +
+ }> + + + }> + + +
diff --git a/ui/lib/categories.ts b/ui/lib/categories.ts index 99d0bb4c8f..8063b3b0ee 100644 --- a/ui/lib/categories.ts +++ b/ui/lib/categories.ts @@ -3,8 +3,15 @@ * Add entries here for edge cases that heuristics can't handle. */ const SPECIAL_CASES: Record = { - // Add special cases here if needed, e.g.: - // "someweirdcase": "SomeWeirdCase", + // Compliance framework acronyms (4+ chars, not caught by length heuristic) + gdpr: "GDPR", + hipaa: "HIPAA", + nist: "NIST", + mitre: "MITRE", + fedramp: "FedRAMP", + ffiec: "FFIEC", + kisa: "KISA", + cisa: "CISA", }; /** @@ -22,14 +29,29 @@ const SPECIAL_CASES: Record = { * - "ec2-imdsv1" -> "EC2 IMDSv1" * - "forensics-ready" -> "Forensics Ready" */ -export function getCategoryLabel(id: string): string { +/** + * Generic label formatter that works with any delimiter. + * Use this for formatting IDs into human-readable labels. + * + * @param id - The ID to format + * @param delimiter - The delimiter to split on (default: "-") + */ +export function formatLabel(id: string, delimiter = "-"): string { return id - .split("-") + .split(delimiter) .map((word) => formatWord(word)) .join(" "); } -function formatWord(word: string): string { +/** + * Converts a category ID to a human-readable label. + * Convenience wrapper for formatLabel with "-" delimiter. + */ +export function getCategoryLabel(id: string): string { + return formatLabel(id, "-"); +} + +export function formatWord(word: string): string { const lowerWord = word.toLowerCase(); // 1. Check special cases dictionary From 484a1d1fef64a7bc4d3a1646861b59d29bb25dde Mon Sep 17 00:00:00 2001 From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com> Date: Thu, 15 Jan 2026 12:46:42 +0100 Subject: [PATCH 5/8] chore: upgrade Node.js to 24.13.0 LTS (#9797) --- .github/workflows/ui-e2e-tests.yml | 2 +- .github/workflows/ui-tests.yml | 2 +- ui/.nvmrc | 2 +- ui/CHANGELOG.md | 4 + ui/Dockerfile | 2 +- ui/dependency-log.json | 16 +-- ui/package.json | 6 +- ui/pnpm-lock.yaml | 151 ++++++++++++----------------- 8 files changed, 83 insertions(+), 102 deletions(-) diff --git a/.github/workflows/ui-e2e-tests.yml b/.github/workflows/ui-e2e-tests.yml index 054bd69f6e..565c378d9a 100644 --- a/.github/workflows/ui-e2e-tests.yml +++ b/.github/workflows/ui-e2e-tests.yml @@ -116,7 +116,7 @@ jobs: - name: Setup Node.js environment uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 with: - node-version: '20.x' + node-version: '24.13.0' - name: Setup pnpm uses: pnpm/action-setup@v4 with: diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml index e657e56960..ca4cbf871b 100644 --- a/.github/workflows/ui-tests.yml +++ b/.github/workflows/ui-tests.yml @@ -16,7 +16,7 @@ concurrency: env: UI_WORKING_DIR: ./ui - NODE_VERSION: '20.x' + NODE_VERSION: '24.13.0' jobs: ui-tests: diff --git a/ui/.nvmrc b/ui/.nvmrc index b009dfb9d9..3fe3b1570a 100644 --- a/ui/.nvmrc +++ b/ui/.nvmrc @@ -1 +1 @@ -lts/* +24.13.0 diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 8a75c50312..6d1f57f6f1 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -20,6 +20,10 @@ All notable changes to the **Prowler UI** are documented in this file. - Remove unused hasDots prop from RadialChart component [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) - Add showCenterLabel prop to RadialChart for optional center text display [(#9773)](https://github.com/prowler-cloud/prowler/pull/9773) +### 🔐 Security + +- Upgrade Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs from January 2026 security advisory [(#9797)](https://github.com/prowler-cloud/prowler/pull/9797) + --- ## [1.16.2] (Prowler v5.16.2) (UNRELEASED) diff --git a/ui/Dockerfile b/ui/Dockerfile index 15e6a71c5e..bad77dae1f 100644 --- a/ui/Dockerfile +++ b/ui/Dockerfile @@ -1,4 +1,4 @@ -FROM node:20-alpine AS base +FROM node:24.13.0-alpine AS base LABEL maintainer="https://github.com/prowler-cloud" diff --git a/ui/dependency-log.json b/ui/dependency-log.json index 57e8812482..1ffc8cb5bf 100644 --- a/ui/dependency-log.json +++ b/ui/dependency-log.json @@ -50,10 +50,10 @@ { "section": "dependencies", "name": "@langchain/core", - "from": "0.3.77", - "to": "1.1.4", + "from": "1.1.8", + "to": "1.1.15", "strategy": "installed", - "generatedAt": "2025-12-15T08:24:46.195Z" + "generatedAt": "2026-01-15T08:46:46.283Z" }, { "section": "dependencies", @@ -410,10 +410,10 @@ { "section": "dependencies", "name": "langchain", - "from": "1.1.4", - "to": "1.1.5", + "from": "1.1.5", + "to": "1.2.10", "strategy": "installed", - "generatedAt": "2025-12-15T08:24:46.195Z" + "generatedAt": "2026-01-15T08:46:46.283Z" }, { "section": "dependencies", @@ -683,9 +683,9 @@ "section": "devDependencies", "name": "@types/node", "from": "20.5.7", - "to": "20.5.7", + "to": "24.10.8", "strategy": "installed", - "generatedAt": "2025-10-22T12:36:37.962Z" + "generatedAt": "2026-01-15T08:43:57.254Z" }, { "section": "devDependencies", diff --git a/ui/package.json b/ui/package.json index aac239f4d7..0158351d6a 100644 --- a/ui/package.json +++ b/ui/package.json @@ -30,7 +30,7 @@ "@hookform/resolvers": "5.2.2", "@internationalized/date": "3.10.0", "@langchain/aws": "1.1.0", - "@langchain/core": "1.1.8", + "@langchain/core": "1.1.15", "@langchain/mcp-adapters": "1.0.3", "@langchain/openai": "1.1.3", "@next/third-parties": "15.5.9", @@ -75,7 +75,7 @@ "jose": "5.10.0", "js-yaml": "4.1.1", "jwt-decode": "4.0.0", - "langchain": "1.1.5", + "langchain": "1.2.10", "lucide-react": "0.543.0", "marked": "15.0.12", "nanoid": "5.1.6", @@ -111,7 +111,7 @@ "@playwright/test": "1.56.1", "@types/d3": "7.4.3", "@types/geojson": "7946.0.16", - "@types/node": "20.5.7", + "@types/node": "24.10.8", "@types/react": "19.1.13", "@types/react-dom": "19.1.9", "@types/topojson-client": "3.1.5", diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml index 9e38766354..cfd6f5272f 100644 --- a/ui/pnpm-lock.yaml +++ b/ui/pnpm-lock.yaml @@ -35,16 +35,16 @@ importers: version: 3.10.0 '@langchain/aws': specifier: 1.1.0 - version: 1.1.0(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) + version: 1.1.0(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) '@langchain/core': - specifier: 1.1.8 - version: 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + specifier: 1.1.15 + version: 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) '@langchain/mcp-adapters': specifier: 1.0.3 - version: 1.0.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@langchain/langgraph@1.0.4(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11)) + version: 1.0.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@langchain/langgraph@1.0.4(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11)) '@langchain/openai': specifier: 1.1.3 - version: 1.1.3(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) + version: 1.1.3(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) '@next/third-parties': specifier: 15.5.9 version: 15.5.9(next@15.5.9(@babel/core@7.28.5)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@19.1.0-rc.3)(react-dom@19.2.2(react@19.2.2))(react@19.2.2))(react@19.2.2) @@ -172,8 +172,8 @@ importers: specifier: 4.0.0 version: 4.0.0 langchain: - specifier: 1.1.5 - version: 1.1.5(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11)) + specifier: 1.2.10 + version: 1.2.10(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11)) lucide-react: specifier: 0.543.0 version: 0.543.0(react@19.2.2) @@ -275,8 +275,8 @@ importers: specifier: 7946.0.16 version: 7946.0.16 '@types/node': - specifier: 20.5.7 - version: 20.5.7 + specifier: 24.10.8 + version: 24.10.8 '@types/react': specifier: 19.1.13 version: 19.1.13 @@ -360,7 +360,7 @@ importers: version: 0.6.14(prettier@3.6.2) shadcn: specifier: 3.4.1 - version: 3.4.1(@cfworker/json-schema@4.1.1)(@types/node@20.5.7)(typescript@5.5.4) + version: 3.4.1(@cfworker/json-schema@4.1.1)(@types/node@24.10.8)(typescript@5.5.4) tailwind-variants: specifier: 0.1.20 version: 0.1.20(tailwindcss@4.1.13) @@ -1711,8 +1711,8 @@ packages: peerDependencies: '@langchain/core': ^1.0.0 - '@langchain/core@1.1.8': - resolution: {integrity: sha512-kIUidOgc0ZdyXo4Ahn9Zas+OayqOfk4ZoKPi7XaDipNSWSApc2+QK5BVcjvwtzxstsNOrmXJiJWEN6WPF/MvAw==} + '@langchain/core@1.1.15': + resolution: {integrity: sha512-b8RN5DkWAmDAlMu/UpTZEluYwCLpm63PPWniRKlE8ie3KkkE7IuMQ38pf4kV1iaiI+d99BEQa2vafQHfCujsRA==} engines: {node: '>=20'} '@langchain/langgraph-checkpoint@1.0.0': @@ -4337,8 +4337,8 @@ packages: '@types/mysql@2.15.27': resolution: {integrity: sha512-YfWiV16IY0OeBfBCk8+hXKmdTKrKlwKN1MNKAPBu5JYxLwBEZl7QzeEpGnlZb3VMGJrrGmB84gXiH+ofs/TezA==} - '@types/node@20.5.7': - resolution: {integrity: sha512-dP7f3LdZIysZnmvP3ANJYTSwg+wLLl8p7RqniVlV7j+oXSXAbt9h0WIBFmJy5inWZoX9wZN6eXx+YXd9Rh3RBA==} + '@types/node@24.10.8': + resolution: {integrity: sha512-r0bBaXu5Swb05doFYO2kTWHMovJnNVbCsII0fhesM8bNRlLhXIuckley4a2DaD+vOdmm5G+zGkQZAPZsF80+YQ==} '@types/pg-pool@2.0.6': resolution: {integrity: sha512-TaAUE5rq2VQYxab5Ts7WZhKNmuN78Q6PiFonTDdpbx8a1H0M1vhy3rhiMjl+e2iHmogyMw7jZF4FrE6eJUy5HQ==} @@ -6401,33 +6401,16 @@ packages: resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==} engines: {node: '>=6'} - langchain@1.1.5: - resolution: {integrity: sha512-tmJHdCsi4AQLEWDeTm9QTWgdwYgIaA4kfp14KFw6e1sUPxjsoHqdFqdf1ZJZxhs1h/n+hpIr3NBfGNBQnWxWEQ==} + langchain@1.2.10: + resolution: {integrity: sha512-9uVxOJE/RTECvNutQfOLwH7f6R9mcq0G/IMHwA2eptDA86R/Yz2zWMz4vARVFPxPrdSJ9nJFDPAqRQlRFwdHBw==} engines: {node: '>=20'} peerDependencies: - '@langchain/core': 1.1.4 + '@langchain/core': 1.1.15 langium@3.3.1: resolution: {integrity: sha512-QJv/h939gDpvT+9SiLVlY7tZC3xB2qK57v0J04Sh9wpMb6MP1q8gB21L3WIo8T5P1MSMg3Ep14L7KkDCFG3y4w==} engines: {node: '>=16.0.0'} - langsmith@0.3.87: - resolution: {integrity: sha512-XXR1+9INH8YX96FKWc5tie0QixWz6tOqAsAKfcJyPkE0xPep+NDz0IQLR32q4bn10QK3LqD2HN6T3n6z1YLW7Q==} - peerDependencies: - '@opentelemetry/api': '*' - '@opentelemetry/exporter-trace-otlp-proto': '*' - '@opentelemetry/sdk-trace-base': '*' - openai: '*' - peerDependenciesMeta: - '@opentelemetry/api': - optional: true - '@opentelemetry/exporter-trace-otlp-proto': - optional: true - '@opentelemetry/sdk-trace-base': - optional: true - openai: - optional: true - langsmith@0.4.2: resolution: {integrity: sha512-BvBeFgSmR9esl8x5wsiDlALiHKKPybw2wE2Hh6x1tgSZki46H9c9KI9/06LARbPhyyDu/TZU7exfg6fnhdj1Qg==} peerDependencies: @@ -8155,6 +8138,9 @@ packages: resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==} engines: {node: '>= 0.4'} + undici-types@7.16.0: + resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==} + unicorn-magic@0.3.0: resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==} engines: {node: '>=18'} @@ -10596,31 +10582,31 @@ snapshots: '@inquirer/ansi@1.0.2': {} - '@inquirer/confirm@5.1.21(@types/node@20.5.7)': + '@inquirer/confirm@5.1.21(@types/node@24.10.8)': dependencies: - '@inquirer/core': 10.3.2(@types/node@20.5.7) - '@inquirer/type': 3.0.10(@types/node@20.5.7) + '@inquirer/core': 10.3.2(@types/node@24.10.8) + '@inquirer/type': 3.0.10(@types/node@24.10.8) optionalDependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 - '@inquirer/core@10.3.2(@types/node@20.5.7)': + '@inquirer/core@10.3.2(@types/node@24.10.8)': dependencies: '@inquirer/ansi': 1.0.2 '@inquirer/figures': 1.0.15 - '@inquirer/type': 3.0.10(@types/node@20.5.7) + '@inquirer/type': 3.0.10(@types/node@24.10.8) cli-width: 4.1.0 mute-stream: 2.0.0 signal-exit: 4.1.0 wrap-ansi: 6.2.0 yoctocolors-cjs: 2.1.3 optionalDependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 '@inquirer/figures@1.0.15': {} - '@inquirer/type@3.0.10(@types/node@20.5.7)': + '@inquirer/type@3.0.10(@types/node@24.10.8)': optionalDependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 '@internationalized/date@3.10.0': dependencies: @@ -10682,17 +10668,17 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.5 - '@langchain/aws@1.1.0(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))': + '@langchain/aws@1.1.0(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))': dependencies: '@aws-sdk/client-bedrock-agent-runtime': 3.948.0 '@aws-sdk/client-bedrock-runtime': 3.948.0 '@aws-sdk/client-kendra': 3.948.0 '@aws-sdk/credential-provider-node': 3.948.0 - '@langchain/core': 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/core': 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) transitivePeerDependencies: - aws-crt - '@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))': + '@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))': dependencies: '@cfworker/json-schema': 4.1.1 ansi-styles: 5.2.0 @@ -10710,26 +10696,26 @@ snapshots: - '@opentelemetry/sdk-trace-base' - openai - '@langchain/langgraph-checkpoint@1.0.0(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))': + '@langchain/langgraph-checkpoint@1.0.0(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))': dependencies: - '@langchain/core': 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/core': 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) uuid: 10.0.0 - '@langchain/langgraph-sdk@1.2.0(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)': + '@langchain/langgraph-sdk@1.2.0(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)': dependencies: p-queue: 6.6.2 p-retry: 4.6.2 uuid: 9.0.1 optionalDependencies: - '@langchain/core': 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/core': 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) react: 19.2.2 react-dom: 19.2.2(react@19.2.2) - '@langchain/langgraph@1.0.4(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11)': + '@langchain/langgraph@1.0.4(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11)': dependencies: - '@langchain/core': 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) - '@langchain/langgraph-checkpoint': 1.0.0(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) - '@langchain/langgraph-sdk': 1.2.0(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2) + '@langchain/core': 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/langgraph-checkpoint': 1.0.0(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) + '@langchain/langgraph-sdk': 1.2.0(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2) uuid: 10.0.0 zod: 4.1.11 optionalDependencies: @@ -10738,10 +10724,10 @@ snapshots: - react - react-dom - '@langchain/mcp-adapters@1.0.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@langchain/langgraph@1.0.4(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11))': + '@langchain/mcp-adapters@1.0.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@langchain/langgraph@1.0.4(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11))': dependencies: - '@langchain/core': 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) - '@langchain/langgraph': 1.0.4(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11) + '@langchain/core': 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/langgraph': 1.0.4(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11) '@modelcontextprotocol/sdk': 1.24.3(@cfworker/json-schema@4.1.1)(zod@4.1.11) debug: 4.4.3 zod: 4.1.11 @@ -10751,9 +10737,9 @@ snapshots: - '@cfworker/json-schema' - supports-color - '@langchain/openai@1.1.3(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))': + '@langchain/openai@1.1.3(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))': dependencies: - '@langchain/core': 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/core': 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) js-tiktoken: 1.0.21 openai: 6.10.0(zod@4.1.11) zod: 4.1.11 @@ -13905,7 +13891,7 @@ snapshots: '@types/connect@3.4.38': dependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 '@types/d3-array@3.2.2': {} @@ -14066,9 +14052,11 @@ snapshots: '@types/mysql@2.15.27': dependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 - '@types/node@20.5.7': {} + '@types/node@24.10.8': + dependencies: + undici-types: 7.16.0 '@types/pg-pool@2.0.6': dependencies: @@ -14076,7 +14064,7 @@ snapshots: '@types/pg@8.15.6': dependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 pg-protocol: 1.10.3 pg-types: 2.2.0 @@ -14094,7 +14082,7 @@ snapshots: '@types/tedious@4.0.14': dependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 '@types/topojson-client@3.1.5': dependencies: @@ -16295,7 +16283,7 @@ snapshots: jest-worker@27.5.1: dependencies: - '@types/node': 20.5.7 + '@types/node': 24.10.8 merge-stream: 2.0.0 supports-color: 8.1.1 @@ -16364,12 +16352,12 @@ snapshots: kleur@4.1.5: {} - langchain@1.1.5(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11)): + langchain@1.2.10(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11)): dependencies: - '@langchain/core': 1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) - '@langchain/langgraph': 1.0.4(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11) - '@langchain/langgraph-checkpoint': 1.0.0(@langchain/core@1.1.8(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) - langsmith: 0.3.87(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/core': 1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) + '@langchain/langgraph': 1.0.4(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)))(react-dom@19.2.2(react@19.2.2))(react@19.2.2)(zod-to-json-schema@3.25.0(zod@4.1.11))(zod@4.1.11) + '@langchain/langgraph-checkpoint': 1.0.0(@langchain/core@1.1.15(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11))) + langsmith: 0.4.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)) uuid: 10.0.0 zod: 4.1.11 transitivePeerDependencies: @@ -16389,19 +16377,6 @@ snapshots: vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.0.8 - langsmith@0.3.87(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)): - dependencies: - '@types/uuid': 10.0.0 - chalk: 4.1.2 - console-table-printer: 2.15.0 - p-queue: 6.6.2 - semver: 7.7.3 - uuid: 10.0.0 - optionalDependencies: - '@opentelemetry/api': 1.9.0 - '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.0) - openai: 6.10.0(zod@4.1.11) - langsmith@0.4.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.2.0(@opentelemetry/api@1.9.0))(openai@6.10.0(zod@4.1.11)): dependencies: '@types/uuid': 10.0.0 @@ -17057,9 +17032,9 @@ snapshots: ms@2.1.3: {} - msw@2.12.4(@types/node@20.5.7)(typescript@5.5.4): + msw@2.12.4(@types/node@24.10.8)(typescript@5.5.4): dependencies: - '@inquirer/confirm': 5.1.21(@types/node@20.5.7) + '@inquirer/confirm': 5.1.21(@types/node@24.10.8) '@mswjs/interceptors': 0.40.0 '@open-draft/deferred-promise': 2.2.0 '@types/statuses': 2.0.6 @@ -18016,7 +17991,7 @@ snapshots: setprototypeof@1.2.0: {} - shadcn@3.4.1(@cfworker/json-schema@4.1.1)(@types/node@20.5.7)(typescript@5.5.4): + shadcn@3.4.1(@cfworker/json-schema@4.1.1)(@types/node@24.10.8)(typescript@5.5.4): dependencies: '@antfu/ni': 25.0.0 '@babel/core': 7.28.5 @@ -18037,7 +18012,7 @@ snapshots: fuzzysort: 3.1.0 https-proxy-agent: 7.0.6 kleur: 4.1.5 - msw: 2.12.4(@types/node@20.5.7)(typescript@5.5.4) + msw: 2.12.4(@types/node@24.10.8)(typescript@5.5.4) node-fetch: 3.3.2 ora: 8.2.0 postcss: 8.5.6 @@ -18559,6 +18534,8 @@ snapshots: has-symbols: 1.1.0 which-boxed-primitive: 1.1.1 + undici-types@7.16.0: {} + unicorn-magic@0.3.0: {} unified@11.0.5: From 76aa65cb6196a1ac5baa2d8342caead566fe52a7 Mon Sep 17 00:00:00 2001 From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com> Date: Thu, 15 Jan 2026 12:55:13 +0100 Subject: [PATCH 6/8] chore(ui): CHANGELOG.md updated (#9800) --- ui/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 6d1f57f6f1..4a5b1caec1 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -10,10 +10,10 @@ All notable changes to the **Prowler UI** are documented in this file. - New findings table UI with new design system components, improved filtering UX, and enhanced table interactions [(#9699)](https://github.com/prowler-cloud/prowler/pull/9699) - Add gradient background to Risk Plot for visual risk context [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) - Add ThreatScore pillar breakdown to Compliance Summary page and detail view [(#9773)](https://github.com/prowler-cloud/prowler/pull/9773) +- Compliance Watchlist component in Overview page [(#9786)](https://github.com/prowler-cloud/prowler/pull/9786) ### 🔄 Changed -- Integrate Compliance Watchlist with new `/overviews/compliance-watchlist` endpoint [(#9786)](https://github.com/prowler-cloud/prowler/pull/9786) - Refactor ScatterPlot as reusable generic component with TypeScript generics [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) - Swap Risk Plot axes: X = Fail Findings, Y = Prowler ThreatScore [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) - Remove duplicate scan_id filter badge from Findings page [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) From 847645543a6a60193c9156907db1c8481b21926c Mon Sep 17 00:00:00 2001 From: Josema Camacho Date: Thu, 15 Jan 2026 13:00:54 +0100 Subject: [PATCH 7/8] feat(attack-paths): update boto dependencies for catrography compatibility (#9798) Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com> --- poetry.lock | 33 +++++++++++-------- pyproject.toml | 4 +-- tests/providers/aws/aws_provider_test.py | 8 ++++- .../eventbridge/eventbridge_service_test.py | 3 +- .../guardduty_is_enabled_test.py | 14 +++++--- 5 files changed, 39 insertions(+), 23 deletions(-) diff --git a/poetry.lock b/poetry.lock index a04d0f80a9..449f1dce8d 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 2.1.3 and should not be changed by hand. +# This file is automatically @generated by Poetry 2.1.4 and should not be changed by hand. [[package]] name = "about-time" @@ -1512,34 +1512,34 @@ files = [ [[package]] name = "boto3" -version = "1.39.15" +version = "1.40.61" description = "The AWS SDK for Python" optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ - {file = "boto3-1.39.15-py3-none-any.whl", hash = "sha256:38fc54576b925af0075636752de9974e172c8a2cf7133400e3e09b150d20fb6a"}, - {file = "boto3-1.39.15.tar.gz", hash = "sha256:b4483625f0d8c35045254dee46cd3c851bbc0450814f20b9b25bee1b5c0d8409"}, + {file = "boto3-1.40.61-py3-none-any.whl", hash = "sha256:6b9c57b2a922b5d8c17766e29ed792586a818098efe84def27c8f582b33f898c"}, + {file = "boto3-1.40.61.tar.gz", hash = "sha256:d6c56277251adf6c2bdd25249feae625abe4966831676689ff23b4694dea5b12"}, ] [package.dependencies] -botocore = ">=1.39.15,<1.40.0" +botocore = ">=1.40.61,<1.41.0" jmespath = ">=0.7.1,<2.0.0" -s3transfer = ">=0.13.0,<0.14.0" +s3transfer = ">=0.14.0,<0.15.0" [package.extras] crt = ["botocore[crt] (>=1.21.0,<2.0a0)"] [[package]] name = "botocore" -version = "1.39.15" +version = "1.40.61" description = "Low-level, data-driven core of boto 3." optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ - {file = "botocore-1.39.15-py3-none-any.whl", hash = "sha256:eb9cfe918ebfbfb8654e1b153b29f0c129d586d2c0d7fb4032731d49baf04cff"}, - {file = "botocore-1.39.15.tar.gz", hash = "sha256:2aa29a717f14f8c7ca058c2e297aaed0aa10ecea24b91514eee802814d1b7600"}, + {file = "botocore-1.40.61-py3-none-any.whl", hash = "sha256:17ebae412692fd4824f99cde0f08d50126dc97954008e5ba2b522eb049238aa7"}, + {file = "botocore-1.40.61.tar.gz", hash = "sha256:a2487ad69b090f9cccd64cf07c7021cd80ee9c0655ad974f87045b02f3ef52cd"}, ] [package.dependencies] @@ -1551,7 +1551,7 @@ urllib3 = [ ] [package.extras] -crt = ["awscrt (==0.23.8)"] +crt = ["awscrt (==0.27.6)"] [[package]] name = "cachetools" @@ -5613,6 +5613,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f66efbc1caa63c088dead1c4170d148eabc9b80d95fb75b6c92ac0aad2437d76"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:22353049ba4181685023b25b5b51a574bce33e7f51c759371a7422dcae5402a6"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:932205970b9f9991b34f55136be327501903f7c66830e9760a8ffb15b07f05cd"}, + {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:a52d48f4e7bf9005e8f0a89209bf9a73f7190ddf0489eee5eb51377385f59f2a"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-win32.whl", hash = "sha256:3eac5a91891ceb88138c113f9db04f3cebdae277f5d44eaa3651a4f573e6a5da"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-win_amd64.whl", hash = "sha256:ab007f2f5a87bd08ab1499bdf96f3d5c6ad4dcfa364884cb4549aa0154b13a28"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-macosx_13_0_arm64.whl", hash = "sha256:4a6679521a58256a90b0d89e03992c15144c5f3858f40d7c18886023d7943db6"}, @@ -5621,6 +5622,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:811ea1594b8a0fb466172c384267a4e5e367298af6b228931f273b111f17ef52"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:cf12567a7b565cbf65d438dec6cfbe2917d3c1bdddfce84a9930b7d35ea59642"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:7dd5adc8b930b12c8fc5b99e2d535a09889941aa0d0bd06f4749e9a9397c71d2"}, + {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1492a6051dab8d912fc2adeef0e8c72216b24d57bd896ea607cb90bb0c4981d3"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-win32.whl", hash = "sha256:bd0a08f0bab19093c54e18a14a10b4322e1eacc5217056f3c063bd2f59853ce4"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-win_amd64.whl", hash = "sha256:a274fb2cb086c7a3dea4322ec27f4cb5cc4b6298adb583ab0e211a4682f241eb"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:20b0f8dc160ba83b6dcc0e256846e1a02d044e13f7ea74a3d1d56ede4e48c632"}, @@ -5629,6 +5631,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:749c16fcc4a2b09f28843cda5a193e0283e47454b63ec4b81eaa2242f50e4ccd"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-musllinux_1_1_i686.whl", hash = "sha256:bf165fef1f223beae7333275156ab2022cffe255dcc51c27f066b4370da81e31"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:32621c177bbf782ca5a18ba4d7af0f1082a3f6e517ac2a18b3974d4edf349680"}, + {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b82a7c94a498853aa0b272fd5bc67f29008da798d4f93a2f9f289feb8426a58d"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-win32.whl", hash = "sha256:e8c4ebfcfd57177b572e2040777b8abc537cdef58a2120e830124946aa9b42c5"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-win_amd64.whl", hash = "sha256:0467c5965282c62203273b838ae77c0d29d7638c8a4e3a1c8bdd3602c10904e4"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:4c8c5d82f50bb53986a5e02d1b3092b03622c02c2eb78e29bec33fd9593bae1a"}, @@ -5637,6 +5640,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:96777d473c05ee3e5e3c3e999f5d23c6f4ec5b0c38c098b3a5229085f74236c6"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-musllinux_1_1_i686.whl", hash = "sha256:3bc2a80e6420ca8b7d3590791e2dfc709c88ab9152c00eeb511c9875ce5778bf"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:e188d2699864c11c36cdfdada94d781fd5d6b0071cd9c427bceb08ad3d7c70e1"}, + {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:4f6f3eac23941b32afccc23081e1f50612bdbe4e982012ef4f5797986828cd01"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-win32.whl", hash = "sha256:6442cb36270b3afb1b4951f060eccca1ce49f3d087ca1ca4563a6eb479cb3de6"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-win_amd64.whl", hash = "sha256:e5b8daf27af0b90da7bb903a876477a9e6d7270be6146906b276605997c7e9a3"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-macosx_12_0_arm64.whl", hash = "sha256:fc4b630cd3fa2cf7fce38afa91d7cfe844a9f75d7f0f36393fa98815e911d987"}, @@ -5645,6 +5649,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e2f1c3765db32be59d18ab3953f43ab62a761327aafc1594a2a1fbe038b8b8a7"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:d85252669dc32f98ebcd5d36768f5d4faeaeaa2d655ac0473be490ecdae3c285"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:e143ada795c341b56de9418c58d028989093ee611aa27ffb9b7f609c00d813ed"}, + {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:2c59aa6170b990d8d2719323e628aaf36f3bfbc1c26279c0eeeb24d05d2d11c7"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-win32.whl", hash = "sha256:beffaed67936fbbeffd10966a4eb53c402fafd3d6833770516bf7314bc6ffa12"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-win_amd64.whl", hash = "sha256:040ae85536960525ea62868b642bdb0c2cc6021c9f9d507810c0c604e66f5a7b"}, {file = "ruamel.yaml.clib-0.2.12.tar.gz", hash = "sha256:6c8fbb13ec503f99a91901ab46e0b07ae7941cd527393187039aec586fdfd36f"}, @@ -5652,14 +5657,14 @@ files = [ [[package]] name = "s3transfer" -version = "0.13.1" +version = "0.14.0" description = "An Amazon S3 Transfer Manager" optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ - {file = "s3transfer-0.13.1-py3-none-any.whl", hash = "sha256:a981aa7429be23fe6dfc13e80e4020057cbab622b08c0315288758d67cabc724"}, - {file = "s3transfer-0.13.1.tar.gz", hash = "sha256:c3fdba22ba1bd367922f27ec8032d6a1cf5f10c934fb5d68cf60fd5a23d936cf"}, + {file = "s3transfer-0.14.0-py3-none-any.whl", hash = "sha256:ea3b790c7077558ed1f02a3072fb3cb992bbbd253392f4b6e9e8976941c7d456"}, + {file = "s3transfer-0.14.0.tar.gz", hash = "sha256:eff12264e7c8b4985074ccce27a3b38a485bb7f7422cc8046fee9be4983e4125"}, ] [package.dependencies] @@ -6553,4 +6558,4 @@ files = [ [metadata] lock-version = "2.1" python-versions = ">3.9.1,<3.13" -content-hash = "841d93c4db73d37dbc83d2b252bb022917974dc44fc4cca6eb60c41288ad49d9" +content-hash = "cff68fda632d74e4aa5b87843d0efa818820c61e1e9a407cb21b83810766f9a1" diff --git a/pyproject.toml b/pyproject.toml index b9bbbd800e..3c3ca6e6b0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -41,8 +41,8 @@ dependencies = [ "azure-monitor-query==2.0.0", "azure-storage-blob==12.24.1", "cloudflare==4.3.1", - "boto3==1.39.15", - "botocore==1.39.15", + "boto3==1.40.61", + "botocore==1.40.61", "colorama==0.4.6", "cryptography==44.0.1", "dash==3.1.1", diff --git a/tests/providers/aws/aws_provider_test.py b/tests/providers/aws/aws_provider_test.py index 6d04022abf..5162a080f2 100644 --- a/tests/providers/aws/aws_provider_test.py +++ b/tests/providers/aws/aws_provider_test.py @@ -844,7 +844,13 @@ aws: aws_provider = AwsProvider() response = aws_provider.generate_regional_clients("ec2") - assert len(response.keys()) == 33 + # Only commercial regions (not GovCloud/China) should have regional clients + commercial_regions = { + r + for r in aws_provider._enabled_regions + if not r.startswith("cn-") and not r.startswith("us-gov-") + } + assert set(response.keys()) == commercial_regions @mock_aws def test_generate_regional_clients_with_enabled_regions(self): diff --git a/tests/providers/aws/services/eventbridge/eventbridge_service_test.py b/tests/providers/aws/services/eventbridge/eventbridge_service_test.py index c9b9ce4dcf..f0aa7e7541 100644 --- a/tests/providers/aws/services/eventbridge/eventbridge_service_test.py +++ b/tests/providers/aws/services/eventbridge/eventbridge_service_test.py @@ -135,7 +135,8 @@ class Test_EventBridge_Service: ) aws_provider = set_mocked_aws_provider() eventbridge = EventBridge(aws_provider) - assert len(eventbridge.buses) == 34 # 1 per region + # Each region has a default bus, plus the "test" bus we created in us-east-1 + assert len(eventbridge.buses) == len(eventbridge.regional_clients) + 1 for bus in eventbridge.buses.values(): if bus.name == "test": assert ( diff --git a/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py b/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py index 9600b320ac..ca8a9e5877 100644 --- a/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py +++ b/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py @@ -55,7 +55,7 @@ class Test_guardduty_is_enabled: patch( "prowler.providers.aws.services.guardduty.guardduty_is_enabled.guardduty_is_enabled.guardduty_client", new=GuardDuty(aws_provider), - ), + ) as mock_guardduty_client, ): from prowler.providers.aws.services.guardduty.guardduty_is_enabled.guardduty_is_enabled import ( guardduty_is_enabled, @@ -63,7 +63,8 @@ class Test_guardduty_is_enabled: check = guardduty_is_enabled() results = check.execute() - assert len(results) == 32 + # One result per detector (one detector per region) + assert len(results) == len(mock_guardduty_client.detectors) for result in results: if result.region == AWS_REGION_EU_WEST_1: assert result.status == "PASS" @@ -108,7 +109,8 @@ class Test_guardduty_is_enabled: check = guardduty_is_enabled() results = check.execute() - assert len(results) == 32 + # One result per detector (one detector per region) + assert len(results) == len(mock_guardduty_client.detectors) for result in results: if result.region == AWS_REGION_EU_WEST_1: assert result.status == "FAIL" @@ -153,7 +155,8 @@ class Test_guardduty_is_enabled: check = guardduty_is_enabled() results = check.execute() - assert len(results) == 32 + # One result per detector (one detector per region) + assert len(results) == len(mock_guardduty_client.detectors) for result in results: if result.region == AWS_REGION_EU_WEST_1: assert result.status == "FAIL" @@ -196,7 +199,8 @@ class Test_guardduty_is_enabled: check = guardduty_is_enabled() results = check.execute() - assert len(results) == 32 + # One result per detector (one detector per region) + assert len(results) == len(mock_guardduty_client.detectors) for result in results: if result.region == AWS_REGION_EU_WEST_1: assert result.status == "FAIL" From 3317c0a5e0cf1d3d4121ba39bfc0f1dcfd8db592 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Thu, 15 Jan 2026 13:01:21 +0100 Subject: [PATCH 8/8] chore(aws): enhance metadata for `ec2` service (#9549) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + .../ec2_ami_public.metadata.json | 27 ++++++++----- ...t_connection_logging_enabled.metadata.json | 37 +++++++++++------- .../ec2_ebs_default_encryption.metadata.json | 36 +++++++++++------- .../ec2_ebs_public_snapshot.metadata.json | 28 ++++++++------ ..._account_block_public_access.metadata.json | 34 ++++++++++------- .../ec2_ebs_snapshots_encrypted.metadata.json | 35 ++++++++++------- .../ec2_ebs_volume_encryption.metadata.json | 35 ++++++++++------- ...ume_protected_by_backup_plan.metadata.json | 37 ++++++++++-------- ..._ebs_volume_snapshots_exists.metadata.json | 36 ++++++++++-------- .../ec2_elastic_ip_shodan.metadata.json | 23 ++++++----- .../ec2_elastic_ip_unassigned.metadata.json | 30 +++++++++------ ...tance_account_imdsv2_enabled.metadata.json | 34 ++++++++++------- ..._detailed_monitoring_enabled.metadata.json | 32 ++++++++++------ .../ec2_instance_imdsv2_enabled.metadata.json | 31 +++++++++------ ...facing_with_instance_profile.metadata.json | 34 ++++++++++------- .../ec2_instance_managed_by_ssm.metadata.json | 34 ++++++++++------- ...nce_older_than_specific_days.metadata.json | 23 ++++++----- ...c2_instance_paravirtual_type.metadata.json | 35 ++++++++++------- ...assandra_exposed_to_internet.metadata.json | 30 +++++++++------ ...ort_cifs_exposed_to_internet.metadata.json | 31 +++++++++------ ...h_kibana_exposed_to_internet.metadata.json | 31 +++++++++------ ...port_ftp_exposed_to_internet.metadata.json | 31 +++++++++------ ...rt_kafka_exposed_to_internet.metadata.json | 32 ++++++++++------ ...kerberos_exposed_to_internet.metadata.json | 29 ++++++++------ ...ort_ldap_exposed_to_internet.metadata.json | 29 ++++++++------ ...emcached_exposed_to_internet.metadata.json | 29 ++++++++------ ..._mongodb_exposed_to_internet.metadata.json | 32 ++++++++++------ ...rt_mysql_exposed_to_internet.metadata.json | 31 +++++++++------ ...t_oracle_exposed_to_internet.metadata.json | 32 ++++++++++------ ...stgresql_exposed_to_internet.metadata.json | 32 ++++++++++------ ...port_rdp_exposed_to_internet.metadata.json | 32 ++++++++++------ ...rt_redis_exposed_to_internet.metadata.json | 31 +++++++++------ ...qlserver_exposed_to_internet.metadata.json | 32 ++++++++++------ ...port_ssh_exposed_to_internet.metadata.json | 31 +++++++++------ ...t_telnet_exposed_to_internet.metadata.json | 30 +++++++++------ ...c2_instance_profile_attached.metadata.json | 29 ++++++++------ .../ec2_instance_public_ip.metadata.json | 28 ++++++++------ ...2_instance_secrets_user_data.metadata.json | 31 +++++++++------ ...ec2_instance_uses_single_eni.metadata.json | 29 ++++++++------ ...2_instance_with_outdated_ami.metadata.json | 36 +++++++++++------- ...nch_template_imdsv2_required.metadata.json | 37 +++++++++++------- ...launch_template_no_public_ip.metadata.json | 36 +++++++++++------- ...2_launch_template_no_secrets.metadata.json | 35 +++++++++++------ ...rkacl_allow_ingress_any_port.metadata.json | 38 +++++++++++-------- ...cl_allow_ingress_tcp_port_22.metadata.json | 29 ++++++++------ ..._allow_ingress_tcp_port_3389.metadata.json | 31 +++++++++------ .../ec2_networkacl_unused.metadata.json | 34 ++++++++++------- ...s_from_internet_to_all_ports.metadata.json | 30 +++++++++------ ...ss_from_internet_to_any_port.metadata.json | 29 ++++++++------ ...ernet_to_high_risk_tcp_ports.metadata.json | 31 +++++++++------ ...from_internet_to_tcp_port_22.metadata.json | 31 +++++++++------ ...om_internet_to_tcp_port_3389.metadata.json | 31 +++++++++------ ...ort_cassandra_7199_9160_8888.metadata.json | 31 +++++++++------ ...search_kibana_9200_9300_5601.metadata.json | 30 +++++++++------ ...ternet_to_tcp_port_ftp_20_21.metadata.json | 37 ++++++++++-------- ...ernet_to_tcp_port_kafka_9092.metadata.json | 31 +++++++++------ ..._to_tcp_port_memcached_11211.metadata.json | 29 ++++++++------ ...tcp_port_mongodb_27017_27018.metadata.json | 38 +++++++++++-------- ...ernet_to_tcp_port_mysql_3306.metadata.json | 29 ++++++++------ ...to_tcp_port_oracle_1521_2483.metadata.json | 27 +++++++------ ...et_to_tcp_port_postgres_5432.metadata.json | 32 ++++++++++------ ...ernet_to_tcp_port_redis_6379.metadata.json | 32 ++++++++++------ ...cp_port_sql_server_1433_1434.metadata.json | 33 +++++++++------- ...ternet_to_tcp_port_telnet_23.metadata.json | 32 ++++++++++------ ..._allow_wide_open_public_ipv4.metadata.json | 29 ++++++++------ ...oup_default_restrict_traffic.metadata.json | 30 +++++++++------ ...ritygroup_from_launch_wizard.metadata.json | 28 ++++++++------ .../ec2_securitygroup_not_used.metadata.json | 30 +++++++++------ ...th_many_ingress_egress_rules.metadata.json | 34 ++++++++++------- ..._auto_accept_vpc_attachments.metadata.json | 36 +++++++++++------- 71 files changed, 1359 insertions(+), 861 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index a8c306af67..7fe5d9cef2 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -52,6 +52,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS IAM service metadata to new format [(#9550)](https://github.com/prowler-cloud/prowler/pull/9550) - Enhance `user_registration_details` perfomance and user `mfa` evaluation [(#9236)](https://github.com/prowler-cloud/prowler/pull/9236) - Update AWS Cognito service metadata to new format [(#8853)](https://github.com/prowler-cloud/prowler/pull/8853) +- Update AWS EC2 service metadata to new format [(#9549)](https://github.com/prowler-cloud/prowler/pull/9549) --- diff --git a/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.metadata.json b/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.metadata.json index d01f57ab62..d54d112516 100644 --- a/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_ami_public", - "CheckTitle": "Ensure there are no EC2 AMIs set as Public.", + "CheckTitle": "EC2 AMI owned by the account is not public", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "ami", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "Other", "ResourceGroup": "compute", - "Description": "Ensure there are no EC2 AMIs set as Public.", - "Risk": "When your AMIs are publicly accessible, they are available in the Community AMIs where everyone with an AWS account can use them to launch EC2 instances. Your AMIs could contain snapshots of your applications (including their data), therefore exposing your snapshots in this manner is not advised.", + "Description": "**EC2 AMIs owned by the account** are evaluated for **public visibility** via their launch permissions. Images shared with all accounts (`Group=all`) are treated as publicly accessible.", + "Risk": "Public AMIs expose image contents to any AWS account, undermining **confidentiality** and **integrity**:\n- Leakage of embedded secrets, configs, or data from referenced snapshots\n- Adversaries can fingerprint your stack, aiding targeted exploits or repackaging for supply chain abuse", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cancel-sharing-an-AMI.html", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html", + "https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-intro.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 modify-image-attribute --region --image-id --launch-permission {\"Remove\":[{\"Group\":\"all\"}]}", + "CLI": "aws ec2 modify-image-attribute --image-id --launch-permission \"Remove=[{Group=all}]\"", "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/public-policies/public_8", + "Other": "1. Open the Amazon EC2 console and go to AMIs\n2. Select the AMI with Visibility = Public\n3. Click Actions > Edit AMI permissions\n4. Under AMI availability, select Private\n5. Click Save changes", "Terraform": "" }, "Recommendation": { - "Text": "We recommend your EC2 AMIs are not publicly accessible, or generally available in the Community AMIs.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cancel-sharing-an-AMI.html" + "Text": "Keep AMIs **private** and enforce **least privilege** launch permissions. Share only with specific accounts and review access routinely. Enable **block public access for AMIs**, sanitize images to remove secrets, encrypt backing snapshots, and apply lifecycle governance to retire outdated images.", + "Url": "https://hub.prowler.com/check/ec2_ami_public" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.metadata.json b/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.metadata.json index 1f78c2ffb1..8a9ad91e20 100644 --- a/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.metadata.json @@ -1,30 +1,41 @@ { "Provider": "aws", "CheckID": "ec2_client_vpn_endpoint_connection_logging_enabled", - "CheckTitle": "EC2 Client VPN endpoints should have client connection logging enabled.", - "CheckType": [], + "CheckTitle": "EC2 Client VPN endpoint has client connection logging enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)" + ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsEc2ClientVpnEndpoint", "ResourceGroup": "network", - "Description": "This control checks whether an AWS Client VPN endpoint has client connection logging enabled. The control fails if the endpoint doesn't have client connection logging enabled.", - "Risk": "Client VPN endpoints allow remote clients to securely connect to resources in a Virtual Private Cloud (VPC) in AWS. Connection logs allow you to track user activity on the VPN endpoint and provides visibility.", - "RelatedUrl": "https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html", + "Description": "**AWS Client VPN endpoints** are evaluated for **client connection logging** that records client connect/disconnect events to CloudWatch Logs. The evaluation detects endpoints where this logging is disabled.", + "Risk": "Without **Client VPN connection logs**, remote access lacks an **audit trail**, reducing detection and accountability.\n- Stolen credentials can be used unnoticed\n- Lateral movement and data exfiltration persist\nImpacts **confidentiality** and **integrity**; delayed investigation can degrade **availability**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-51", + "https://docs.aws.amazon.com/config/latest/developerguide/ec2-client-vpn-connection-log-enabled.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-51", - "Terraform": "" + "CLI": "aws ec2 modify-client-vpn-endpoint --client-vpn-endpoint-id --connection-log-options Enabled=true,CloudWatchLogGroup=", + "NativeIaC": "```yaml\n# CloudFormation: enable connection logging on a Client VPN endpoint\nResources:\n :\n Type: AWS::EC2::ClientVpnEndpoint\n Properties:\n ClientCidrBlock: 10.0.0.0/22\n ServerCertificateArn: arn:aws:acm:::certificate/\n AuthenticationOptions:\n - Type: certificate-authentication\n MutualAuthentication:\n ClientRootCertificateChainArn: arn:aws:acm:::certificate/\n ConnectionLogOptions: # CRITICAL: enables client connection logging\n Enabled: true # CRITICAL: turns on logging\n CloudWatchLogGroup: # CRITICAL: destination log group\n```", + "Other": "1. Open the Amazon VPC console and go to Client VPN Endpoints\n2. Select the endpoint and choose Actions > Modify client VPN endpoint\n3. Under Connection logging, check Enable\n4. For CloudWatch log group, select an existing log group\n5. Click Save changes", + "Terraform": "```hcl\n# Terraform: enable connection logging on a Client VPN endpoint\nresource \"aws_ec2_client_vpn_endpoint\" \"\" {\n server_certificate_arn = \"arn:aws:acm:::certificate/\"\n client_cidr_block = \"10.0.0.0/22\"\n\n authentication_options {\n type = \"certificate-authentication\"\n root_certificate_chain_arn = \"arn:aws:acm:::certificate/\"\n }\n\n connection_log_options { # CRITICAL: enables client connection logging\n enabled = true # CRITICAL: turns on logging\n cloudwatch_log_group = \"\" # CRITICAL: destination log group\n }\n}\n```" }, "Recommendation": { - "Text": "To enable connection logging, see Enable connection logging for an existing Client VPN endpoint in the AWS Client VPN Administrator Guide.", - "Url": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-client-vpn-connection-log-enabled.html" + "Text": "Enable **client connection logging** on all Client VPN endpoints and send events to a centralized log group.\n- Enforce least privilege on log access\n- Define retention and immutability\n- Integrate with monitoring/alerts\n- Separate VPN operations from log administration\n- Review anomalous login patterns", + "Url": "https://hub.prowler.com/check/ec2_client_vpn_endpoint_connection_logging_enabled" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.metadata.json b/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.metadata.json index 8e61062980..691af1b376 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_ebs_default_encryption", - "CheckTitle": "Check if EBS Default Encryption is activated.", + "CheckTitle": "EBS default encryption is enabled", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "ebs", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "medium", - "ResourceType": "Other", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "AwsEc2Volume", "ResourceGroup": "compute", - "Description": "Check if EBS Default Encryption is activated.", - "Risk": "If not enabled sensitive information at rest is not protected.", + "Description": "**EBS** uses `encryption by default` at the account and region level, ensuring new volumes, snapshots, and AMI-backed volumes are automatically encrypted with a chosen **KMS key**", + "Risk": "Without `encryption by default`, data on new **EBS volumes** and **snapshots** may be stored in plaintext. A compromised account or mis-shared snapshot can expose disk contents, enabling data exfiltration, offline analysis, and loss of **confidentiality**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/", + "https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/configure-default-encryption.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 enable-ebs-encryption-by-default", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/general-policies/ensure-ebs-default-encryption-is-enabled#aws-console", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-ebs-default-encryption-is-enabled#terraform" + "CLI": "aws ec2 enable-ebs-encryption-by-default --region ", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::EC2::EBSEncryptionByDefault\n Properties:\n Enabled: true # Critical: turns on default EBS encryption in this region\n```", + "Other": "1. In the AWS console, switch to the affected Region\n2. Go to EC2 > Settings (or Account attributes) > EBS encryption\n3. Click Enable default encryption and Save", + "Terraform": "```hcl\nresource \"aws_ebs_encryption_by_default\" \"\" {\n enabled = true # Critical: enables default EBS encryption in this region\n}\n```" }, "Recommendation": { - "Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.", - "Url": "https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/" + "Text": "Enable `EBS encryption by default` in every region and select a **customer-managed KMS key**. Apply **least privilege** to key use, rotate keys, and monitor access. Enforce encrypted volume creation with organizational guardrails and secure templates as **defense in depth**.", + "Url": "https://hub.prowler.com/check/ec2_ebs_default_encryption" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.metadata.json b/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.metadata.json index b8e84aa4bb..cc602f1e7f 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "ec2_ebs_public_snapshot", - "CheckTitle": "Ensure there are no EBS Snapshots set as Public.", + "CheckTitle": "EBS snapshot is not public", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "snapshot", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", - "ResourceType": "Other", + "ResourceType": "AwsEc2Volume", "ResourceGroup": "compute", - "Description": "Ensure there are no EBS Snapshots set as Public.", - "Risk": "When you share a snapshot, you are giving others access to all of the data on the snapshot. Share snapshots only with people with whom you want to share all of your snapshot data.", + "Description": "**EBS snapshots** with **public sharing** permissions (accessible by all AWS accounts) are identified, as opposed to snapshots shared privately with specific accounts.", + "Risk": "Public snapshots expose full volume contents, harming **confidentiality**. Any account can create a volume from the snapshot to read files, secrets, or database data, enabling **data exfiltration**, broad reconnaissance, and facilitating **lateral movement**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/public-snapshots.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 modify-snapshot-attribute --region --snapshot-id --attribute createVolumePermission --operation remove --user-ids all", + "CLI": "aws ec2 modify-snapshot-attribute --snapshot-id --attribute createVolumePermission --operation-type remove --group-names all", "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/public-policies/public_7", + "Other": "1. Open the AWS Management Console and go to EC2\n2. In the left menu, select Snapshots\n3. Select the snapshot \n4. Click Actions > Modify permissions\n5. Choose Private (remove Public/all if present)\n6. Click Save changes", "Terraform": "" }, "Recommendation": { - "Text": "Ensure the snapshot should be shared.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html" + "Text": "Keep snapshots **private** and share only with specific accounts under **least privilege**. Enable `Block public access for Amazon EBS snapshots` regionally. Prefer **CMEK encryption** and avoid sharing keys broadly. Regularly review sharing permissions and monitor snapshot usage.", + "Url": "https://hub.prowler.com/check/ec2_ebs_public_snapshot" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.metadata.json b/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.metadata.json index a896e1386f..88f1dfa7e8 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "ec2_ebs_snapshot_account_block_public_access", - "CheckTitle": "Ensure that public access to EBS snapshots is disabled", + "CheckTitle": "All EBS snapshots have public access blocked", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "snapshot", - "ResourceIdTemplate": "arn:partition:service:region:account-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", - "ResourceType": "AwsAccount", - "ResourceGroup": "governance", - "Description": "EBS snapshots can be shared with other AWS accounts or made public. By default, EBS snapshots are private and only the AWS account that created the snapshot can access it. If an EBS snapshot is shared with another AWS account or made public, the data in the snapshot can be accessed by the other account or by anyone on the internet. Ensure that public access to EBS snapshots is disabled.", - "Risk": "If public access to EBS snapshots is enabled, the data in the snapshot can be accessed by anyone on the internet.", - "RelatedUrl": "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable", + "ResourceType": "AwsEc2Volume", + "ResourceGroup": "compute", + "Description": "**EBS snapshots** account/Region configuration for **Block Public Access** is assessed to see whether public sharing is fully blocked (`block-all-sharing`) versus only new sharing (`block-new-sharing`) or unblocked. The state indicates if any snapshot can be publicly shared.", + "Risk": "Without `block-all-sharing`, previously public snapshots can remain accessible, exposing raw disk data.\n\nImpacts:\n- Loss of **confidentiality** (PII, keys, configs)\n- Unauthorized cloning enabling **lateral movement**\n- Cross-account copies create **irreversible data leakage**", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable", + "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html" + ], "Remediation": { "Code": { "CLI": "aws ec2 enable-snapshot-block-public-access --state block-all-sharing", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::EC2::SnapshotBlockPublicAccess\n Properties:\n State: block-all-sharing # CRITICAL: Blocks all public sharing of EBS snapshots in this Region to pass the check\n```", + "Other": "1. In the AWS console, select the target Region in the top-right.\n2. Go to EC2 > Snapshots.\n3. Click Settings > Block public access for snapshots.\n4. Select Block all sharing.\n5. Click Save changes.", + "Terraform": "```hcl\nresource \"aws_ebs_snapshot_block_public_access\" \"\" {\n state = \"block-all-sharing\" # CRITICAL: Blocks all public sharing of EBS snapshots in this Region\n}\n```" }, "Recommendation": { - "Text": "Use the following procedures to configure and monitor block public access for snapshots.", - "Url": "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable" + "Text": "Set **Block Public Access** for EBS snapshots to `block-all-sharing` in all active Regions.\n\nApply **least privilege** and guardrails (SCPs) to prevent changes. Regularly inventory snapshots, remove public sharing, and use segregated accounts with strict reviews for any necessary external sharing.", + "Url": "https://hub.prowler.com/check/ec2_ebs_snapshot_account_block_public_access" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.metadata.json b/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.metadata.json index f98e613033..606e7c5eef 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_ebs_snapshots_encrypted", - "CheckTitle": "Check if EBS snapshots are encrypted.", + "CheckTitle": "EBS snapshot is encrypted", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "snapshot", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "medium", - "ResourceType": "Other", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "AwsEc2Volume", "ResourceGroup": "compute", - "Description": "Check if EBS snapshots are encrypted.", - "Risk": "Data encryption at rest prevents data visibility in the event of its unauthorized access or theft.", + "Description": "**EBS snapshots** are evaluated for **encryption at rest** with AWS KMS. The finding identifies snapshots where encryption is not enabled.", + "Risk": "Unencrypted snapshots expose complete disk images to anyone with snapshot access or if mis-shared. Attackers can exfiltrate data, harvest credentials, and clone volumes for offline analysis, compromising **confidentiality** and enabling **lateral movement**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default", + "https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/snapshot-encrypted.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 --region enable-ebs-encryption-by-default", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#cloudformation", - "Other": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#aws-console", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_3-encrypt-ebs-volume#terraform" + "CLI": "aws ec2 copy-snapshot --source-region --source-snapshot-id --encrypted --description \"Encrypted copy of \"", + "NativeIaC": "", + "Other": "1. In the AWS Console, go to EC2 > Snapshots and select the unencrypted snapshot\n2. Click Actions > Copy snapshot\n3. Check Encrypt this snapshot (leave the default KMS key unless a specific key is required)\n4. Click Copy snapshot and wait for the new encrypted snapshot to be available\n5. Select the original unencrypted snapshot > Actions > Delete snapshot > Delete", + "Terraform": "```hcl\nresource \"aws_ebs_snapshot_copy\" \"\" {\n source_snapshot_id = \"\"\n source_region = \"\"\n encrypted = true # Critical: creates an encrypted copy of the snapshot to remediate the finding\n}\n```" }, "Recommendation": { - "Text": "Encrypt all EBS Snapshot and Enable Encryption by default. You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default" + "Text": "Encrypt all **EBS snapshots** and enable `encryption by default` to prevent unencrypted creations and copies. Use **customer-managed KMS keys** for control and rotation, restrict snapshot sharing, and enforce **least privilege** on snapshot and key permissions as **defense in depth**.", + "Url": "https://hub.prowler.com/check/ec2_ebs_snapshots_encrypted" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.metadata.json b/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.metadata.json index 79356a2544..1b4033c4b9 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_ebs_volume_encryption", - "CheckTitle": "Ensure there are no EBS Volumes unencrypted.", + "CheckTitle": "EBS volume is encrypted", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "volume", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "medium", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsEc2Volume", - "ResourceGroup": "storage", - "Description": "Ensure there are no EBS Volumes unencrypted.", - "Risk": "Data encryption at rest prevents data visibility in the event of its unauthorized access or theft.", + "ResourceGroup": "compute", + "Description": "**EBS volumes** are assessed for **encryption at rest** using **AWS KMS**.\n\nThe finding identifies volumes whose `encrypted` state is disabled, meaning data is stored unencrypted on block storage.", + "Risk": "Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining **confidentiality**.\n\nAdversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting **integrity** and enabling **lateral movement**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/ebs-encrypted.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 create-snapshot --volume-id --description \"Snapshot for encryption\" && aws ec2 copy-snapshot --source-region --source-snapshot-id --encrypted --description \"Encrypted snapshot\" && aws ec2 create-volume --snapshot-id --availability-zone --encrypted", + "NativeIaC": "```yaml\n# CloudFormation: Encrypted EBS volume\nResources:\n :\n Type: AWS::EC2::Volume\n Properties:\n AvailabilityZone: \n Size: 1\n Encrypted: true # CRITICAL: enables EBS encryption so the volume is created encrypted\n```", + "Other": "1. In the AWS Console, go to EC2 > Volumes and select the unencrypted volume\n2. Choose Actions > Create snapshot and wait for it to complete\n3. Open the snapshot, click Actions > Create volume, select the same Availability Zone, and check Encrypted, then create\n4. Stop the instance using the old volume\n5. Detach the old (unencrypted) volume\n6. Attach the new encrypted volume to the instance using the same device name\n7. Start the instance\n8. Verify the new volume shows Encrypted = Yes", + "Terraform": "```hcl\n# Encrypted EBS volume\nresource \"aws_ebs_volume\" \"\" {\n availability_zone = \"\"\n size = 1\n encrypted = true # CRITICAL: ensures the volume is created encrypted\n}\n```" }, "Recommendation": { - "Text": "Encrypt all EBS volumes and Enable Encryption by default You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html" + "Text": "Encrypt all EBS volumes and enable `encryption by default` for new volumes and snapshot copies.\n\nApply **least privilege** to KMS keys, restrict snapshot sharing, and enforce **defense in depth** with policies and templates that prevent creation of unencrypted storage.", + "Url": "https://hub.prowler.com/check/ec2_ebs_volume_encryption" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.metadata.json b/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.metadata.json index 7fe1bfa832..46b406cf1a 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.metadata.json @@ -1,33 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_ebs_volume_protected_by_backup_plan", - "CheckTitle": "Amazon EBS volumes should be protected by a backup plan.", + "CheckTitle": "EBS volume is protected by a backup plan", "CheckType": [ - "Software and Configuration Checks, AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:volume/volume-id", - "Severity": "low", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsEc2Volume", - "ResourceGroup": "storage", - "Description": "Evaluates if an Amazon EBS volume in in-use state is covered by a backup plan. The check fails if an EBS volume isn't covered by a backup plan. If you set the backupVaultLockCheck parameter equal to true, the control passes only if the EBS volume is backed up in an AWS Backup locked vault.", - "Risk": "Without backup coverage, Amazon EBS volumes are vulnerable to data loss or deletion, reducing the resilience of your systems and making recovery from incidents more difficult.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ebs-resources-protected-by-backup-plan.html", + "ResourceGroup": "compute", + "Description": "**EBS volumes** are evaluated for coverage by an **AWS Backup plan**, whether explicitly targeted or included via broad resource selection, confirming scheduled, policy-driven backups exist for the volume.", + "Risk": "Absent backup coverage, volumes face **data loss**, weakened **integrity**, and reduced **availability**. Deletion or corruption-whether accidental or malicious-can leave no recovery path, causing prolonged outages, failed point-in-time restoration, unmet retention needs, and harder incident response.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.amazonaws.cn/en_us/aws-backup/latest/devguide/vault-lock.html", + "https://aws.amazon.com/blogs/storage/protecting-your-critical-amazon-ebs-volumes-using-aws-backup/", + "https://docs.aws.amazon.com/config/latest/developerguide/ebs-resources-protected-by-backup-plan.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-28", - "Terraform": "" + "CLI": "aws backup create-backup-selection --backup-plan-id --backup-selection '{\"SelectionName\":\"\",\"IamRoleArn\":\"arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole\",\"Resources\":[\"arn:aws:ec2:*:*:volume/*\"]}'", + "NativeIaC": "```yaml\n# CloudFormation: protect all EBS volumes by assigning them to a backup plan\nResources:\n BackupPlan:\n Type: AWS::Backup::BackupPlan\n Properties:\n BackupPlan:\n BackupPlanName: \n Rules:\n - RuleName: \n TargetBackupVault: Default\n\n BackupSelection:\n Type: AWS::Backup::BackupSelection\n Properties:\n BackupPlanId: !Ref BackupPlan\n BackupSelection:\n SelectionName: \n IamRoleArn: arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole\n Resources:\n - arn:aws:ec2:*:*:volume/* # Critical: wildcard includes all EBS volumes so they are covered by the plan\n```", + "Other": "1. In the AWS Backup console, go to Backup plans and click Create backup plan\n2. Choose Start with a template (any), keep the Default vault, and create the plan\n3. Open the plan and click Assign resources\n4. Set Selection name and choose IAM role AWSBackupDefaultServiceRole\n5. Under Assign resources, choose Include specific resource types and select EBS\n6. For Resources, select all EBS volumes (or the specific volumes to protect) and click Assign resources", + "Terraform": "```hcl\n# Minimal AWS Backup plan protecting all EBS volumes\nresource \"aws_backup_plan\" \"\" {\n name = \"\"\n\n rule {\n rule_name = \"\"\n target_vault_name = \"Default\"\n }\n}\n\nresource \"aws_backup_selection\" \"\" {\n name = \"\"\n plan_id = aws_backup_plan..id\n iam_role_arn = \"arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole\"\n\n resources = [\n \"arn:aws:ec2:*:*:volume/*\" # Critical: selects all EBS volumes to satisfy the check\n ]\n}\n```" }, "Recommendation": { - "Text": "Ensure that all in-use Amazon EBS volumes are included in a backup plan, and consider using AWS Backup Vault Lock for additional protection.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html" + "Text": "Include all critical EBS volumes in standardized **AWS Backup** plans aligned to your `RPO`/`RTO`. Use tags for automatic assignment, enable cross-Region/account copies, apply **Vault Lock** for WORM retention, encrypt with KMS, enforce least-privilege access, and regularly test restores to verify integrity.", + "Url": "https://hub.prowler.com/check/ec2_ebs_volume_protected_by_backup_plan" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.metadata.json b/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.metadata.json index 338a977af9..d14225a216 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.metadata.json @@ -1,32 +1,38 @@ { "Provider": "aws", "CheckID": "ec2_ebs_volume_snapshots_exists", - "CheckTitle": "Check if EBS snapshots exists.", + "CheckTitle": "EBS volume has at least one snapshot", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "ec2", - "SubServiceName": "volume", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "medium", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsEc2Volume", - "ResourceGroup": "storage", - "Description": "Check if EBS snapshots exists.", - "Risk": "Ensure that your EBS volumes (available or in-use) have recent snapshots (taken weekly) available for point-in-time recovery for a better, more reliable data backup strategy.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html", + "ResourceGroup": "compute", + "Description": "**EBS volumes** are evaluated for the existence of at least one associated **snapshot**, identifying volumes without any point-in-time backup available.", + "Risk": "Missing **EBS snapshots** removes point-in-time recovery. Accidental deletion, corruption, or ransomware can cause **irrecoverable data loss** and prolonged **service outages**, degrading data **integrity** and **availability** and complicating recovery and forensics.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/ebs/latest/userguide/ebs-snapshots.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EBS/ebs-volumes-recent-snapshots.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 --region create-snapshot --volume-id ", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/EBS/ebs-volumes-recent-snapshots.html", - "Terraform": "" + "CLI": "aws ec2 create-snapshot --region --volume-id ", + "NativeIaC": "```yaml\n# CloudFormation: create a snapshot of an existing EBS volume\nResources:\n :\n Type: AWS::EC2::Snapshot\n Properties:\n VolumeId: # Critical: creates a snapshot for this volume to pass the check\n```", + "Other": "1. In the AWS Console, go to EC2\n2. Click Volumes, select the target EBS volume\n3. Choose Actions > Create snapshot\n4. Click Create snapshot to confirm", + "Terraform": "```hcl\n# Create a snapshot for an existing EBS volume\nresource \"aws_ebs_snapshot\" \"\" {\n volume_id = \"\" # Critical: creating this snapshot makes the volume pass the check\n}\n```" }, "Recommendation": { - "Text": "Creating point-in-time EBS snapshots periodically will allow you to handle efficiently your data recovery process in the event of a failure, to save your data before shutting down an EC2 instance, to back up data for geographical expansion and to maintain your disaster recovery stack up to date.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html" + "Text": "Establish automated, policy-based **EBS snapshot** coverage for all volumes aligned to business `RPO/RTO`.\n- Schedule regular snapshots with retention controls\n- Encrypt snapshots and enforce **least privilege** access\n- Replicate to another Region/account for DR\n- Periodically test restores and document procedures", + "Url": "https://hub.prowler.com/check/ec2_ebs_volume_snapshots_exists" } }, "Categories": [ + "resilience", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.metadata.json b/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.metadata.json index 3e21835ff1..45e3b083c3 100644 --- a/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_elastic_ip_shodan", - "CheckTitle": "Check if any of the Elastic or Public IP are in Shodan (requires Shodan API KEY).", + "CheckTitle": "EC2 Elastic IP address is not listed in Shodan", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Discovery" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "high", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsEc2Eip", "ResourceGroup": "network", - "Description": "Check if any of the Elastic or Public IP are in Shodan (requires Shodan API KEY).", - "Risk": "Sites like Shodan index exposed systems and further expose them to wider audiences as a quick way to find exploitable systems.", + "Description": "**EC2 Elastic IPs** are compared with **Shodan**'s index to identify publicly reachable addresses that have been scanned and cataloged, including metadata such as open ports, ISP, and geolocation", + "Risk": "Being listed on **Shodan** confirms Internet exposure and reveals open services, versions, and banners. Adversaries can rapidly target these hosts for credential attacks and CVE exploits, threatening **confidentiality** (data access), **integrity** (system takeover), and **availability** (service disruption).", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.shodan.io/", + "https://support.icompaas.com/support/solutions/articles/62000229484-ensure-any-of-the-elastic-or-public-ip-are-in-shodan" + ], "Remediation": { "Code": { "CLI": "", "NativeIaC": "", - "Other": "", + "Other": "1. In the AWS Console, go to EC2\n2. In the left pane, select Network & Security > Elastic IPs\n3. Select the flagged Elastic IP\n4. If it is associated: click Actions > Disassociate Elastic IP address > Disassociate\n5. Click Actions > Release Elastic IP address > Release", "Terraform": "" }, "Recommendation": { - "Text": "Check Identified IPs, consider changing them to private ones and delete them from Shodan.", - "Url": "https://www.shodan.io/" + "Text": "Reduce attack surface with **defense in depth**:\n- Avoid public exposure; use private networking or proxies\n- Enforce **least-privilege** ingress rules; close unused ports\n- Patch and harden services; limit verbose banners\n- Rotate exposed IPs and continuously monitor external visibility", + "Url": "https://hub.prowler.com/check/ec2_elastic_ip_shodan" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.metadata.json b/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.metadata.json index 6c62777b0b..d94244ada3 100644 --- a/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.metadata.json @@ -1,32 +1,38 @@ { "Provider": "aws", "CheckID": "ec2_elastic_ip_unassigned", - "CheckTitle": "Check if there is any unassigned Elastic IP.", + "CheckTitle": "Elastic IP is associated with an instance or network interface", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Resource Consumption" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsEc2Eip", "ResourceGroup": "network", - "Description": "Check if there is any unassigned Elastic IP.", - "Risk": "Unassigned Elastic IPs may result in extra cost.", + "Description": "**EC2 Elastic IPs** that are allocated but **not associated** with any instance or network interface. The evaluation identifies EIPs present in the account without an active association.", + "Risk": "Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (**availability**). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 release-address --public-ip ", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_19#cloudformation", - "Other": "https://docs.prowler.com/checks/aws/general-policies/general_19#ec2-console", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_19#terraform" + "CLI": "aws ec2 release-address --allocation-id ", + "NativeIaC": "```yaml\n# Associate an existing unassigned Elastic IP to an instance\nResources:\n :\n Type: AWS::EC2::EIPAssociation\n Properties:\n AllocationId: # Critical: selects the unassigned EIP to associate\n InstanceId: # Critical: associates the EIP to this instance, fixing the finding\n```", + "Other": "1. In the AWS console, go to EC2 > Network & Security > Elastic IPs\n2. Select the Elastic IP with Status = Not associated\n3. Choose Actions > Associate Elastic IP address\n4. Select Instance (or Network interface), pick the target, and click Associate\n5. Alternatively, to remove the finding by deleting the unused EIP: Actions > Release Elastic IP address > Release", + "Terraform": "```hcl\n# Associate an existing unassigned Elastic IP to an instance\nresource \"aws_eip_association\" \"\" {\n allocation_id = \"\" # Critical: target unassigned EIP\n instance_id = \"\" # Critical: attach EIP to this instance to pass the check\n}\n```" }, "Recommendation": { - "Text": "Ensure Elastic IPs are not unassigned.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html" + "Text": "Release **unused Elastic IPs** or promptly associate them only where required. Enforce **least privilege** for address allocation, apply **tagging** to track ownership, and schedule periodic audits. Prefer **private networking** or managed front ends to reduce public IPv4 use. Automate reclaiming of `unassociated` addresses in lifecycle policies.", + "Url": "https://hub.prowler.com/check/ec2_elastic_ip_unassigned" } }, - "Categories": [], + "Categories": [ + "internet-exposed" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.metadata.json index 93c5c3e260..513d93ce65 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.metadata.json @@ -1,34 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_instance_account_imdsv2_enabled", - "CheckTitle": "Ensure Instance Metadata Service Version 2 (IMDSv2) is enforced for EC2 instances at the account level to protect against SSRF vulnerabilities.", + "CheckTitle": "IMDSv2 is required by default for EC2 instances at the account level", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Credential Access" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id", + "ResourceIdTemplate": "", "Severity": "high", - "ResourceType": "AwsAccount", - "ResourceGroup": "governance", - "Description": "Ensure Instance Metadata Service Version 2 (IMDSv2) is enforced for EC2 instances at the account level to protect against SSRF vulnerabilities.", - "Risk": "EC2 instances that use IMDSv1 are vulnerable to SSRF attacks.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults", + "ResourceType": "AwsEc2Instance", + "ResourceGroup": "compute", + "Description": "**EC2 account IMDS defaults** with `http_tokens`=`required` ensure new instances in the Region use **IMDSv2** by default and disable IMDSv1. *Existing instances keep their current setting.*", + "Risk": "Without a default of **IMDSv2**, new instances may enable **IMDSv1**, exposing metadata via simple HTTP. SSRF or proxy misconfigs can steal **temporary IAM credentials**, enabling data exfiltration (confidentiality), unauthorized API changes (integrity), and lateral movement that can disrupt services (availability).", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/require-imds-v2.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 modify-instance-metadata-defaults --region --http-tokens required --http-put-response-hop-limit 2", + "CLI": "aws ec2 modify-instance-metadata-defaults --region --http-tokens required", "NativeIaC": "", - "Other": "", + "Other": "1. In the AWS Console, open EC2 and select the target Region\n2. Go to EC2 Dashboard > Account attributes > Data protection and security\n3. Next to IMDS defaults, click Manage\n4. Set Metadata version to V2 only (token required)\n5. Click Update", "Terraform": "" }, "Recommendation": { - "Text": "Enable Instance Metadata Service Version 2 (IMDSv2) on the EC2 instances. Apply this configuration at the account level for each AWS Region to set the default instance metadata version.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults" + "Text": "Enforce **IMDSv2** at the account level in every Region by setting `http_tokens` to `required`. Add guardrails with **SCP/IAM conditions**. Standardize AMIs and launch templates to require tokens, validate workload compatibility, and apply **least privilege** to instance roles for defense in depth. *For containers*, prefer hop limit `2`.", + "Url": "https://hub.prowler.com/check/ec2_instance_account_imdsv2_enabled" } }, "Categories": [ - "internet-exposed", - "ec2-imdsv1" + "secrets" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.metadata.json index 60054d873b..90aeea9c90 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_instance_detailed_monitoring_enabled", - "CheckTitle": "Check if EC2 instances have detailed monitoring enabled.", + "CheckTitle": "EC2 instance has detailed monitoring enabled", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Check if EC2 instances have detailed monitoring enabled.", - "Risk": "Enabling detailed monitoring provides enhanced monitoring and granular insights into EC2 instance metrics. Not having detailed monitoring enabled may limit the ability to troubleshoot performance issues effectively.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html", + "Description": "**EC2 instances** are assessed for **CloudWatch detailed monitoring**, indicating whether 1-minute metrics collection is enabled.\n\nInstances lacking this setting provide only 5-minute metrics.", + "Risk": "Without 1-minute metrics, visibility drops, delaying detection of:\n- Sudden CPU/network/disk spikes affecting **availability**\n- **Malicious workloads** (crypto-mining, brute force)\n- **Data exfiltration** patterns\nSlower detection expands blast radius, raising incident impact and response cost.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/instance-detailed-monitoring.html", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html#enable-detailed-monitoring-instance" + ], "Remediation": { "Code": { "CLI": "aws ec2 monitor-instances --instance-ids ", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/instance-detailed-monitoring.html", - "Terraform": "https://docs.prowler.com/checks/aws/logging-policies/ensure-that-detailed-monitoring-is-enabled-for-ec2-instances#terraform" + "NativeIaC": "```yaml\n# CloudFormation: Enable detailed monitoring on an EC2 instance\nResources:\n :\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \"\"\n InstanceType: \"\"\n Monitoring: true # Critical: enables detailed (1-minute) CloudWatch monitoring\n```", + "Other": "1. Open the AWS Console and go to EC2 > Instances\n2. Select the instance\n3. Choose Actions > Monitor and troubleshoot > Manage detailed monitoring\n4. Check Enable detailed monitoring and click Save", + "Terraform": "```hcl\n# Enable detailed monitoring on an EC2 instance\nresource \"aws_instance\" \"\" {\n ami = \"\"\n instance_type = \"\"\n monitoring = true # Critical: enables detailed (1-minute) CloudWatch monitoring\n}\n```" }, "Recommendation": { - "Text": "Enable detailed monitoring for EC2 instances to gain better insights into performance metrics.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html#enable-detailed-monitoring-instance" + "Text": "Enable **detailed monitoring** to collect `1-minute` metrics on critical instances. Use **defense in depth**: baseline normal behavior, create alerts for anomalies, and correlate metrics with logs and traces. Review dashboards regularly. *If costs matter*, prioritize production, internet-facing, and autoscaling fleets.", + "Url": "https://hub.prowler.com/check/ec2_instance_detailed_monitoring_enabled" } }, - "Categories": [], + "Categories": [ + "logging", + "forensics-ready" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.metadata.json index d829d5f396..1fec3375c5 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.metadata.json @@ -1,33 +1,42 @@ { "Provider": "aws", "CheckID": "ec2_instance_imdsv2_enabled", - "CheckTitle": "Check if EC2 Instance Metadata Service Version 2 (IMDSv2) is Enabled and Required.", + "CheckTitle": "EC2 instance requires IMDSv2 or has the instance metadata service disabled", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Credential Access" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Check if EC2 Instance Metadata Service Version 2 (IMDSv2) is Enabled and Required.", - "Risk": "Using IMDSv2 will protect from misconfiguration and SSRF vulnerabilities. IMDSv1 will not.", + "Description": "**EC2 instances** are evaluated for **IMDSv2 enforcement**: metadata endpoint enabled with `http_tokens: required`, or metadata service fully disabled (`http_endpoint: disabled`).", + "Risk": "Permitting **IMDSv1** or optional tokens lets SSRF or compromised workloads retrieve **temporary IAM credentials**, impacting confidentiality and integrity. Stolen role creds can drive **privilege escalation**, unauthorized data access, and lateral movement across AWS resources.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/require-imds-v2.html", + "https://support.icompaas.com/support/solutions/articles/62000234166-5-7-ensure-that-the-ec2-metadata-service-only-allows-imdsv2-automated-", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html#configuring-instance-metadata-options" + ], "Remediation": { "Code": { "CLI": "aws ec2 modify-instance-metadata-options --instance-id --http-tokens required --http-endpoint enabled", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_31#cloudformation", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/require-imds-v2.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_31#terraform" + "NativeIaC": "```yaml\n# CloudFormation: enforce IMDSv2 on an EC2 instance\nResources:\n :\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \"\"\n InstanceType: \"\"\n MetadataOptions:\n HttpTokens: required # Critical: Require IMDSv2 tokens (blocks IMDSv1)\n```", + "Other": "1. In AWS Console, go to EC2 > Instances\n2. Select the instance > Actions > Instance settings > Modify instance metadata options\n3. Set Metadata version to IMDSv2 only (HTTP tokens: Required)\n4. Ensure Instance metadata service is Enabled (or set to Disabled to turn off IMDS entirely)\n5. Click Save", + "Terraform": "```hcl\n# Enforce IMDSv2 on an EC2 instance\nresource \"aws_instance\" \"\" {\n ami = \"\"\n instance_type = \"\"\n\n metadata_options {\n http_tokens = \"required\" # Critical: Require IMDSv2 tokens (blocks IMDSv1)\n }\n}\n```" }, "Recommendation": { - "Text": "If you don't need IMDS you can turn it off. Using aws-cli you can force the instance to use only IMDSv2.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html#configuring-instance-metadata-options" + "Text": "Apply defense in depth:\n- Require **IMDSv2** tokens on all instances (`http_tokens: required`)\n- Disable metadata where not needed (`http_endpoint: disabled`)\n- Minimize hop limit to `1` when feasible\n- Update SDKs/apps for IMDSv2\n- Restrict instance profile permissions (least privilege)\n- Block metadata access from untrusted workloads", + "Url": "https://hub.prowler.com/check/ec2_instance_imdsv2_enabled" } }, "Categories": [ - "ec2-imdsv1" + "identity-access", + "secrets" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.metadata.json index 97dd166750..bd2c1d7278 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.metadata.json @@ -1,33 +1,41 @@ { "Provider": "aws", "CheckID": "ec2_instance_internet_facing_with_instance_profile", - "CheckTitle": "Check for internet facing EC2 instances with Instance Profiles attached.", + "CheckTitle": "EC2 instance is not internet-facing with an instance profile attached", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access", + "TTPs/Credential Access" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Check for internet facing EC2 instances with Instance Profiles attached.", - "Risk": "Exposing an EC2 directly to internet increases the attack surface and therefore the risk of compromise.", + "Description": "**EC2 instances** with a public IP address and an attached **instance profile** (IAM role) are identified.\n\nInstances lacking public exposure or without an instance profile are excluded.", + "Risk": "Publicly reachable instances with **IAM role credentials** expand the blast radius. Remote exploits or misconfigurations can steal credentials via the **instance metadata service**, enabling unauthorized API calls, data exfiltration, and lateral movement, impacting confidentiality, integrity, and availability.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html", + "https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/", + "https://support.icompaas.com/support/solutions/articles/62000127121-ensure-instance-profile-is-attached-for-internet-facing-ec2-instances" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 disassociate-iam-instance-profile --association-id ", + "NativeIaC": "```yaml\n# CloudFormation: EC2 instance without a public IP to avoid being internet-facing\nResources:\n :\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \n InstanceType: t3.micro\n NetworkInterfaces:\n - DeviceIndex: 0\n SubnetId: \n AssociatePublicIpAddress: false # Critical: disables public IPv4 so the instance is not internet-facing\n```", + "Other": "1. In the AWS Console, go to EC2 > Instances and select the instance\n2. Choose Actions > Security > Modify IAM role\n3. Set IAM role to None and click Update IAM role\n4. Verify the instance no longer lists an IAM role (instance profile)\n\nAlternative (if you need the role): remove internet exposure\n1. Select the instance > Networking tab\n2. If an Elastic IP is attached, choose Disassociate Elastic IP\n3. For auto-assigned public IPv4, stop the instance and relaunch without a public IP or in a subnet without auto-assign public IPv4", + "Terraform": "```hcl\n# EC2 instance without a public IP to avoid being internet-facing\nresource \"aws_instance\" \"\" {\n ami = \"\"\n instance_type = \"t3.micro\"\n associate_public_ip_address = false # Critical: disables public IPv4 so the instance is not internet-facing\n}\n```" }, "Recommendation": { - "Text": "Use an ALB and apply WAF ACL.", - "Url": "https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/" + "Text": "Avoid direct Internet exposure. Place workloads behind an **Application Load Balancer** and protect HTTP apps with **WAF**. Remove public IPs or restrict ingress to trusted sources. Apply **least privilege** to instance profiles and enforce **IMDSv2**. Use **bastion hosts** or **Session Manager** for admin access.", + "Url": "https://hub.prowler.com/check/ec2_instance_internet_facing_with_instance_profile" } }, "Categories": [ - "internet-exposed" + "internet-exposed", + "identity-access" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.metadata.json index cff3ac2e09..41f39bb5f5 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_instance_managed_by_ssm", - "CheckTitle": "Check if EC2 instances are managed by Systems Manager.", + "CheckTitle": "EC2 instance is managed by AWS Systems Manager or not running", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Patch Management" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Check if EC2 instances are managed by Systems Manager.", - "Risk": "AWS Config provides AWS Managed Rules, which are predefined, customizable rules that AWS Config uses to evaluate whether your AWS resource configurations comply with common best practices.", + "Description": "**EC2 instances** are assessed for enrollment as **Systems Manager managed nodes**. Running instances lacking Systems Manager registration are marked as unmanaged; instances in `stopped`, `terminated`, or `pending` states are noted separately.", + "Risk": "Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SSM/ssm-managed-instances.html", + "https://docs.aws.amazon.com/systems-manager/latest/userguide/managed_instances.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/SSM/ssm-managed-instances.html", - "Terraform": "" + "CLI": "aws ec2 stop-instances --instance-ids ", + "NativeIaC": "```yaml\n# CloudFormation: make the instance SSM-managed by attaching the required IAM role\nResources:\n Role:\n Type: AWS::IAM::Role\n Properties:\n AssumeRolePolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n Service: ec2.amazonaws.com\n Action: sts:AssumeRole\n ManagedPolicyArns:\n - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore # CRITICAL: grants SSM permissions required for management\n\n InstanceProfile:\n Type: AWS::IAM::InstanceProfile\n Properties:\n Roles:\n - !Ref Role\n\n Instance:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: ami-\n InstanceType: t3.micro\n IamInstanceProfile: !Ref InstanceProfile # CRITICAL: attaches the SSM-enabled role to the instance\n```", + "Other": "1. In IAM console: Create role > AWS service > EC2 > Next; attach policy \"AmazonSSMManagedInstanceCore\"; Create role\n2. In EC2 console: Instances > select the instance > Actions > Security > Modify IAM role > choose the role created above > Update IAM role\n3. Wait a few minutes; in Systems Manager console: Managed nodes, verify the instance shows as Online\n4. If the instance OS does not include SSM Agent by default, install the SSM Agent for that OS, then verify again", + "Terraform": "```hcl\n# Terraform: make the instance SSM-managed by attaching the required IAM role\nresource \"aws_iam_role\" \"\" {\n name = \"\"\n assume_role_policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Principal = { Service = \"ec2.amazonaws.com\" }\n Action = \"sts:AssumeRole\"\n }]\n })\n}\n\nresource \"aws_iam_role_policy_attachment\" \"_ssm\" {\n role = aws_iam_role..name\n policy_arn = \"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore\" # CRITICAL: grants SSM permissions required for management\n}\n\nresource \"aws_iam_instance_profile\" \"\" {\n name = \"\"\n role = aws_iam_role..name\n}\n\nresource \"aws_instance\" \"\" {\n ami = \"ami-\"\n instance_type = \"t3.micro\"\n iam_instance_profile = aws_iam_instance_profile..name # CRITICAL: attaches the SSM-enabled role to the instance\n}\n```" }, "Recommendation": { - "Text": "Verify and apply Systems Manager Prerequisites.", - "Url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/managed_instances.html" + "Text": "Enroll all instances as **Systems Manager managed nodes**. Prefer **Session Manager** over SSH/RDP, restrict inbound admin ports, and use **least privilege** roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.", + "Url": "https://hub.prowler.com/check/ec2_instance_managed_by_ssm" } }, - "Categories": [], + "Categories": [ + "node-security" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.metadata.json index d850e0f2c6..fb34f8b1c7 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_instance_older_than_specific_days", - "CheckTitle": "Check EC2 Instances older than specific days.", + "CheckTitle": "EC2 instance is not older than the configured maximum age or is not running", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Patch Management" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Check EC2 Instances older than specific days.", - "Risk": "Having old instances within your AWS account could increase the risk of having vulnerable software.", + "Description": "**EC2 instances** are evaluated for age while in `running` state. Instances launched beyond the configurable limit (`max_ec2_instance_age_in_days`, default `180`) are flagged as older than the allowed lifetime. Stopped instances are ignored.", + "Risk": "Long-lived instances often run **unpatched OS and agents**, enabling:\n- Exploitation of known CVEs loss of confidentiality\n- Privilege escalation and tampering integrity compromise\n- Malware/crypto-mining and instability reduced availability\n\nAged hosts also drift from baselines and impede response.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-patch-compliance-results.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/ec2-instance-too-old.html" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws ec2 stop-instances --instance-ids ", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/ec2-instance-too-old.html", + "Other": "1. Sign in to the AWS Management Console and open EC2\n2. Go to Instances and select the noncompliant instance\n3. Choose Instance state > Stop instance\n4. Confirm Stop\n5. Verify the instance state is Stopped (the check passes when the instance is not running)", "Terraform": "" }, "Recommendation": { - "Text": "Check if software running in the instance is up to date and patched accordingly. Use AWS Systems Manager to patch instances and view patching compliance information.", - "Url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-patch-compliance-results.html" + "Text": "Adopt **short-lived, patched workloads**:\n- Rebuild regularly from hardened, updated images; rotate AMIs\n- Use centralized patch management and vulnerability scanning\n- Retire or modernize legacy hosts; tag for lifecycle\n- Apply **least privilege** and **defense in depth** to limit blast radius\n\nAdjust `max_ec2_instance_age_in_days` to match policy.", + "Url": "https://hub.prowler.com/check/ec2_instance_older_than_specific_days" } }, "Categories": [], diff --git a/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.metadata.json index 8dbe7b9788..6f8071954b 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.metadata.json @@ -1,30 +1,39 @@ { "Provider": "aws", "CheckID": "ec2_instance_paravirtual_type", - "CheckTitle": "Amazon EC2 paravirtual virtualization type should not be used.", - "CheckType": [], + "CheckTitle": "EC2 instance virtualization type is HVM", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure that the virtualization type of an EC2 instance is not paravirtual. The control fails if the virtualizationType of the EC2 instance is set to paravirtual.", - "Risk": "Using paravirtual instances can limit performance and security benefits offered by hardware virtual machine (HVM) instances, such as improved CPU, network, and storage efficiency.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-paravirtual-instance-check.html", + "Description": "**EC2 instances** are evaluated for their virtualization mode. Instances with `virtualization_type` set to `paravirtual` are identified; those using **HVM** are recognized as hardware-assisted virtualization.", + "Risk": "Using **paravirtual (PV)** weakens isolation versus **HVM/Nitro** and blocks features like `ENA` and `NVMe`. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-24", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html", + "https://docs.aws.amazon.com/config/latest/developerguide/ec2-paravirtual-instance-check.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-24", - "Terraform": "" + "CLI": "aws ec2 terminate-instances --instance-ids ", + "NativeIaC": "```yaml\n# Launch an EC2 instance using an HVM-based AMI\nResources:\n :\n Type: AWS::EC2::Instance\n Properties:\n ImageId: # Critical: Using an HVM AMI ensures virtualization type is HVM\n InstanceType: t3.micro\n```", + "Other": "1. In the AWS Console, go to EC2 > Instances and select the instance with Virtualization type = paravirtual\n2. Launch a replacement instance using any HVM-based AMI (e.g., Amazon Linux 2)\n3. Verify the new instance is running\n4. Back in EC2 > Instances, select the paravirtual instance, choose Instance state > Terminate instance, and confirm", + "Terraform": "```hcl\n# EC2 instance launched from an HVM AMI\nresource \"aws_instance\" \"\" {\n ami = \"\" # Critical: AMI must be HVM to pass the check\n instance_type = \"t3.micro\"\n}\n```" }, "Recommendation": { - "Text": "To update an EC2 instance to a new instance type, see Change the instance type in the Amazon EC2 User Guide.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html" + "Text": "Standardize on **HVM/Nitro**. Migrate PV workloads to HVM AMIs and current instance families; ensure support for `ENA` and `NVMe`, current kernels, and hardened configs. Apply **defense in depth** and **least privilege**. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.", + "Url": "https://hub.prowler.com/check/ec2_instance_paravirtual_type" } }, - "Categories": [], + "Categories": [ + "node-security" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.metadata.json index 6a4161a0e5..af54b617e8 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_cassandra_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160).", + "CheckTitle": "EC2 instance does not have Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160) open to the Internet", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to Cassandra ports (TCP 7000, 7001, 7199, 9042, 9160).", - "Risk": "Cassandra is a distributed database management system designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure. Exposing Cassandra ports to the internet can lead to unauthorized access to the database, data exfiltration, and data loss.", + "Description": "**EC2 instances** have **Cassandra service ports** (`7000`, `7001`, `7199`, `9042`, `9160`) reachable from the Internet through security group ingress.\n\nPublic IP presence and subnet exposure are considered to assess external reachability.", + "Risk": "Internet-exposed Cassandra enables unauthorized queries on `9042`, remote management via `7199` (JMX), and tampering with inter-node channels on `7000/7001` and `9160`.\n\nAttackers can read/modify data (**confidentiality, integrity**), disrupt or take over the cluster (**availability**), and pivot within the VPC.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000127020-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-cassandra-ports-7199-or-9160-or-88" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":7000,\"ToPort\":7000,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":7001,\"ToPort\":7001,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":7199,\"ToPort\":7199,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9042,\"ToPort\":9042,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9160,\"ToPort\":9160,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]]'", + "NativeIaC": "```yaml\n# Restrict Cassandra ports so they are not open to the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Cassandra ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 7000\n ToPort: 7000\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0; restricts Internet access\n - IpProtocol: tcp\n FromPort: 7001\n ToPort: 7001\n CidrIp: 10.0.0.0/8 # FIX\n - IpProtocol: tcp\n FromPort: 7199\n ToPort: 7199\n CidrIp: 10.0.0.0/8 # FIX\n - IpProtocol: tcp\n FromPort: 9042\n ToPort: 9042\n CidrIp: 10.0.0.0/8 # FIX\n - IpProtocol: tcp\n FromPort: 9160\n ToPort: 9160\n CidrIp: 10.0.0.0/8 # FIX\n```", + "Other": "1. Open the AWS Console > EC2 > Instances and select the instance\n2. In the Security tab, click the attached Security Group(s)\n3. Click Edit inbound rules\n4. Remove or change any rule allowing TCP 7000, 7001, 7199, 9042, or 9160 from Anywhere (0.0.0.0/0 or ::/0)\n5. If needed, re-add those ports with a specific trusted source CIDR or security group\n6. Save rules", + "Terraform": "```hcl\n# Security group with Cassandra ports not open to the Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n # FIX: restrict these ports; do not use 0.0.0.0/0\n ingress { from_port = 7000 to_port = 7000 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 7001 to_port = 7001 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 7199 to_port = 7199 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 9042 to_port = 9042 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n ingress { from_port = 9160 to_port = 9160 protocol = \"tcp\" cidr_blocks = [\"10.0.0.0/8\"] }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP ports 7000, 7001, 7199, 9042 or 9160.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege network access**:\n- Remove `0.0.0.0/0` and `::/0` to Cassandra ports\n- Allow only trusted subnets or VPN/bastion\n- Keep nodes in private subnets; segment inter-node traffic\n- Enforce **authentication** and **TLS/mTLS** for clients and JMX\n- Add **defense in depth** with NACLs and monitoring", + "Url": "https://hub.prowler.com/check/ec2_instance_port_cassandra_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.metadata.json index 1a013c4f8e..133c565e04 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_cifs_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 139 or 445 (CIFS).", + "CheckTitle": "EC2 instance does not allow Internet ingress to TCP ports 139 or 445 (CIFS)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 139 or 445 (CIFS).", - "Risk": "CIFS is a file sharing protocol that is used to access files and printers on remote systems. It is not recommended to expose CIFS to the internet.", + "Description": "**EC2 instances** with security groups permitting **inbound** TCP `139` or `445` (**CIFS/SMB**) from `0.0.0.0/0` are identified.\n\nExposure level reflects whether the instance has a **public IP** and the subnet's Internet reachability.", + "Risk": "Publicly reachable **SMB** allows unauthorized access and **remote code execution**, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread **ransomware**, degrading **confidentiality**, **integrity**, and **availability**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-cifs-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":139,\"ToPort\":139,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":445,\"ToPort\":445,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: Security group without CIFS open to the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: SG without CIFS open to Internet\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 139\n ToPort: 139\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict CIFS (139) to a non-Internet CIDR to avoid 0.0.0.0/0\n - IpProtocol: tcp\n FromPort: 445\n ToPort: 445\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict CIFS (445) to a non-Internet CIDR to avoid 0.0.0.0/0\n```", + "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Edit Inbound rules\n4. Delete any rule allowing TCP port 139 or 445 from 0.0.0.0/0 or ::/0, or change the source to a specific trusted CIDR\n5. Save rules", + "Terraform": "```hcl\n# Security group without CIFS open to the Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 139\n to_port = 139\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restrict CIFS (139); do not use 0.0.0.0/0\n }\n\n ingress {\n from_port = 445\n to_port = 445\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restrict CIFS (445); do not use 0.0.0.0/0\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 139 or 445 (CIFS).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict **CIFS/SMB** to trusted internal sources using **least privilege**; do not allow `0.0.0.0/0`.\n\nAdopt **defense in depth**: place hosts in private subnets, require **VPN** or controlled jump paths, and enforce **segmentation**. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_cifs_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.metadata.json index 974616bd14..a279f96116 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to Elasticsearch and Kibana ports (TCP 9200, 9300, 5601).", - "Risk": "Elasticsearch and Kibana are commonly used for log and data analysis. Allowing ingress from the internet to these ports can expose sensitive data to unauthorized users.", + "Description": "**EC2 instances** with **Elasticsearch/Kibana ports** (`9200`, `9300`, `5601`) exposed to the Internet through inbound security group rules.\n\nAssesses reachability considering instance public IP and subnet to reflect real exposure.", + "Risk": "Public access to Elasticsearch/Kibana can lead to:\n- Unauthorized queries or dashboard viewing confidentiality loss\n- Index changes or cluster control via `9300` integrity impact\n- Scans and bulk queries availability degradation\n\nEnables data exfiltration and lateral movement.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233821-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-elasticsearch-and-kibana-ports-tcp-9200-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":9200,\"ToPort\":9200,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9300,\"ToPort\":9300,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":5601,\"ToPort\":5601,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict Elasticsearch/Kibana ports to a private CIDR (not the Internet)\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Elasticsearch/Kibana ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9200\n ToPort: 9200\n CidrIp: 10.0.0.0/8 # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict to internal CIDR\n - IpProtocol: tcp\n FromPort: 9300\n ToPort: 9300\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict source to stop Internet exposure\n - IpProtocol: tcp\n FromPort: 5601\n ToPort: 5601\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict source to stop Internet exposure\n```", + "Other": "1. Open the AWS Console and go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. In Inbound rules, find any rule allowing TCP 9200, 9300, or 5601 from 0.0.0.0/0 or ::/0\n4. Edit inbound rules and either delete those rules or change the source to a restricted CIDR (e.g., your internal network)\n5. Save rules", + "Terraform": "```hcl\n# Terraform: restrict Elasticsearch/Kibana ports to a private CIDR (not the Internet)\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n # CRITICAL: restrict sources; do NOT use 0.0.0.0/0 or ::/0\n ingress {\n from_port = 9200\n to_port = 9200\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n ingress {\n from_port = 9300\n to_port = 9300\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n ingress {\n from_port = 5601\n to_port = 5601\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP ports 9200, 9300, 5601.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** to network exposure:\n- Restrict `9200`, `9300`, `5601` to trusted sources or keep them private\n- Use **private subnets**, **VPN/peering**, or **bastion/SSM** for admin access\n- Enforce **authentication** and **TLS** on Elasticsearch/Kibana\n- Avoid public IPs unless strictly required", + "Url": "https://hub.prowler.com/check/ec2_instance_port_elasticsearch_kibana_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.metadata.json index 1017e862d2..7254e29872 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_ftp_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 20 or 21 (FTP)", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 20 or 21 (FTP)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 20 or 21 (FTP).", - "Risk": "FTP is an insecure protocol and should not be used. If FTP is required, it should be used over a secure channel such as FTPS or SFTP.", + "Description": "**EC2 instances** with security groups permitting inbound **FTP** on `TCP 20-21` from any address (e.g., `0.0.0.0/0` or `::/0`) are identified.\n\nExposure is contextualized by the instance's public reachability (public IP and subnet).", + "Risk": "Exposed **FTP** invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (**confidentiality**).\n\nAttackers can upload/alter files (**integrity**) and abuse services for malware staging or DoS (**availability**). Publicly reachable hosts are rapidly probed by scanners.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ftp-access.html", + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions 'IpProtocol=tcp,FromPort=20,ToPort=21,IpRanges=[{CidrIp=0.0.0.0/0}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict FTP (ports 20-21) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict FTP access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 20\n ToPort: 21\n CidrIp: 10.0.0.0/8 # CRITICAL: restrict source; not 0.0.0.0/0. Fixes Internet exposure.\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule allowing TCP ports 20-21 from 0.0.0.0/0 or ::/0\n5. Delete the rule, or change Source to a trusted CIDR (e.g., your office IP)\n6. Click Save rules", + "Terraform": "```hcl\n# Security group with FTP restricted\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 20\n to_port = 21\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restrict source; not 0.0.0.0/0. Fixes Internet exposure.\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 20 or 21 (FTP).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Deny public ingress to **FTP** ports `20-21` following **least privilege**. Prefer **SFTP** or **FTPS**; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply **defense in depth** with tightened security groups and network ACLs, and monitor authentication and access.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_ftp_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.metadata.json index cca83acff0..852d4377bf 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_kafka_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 9092 (Kafka).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 9092 (Kafka)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 9092 (Kafka).", - "Risk": "Kafka is a distributed streaming platform that is used to build real-time data pipelines and streaming applications. Exposing the Kafka port to the internet can lead to unauthorized access to the Kafka cluster, which can result in data leakage, data corruption, and data loss.", + "Description": "**EC2 instances** with security group rules that allow inbound `TCP 9092` (Kafka) from the Internet are reported. The evaluation inspects ingress rules to detect broad sources (for example `0.0.0.0/0` or `::/0`) that expose Kafka brokers.", + "Risk": "Public Kafka access undermines CIA: adversaries can read topics and metadata (**confidentiality**), publish or alter events (**integrity**), and overwhelm brokers (**availability**). Exposure also eases reconnaissance and lateral movement from the broker host.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233794-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-9092-kafka-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 9092 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict Kafka (9092) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Kafka port\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9092\n ToPort: 9092\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0; restrict to trusted CIDR to close Internet access\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Remove the rule allowing TCP 9092 from 0.0.0.0/0 or ::/0 (Internet)\n5. If needed, add TCP 9092 with a restricted source (e.g., your VPC CIDR)\n6. Click Save rules", + "Terraform": "```hcl\n# Restrict Kafka (9092) from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 9092\n to_port = 9092\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: restrict source; not 0.0.0.0/0\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 9092 (Kafka).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege**: restrict `TCP 9092` to trusted networks, not `0.0.0.0/0` or `::/0`. Keep brokers in private subnets and use private connectivity (VPN/peering). Enforce **TLS** and authenticated clients with granular ACLs, and add **defense in depth** via NACLs or proxies.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_kafka_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.metadata.json index ffdb964ef7..c15d4f7eae 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_kerberos_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 88, 464, 749 or 750 (Kerberos).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 88, 464, 749, or 750 (Kerberos)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access/Unauthorized Access" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 88, 464, 749 or 750 (Kerberos).", - "Risk": "Kerberos is a network authentication protocol that uses secret-key cryptography to authenticate clients and servers. It is typically used in environments where users need to authenticate to access network resources. If an EC2 instance allows ingress from the internet to TCP port 88 or 464, it may be vulnerable to unauthorized access.", + "Description": "**EC2 instances** whose security groups allow public **inbound TCP** access to Kerberos ports `88`, `464`, `749`, or `750` (authentication, password change, admin).\n\nRules permitting `0.0.0.0/0` or `::/0` are treated as Internet-exposed.", + "Risk": "Public Kerberos exposure risks CIA:\n- **Password spraying**/AS-REP roasting against accounts\n- Unauthorized password changes on `464`\n- Realm/user enumeration and DoS of KDC/services\n\nStolen tickets enable **lateral movement** and privilege escalation in Active Directory or the Kerberos realm.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233825-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-88-464-749-or-750-kerberos-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":88,\"ToPort\":88,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":464,\"ToPort\":464,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":749,\"ToPort\":749,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":750,\"ToPort\":750,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict Kerberos ports from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Kerberos ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 88\n ToPort: 88\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restrict access to trusted CIDR\n - IpProtocol: tcp\n FromPort: 464\n ToPort: 464\n CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure\n - IpProtocol: tcp\n FromPort: 749\n ToPort: 749\n CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure\n - IpProtocol: tcp\n FromPort: 750\n ToPort: 750\n CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure\n```", + "Other": "1. In the AWS console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Edit inbound rules\n4. Remove any rule allowing TCP ports 88, 464, 749, or 750 from 0.0.0.0/0 or ::/0\n5. If access is required, re-add these ports only from trusted CIDR(s) (e.g., your internal network)\n6. Save rules", + "Terraform": "```hcl\n# Terraform: restrict Kerberos ports from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 88\n to_port = 88\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restrict to trusted CIDR\n }\n\n ingress {\n from_port = 464\n to_port = 464\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: blocks Internet exposure\n }\n\n ingress {\n from_port = 749\n to_port = 749\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: blocks Internet exposure\n }\n\n ingress {\n from_port = 750\n to_port = 750\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: blocks Internet exposure\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 88, 464, 749 or 750 (Kerberos).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict Kerberos ports to trusted sources only.\n- Prefer **private connectivity** (VPN, peering) over public exposure\n- Place KDCs/services in private subnets without public IPs\n- Apply **least privilege** with narrowly scoped security group rules and NACLs\n- Add defense-in-depth: host firewalls and monitor authentication activity", + "Url": "https://hub.prowler.com/check/ec2_instance_port_kerberos_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.metadata.json index 564fd5153d..92cc42fefd 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_ldap_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 389 or 636 (LDAP).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 389 or 636 (LDAP/LDAPS)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 389 or 636 (LDAP).", - "Risk": "LDAP is a protocol used for authentication and authorization. Exposing LDAP to the internet can lead to unauthorized access to the LDAP server and the data it contains.", + "Description": "**EC2 instances** with security groups permitting Internet-sourced access to **LDAP** on `TCP 389` or **LDAPS** on `TCP 636` are identified.\n\nPublic exposure context (presence of public IP and subnet reachability) is considered to gauge how broadly these ports can be accessed.", + "Risk": "Publicly reachable **LDAP/LDAPS** enables:\n- Directory enumeration and weak/anonymous bind attempts\n- **Password spraying** and credential theft (cleartext on `389`)\n- Unauthorized queries causing **data exfiltration**\n\nAbuse may lead to **privilege escalation** and availability impact via account lockouts.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":389,\"ToPort\":389,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":636,\"ToPort\":636,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict LDAP/LDAPS from the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restricted LDAP access\n VpcId: \"\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 389\n ToPort: 389\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restricts LDAP (389) to internal range\n - IpProtocol: tcp\n FromPort: 636\n ToPort: 636\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636) to internal range\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. In Inbound rules, find rules for TCP 389 or 636 with Source set to Anywhere (0.0.0.0/0 or ::/0)\n4. Delete those rule(s)\n5. (If access is required) Add inbound rules for TCP 389 and/or 636 scoped to specific trusted CIDR(s) only\n6. Save rules", + "Terraform": "```hcl\n# Restrict LDAP/LDAPS from the Internet\nresource \"aws_security_group\" \"\" {\n name = \"restricted-ldap\"\n vpc_id = \"\"\n\n ingress {\n from_port = 389\n to_port = 389\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restricts LDAP (389)\n }\n\n ingress {\n from_port = 636\n to_port = 636\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restricts LDAPS (636)\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 389 or 636 (LDAP).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Limit LDAP to trusted networks:\n- Allowlist specific source CIDRs in security groups (*least privilege*)\n- Use **private connectivity** (peering/VPN) instead of Internet\n- Require **LDAPS**, strong certificates, and disable insecure binds\n- Add NACLs and monitoring for defense in depth\n\n*If external access is required*, place a proxy and enforce rate limits.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_ldap_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.metadata.json index 608ed81cc2..8ec39a3011 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_memcached_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 11211 (Memcached).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 11211 (Memcached)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 11211 (Memcached).", - "Risk": "Memcached is an open-source, high-performance, distributed memory object caching system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source must be read. Memcached is designed to be used in trusted environments and should not be exposed to the internet. If Memcached is exposed to the internet, it can be exploited by attackers to perform distributed denial-of-service (DDoS) attacks, data exfiltration, and other malicious activities.", + "Description": "**EC2 instances** are evaluated for **open Memcached access**: inbound `TCP 11211` allowed from any address (`0.0.0.0/0` or `::/0`) via their security groups, considering the instance's public exposure.", + "Risk": "Internet-exposed **Memcached** weakens:\n- **Availability**: abuse for reflection/amplification and resource exhaustion\n- **Confidentiality**: unauthorized reads of cached objects and metadata\n- **Integrity**: manipulation of cache entries influencing app behavior\n\nPublic reachability also aids reconnaissance and lateral movement.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000127021-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-memcached-port-11211" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 11211 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict Memcached (11211) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Memcached access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 11211\n ToPort: 11211\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0; limits access to internal range to avoid Internet exposure\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. In Inbound rules, find the rule allowing TCP 11211 from 0.0.0.0/0 or ::/0\n4. Delete the rule or edit the Source to a restricted range (e.g., a private CIDR or a specific security group)\n5. Save rules", + "Terraform": "```hcl\n# Security group with Memcached (11211) not exposed to the Internet\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 11211\n to_port = 11211\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: not 0.0.0.0/0; restricts access to internal range\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 11211 (Memcached).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** on network access:\n- Restrict `TCP 11211` to trusted sources or internal subnets only\n- Place instances in private subnets; avoid public IPs\n- Layer **defense in depth** with NACLs and routing to block Internet paths\n- Prefer private connectivity (peering/VPN) and implement service-level authentication where available", + "Url": "https://hub.prowler.com/check/ec2_instance_port_memcached_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.metadata.json index a738196e04..7c3cf7c05e 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_mongodb_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 27017 or 27018 (MongoDB)", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 27017 or 27018 (MongoDB)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 27017 or 27018 (MongoDB).", - "Risk": "MongoDB is a popular NoSQL database that is often used in web applications. If an EC2 instance allows ingress from the internet to TCP port 27017 or 27018, it may be vulnerable to unauthorized access and data exfiltration.", + "Description": "**EC2 instances** with security groups permitting inbound `TCP 27017` or `27018` (MongoDB) from `0.0.0.0/0` or `::/0` are identified, factoring the instance's public reachability to gauge exposure.", + "Risk": "Internet-exposed MongoDB invites scanning, brute force, and exploits leading to:\n- Data extraction (**confidentiality**)\n- Collection tampering or deletion (**integrity**)\n- DoS or ransomware disruptions (**availability**)\nA compromised DB host can also enable lateral movement within the environment.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233752-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-27017-or-27018-mongodb-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":27017,\"ToPort\":27017,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":27018,\"ToPort\":27018,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict MongoDB ports from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict MongoDB ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 27017\n ToPort: 27017\n CidrIp: 10.0.0.0/8 # Critical: restricts 27017 to internal CIDR (not 0.0.0.0/0)\n - IpProtocol: tcp\n FromPort: 27018\n ToPort: 27018\n CidrIp: 10.0.0.0/8 # Critical: restricts 27018 to internal CIDR (not 0.0.0.0/0)\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Delete any rule allowing TCP port 27017 or 27018 from 0.0.0.0/0 or ::/0\n5. If access is required, add a rule for those ports limited to a specific trusted CIDR (e.g., your VPC CIDR)\n6. Click Save rules", + "Terraform": "```hcl\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n # Critical: restrict MongoDB ports to internal CIDR, not 0.0.0.0/0 or ::/0\n ingress {\n from_port = 27017\n to_port = 27017\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n\n ingress {\n from_port = 27018\n to_port = 27018\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 27017 or 27018 (MongoDB).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** to MongoDB access:\n- Remove Internet-wide rules; allow only trusted sources\n- Keep DBs on **private subnets** without public IPs; use private connectivity or proxies\n- Enforce strong auth and **TLS**\n- Add segmentation and monitoring for **defense in depth**", + "Url": "https://hub.prowler.com/check/ec2_instance_port_mongodb_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.metadata.json index dbf2fd08fc..c67004ef3a 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_mysql_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 3306 (MySQL).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 3306 (MySQL)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 3306 (MySQL).", - "Risk": "MySQL is a popular open-source relational database management system that is widely used in web applications. Exposing MySQL to the internet can lead to unauthorized access and data exfiltration.", + "Description": "**EC2 instances** with security groups that expose **MySQL** on `TCP 3306` to the Internet (`0.0.0.0/0` or `::/0`) are identified, with context on public IP and subnet exposure.", + "Risk": "Publicly reachable **MySQL** enables Internet scanning, brute force, and credential stuffing, leading to unauthorized queries and data dumps (**confidentiality**). Attackers can alter or delete data (**integrity**), overload the service with query floods (**availability**), and pivot from the DB host into adjacent workloads.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-mysql-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3306 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict MySQL (3306) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict MySQL access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3306\n ToPort: 3306\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0; restrict 3306 to a private range\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Click Inbound rules > Edit inbound rules\n4. Find the rule allowing TCP 3306 from 0.0.0.0/0 or ::/0 and delete it\n5. (If access is required) Add a rule for TCP 3306 from a specific private CIDR or trusted IP range only\n6. Save rules", + "Terraform": "```hcl\n# Restrict MySQL (3306) from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 3306\n to_port = 3306\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do NOT use 0.0.0.0/0; restrict 3306 to a private CIDR\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 3306 (MySQL).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict `TCP 3306` to trusted sources per **least privilege**:\n- Allow DB access only from specific application subnets or security groups\n- Place database hosts in private subnets without public IPs\n- Apply **defense in depth** with VPN/peering for admin access, TLS for connections, and host firewalls; optionally reinforce with NACLs", + "Url": "https://hub.prowler.com/check/ec2_instance_port_mysql_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.metadata.json index 1c73fb9265..fa42c016ab 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_oracle_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 1521, 2483 or 2484 (Oracle).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 1521, 2483, or 2484 (Oracle)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 1521, 2483 or 2484 (Oracle).", - "Risk": "Oracle database servers are a high value target for attackers. Allowing internet access to these ports could lead to unauthorized access to the database.", + "Description": "**EC2 instances** with security groups allowing inbound `TCP` from any address to Oracle listener ports `1521`, `2483`, or `2484`", + "Risk": "Exposed Oracle listener ports enable SID enumeration, credential brute force, and TNS abuse. A successful intrusion can grant database access, causing data exfiltration (C), unauthorized changes (I), and outages via exploits or DoS (A). Internet scanning quickly finds these endpoints, enlarging the attack surface.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-oracle-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 1521 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: Restrict Oracle port from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Oracle port access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1521\n ToPort: 1521\n CidrIp: 10.0.0.0/16 # FIX: do not use 0.0.0.0/0 or ::/0; limits access to a trusted CIDR to block Internet\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. For TCP ports 1521, 2483, and 2484, delete any rule with Source 0.0.0.0/0 or ::/0\n5. If access is required, change the Source to a specific trusted CIDR only\n6. Click Save rules", + "Terraform": "```hcl\n# Security group with Oracle port restricted from Internet\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 1521\n to_port = 1521\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # FIX: restrict source; do not use 0.0.0.0/0 or ::/0\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 1521, 2483 or 2484.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict Oracle ports to trusted sources; remove `0.0.0.0/0` and `::/0`. Place databases in private subnets without public IPs. Use VPN/Direct Connect or bastions for access. Enable TLS on `2484`, strong auth, and apply **least privilege** rules with **defense in depth** using NACLs and monitoring.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_oracle_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.metadata.json index 5e6a2c09d6..8ce8482a28 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_postgresql_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 5432 (PostgreSQL)", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 5432 (PostgreSQL)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 5432 (PostgreSQL).", - "Risk": "PostgreSQL is a popular open-source relational database management system. Exposing the PostgreSQL port to the internet can lead to unauthorized access to the database, data exfiltration, and other security risks.", + "Description": "**EC2 instances** with security group rules allowing inbound **PostgreSQL** on `TCP 5432` from the Internet (`0.0.0.0/0` or `::/0`) are identified, considering the instance's public reachability via IP and subnet.", + "Risk": "Exposed `TCP 5432` enables unauthenticated Internet probes and **brute-force** attempts against PostgreSQL, risking database **confidentiality**, **integrity**, and **availability**. Attackers could dump data, alter schemas, create backdoor accounts, pivot within the VPC, or exploit unpatched flaws at scale.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-postgresql-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 5432 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict PostgreSQL (5432) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict PostgreSQL\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 5432\n ToPort: 5432\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; limits access to internal range\n```", + "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the group attached to the instance\n3. In Inbound rules, find any rule for PostgreSQL (TCP 5432) with source 0.0.0.0/0 or ::/0\n4. Delete the rule or change the source to a specific trusted CIDR only\n5. Save rules", + "Terraform": "```hcl\n# Restrict PostgreSQL (5432) from Internet\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 5432\n to_port = 5432\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; prevents Internet exposure\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 5432 (PostgreSQL).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict PostgreSQL to trusted sources only:\n- Remove `0.0.0.0/0` and `::/0` rules\n- Apply **least privilege** security groups (allow from app tier or VPN)\n- Place instances in private subnets without public IPs\n- Enforce **TLS** and strong auth; disable unused listeners\n- Layer with NACLs and monitoring for **defense in depth**", + "Url": "https://hub.prowler.com/check/ec2_instance_port_postgresql_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.metadata.json index 92dc5338e5..2caf66efa8 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_rdp_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 3389 (RDP)", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 3389 (RDP)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/External Remote Services" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 3389 (RDP).", - "Risk": "RDP is a proprietary protocol developed by Microsoft for connecting to Windows systems. Exposing RDP to the internet can allow attackers to brute force the login credentials and gain unauthorized access to the EC2 instance.", + "Description": "**EC2 instances** whose security groups allow Internet-wide inbound **RDP** on `TCP 3389` (`0.0.0.0/0` or `::/0`). The instance's public IP and subnet routing are considered to determine external reachability.", + "Risk": "Internet-exposed **RDP** allows:\n- **Brute force** and credential reuse on Windows logons\n- Exploitation of RDP flaws for remote code execution\n- **Lateral movement** and data exfiltration\nThis threatens **confidentiality**, **integrity**, and **availability** through data theft, tampering, account lockouts, or ransomware.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233789-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-3389-rdp-", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-rdp-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict RDP so it's not open to the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict RDP access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3389\n ToPort: 3389\n CidrIp: # CRITICAL: limit RDP to a specific CIDR to avoid 0.0.0.0/0 (::/0)\n```", + "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Open each security group attached to the affected instance\n3. In Inbound rules, find any rule allowing TCP 3389 from 0.0.0.0/0 or ::/0\n4. Delete the rule, or edit Source to a specific trusted IP/CIDR only\n5. Click Save rules", + "Terraform": "```hcl\n# Restrict RDP so it's not open to the Internet\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 3389\n to_port = 3389\n protocol = \"tcp\"\n cidr_blocks = [\"\"] # CRITICAL: restrict RDP to a specific CIDR; not 0.0.0.0/0 or ::/0\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 3389 (RDP).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Remove Internet-wide RDP. Apply **least privilege**:\n- Restrict `TCP 3389` to trusted IPs\n- Prefer private access via **VPN** or a hardened **bastion**; consider **Session Manager**\n- Use **just-in-time** access and short-lived rules\n- Enforce strong auth (e.g., NLA) and monitor logs\nAdopt **defense in depth** with layered network controls.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_rdp_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.metadata.json index 10451778c6..d37769600e 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_redis_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 6379 (Redis).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 6379 (Redis)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 6379 (Redis).", - "Risk": "Redis is an open-source, in-memory data structure store, used as a database, cache, and message broker. Redis is often used to store sensitive data, such as session tokens, user credentials, and other sensitive information. Allowing ingress from the internet to TCP port 6379 (Redis) can expose sensitive data to unauthorized users.", + "Description": "**EC2 instances** with security groups permitting Internet access to **Redis** on `TCP 6379` are identified.\n\nExposure is assessed using public IP assignment and subnet reachability to reflect how broadly the service can be contacted.", + "Risk": "Exposed **Redis** allows remote access to cached data and secrets, reducing **confidentiality**. Unauthorized commands (`SET`, `DEL`, `FLUSHALL`, config changes) can corrupt or erase data, harming **integrity**. Internet scanning and abuse can exhaust memory and disrupt service, degrading **availability** and enabling lateral movement.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233806-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-6379-redis-", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-redis-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 6379 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict Redis (6379) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Redis ingress\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 6379\n ToPort: 6379\n CidrIp: 10.0.0.0/8 # Critical: restrict source CIDR (not 0.0.0.0/0 or ::/0) to block Internet access\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule allowing TCP port 6379 from 0.0.0.0/0 or ::/0\n5. Delete the rule, or change the source to a specific trusted CIDR or security group\n6. Click Save rules", + "Terraform": "```hcl\n# Terraform: restrict Redis (6379) from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 6379\n to_port = 6379\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0 or ::/0; restrict to trusted range\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 6379 (Redis).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** network access: restrict Redis to trusted sources or VPC-only, place instances in private subnets, and avoid public IPs.\n\nLayer controls with **NACLs** and host firewalls, enforce **authentication and TLS** on Redis, and use **VPN/bastion** or proxies to broker access.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_redis_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.metadata.json index 26c6be9f99..a23441b72b 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_sqlserver_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 1433 or 1434 (SQL Server).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP ports 1433 or 1434 (SQL Server)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 1433 or 1434 (SQL Server).", - "Risk": "SQL Server is a database management system that is used to store and retrieve data. If an EC2 instance allows ingress from the internet to TCP port 1433 or 1434, it may be vulnerable to unauthorized access and data exfiltration.", + "Description": "**EC2 instances** with security groups permitting any source to `TCP 1433` or `1434` (SQL Server) are identified, considering the instance's public reachability based on IP and subnet exposure.", + "Risk": "Internet-reachable SQL services enable:\n- Brute-force and credential-stuffing of DB logins\n- Exploitation of SQL Server flaws for remote code execution\n- Unauthorized queries and data exfiltration\nThis threatens **confidentiality** and **integrity**, and facilitates **lateral movement** from the database host.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000223371-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-windows-sql-server-ports-1433-or-14", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-mssql-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":1433,\"ToPort\":1434,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict SQL Server ports to non-Internet sources\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SQL ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1433\n ToPort: 1434\n CidrIp: 10.0.0.0/8 # FIX: do not use 0.0.0.0/0; limits access to internal range to close Internet exposure\n```", + "Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the security group attached to the affected EC2 instance\n3. In the Inbound rules tab, click Edit inbound rules\n4. Delete any rule allowing TCP 1433 or 1434 from 0.0.0.0/0 or ::/0\n5. If access is required, add a rule for TCP 1433-1434 with a specific trusted source (e.g., your office IP or another security group)\n6. Click Save rules", + "Terraform": "```hcl\n# Restrict SQL Server ports to non-Internet sources\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 1433\n to_port = 1434\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: do not use 0.0.0.0/0; restricts access to prevent Internet exposure\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group to remove the rule that allows ingress from the internet to TCP port 1433 or 1434 (SQL Server).", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Enforce **least privilege** and **defense in depth**:\n- Remove `0.0.0.0/0` and `::/0` to `1433-1434`\n- Allow only trusted IPs or app tiers via security group references\n- Keep databases in private subnets without public IPs; access via VPN or bastion\n- Require TLS and strong authentication; monitor access.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_sqlserver_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.metadata.json index 2fbce38d91..727e089d00 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_ssh_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 22 (SSH)", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 22 (SSH)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/External Remote Services" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 22 (SSH).", - "Risk": "SSH is a common target for brute force attacks. If an EC2 instance allows ingress from the internet to TCP port 22, it is at risk of being compromised.", + "Description": "**EC2 instances** with **SSH (TCP 22)** exposed to the Internet via security group inbound rules allowing `0.0.0.0/0` or `::/0`.\n\nExposure is qualified using the instance's public IP status and subnet reachability.", + "Risk": "**Internet-exposed SSH** invites **brute force** and **credential stuffing**. A successful sign-in grants **remote shell**, enabling data exfiltration, tampering of workloads, and **lateral movement** within the VPC, degrading confidentiality, integrity, and availability.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ssh-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":22,\"ToPort\":22,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":22,\"ToPort\":22,\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: Restrict SSH so it's not open to the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SSH\n VpcId: \"\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 22\n ToPort: 22\n CidrIp: 10.0.0.0/8 # Critical: restrict SSH to a specific CIDR, not 0.0.0.0/0\n```", + "Other": "1. Open the Amazon EC2 console and go to Security Groups\n2. Select the security group attached to the instance\n3. Click Inbound rules > Edit inbound rules\n4. Delete any rule allowing SSH (port 22) from 0.0.0.0/0 or ::/0\n5. Save rules", + "Terraform": "```hcl\n# Terraform: Restrict SSH so it's not open to the Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 22\n to_port = 22\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: restrict SSH to a specific CIDR, not 0.0.0.0/0\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 22.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** on SSH:\n- Restrict ingress to trusted IPs; avoid `0.0.0.0/0` and `::/0`\n- Prefer **Session Manager** or a hardened **bastion** behind VPN\n- Use **key-based auth**; disable passwords\n- Add **defense in depth** with network controls and monitor access logs", + "Url": "https://hub.prowler.com/check/ec2_instance_port_ssh_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.metadata.json index 371501b8ca..733c055fea 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "ec2_instance_port_telnet_exposed_to_internet", - "CheckTitle": "Ensure no EC2 instances allow ingress from the internet to TCP port 23 (Telnet).", + "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 23 (Telnet)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 23 (Telnet).", - "Risk": "Telnet is an insecure protocol that transmits data in plain text. Exposure of Telnet services to the internet can lead to unauthorized access to the EC2 instance.", + "Description": "EC2 instances with security groups allowing inbound **Telnet** on `TCP 23` from the Internet are identified, including open IPv4/IPv6 sources like `0.0.0.0/0` and `::/0`.\n\nExposure is evaluated considering public IP assignment and subnet reachability.", + "Risk": "Exposed **Telnet** weakens **confidentiality** and **integrity**: credentials and commands are plaintext, enabling interception and session hijacking. Attackers can brute-force to gain shell, run remote commands, exfiltrate data, and pivot laterally, also threatening **availability** through misuse or takeover.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-telnet-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 23 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict Telnet (port 23) from the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Telnet access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 23\n ToPort: 23\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0; restrict Telnet to trusted CIDR to remediate exposure\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the affected instance\n3. Open the Inbound rules tab and find any rule allowing TCP port 23 from 0.0.0.0/0 or ::/0\n4. Delete the rule, or edit it to a specific trusted CIDR only\n5. Click Save rules", + "Terraform": "```hcl\n# Restrict Telnet (port 23) from the Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 23\n to_port = 23\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do NOT use 0.0.0.0/0; restrict Telnet to trusted CIDR to fix the finding\n }\n}\n```" }, "Recommendation": { - "Text": "Modify the security group associated with the EC2 instance to remove the rule that allows ingress from the internet to TCP port 23.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Eliminate Telnet: disable the service and block `TCP 23`.\n\nApply **least privilege** network access-restrict admin connectivity via **SSH** through bastion or **VPN**, keep management paths private, and segregate hosts. Use **defense in depth** with monitoring and strong authentication for any legacy needs.", + "Url": "https://hub.prowler.com/check/ec2_instance_port_telnet_exposed_to_internet" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.metadata.json index 43dfe535ea..6cc1b53430 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.metadata.json @@ -1,32 +1,39 @@ { "Provider": "aws", "CheckID": "ec2_instance_profile_attached", - "CheckTitle": "Ensure IAM instance roles are used for AWS resource access from instances", + "CheckTitle": "EC2 instance is associated with an IAM instance profile role", "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Ensure IAM instance roles are used for AWS resource access from instances.", - "Risk": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS IAM roles reduce the risks associated with sharing and rotating credentials that can be used outside of AWS itself. If credentials are compromised, they can be used from outside of the AWS account.", + "Description": "**EC2 instances** are evaluated for association with an **IAM instance profile role** that delivers temporary credentials to workloads running on the instance", + "Risk": "Without an instance profile, apps often rely on long-term access keys on the host. Exposed keys can be used from anywhere to read data, alter resources, or disrupt services, impacting confidentiality, integrity, and availability. Keys may persist in AMIs, images, or logs, hindering rotation and amplifying blast radius.", "RelatedUrl": "", + "AdditionalURLs": [ + "http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/ec2-instance-using-iam-roles.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/ec2/attach_iam_roles_ec2_instances", - "Terraform": "" + "CLI": "aws ec2 associate-iam-instance-profile --instance-id --iam-instance-profile Name=", + "NativeIaC": "```yaml\n# CloudFormation: attach an IAM instance profile to the EC2 instance\nResources:\n ExampleInstance:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \n InstanceType: \n IamInstanceProfile: # Critical: associates an instance profile so the check passes\n```", + "Other": "1. Open the AWS Management Console and go to EC2\n2. Select Instances and choose the target instance\n3. Click Actions > Security > Modify IAM role\n4. Select the IAM role (instance profile) to attach\n5. Click Update IAM role", + "Terraform": "```hcl\n# Attach an IAM instance profile to the EC2 instance\nresource \"aws_instance\" \"example\" {\n ami = \"\"\n instance_type = \"\"\n iam_instance_profile = \"\" # Critical: associates an instance profile so the check passes\n}\n```" }, "Recommendation": { - "Text": "Create an IAM instance role if necessary and attach it to the corresponding EC2 instance..", - "Url": "http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html" + "Text": "Attach an **IAM instance profile** to every instance and grant only permissions each workload requires (**least privilege**). Eliminate static keys on hosts; use **temporary credentials** with automatic rotation. Separate roles per application, enforce **separation of duties**, and limit who can assign roles (govern via `iam:PassRole`). Monitor role usage for anomalies.", + "Url": "https://hub.prowler.com/check/ec2_instance_profile_attached" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.metadata.json index f835b8ae7b..509b7394c7 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "ec2_instance_public_ip", - "CheckTitle": "Check for EC2 Instances with Public IP.", + "CheckTitle": "EC2 instance does not have a public IP address", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "instance", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Check for EC2 Instances with Public IP.", - "Risk": "Exposing an EC2 directly to internet increases the attack surface and therefore the risk of compromise.", + "Description": "**EC2 instances** are assessed for the presence of a **public IPv4 address** and public DNS. A public IP indicates the instance is directly reachable from the Internet; no public IP implies access only through private networking paths such as load balancers, gateways, or proxies.", + "Risk": "Publicly addressed instances are Internet-scannable, enabling direct probing and brute-force of exposed services and management ports. This increases risks of unauthorized access, remote code execution, and data exfiltration (**confidentiality, integrity**), and allows direct DDoS targeting, degrading **availability**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/aws-ec2-public-ip.html", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "https://docs.prowler.com/checks/aws/public-policies/public_12#cloudformation", - "Other": "https://docs.prowler.com/checks/aws/public-policies/public_12#aws-console", - "Terraform": "https://docs.prowler.com/checks/aws/public-policies/public_12#terraform" + "NativeIaC": "```yaml\n# CloudFormation: Launch EC2 without a public IP\nResources:\n ExampleInstance:\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \n InstanceType: \n NetworkInterfaces:\n - DeviceIndex: 0\n SubnetId: \n AssociatePublicIpAddress: false # CRITICAL: ensures the instance has no public IPv4 address\n```", + "Other": "1. In the AWS Console, go to EC2 > Instances and select the instance with a public IPv4 address\n2. Check the Networking tab to see if an Elastic IP is attached\n3. If an Elastic IP is attached:\n - Go to EC2 > Elastic IPs, select the address, choose Actions > Disassociate Elastic IP\n4. If the public IPv4 is auto-assigned (no Elastic IP shown):\n - Create a new instance (or an AMI from the current one) and, during launch, in Network settings, set Auto-assign public IP to Disable\n - Verify the new instance has no public IPv4, then migrate and terminate the old instance", + "Terraform": "```hcl\n# Terraform: Launch EC2 without a public IP\nresource \"aws_instance\" \"example\" {\n ami = \"\"\n instance_type = \"\"\n subnet_id = \"\"\n\n associate_public_ip_address = false # CRITICAL: ensures no public IPv4 is assigned\n}\n```" }, "Recommendation": { - "Text": "Use an ALB and apply WAF ACL.", - "Url": "https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/" + "Text": "Avoid assigning public IPs unless strictly required. Place workloads in private subnets and expose only via **load balancers** with **WAF**; use **bastions** or **Session Manager** for administration. Enforce **least privilege** security groups, prefer **private endpoints**, and route egress via **NAT** for **defense in depth**.", + "Url": "https://hub.prowler.com/check/ec2_instance_public_ip" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.metadata.json index 2adc3bb922..455bfce9f7 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_instance_secrets_user_data", - "CheckTitle": "Find secrets in EC2 User Data.", + "CheckTitle": "EC2 instance user data contains no secrets", "CheckType": [ - "IAM" + "Software and Configuration Checks/AWS Security Best Practices", + "Sensitive Data Identifications/Security", + "Sensitive Data Identifications/Passwords", + "Effects/Data Exposure" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:access-analyzer:region:account-id:analyzer/resource-id", - "Severity": "critical", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "Find secrets in EC2 User Data.", - "Risk": "Secrets hardcoded into instance user data can be used by malware and bad actors to gain lateral access to other services.", + "Description": "**EC2 instance User Data** is inspected for **secret-like values** (credentials, tokens, keys). Both plain and compressed content are parsed, honoring configured exclusions, to identify patterns that resemble sensitive material within initialization scripts.", + "Risk": "**Secrets embedded in User Data** undermine confidentiality and integrity. Anyone with instance or build-system access can read them, reuse credentials to call services, exfiltrate data, or move laterally. Exposure may persist in AMIs, snapshots, and backups, increasing blast radius over time.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html", + "https://support.icompaas.com/support/solutions/articles/62000127092-ensure-no-secrets-are-found-in-ec2-user-data" + ], "Remediation": { "Code": { - "CLI": "aws ec2 describe-instance-attribute --attribute userData --region --instance-id --query UserData.Value --output text > encodeddata; base64 --decode encodeddata", - "NativeIaC": "https://docs.prowler.com/checks/aws/secrets-policies/bc_aws_secrets_1#cloudformation", - "Other": "https://docs.prowler.com/checks/aws/secrets-policies/bc_aws_secrets_1", - "Terraform": "https://docs.prowler.com/checks/aws/secrets-policies/bc_aws_secrets_1#terraform" + "CLI": "aws ec2 modify-instance-attribute --instance-id --user-data \"Value=\"", + "NativeIaC": "```yaml\n# CloudFormation: EC2 instance with empty user data\nResources:\n :\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \n InstanceType: t3.micro\n UserData: !Base64 \"\" # Critical: empty user data ensures no secrets are present\n```", + "Other": "1. Open the AWS EC2 console and go to Instances\n2. Select the affected instance\n3. Click Actions > Instance settings > Edit user data\n4. Delete all contents of the user data field\n5. Click Save", + "Terraform": "```hcl\nresource \"aws_instance\" \"\" {\n ami = \"\"\n instance_type = \"t3.micro\"\n user_data = \"\" # Critical: empty user data so no secrets are stored\n}\n```" }, "Recommendation": { - "Text": "Implement automated detective control (e.g. using tools like Prowler) to scan accounts for passwords and secrets. Use secrets manager service to store and retrieve passwords and secrets.", - "Url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html" + "Text": "Avoid placing secrets in User Data. Store them in a **managed secret service** and fetch at runtime via a **least-privilege instance role**. Prefer short-lived credentials with **regular rotation**. Limit who can view or edit User Data and apply **defense in depth** with automated secret scanning in build pipelines.", + "Url": "https://hub.prowler.com/check/ec2_instance_secrets_user_data" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.metadata.json index edc64e0fcf..60fa42cf35 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_instance_uses_single_eni", - "CheckTitle": "Amazon EC2 instances should not use multiple ENIs", + "CheckTitle": "EC2 instance has no more than one Elastic Network Interface (ENI) attached", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:instance/resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "This control checks whether an EC2 instance uses multiple Elastic Network Interfaces (ENIs) or Elastic Fabric Adapters (EFAs). This control passes if a single network adapter is used. The control includes an optional parameter list to identify the allowed ENIs. This control also fails if an EC2 instance that belongs to an Amazon EKS cluster uses more than one ENI. If your EC2 instances need to have multiple ENIs as part of an Amazon EKS cluster, you can suppress those control findings.", - "Risk": "Multiple ENIs can cause dual-homed instances, meaning instances that have multiple subnets. This can add network security complexity and introduce unintended network paths and access.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-multiple-eni-check.html", + "Description": "**EC2 instances** are evaluated for attached network adapters. It identifies instances with more than one `ENI`-including `efa`, `interface`, or `trunk` types-and distinguishes those using a single adapter.", + "Risk": "**Multiple ENIs** create dual-homed hosts across subnets and security groups, enabling unintended routing and policy bypass. Adversaries can pivot between segments, use alternate egress for **data exfiltration**, or exploit asymmetric paths, undermining segmentation and **confidentiality/integrity** while complicating containment.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#detach_eni", + "https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-multiple-eni-check.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-17" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-17", - "Terraform": "" + "CLI": "aws ec2 detach-network-interface --attachment-id ", + "NativeIaC": "```yaml\n# CloudFormation: ensure the instance has only one ENI\nResources:\n :\n Type: AWS::EC2::Instance\n Properties:\n ImageId: \n InstanceType: t3.micro\n SubnetId: # FIX: creates a single primary ENI; do not add extra NetworkInterfaces/attachments\n```", + "Other": "1. Open the AWS EC2 console and go to Network Interfaces\n2. Filter by the affected instance ID\n3. Select each non-primary network interface (Primary cannot be detached)\n4. Choose Actions > Detach\n5. Confirm the detach for each secondary ENI", + "Terraform": "```hcl\n# Terraform: instance with only the primary ENI\nresource \"aws_instance\" \"\" {\n ami = \"\"\n instance_type = \"t3.micro\"\n subnet_id = \"\" # FIX: only primary ENI; no additional network_interface attachments\n}\n```" }, "Recommendation": { - "Text": "To detach a network interface from an EC2 instance, follow the instructions in the Amazon EC2 User Guide.", - "Url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#detach_eni" + "Text": "Prefer a **single ENI per instance**.\n\nIf multi-homing is unavoidable:\n- Place ENIs in least-privilege subnets/SGs\n- Keep `source/destination check` enabled and routes explicit\n- Use gateways/LBs for NAT or ingress, not the host\n- Monitor flow logs and formally approve exceptions\n\nEmbed **defense in depth** and **zero trust**.", + "Url": "https://hub.prowler.com/check/ec2_instance_uses_single_eni" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.metadata.json b/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.metadata.json index cb207e36bf..abde63f8ea 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_instance_with_outdated_ami/ec2_instance_with_outdated_ami.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_instance_with_outdated_ami", - "CheckTitle": "Check for EC2 Instances Using Outdated AMIs", - "CheckType": [], + "CheckTitle": "EC2 instance uses a non-deprecated Amazon AMI", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Patch Management", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:instance/resource-id", - "Severity": "high", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsEc2Instance", "ResourceGroup": "compute", - "Description": "This check identifies EC2 instances using outdated Amazon Machine Images (AMIs) by auditing instances to gather AMI IDs, comparing them against the latest available versions, verifying suppo and security update status, and checking for deprecation.", - "Risk": "Using outdated AMIs can expose EC2 instances to security vulnerabilities, lack of support, and missing critical updates, increasing the risk of exploitation.", + "Description": "**EC2 instances** launched from **Amazon-owned AMIs** are evaluated for the AMI's `DeprecationTime`; instances tied to images with a deprecation date in the past are reported as using **deprecated AMIs**.", + "Risk": "Running on a **deprecated AMI** undermines security and availability:\n- Missing patches enable exploitation of known CVEs (confidentiality/integrity)\n- Unsupported components hinder hardening and forensics\n- AMI removal from catalogs complicates scale-out and recovery (availability)", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-deprecate.html", + "https://repost.aws/knowledge-center/ec2-find-deprecated-ami" + ], "Remediation": { "Code": { - "CLI": "aws ec2 describe-images --image-ids ", - "NativeIaC": "", - "Other": "https://repost.aws/knowledge-center/ec2-find-deprecated-ami", - "Terraform": "" + "CLI": "", + "NativeIaC": "```yaml\n# Use a non-deprecated Amazon AMI for instances launched via this template\nResources:\n :\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateData:\n ImageId: \"\" # Critical: Amazon-owned AMI with no DeprecationTime\n```", + "Other": "1. In the EC2 console, go to AMIs\n2. Set Owner to \"Amazon\" and ensure deprecated AMIs are not included; copy the AMI ID\n3. If using an Auto Scaling Group:\n - Launch templates > select the one in use > Create new version with Image ID set to the copied AMI and set it as default\n - Auto Scaling Groups > select the group > Start instance refresh\n4. If it is a standalone instance:\n - Launch a new instance using the copied Amazon AMI\n - Move workloads and terminate the old instance", + "Terraform": "```hcl\n# EC2 instance using a non-deprecated Amazon AMI\nresource \"aws_instance\" \"\" {\n ami = \"\" # Critical: Amazon-owned AMI with no DeprecationTime\n instance_type = \"t3.micro\"\n}\n```" }, "Recommendation": { - "Text": "Regularly update your EC2 instances to use the latest AMIs to ensure they receive the latest security patches and updates.", - "Url": "https://repost.aws/knowledge-center/ec2-find-deprecated-ami" + "Text": "Adopt **non-deprecated, maintained AMIs** and perform rolling replacements of affected instances. Standardize on hardened golden images with **regular AMI rotation** and `DeprecationTime` monitoring. Update launch templates/ASGs to reference current images. Automate patching via an image pipeline and apply **defense in depth**.", + "Url": "https://hub.prowler.com/check/ec2_instance_with_outdated_ami" } }, - "Categories": [], + "Categories": [ + "vulnerabilities" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.metadata.json b/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.metadata.json index 6d56feb488..2a7517c5bb 100644 --- a/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.metadata.json @@ -1,32 +1,43 @@ { "Provider": "aws", "CheckID": "ec2_launch_template_imdsv2_required", - "CheckTitle": "Amazon EC2 launch templates should have IMDSv2 enabled and required.", + "CheckTitle": "EC2 launch template has IMDSv2 enabled and required or instance metadata service disabled", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Credential Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:ec2:region:account-id:launch-template/resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2LaunchTemplate", "ResourceGroup": "compute", - "Description": "This control checks if Amazon EC2 launch templates are configured with IMDSv2 enabled and required. The control fails if IMDSv2 is not enabled or required in the launch template versions.", - "Risk": "Without IMDSv2 required, EC2 instances may be vulnerable to metadata service attacks, allowing unauthorized access to instance metadata, potentially leading to compromise of instance credentials or other sensitive data.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html", + "Description": "EC2 launch templates are inspected for **Instance Metadata Service** configuration. It identifies versions where `http_endpoint` is `enabled` and `http_tokens` is `required` (IMDSv2 enforced), versions with the metadata service `disabled`, and versions that allow metadata without requiring tokens.", + "Risk": "Allowing metadata access without **IMDSv2** enables SSRF and open proxy paths to query instance metadata, exposing temporary credentials and secrets. Attackers can steal IAM role credentials to access data, modify resources, and pivot within the account, threatening confidentiality and integrity.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-metadata-options", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-170" + ], "Remediation": { "Code": { - "CLI": "aws ec2 modify-launch-template --launch-template-id --version --metadata-options HttpTokens=required", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-170", - "Terraform": "" + "CLI": "aws ec2 create-launch-template-version --launch-template-id --source-version --launch-template-data '{\"MetadataOptions\":{\"HttpTokens\":\"required\"}}'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateName: \n LaunchTemplateData:\n MetadataOptions:\n HttpTokens: required # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check\n```", + "Other": "1. In the AWS Console, go to EC2 > Launch Templates\n2. Select the launch template, then choose Actions > Modify template (Create new version)\n3. Expand Advanced details > Metadata options\n4. Set Http tokens to Required (or disable Metadata accessible)\n5. Click Create template version\n6. (Optional) Set this new version as Default if you want it used for future launches", + "Terraform": "```hcl\nresource \"aws_launch_template\" \"\" {\n name = \"\"\n\n metadata_options {\n http_tokens = \"required\" # CRITICAL: Require IMDSv2 (blocks IMDSv1) to pass the check\n }\n}\n```" }, "Recommendation": { - "Text": "To ensure EC2 launch templates have IMDSv2 enabled and required, update the template to configure the Instance Metadata Service Version 2 as required.", - "Url": "https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-metadata-options" + "Text": "Enforce **IMDSv2** in all launch template versions by setting token use to `required`; disable the metadata service when not needed. Apply **least privilege** to instance roles and use **defense in depth** (egress filtering, input validation) to reduce SSRF paths. Ensure applications and SDKs are compatible with IMDSv2.", + "Url": "https://hub.prowler.com/check/ec2_launch_template_imdsv2_required" } }, - "Categories": [], + "Categories": [ + "secrets" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.metadata.json b/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.metadata.json index 8f9c806585..098fb50adf 100644 --- a/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_launch_template_no_public_ip", - "CheckTitle": "Amazon EC2 launch templates should not assign public IPs to network interfaces.", - "CheckType": [], + "CheckTitle": "Amazon EC2 launch template has no public IP addresses configured on network interfaces", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2LaunchTemplate", "ResourceGroup": "compute", - "Description": "This control checks if Amazon EC2 launch templates are configured to assign public IP addresses to network interfaces upon launch. The control fails if an EC2 launch template is configured to assign a public IP address to network interfaces or if there is at least one network interface that has a public IP address.", - "Risk": "A public IP address is reachable from the internet, making associated resources potentially accessible from the internet. EC2 resources should not be publicly accessible to avoid unintended access to workloads.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-launch-template-public-ip-disabled.html", + "Description": "**EC2 launch templates** with versions that either enable `associate_public_ip_address` for network interfaces or reference **ENIs** already associated with public IPs", + "Risk": "Assigning **public IPs** makes instances Internet-reachable, enabling:\n- Loss of **confidentiality** via unauthorized access and data exfiltration\n- Compromised **integrity** through remote exploitation and tampering\n- Reduced **availability** from DDoS and brute-force traffic\nAttackers can scan exposed services and pivot within the VPC.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-network-interface", + "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-25", + "https://docs.aws.amazon.com/config/latest/developerguide/ec2-launch-template-public-ip-disabled.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-25", - "Terraform": "" + "CLI": "aws ec2 create-launch-template-version --launch-template-id --launch-template-data '{\"NetworkInterfaces\":[{\"DeviceIndex\":0,\"AssociatePublicIpAddress\":false}]}' --set-default-version", + "NativeIaC": "```yaml\n# CloudFormation: Launch template configured to not assign public IPs\nResources:\n :\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateData:\n NetworkInterfaces:\n - DeviceIndex: 0\n AssociatePublicIpAddress: false # Critical: disables public IP assignment on the primary ENI\n```", + "Other": "1. Open the EC2 console and go to Launch Templates\n2. Select the template and choose Actions > Create new version\n3. Under Network settings > Advanced network configuration, set Auto-assign public IP to Disable\n4. Ensure no Network interface is attached that already has a public IP\n5. Check Set as default version and choose Create launch template version", + "Terraform": "```hcl\n# EC2 launch template configured to not assign public IPs\nresource \"aws_launch_template\" \"\" {\n name = \"\"\n\n network_interfaces {\n device_index = 0\n associate_public_ip_address = false # Critical: disables public IP assignment on the primary ENI\n }\n}\n```" }, "Recommendation": { - "Text": "To update an EC2 launch template, see Change the default network interface settings in the Amazon EC2 Auto Scaling User Guide.", - "Url": "https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-launch-template.html#change-network-interface" + "Text": "Apply **least privilege** and network segmentation:\n- Set `associate_public_ip_address=false` in launch templates\n- Avoid referencing ENIs with public IPs\n- Place instances in private subnets behind **NAT/ALB**\n- Use **Session Manager**, bastions, or **VPC endpoints/PrivateLink** for access\nAdopt **defense in depth** to minimize exposure.", + "Url": "https://hub.prowler.com/check/ec2_launch_template_no_public_ip" } }, - "Categories": [], + "Categories": [ + "internet-exposed" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.metadata.json b/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.metadata.json index 48fc89a4c3..a3c9d3c7c3 100644 --- a/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.metadata.json @@ -1,27 +1,38 @@ { "Provider": "aws", "CheckID": "ec2_launch_template_no_secrets", - "CheckTitle": "Find secrets in EC2 Launch Template", - "CheckType": [], + "CheckTitle": "EC2 launch template user data contains no secrets in any version", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Sensitive Data Identifications/Security", + "Sensitive Data Identifications/Passwords", + "Effects/Data Exposure", + "TTPs/Credential Access" + ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:ec2:region:account-id:launch-template/template-id", - "Severity": "critical", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsEc2LaunchTemplate", "ResourceGroup": "compute", - "Description": "Find secrets in EC2 Launch Template", - "Risk": "The use of a hard-coded password increases the possibility of password guessing. If hard-coded passwords are used, it is possible that malicious users gain access through the account in question.", - "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html", + "Description": "**EC2 launch template** user data is analyzed across versions to identify embedded secrets-hard-coded passwords, tokens, API keys, or private keys-within the startup scripts or configuration supplied to instances.", + "Risk": "Secrets in user data can be read by identities able to view launch templates, eroding confidentiality.\n\nExposed credentials enable unauthorized API actions, data exfiltration, and lateral movement. Past template versions retain leaked values, complicating rotation and recovery.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html", + "https://support.icompaas.com/support/solutions/articles/62000233727-ensure-no-secrets-are-hardcoded-in-ec2-launch-templates" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Launch Template without user data secrets\nResources:\n :\n Type: AWS::EC2::LaunchTemplate\n Properties:\n LaunchTemplateData:\n UserData: \"\" # Critical: empty user data ensures no secrets are stored in any new version\n```", + "Other": "1. In the AWS Console, go to EC2 > Launch Templates\n2. Select the launch template and click Create new version\n3. In Advanced details, clear the User data field so it is blank\n4. Save and set this clean version as the Default version\n5. Back in the Versions tab, select all versions that contain secrets and click Actions > Delete versions\n6. Ensure only versions with blank (or non-secret) user data remain", + "Terraform": "```hcl\n# Terraform: Launch Template with empty user data\nresource \"aws_launch_template\" \"\" {\n name = \"\"\n user_data = \"\" # Critical: empty user data prevents secrets from being stored\n}\n```" }, "Recommendation": { - "Text": "Do not include sensitive information in user data within the launch templates, try to use Secrets Manager instead.", - "Url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html" + "Text": "Keep user data free of secrets. Retrieve sensitive values at runtime from **AWS Secrets Manager** or **SSM Parameter Store** `SecureString` using instance roles.\n\nEnforce **least privilege**, rotate to short-lived credentials, and review template history; if exposure occurred, rotate affected secrets.", + "Url": "https://hub.prowler.com/check/ec2_launch_template_no_secrets" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.metadata.json b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.metadata.json index e629d7c52b..c8db63f27f 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.metadata.json @@ -1,31 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_networkacl_allow_ingress_any_port", - "CheckTitle": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to any port.", + "CheckTitle": "Network ACL does not allow ingress from 0.0.0.0/0 to any port", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS AWS Foundations Benchmark" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "networkacl", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "medium", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsEc2NetworkAcl", "ResourceGroup": "network", - "Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to any port.", - "Risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.", + "Description": "**VPC network ACLs** with **inbound entries** that permit traffic from `0.0.0.0/0` to any port (any protocol) are identified at the subnet boundary.", + "Risk": "Allowing Internet-wide ingress at the subnet layer enables broad port scanning and unsolicited connections. Attackers can probe and exploit exposed services, risking data disclosure and tampering (confidentiality, integrity) and causing outages via floods or brute-force (availability). Any security group lapse then lacks a compensating control.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html", + "https://support.icompaas.com/support/solutions/articles/62000233809-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-any-port" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 replace-network-acl-entry --network-acl-id --ingress --rule-number --protocol -1 --rule-action deny --cidr-block 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: deny all inbound from the Internet on the NACL\nResources:\n NetworkAclDenyAllIngress:\n Type: AWS::EC2::NetworkAclEntry\n Properties:\n NetworkAclId: \"\"\n RuleNumber: 100\n Protocol: -1\n Egress: false\n RuleAction: deny # CRITICAL: Denies ingress\n CidrBlock: 0.0.0.0/0 # CRITICAL: From the Internet (any IP)\n```", + "Other": "1. In AWS Console, go to VPC > Network ACLs\n2. Select the NACL used by the affected subnet\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule that allows 0.0.0.0/0 to all ports and change Action to Deny (or delete the allow-all rule)\n5. Save changes", + "Terraform": "```hcl\n# Deny all inbound from the Internet on the NACL\nresource \"aws_network_acl_rule\" \"\" {\n network_acl_id = \"\"\n rule_number = 100\n egress = false\n protocol = \"-1\"\n rule_action = \"deny\" # CRITICAL: Denies ingress\n cidr_block = \"0.0.0.0/0\" # CRITICAL: From the Internet (any IP)\n}\n```" }, "Recommendation": { - "Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html" + "Text": "Adopt a **deny-by-default** NACL posture: block `0.0.0.0/0` and allow only required ports from trusted CIDRs. Apply **least privilege** using security groups for fine-grained access, with NACLs as coarse stateless filters. Review and prune rules regularly, and employ **defense in depth** with monitoring and alerting.", + "Url": "https://hub.prowler.com/check/ec2_networkacl_allow_ingress_any_port" } }, "Categories": [ @@ -33,5 +39,5 @@ ], "DependsOn": [], "RelatedTo": [], - "Notes": "Infrastructure Security" + "Notes": "" } diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.metadata.json b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.metadata.json index 1bf207e19b..4837548c21 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_networkacl_allow_ingress_tcp_port_22", - "CheckTitle": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to SSH port 22", + "CheckTitle": "Network ACL does not allow ingress from the Internet to TCP port 22 (SSH)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "networkacl", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2NetworkAcl", "ResourceGroup": "network", - "Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to SSH port 22", - "Risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.", + "Description": "**VPC network ACLs** are evaluated for inbound rules that permit `0.0.0.0/0` to access **SSH** on `TCP 22` at the subnet boundary.", + "Risk": "An ACL allowing Internet-wide SSH erodes **defense in depth**. Systems reachable on `TCP 22` face **brute-force**, credential stuffing, reconnaissance, and SSH exploit attempts.\n\nChanges to routes or security groups can create direct exposure, enabling unauthorized access and **lateral movement**, undermining **confidentiality** and **integrity**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000233578-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-ssh-port-22", + "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-22#cloudformation", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-22#terraform" + "CLI": "aws ec2 replace-network-acl-entry --network-acl-id --ingress --rule-number --protocol 6 --rule-action deny --cidr-block 0.0.0.0/0 --port-range From=22,To=22", + "NativeIaC": "```yaml\n# CloudFormation: Deny SSH (22) from Internet on the NACL\nResources:\n :\n Type: AWS::EC2::NetworkAclEntry\n Properties:\n NetworkAclId: \n RuleNumber: 1\n Protocol: 6\n RuleAction: deny # Critical: blocks the traffic instead of allowing it\n Egress: false\n CidrBlock: 0.0.0.0/0 # Critical: matches Internet sources\n PortRange:\n From: 22 # Critical: SSH port\n To: 22\n```", + "Other": "1. In AWS Console, go to VPC > Network ACLs\n2. Select and open the Inbound rules tab\n3. Delete any rule that ALLOWS TCP port 22 from 0.0.0.0/0 or ::/0\n4. Save changes\n5. If you cannot delete it, edit the rule and set Action to Deny for TCP port 22 with source 0.0.0.0/0 (and ::/0 if present), then save", + "Terraform": "```hcl\n# Deny SSH (22) from Internet on the NACL\nresource \"aws_network_acl_rule\" \"\" {\n network_acl_id = \"\"\n rule_number = 1\n egress = false\n protocol = \"tcp\"\n rule_action = \"deny\" # Critical: blocks SSH ingress\n cidr_block = \"0.0.0.0/0\" # Critical: Internet sources\n from_port = 22 # Critical: SSH port\n to_port = 22\n}\n```" }, "Recommendation": { - "Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html" + "Text": "Apply **least privilege** at the subnet layer:\n- Do not allow `0.0.0.0/0` to `TCP 22`\n- Restrict SSH to trusted sources, or avoid direct SSH via **Session Manager** or a bastion behind **VPN**\n\nPair tight **security groups** with periodic rule reviews and change control to maintain **defense in depth**.", + "Url": "https://hub.prowler.com/check/ec2_networkacl_allow_ingress_tcp_port_22" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.metadata.json b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.metadata.json index 1269640e32..4dc401c723 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_networkacl_allow_ingress_tcp_port_3389", - "CheckTitle": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to Microsoft RDP port 3389", + "CheckTitle": "Network ACL does not allow ingress from the Internet to TCP port 3389 (RDP)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "networkacl", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2NetworkAcl", "ResourceGroup": "network", - "Description": "Ensure no Network ACLs allow ingress from 0.0.0.0/0 to Microsoft RDP port 3389", - "Risk": "Even having a perimeter firewall, having network acls open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.", + "Description": "**VPC network ACLs** with inbound rules allowing **RDP** on `TCP 3389` from `0.0.0.0/0` are identified.\n\nAssessment focuses on subnet-level ACL entries that permit this traffic.", + "Risk": "Internet-exposed **RDP** enables **password spraying**, brute force, and exploitation of RDP flaws to gain remote control. Allowing it at the subnet layer weakens **defense in depth**-a misconfigured security group or route can expose instances-leading to data exfiltration, privilege escalation, and ransomware, impacting confidentiality and integrity.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000223179-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-microsoft-rdp-port-3389-", + "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-3389#cloudformation", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-nacl-does-not-allow-ingress-from-00000-to-port-3389#terraform" + "CLI": "aws ec2 delete-network-acl-entry --network-acl-id --ingress --rule-number ", + "NativeIaC": "```yaml\n# CloudFormation: deny inbound RDP (TCP 3389) from the Internet on an existing NACL\nResources:\n NetworkAclDenyRDP:\n Type: AWS::EC2::NetworkAclEntry\n Properties:\n NetworkAclId: \n RuleNumber: 1 # Critical: ensure this deny is evaluated before any allow\n Protocol: 6 # TCP\n Egress: false # Ingress rule\n RuleAction: deny # Critical: block the traffic\n CidrBlock: 0.0.0.0/0 # Critical: Internet source\n PortRange:\n From: 3389 # Critical: RDP port\n To: 3389\n```", + "Other": "1. In the AWS Console, go to VPC > Network ACLs and select the ACL used by the affected subnet(s)\n2. Open the Inbound rules tab\n3. Find any rule allowing TCP port 3389 (RDP) from 0.0.0.0/0 or ::/0\n4. Select that rule and click Delete, then Save\n5. If you must keep broad allows, instead click Edit inbound rules and add a new rule with a lower rule number that Denies TCP 3389 from 0.0.0.0/0, then Save", + "Terraform": "```hcl\n# Deny inbound RDP (TCP 3389) from the Internet on an existing NACL\nresource \"aws_network_acl_rule\" \"\" {\n network_acl_id = \"\"\n rule_number = 1 # Critical: lower than any allow so deny takes precedence\n egress = false # Ingress rule\n protocol = \"tcp\"\n rule_action = \"deny\" # Critical: block the traffic\n cidr_block = \"0.0.0.0/0\" # Critical: Internet source\n from_port = 3389 # Critical: RDP port\n to_port = 3389\n}\n```" }, "Recommendation": { - "Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive network acls. Recommended best practices is to narrow the definition for the minimum ports required.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html" + "Text": "Enforce **least privilege**: do not allow `TCP 3389` from `0.0.0.0/0` in network ACLs.\n\n- Restrict RDP to specific admin IP ranges\n- Prefer **bastion hosts** or **Session Manager** over direct RDP\n- Use private subnets and layer controls for **defense in depth**", + "Url": "https://hub.prowler.com/check/ec2_networkacl_allow_ingress_tcp_port_3389" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.metadata.json b/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.metadata.json index 5494405ba1..6f6c696085 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.metadata.json @@ -1,33 +1,41 @@ { "Provider": "aws", "CheckID": "ec2_networkacl_unused", - "CheckTitle": "Unused Network Access Control Lists should be removed.", - "CheckType": [], + "CheckTitle": "Non-default network ACL is associated with a subnet", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "ec2", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsEc2NetworkAcl", "ResourceGroup": "network", - "Description": "Ensure that there are no unused network access control lists (network ACLs) in your virtual private cloud (VPC). The control fails if the network ACL isn't associated with a subnet. The control doesn't generate findings for an unused default network ACL.", - "Risk": "Unused network ACLs may represent a potential security risk if left in place without purpose, as they could be mistakenly associated with subnets later.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/vpc-network-acl-unused-check.html", + "Description": "**VPC network ACLs** that are **not associated with any subnet** are considered unused. The evaluation focuses on non-default ACLs and identifies those without a current subnet association; the default network ACL is excluded.", + "Risk": "Unused ACLs raise the risk of **misassociation**, unexpectedly changing subnet filtering. A permissive ACL could expose workloads (**confidentiality, integrity**), while an overly restrictive one could disrupt traffic (**availability**). Stale objects also hinder reviews and conceal drift.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#vpc-network-acl-delete", + "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-16", + "https://docs.aws.amazon.com/config/latest/developerguide/vpc-network-acl-unused-check.html" + ], "Remediation": { "Code": { "CLI": "aws ec2 delete-network-acl --network-acl-id ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-16", - "Terraform": "" + "NativeIaC": "```yaml\n# Associate the unused non-default NACL to a subnet so it's in use\nResources:\n :\n Type: AWS::EC2::SubnetNetworkAclAssociation\n Properties:\n SubnetId: # Critical: makes the subnet use this NACL\n NetworkAclId: # Critical: the unused non-default NACL to associate\n```", + "Other": "1. In the AWS console, open VPC > Network ACLs\n2. Select the non-default NACL with Association: None\n3. Choose Actions > Delete ACL > Delete\n\nAlternative (if you want to keep it):\n1. Select the NACL > Actions > Edit subnet associations\n2. Check a subnet to associate > Save", + "Terraform": "```hcl\n# Associate the unused non-default NACL to a subnet so it's in use\nresource \"aws_network_acl_association\" \"\" {\n subnet_id = \"\" # Critical: makes the subnet use this NACL\n network_acl_id = \"\" # Critical: the unused non-default NACL to associate\n}\n```" }, "Recommendation": { - "Text": "For instructions on deleting an unused network ACL, see Deleting a network ACL in the Amazon VPC User Guide.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#vpc-network-acl-delete" + "Text": "Remove **unused non-default ACLs** to minimize drift. Apply **least privilege** and **change control** to ACL creation and associations. If retention is necessary, tag owner and purpose, restrict who can associate ACLs, and review regularly as part of **defense in depth**.", + "Url": "https://hub.prowler.com/check/ec2_networkacl_unused" } }, "Categories": [ - "internet-exposed" + "trust-boundaries" ], "DependsOn": [], "RelatedTo": [], - "Notes": "Infrastructure Security" + "Notes": "" } diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json index de12363a49..4ceccb1f1d 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to all ports.", + "CheckTitle": "Security group does not have all ports open to the Internet", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to all ports.", - "Risk": "If Security groups are not properly configured the attack surface is increased. An attacker could exploit this misconfiguration to gain unauthorized access to resources.", + "Description": "**EC2 security groups** with **inbound rules** permitting Internet sources (`0.0.0.0/0`, `::/0`) to `all ports` across any protocol", + "Risk": "Opening every port to the Internet enables broad scanning and exploit attempts, leading to **unauthorized access**, **remote code execution**, and **data exfiltration**, with easier lateral movement into the VPC. Confidentiality, integrity, and availability are all at risk.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-ingress-any.html" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-security-group-does-not-allow-all-traffic-on-all-ports/" + "NativeIaC": "```yaml\n# CloudFormation: Security Group without an inbound rule that opens all ports to the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Example SG\n VpcId: \n # Critical: Omit SecurityGroupIngress to ensure no rule with IpProtocol \"-1\" from 0.0.0.0/0 or ::/0 exists,\n # which prevents all ports from being open to the Internet.\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Delete any rule where Type is All traffic (protocol = All) with Source 0.0.0.0/0 or ::/0\n5. Click Save rules", + "Terraform": "```hcl\n# Security Group with no inbound rules (prevents all ports open to the Internet)\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n # Critical: no ingress blocks; avoids any rule with protocol \"-1\" from 0.0.0.0/0 or ::/0\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Enforce **least privilege** on ingress: allow only required ports from trusted sources, avoid `0.0.0.0/0` and `::/0`. Prefer private access (VPN, bastion, or Session Manager), use security group references, and layer **defense in depth** with network ACLs. Periodically review and remove unused rules.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_all_ports" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.metadata.json index 289cb4298a..9f4d1525bf 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_any_port", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to any port.", + "CheckTitle": "Security group has no 0.0.0.0/0 or ::/0 ingress to any port, or is attached only to allowed interface types or instance owners", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to any port and not attached to a network interface with not allowed network interface types or instance owners. By default, the allowed network interface types are 'api_gateway_managed' and 'vpc_endpoint', and the allowed instance owners are 'amazon-elb', you can customize these values by setting the 'ec2_allowed_interface_types' and 'ec2_allowed_instance_owners' variables.", - "Risk": "The security group allows all traffic from the internet to any port. This could allow an attacker to access the instance.", + "Description": "**EC2 security groups** with **internet-sourced ingress** from `0.0.0.0/0` or `::/0` to any port, and their attachments, are evaluated. Groups linked to network interfaces or instance owners outside an approved list for public exposure are identified.", + "Risk": "Open ingress to any port on non-approved interfaces enables external scanning, brute force, and exploitation of unintended services. This threatens **confidentiality** (unauthorized access), **integrity** (tampering), and **availability** (DoS), and facilitates **lateral movement**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000234274-5-3-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-to-remote-server-administration-ports-aut" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: security group without Internet-open ingress\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"SG without Internet ingress\"\n VpcId: \"\"\n SecurityGroupIngress: [] # Critical: no 0.0.0.0/0 or ::/0 inbound; denies all inbound\n```", + "Other": "1. In the AWS console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open Inbound rules > Edit inbound rules\n4. Delete any rule with Source 0.0.0.0/0 or ::/0\n5. Save rules", + "Terraform": "```hcl\n# Security group with no Internet-open ingress\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n # Critical: no ingress blocks -> prevents 0.0.0.0/0 or ::/0 inbound\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege**: restrict ingress to required ports and trusted sources; avoid `0.0.0.0/0` and `::/0` except for managed public endpoints. Place workloads behind **load balancers**, **API gateways**, or **WAFs**; use **private networking**. Allow public rules only on approved interface types.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_any_port" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.metadata.json index 2403143175..3d85848a54 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to high risk ports.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to high-risk TCP ports", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Unauthorized Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "critical", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to ports 25(SMTP), 110(POP3), 135(RCP), 143(IMAP), 445(CIFS), 3000(Go, Node.js, and Ruby web developemnt frameworks), 4333(ahsp), 5000(Python web development frameworks), 5500(fcp-addr-srvr1), 8080(proxy), 8088(legacy HTTP port).", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are assessed for inbound rules that allow Internet sources (`0.0.0.0/0` or `::/0`) to **high-risk TCP ports**: `25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088`.\n\nFindings highlight groups exposing any of these ports to the public network.", + "Risk": "Public exposure of these ports enables:\n- **RCE** via SMB/RPC and weak admin consoles (`445`, `135`, `3000`, `5000`, `8080`)\n- **Credential theft/data leakage** via mail protocols (`25`, `110`, `143`)\n- **Spam relay** on `25`\nImpacts: **confidentiality**, **integrity**, and **availability** through exploitation and mass scanning.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000234274-5-3-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-to-remote-server-administration-ports-aut" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: restrict high-risk TCP port from Internet\nResources:\n ExampleSecurityGroup:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict high-risk TCP port\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 8080\n ToPort: 8080\n CidrIp: 10.0.0.0/8 # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict source to non-Internet to pass the check\n```", + "Other": "1. In the AWS console, go to EC2 > Network & Security > Security Groups\n2. Select the security group in the finding and click Inbound rules > Edit inbound rules\n3. For each high-risk TCP port (25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088) with Source 0.0.0.0/0 or ::/0, delete the rule or change Source to a specific trusted CIDR (for example, your VPC CIDR)\n4. Save rules", + "Terraform": "```hcl\n# Terraform: restrict high-risk TCP port from Internet\nresource \"aws_security_group\" \"example\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 8080\n to_port = 8080\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: do not use 0.0.0.0/0 or ::/0; restrict source to non-Internet to pass the check\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict these ports using **least privilege**:\n- Deny Internet ingress; allow only trusted CIDRs or private connectivity\n- Place services behind **VPN**, **bastion**, or **proxies/WAF**; prefer **private endpoints**\n- Disable unnecessary services; require auth and TLS on exposed apps\nApply **defense in depth** with security groups and network ACLs.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.metadata.json index 04952d0ee3..cc7174631d 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to SSH port 22.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 22 (SSH)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Unauthorized Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to SSH port 22.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are assessed for **inbound SSH exposure** by locating ingress rules that allow `TCP 22` from the Internet (`0.0.0.0/0` or `::/0`).\n\nOnly groups in use are considered; sets already flagged for all-port exposure are not repeated.", + "Risk": "Exposed **SSH** invites Internet-scale **brute force** and **credential stuffing**. A successful login grants **remote shell**, enabling data theft (confidentiality), code or config tampering (integrity), and cryptomining or service disruption (availability), plus **lateral movement** within the environment.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ssh-access.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 22 --cidr", - "NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/networking_1-port-security#cloudformation", - "Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_1-port-security", - "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_1-port-security#terraform" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 22 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict SSH from the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SSH\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 22\n ToPort: 22\n CidrIp: 10.0.0.0/8 # Critical: allows SSH only from a private range, not 0.0.0.0/0\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab\n4. Delete any rule for port 22 (SSH) with source 0.0.0.0/0 or ::/0\n5. Click Save rules", + "Terraform": "```hcl\n# Terraform: restrict SSH from the Internet\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 22\n to_port = 22\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do not use 0.0.0.0/0 or ::/0\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** to SSH:\n- Disallow `0.0.0.0/0` and `::/0`; allow only trusted IPs or VPN ranges\n- Prefer **private access** via bastion hosts or AWS Systems Manager Session Manager\n- Enforce **key-based auth**, disable passwords, rotate keys\n- Add **network segmentation** and monitoring for **defense in depth**", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.metadata.json index 07eadb0c79..9224f9d92b 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 3389.", + "CheckTitle": "Security group does not allow ingress from the Internet to TCP port 3389 (RDP)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 3389.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** restrict **inbound RDP** on `TCP 3389` to trusted sources, avoiding Internet-wide (`0.0.0.0/0`, `::/0`) exposure.", + "Risk": "**Internet-exposed RDP** enables brute force and credential stuffing and increases the chance of **remote code execution** via RDP flaws.\n\nAdversaries can gain interactive access, exfiltrate data (**confidentiality**), tamper with systems (**integrity**), and trigger ransomware or service disruption (**availability**).", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-rdp-access.html" + ], "Remediation": { "Code": { - "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr", - "NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/networking_2#cloudformation", - "Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_2", - "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_2#terraform" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict RDP (3389) from the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict RDP\n VpcId: vpc-\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3389\n ToPort: 3389\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0; limits RDP to internal range, closing Internet access\n```", + "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. In the Inbound rules tab, click Edit inbound rules\n4. Find any rule with Type RDP (TCP 3389) and Source 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific trusted CIDR (e.g., your office IP)\n6. Click Save rules", + "Terraform": "```hcl\n# Restrict RDP (3389) from the Internet\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 3389\n to_port = 3389\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: not 0.0.0.0/0; restricts RDP to internal range\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege**: disallow `0.0.0.0/0` and `::/0` to `3389`; permit only specific IPs or private networks.\n\nPrefer **Session Manager**, VPN, or a hardened bastion with MFA and just-in-time access. Use private subnets and add **defense in depth** with network controls and monitoring.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.metadata.json index 89cd005ac8..9c7e694fb6 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Cassandra ports 7199 or 9160 or 8888.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Cassandra TCP ports 7199, 9160, or 8888", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Cassandra ports 7199 or 9160 or 8888.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are evaluated for inbound rules that allow the Internet (`0.0.0.0/0` or `::/0`) to reach **Cassandra ports** `7199`, `9160`, or `8888`.\n\nFocuses on `tcp` rules that expose these ports to public sources.", + "Risk": "Exposed **Cassandra interfaces** (`7199` JMX, `9160` Thrift, `8888` tools) enable:\n- Unauthorized reads of data/metrics (confidentiality)\n- Schema and cluster changes (integrity)\n- Remote operations causing outages (availability)\n\nPublic reachability also increases brute-force and exploit attempts.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000127020-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-cassandra-ports-7199-or-9160-or-88" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions IpProtocol=tcp,FromPort=7199,ToPort=7199,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]' IpProtocol=tcp,FromPort=9160,ToPort=9160,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]' IpProtocol=tcp,FromPort=8888,ToPort=8888,IpRanges='[{CidrIp=0.0.0.0/0}]',Ipv6Ranges='[{CidrIpv6=::/0}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict Cassandra ports from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Cassandra ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 7199\n ToPort: 7199\n CidrIp: 10.0.0.0/16 # Critical: not 0.0.0.0/0; restricts IPv4 source\n - IpProtocol: tcp\n FromPort: 9160\n ToPort: 9160\n CidrIp: 10.0.0.0/16 # Critical: not 0.0.0.0/0; restricts IPv4 source\n - IpProtocol: tcp\n FromPort: 8888\n ToPort: 8888\n CidrIp: 10.0.0.0/16 # Critical: not 0.0.0.0/0; restricts IPv4 source\n```", + "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the instance\n3. In Inbound rules, delete any rule allowing TCP 7199, 9160, or 8888 from 0.0.0.0/0 or ::/0\n4. If needed, add new rules for these ports limited to specific trusted CIDR(s)\n5. Save rules", + "Terraform": "```hcl\n# Restrict Cassandra ports from Internet\nresource \"aws_security_group\" \"example\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 7199\n to_port = 7199\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # Critical: not 0.0.0.0/0; restricts IPv4 source\n }\n ingress {\n from_port = 9160\n to_port = 9160\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # Critical: not 0.0.0.0/0; restricts IPv4 source\n }\n ingress {\n from_port = 8888\n to_port = 8888\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/16\"] # Critical: not 0.0.0.0/0; restricts IPv4 source\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict **ingress** on `7199`, `9160`, `8888` to trusted sources:\n- Enforce **least privilege** allow-lists; avoid `0.0.0.0/0` and `::/0`\n- Place nodes in private subnets; use VPN or a bastion for admin\n- Prefer strong auth and *mTLS*; bind management to internal interfaces\n- Apply **defense in depth** with segmentation (north-south and east-west)", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.metadata.json index 3e950f09fb..e4d73468f5 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana ports.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana TCP ports 9200, 9300, and 5601", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana ports.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** restrict public ingress to Elasticsearch/Kibana ports `9200`, `9300`, and `5601`, denying sources `0.0.0.0/0` and `::/0`", + "Risk": "Open Elasticsearch/Kibana ports to the Internet erode CIA:\n- Confidentiality: unauthorized queries and data exfiltration\n- Integrity: index tampering/deletion, cluster control via `9300`\n- Availability: API abuse, exploit-based outages, and Kibana `5601` brute-force", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233821-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-elasticsearch-and-kibana-ports-tcp-9200-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":9200,\"ToPort\":9200,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":9300,\"ToPort\":9300,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":5601,\"ToPort\":5601,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict Elasticsearch/Kibana ports from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Block Internet access to 9200, 9300, 5601\n VpcId: vpc-\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9200\n ToPort: 9200\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0 or ::/0; restricts 9200 to trusted CIDR\n - IpProtocol: tcp\n FromPort: 9300\n ToPort: 9300\n CidrIp: 10.0.0.0/8 # CRITICAL: restricts 9300 from Internet\n - IpProtocol: tcp\n FromPort: 5601\n ToPort: 5601\n CidrIp: 10.0.0.0/8 # CRITICAL: restricts 5601 (Kibana) from Internet\n```", + "Other": "1. Open the AWS Console and go to VPC > Security Groups\n2. Select the affected security group\n3. Choose Inbound rules > Edit inbound rules\n4. For ports 9200, 9300, and 5601, remove any rule with Source 0.0.0.0/0 or ::/0\n5. If access is required, add rules for only trusted CIDR(s) instead\n6. Save rules", + "Terraform": "```hcl\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n # CRITICAL: Do not use 0.0.0.0/0 or ::/0; restrict these ports to trusted CIDRs\n ingress {\n from_port = 9200\n to_port = 9200\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restricts 9200 from Internet\n }\n ingress {\n from_port = 9300\n to_port = 9300\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restricts 9300 from Internet\n }\n ingress {\n from_port = 5601\n to_port = 5601\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: restricts 5601 (Kibana) from Internet\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Limit ingress to `9200`, `9300`, and `5601` to trusted CIDRs or private connectivity; never allow `0.0.0.0/0` or `::/0`. Prefer **private access** via VPN, bastion, or private endpoints. Apply **least privilege**, network segmentation, and **defense in depth** (NACLs/WAF). Require strong auth and TLS on Elasticsearch/Kibana.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21.metadata.json index a16019e01e..7e96f23a1c 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21.metadata.json @@ -1,32 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21.", - "CheckAliases": [ - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21" - ], + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to FTP ports 20 or 21.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "EC2 security groups are evaluated for Internet-exposed **FTP**: any inbound rule allowing `tcp` ports `20` or `21` from `0.0.0.0/0` or `::/0`.", + "Risk": "Exposed FTP weakens CIA:\n- Confidentiality: cleartext credentials/files enable interception and brute force.\n- Integrity: unauthorized uploads or tampering enable malware staging.\n- Availability: mass scans and login attempts can exhaust resources and disrupt services.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-ftp-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":20,\"ToPort\":20,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":21,\"ToPort\":21,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict FTP (20,21) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict FTP from Internet\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 20\n ToPort: 20\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0; limits IPv4 to a private range\n - IpProtocol: tcp\n FromPort: 21\n ToPort: 21\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0; limits IPv4 to a private range\n```", + "Other": "1. Open the AWS Console and go to EC2 > Security Groups\n2. Select the security group attached to the affected resource\n3. In Inbound rules, find any rules for TCP ports 20 or 21 with Source 0.0.0.0/0 or ::/0\n4. Delete those rules (or edit them to a specific trusted CIDR only)\n5. Save rules", + "Terraform": "```hcl\n# Terraform: restrict FTP (20,21) from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 20\n to_port = 20\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0; restricts IPv4\n }\n\n ingress {\n from_port = 21\n to_port = 21\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0; restricts IPv4\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** and **defense in depth**:\n- Remove `0.0.0.0/0` and `::/0` to `20`/`21`; allow only trusted IPs or private access (VPN/peering).\n- Prefer **SFTP/FTPS** or HTTPS; disable anonymous FTP.\n- Segment transfer hosts, monitor access, and enforce rate limits and strong authentication.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21" } }, "Categories": [ @@ -34,5 +36,8 @@ ], "DependsOn": [], "RelatedTo": [], - "Notes": "" + "Notes": "", + "CheckAliases": [ + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21" + ] } diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.metadata.json index 88f6cf56e3..6f39a49b10 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Kafka port 9092.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 9092 (Kafka)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Kafka port 9092.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are evaluated for ingress rules that expose **Kafka** on `TCP 9092` to the Internet via `0.0.0.0/0` or `::/0`", + "Risk": "Public Kafka `9092` access allows arbitrary clients to connect, enabling topic enumeration, data exfiltration, and producer/consumer impersonation (**C/I**). Brokers can be flooded or exploited, disrupting clusters (**A**). Exposure gives attackers a foothold for lateral movement inside the VPC.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233725-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-kafka-port-9092-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":9092,\"ToPort\":9092,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict Kafka (9092) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Kafka 9092\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 9092\n ToPort: 9092\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0; restricts access to private range to avoid Internet exposure\n```", + "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the group attached to the resource\n3. Inbound rules > Edit inbound rules\n4. Find any rule for TCP port 9092 with Source 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific trusted CIDR or security group\n6. Save rules", + "Terraform": "```hcl\n# Restrict Kafka (9092) from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 9092\n to_port = 9092\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0; restricts access to avoid Internet exposure\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege**: restrict `9092` to required subnets or IPs; avoid `0.0.0.0/0` and `::/0`. Place brokers on private networks and use peering or VPN for access. Enforce **mutual TLS/SASL** and topic ACLs, and add **defense in depth** with segmentation and NACLs.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.metadata.json index 46c7c45c25..bc29a4e7e0 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Memcached port 11211.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Memcached TCP port 11211", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Memcached port 11211.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are evaluated for inbound rules that permit Internet-sourced access to `TCP 11211` (Memcached) from `0.0.0.0/0` or `::/0`.", + "Risk": "Exposed **Memcached** enables unauthenticated access, impacting CIA:\n- **Confidentiality**: read cached data (sessions, secrets)\n- **Integrity**: modify or poison entries\n- **Availability**: flush or overload cache, degrading apps\n\nOpen `11211` is widely scanned, enabling unauthorized access and lateral movement.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000127021-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-memcached-port-11211" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: restrict Memcached (11211) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Memcached access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 11211\n ToPort: 11211\n CidrIp: 10.0.0.0/8 # FIX: Not 0.0.0.0/0; limits access so 11211 isn't open to the Internet\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group and open the Inbound rules tab\n3. Click Edit inbound rules\n4. Delete any rule allowing TCP 11211 from 0.0.0.0/0 or ::/0, or change its Source to a specific trusted CIDR\n5. Click Save rules", + "Terraform": "```hcl\n# Restrict Memcached (11211) from Internet\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 11211\n to_port = 11211\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: avoid 0.0.0.0/0 to prevent Internet exposure\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** and **segmentation**:\n- Restrict `TCP 11211` to trusted CIDRs or security groups\n- Keep Memcached on private subnets; avoid public IPs\n- Add **defense in depth** with NACLs/firewalls; disable unused protocols\n- Use private connectivity (VPN/peering) and monitor access", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018.metadata.json index 92f1946076..c6cd7eec5e 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018.metadata.json @@ -1,32 +1,35 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018.", - "CheckAliases": [ - "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018" - ], + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MongoDB TCP ports 27017 and 27018", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MongoDB ports 27017 and 27018.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are inspected for inbound rules that expose **MongoDB** on `TCP 27017-27018` to the Internet via `0.0.0.0/0` or `::/0`.\n\nIt identifies groups where these ports are reachable from any address.", + "Risk": "Public **MongoDB** ports invite unauthenticated probing, brute force, and misuse of weak configs. Attackers can read/alter data, drop collections, or deploy ransomware, compromising **confidentiality** and **integrity**.\n\nExposure also enables enumeration and lateral movement, threatening **availability**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000127019-ensure-security-groups-do-not-allow-unrestricted-ingress-access-to-mongodb-ports-27017-and-27018" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":27017,\"ToPort\":27018,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict MongoDB ports from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict MongoDB ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 27017\n ToPort: 27018\n CidrIp: 10.0.0.0/8 # FIX: not 0.0.0.0/0 or ::/0; limits access to internal range\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to your resource\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find rules for TCP ports 27017 or 27018 with Source 0.0.0.0/0 or ::/0\n5. Delete those rules or change Source to a specific trusted CIDR (e.g., 10.0.0.0/8)\n6. Click Save rules", + "Terraform": "```hcl\n# Restrict MongoDB ports from Internet\nresource \"aws_security_group\" \"secure\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 27017\n to_port = 27018\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # FIX: not 0.0.0.0/0 or ::/0; restricts Internet access\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** to MongoDB access:\n- Block `0.0.0.0/0` and `::/0`\n- Allow only trusted IPs or private networks\n- Prefer private connectivity and SG-to-SG references\n- Enforce authentication and TLS\n- Segment east-west traffic and monitor access for **defense in depth**", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018" } }, "Categories": [ @@ -34,5 +37,8 @@ ], "DependsOn": [], "RelatedTo": [], - "Notes": "" + "Notes": "", + "CheckAliases": [ + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018" + ] } diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.metadata.json index 20f5e359aa..b99db5dfc6 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroups", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to MySQL port 3306.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are assessed for **inbound exposure** of **MySQL** on `TCP 3306` from `0.0.0.0/0` or `::/0`.\n\nThe finding reflects whether this port is reachable from any IPv4 or IPv6 address.", + "Risk": "**Public MySQL** access lets anyone reach the service, enabling credential brute force and vulnerability exploitation. This threatens:\n- **Confidentiality**: data exfiltration\n- **Integrity**: unauthorized writes or schema changes\n- **Availability**: DoS from abuse or scans", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-mysql-access.html" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: restrict MySQL (3306) from Internet\nResources:\n ExampleSecurityGroup:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Limit MySQL access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 3306\n ToPort: 3306\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0 or ::/0; limits MySQL to internal range\n```", + "Other": "1. In AWS Console, go to EC2 > Security Groups\n2. Select the security group in use by the instance\n3. In Inbound rules, click Edit inbound rules\n4. Remove any rule for TCP port 3306 with source 0.0.0.0/0 or ::/0\n5. Add a rule for TCP 3306 only from a trusted source (e.g., specific IP/CIDR or a security group)\n6. Click Save rules", + "Terraform": "```hcl\n# Restrict MySQL (3306) from Internet\nresource \"aws_security_group\" \"example_resource_name\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 3306\n to_port = 3306\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: not 0.0.0.0/0 or ::/0; restricts MySQL access\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege**: restrict `3306` to specific sources or peer security groups only. Keep databases in private subnets and use **VPN**, **bastion**, or application proxies for admin access. Enable **defense in depth** with TLS and strong auth. Never allow `0.0.0.0/0` or `::/0` ingress.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.metadata.json index 971a7528ea..12ff148f45 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Oracle ports 1521 or 2483.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Oracle TCP ports 1521 or 2483", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Oracle ports 1521 or 2483.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are evaluated for inbound rules that permit public sources (`0.0.0.0/0` or `::/0`) to `TCP 1521` or `TCP 2483`-Oracle listener ports.\n\nThe focus is on rules that make these ports reachable from the Internet over IPv4 or IPv6.", + "Risk": "Public Oracle listener exposure enables attackers to:\n- **Brute force** credentials and enumerate services\n- Exploit **listener flaws** for remote access\n- Run unauthorized queries causing **data exfiltration**\n- Launch **DoS** on the listener\n\nThis jeopardizes database confidentiality, integrity, and availability.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000236318-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-oracle-ports-1521-or-2483-" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: restrict Oracle ports 1521 and 2483 from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Oracle ports from Internet\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1521\n ToPort: 1521\n CidrIp: 10.0.0.0/8 # Critical: do not use 0.0.0.0/0; restrict source to internal range to block Internet\n - IpProtocol: tcp\n FromPort: 2483\n ToPort: 2483\n CidrIp: 10.0.0.0/8 # Critical: restrict Oracle port 2483 from Internet\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the security group attached to the resource\n3. Open the Inbound rules tab and click Edit inbound rules\n4. For rules on TCP ports 1521 or 2483 with Source 0.0.0.0/0 or ::/0, delete them or change Source to a specific trusted CIDR (e.g., your internal range)\n5. Click Save rules", + "Terraform": "```hcl\n# Restrict Oracle ports 1521 and 2483 from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 1521\n to_port = 1521\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do not use 0.0.0.0/0; restrict to internal range\n }\n\n ingress {\n from_port = 2483\n to_port = 2483\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: restrict Oracle port 2483 from Internet\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** and **defense in depth**: disallow public ingress to `TCP 1521` and `TCP 2483`.\n\nRestrict access to trusted CIDRs or peer security groups, keep databases on private networks, and require **VPN**, **bastion**, or **proxy** access. Enforce **TLS** and segment east-west and north-south traffic.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.metadata.json index bc5f0fcae9..d2c9f44c1c 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Postgres port 5432.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Postgres TCP port 5432", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Postgres port 5432.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are evaluated for inbound rules that expose **Postgres** on `TCP 5432` to the Internet. Rules permitting `0.0.0.0/0` or `::/0` to this port, or policies that open all ports publicly, are identified.", + "Risk": "Exposing `5432` to the Internet enables credential stuffing and Postgres exploits, risking data disclosure (**confidentiality**), unauthorized changes (**integrity**), and service disruption via brute force or DoS (**availability**).", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-postgresql-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 5432 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict Postgres (5432) from the Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"\"\n VpcId: \"\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 5432\n ToPort: 5432\n CidrIp: 10.0.0.0/8 # Critical: not 0.0.0.0/0 or ::/0; limits access so 5432 is not open to the Internet\n```", + "Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Locate any rule for PostgreSQL (port 5432) with Source 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific CIDR or security group\n6. Click Save rules", + "Terraform": "```hcl\n# Security group with Postgres (5432) not exposed to the Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 5432\n to_port = 5432\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: avoid 0.0.0.0/0 or ::/0 to prevent Internet exposure\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** on security groups: remove `0.0.0.0/0` and `::/0` for `5432`, allow only trusted CIDRs or private peers. Prefer **private access** (VPC-only) via VPN, bastion, or proxy. Add **defense in depth** with SG references and network ACLs, and enforce TLS and strong authentication.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.metadata.json index e245d68b5a..808aa9f8bf 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis port 6379.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Redis TCP port 6379", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Redis port 6379.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** permitting Internet sources (`0.0.0.0/0` or `::/0`) to `TCP 6379` are identified, indicating Redis is reachable from public networks", + "Risk": "Public Redis access undermines **confidentiality, integrity, and availability**:\n- Read keys and secrets\n- Modify or flush data and configs\n- Exhaust memory for DoS\nAttackers can brute-force `AUTH`, exploit replication or modules for code execution, and pivot within the VPC.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233806-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-6379-redis-" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 6379 --cidr 0.0.0.0/0", + "NativeIaC": "```yaml\n# CloudFormation: restrict Redis (6379) from Internet\nResources:\n SecureSecurityGroup:\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Redis access\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 6379\n ToPort: 6379\n CidrIp: 10.0.0.0/8 # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR\n```", + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the affected security group\n3. Open the Inbound rules tab and click Edit inbound rules\n4. Find any rule allowing TCP port 6379 with Source 0.0.0.0/0 or ::/0\n5. Delete that rule (or change Source to a trusted CIDR or security group)\n6. Click Save rules", + "Terraform": "```hcl\n# Security group with Redis limited to trusted sources\nresource \"aws_security_group\" \"secure\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 6379\n to_port = 6379\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # Critical: do NOT use 0.0.0.0/0 or ::/0; restrict to trusted CIDR\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Restrict Redis to **private connectivity** and apply **least privilege**:\n- Allow `6379` only from required app hosts, security groups, or CIDRs\n- Prefer VPC/private networks or VPN over public IPs\n- Enforce Redis `AUTH` and TLS, bind to private interfaces\n- Use segmentation and monitoring for **defense in depth**", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.metadata.json index a669ee7367..1804700d2f 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Windows SQL Server ports 1433 or 1434.", + "CheckTitle": "Security group does not allow ingress from 0.0.0.0/0 or ::/0 to Microsoft SQL Server ports 1433 and 1434", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", - "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Windows SQL Server ports 1433 or 1434.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** with inbound rules that allow Internet sources (`0.0.0.0/0`, `::/0`) to reach **Microsoft SQL Server** on `TCP 1433` or `TCP 1434`", + "Risk": "**Internet-exposed SQL ports** enable credential brute force, service enumeration, and remote exploitation. Compromise can lead to unauthorized queries, data exfiltration or tampering, and outages via destructive commands, degrading **confidentiality**, **integrity**, and **availability**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000223371-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-windows-sql-server-ports-1433-or-14" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":1433,\"ToPort\":1433,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]},{\"IpProtocol\":\"tcp\",\"FromPort\":1434,\"ToPort\":1434,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict SQL Server ports from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict SQL ports\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 1433\n ToPort: 1433\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; limits exposure to internal range\n - IpProtocol: tcp\n FromPort: 1434\n ToPort: 1434\n CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; blocks Internet access\n```", + "Other": "1. Open the AWS Console > EC2 > Security Groups\n2. Select the target security group and open Inbound rules\n3. Find rules allowing TCP 1433 or 1434 from 0.0.0.0/0 or ::/0\n4. Delete those rules (or change Source to a specific CIDR or security group)\n5. Click Save rules", + "Terraform": "```hcl\n# Restrict SQL Server ports from Internet\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 1433\n to_port = 1433\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; restricts Internet access\n }\n\n ingress {\n from_port = 1434\n to_port = 1434\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: not 0.0.0.0/0; blocks Internet exposure\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** on network access:\n- Restrict SQL ingress to trusted IPs or via VPN/bastion\n- Place databases in private subnets; allow only app-tier sources\n- Avoid `0.0.0.0/0` and `::/0`\n- Use **defense in depth** with network ACLs/firewalls\n- Monitor auth failures and rate-limit repeated attempts", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.metadata.json index e7df205246..7fd49436b0 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", - "CheckTitle": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.", + "CheckTitle": "Security group does not allow ingress from the Internet to TCP port 23 (Telnet)", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are evaluated for rules that allow **inbound Telnet** on `TCP 23` from the Internet (`0.0.0.0/0` or `::/0`).", + "Risk": "Public **Telnet** exposes cleartext credentials and remote shell access.\n- Brute-force and credential interception enable account takeover\n- Command execution enables data theft and lateral movement\n\nThis threatens confidentiality and integrity and can degrade availability through misuse.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://support.icompaas.com/support/solutions/articles/62000233790-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-23-telnet-", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/unrestricted-telnet-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws ec2 revoke-security-group-ingress --group-id --ip-permissions '[{\"IpProtocol\":\"tcp\",\"FromPort\":23,\"ToPort\":23,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}],\"Ipv6Ranges\":[{\"CidrIpv6\":\"::/0\"}]}]'", + "NativeIaC": "```yaml\n# CloudFormation: restrict Telnet (port 23) from Internet\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: Restrict Telnet\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 23\n ToPort: 23\n CidrIp: 10.0.0.0/8 # CRITICAL: Restricts Telnet (23) to internal range; removes Internet-wide (0.0.0.0/0) access\n```", + "Other": "1. In the AWS console, go to VPC > Security Groups\n2. Select the affected security group and open Inbound rules\n3. Click Edit inbound rules\n4. Find any rule allowing TCP port 23 (Telnet) from 0.0.0.0/0 or ::/0\n5. Delete the rule or change Source to a specific trusted CIDR\n6. Save rules", + "Terraform": "```hcl\nresource \"aws_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress {\n from_port = 23\n to_port = 23\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"] # CRITICAL: Restricts Telnet (23); do not use 0.0.0.0/0 or ::/0\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Remove rules permitting Internet access to `TCP 23` from `0.0.0.0/0` or `::/0`. Disable **Telnet** on hosts. Prefer **SSH** or **SSM** and apply **least privilege** network rules. Restrict admin access to trusted IPs, VPN, or private endpoints, and use **defense in depth** with NACLs and logging.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.metadata.json index 87c89a3b18..d8cc0f08c6 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_allow_wide_open_public_ipv4", - "CheckTitle": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.", + "CheckTitle": "Security group has no ingress or egress rules with public IPv4 CIDR ranges from /1 to /23", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Unauthorized Access" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** with rules that permit non-RFC1918 IPv4 ranges wider than `/24` are identified across both **ingress** and **egress**.\n\nThe focus is on public CIDRs (`/1`-`/23`) that broadly expose sources or destinations, not on private networks.", + "Risk": "Over-broad public CIDRs expand exposure and enable:\n- **Confidentiality** loss via unauthorized access and exfiltration\n- **Integrity** compromise by exploiting exposed services\n- **Availability** impact from scanning and abuse\n\nOpen egress further allows **C2** beacons and bulk data exfiltration to untrusted IPs.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000229600-ensure-vpc-security-groups-not-wide-open-public-ipv4-cidr-ranges-non-rfc1918-", + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: ensure no public IPv4 CIDR wider than /24\nResources:\n \"\":\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"sg\"\n VpcId: \"\"\n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 443\n ToPort: 443\n CidrIp: 203.0.113.0/24 # Critical: /24 (or private RFC1918) avoids wide-open public /1-/23\n```", + "Other": "1. In the AWS Console, go to VPC > Security Groups\n2. Select the security group with the finding\n3. Click Edit inbound rules (and Edit outbound rules if needed)\n4. For any rule with a public IPv4 CIDR mask /1-/23, delete it or change the CIDR to a private RFC1918 range or to /24 or more specific (e.g., 203.0.113.0/24)\n5. Save rules", + "Terraform": "```hcl\n# Terraform: ensure no public IPv4 CIDR wider than /24\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress {\n from_port = 443\n to_port = 443\n protocol = \"tcp\"\n cidr_blocks = [\"203.0.113.0/24\"] # Critical: /24 (or private RFC1918) avoids wide-open public /1-/23\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** on security groups:\n- Allow only known IPs (prefer `/32` or tight CIDRs)\n- Use **private connectivity** (VPN, Direct Connect, private endpoints)\n- Restrict and log **egress**; deny by default\n- Segment with security group references and **network ACLs** for **defense-in-depth**", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_allow_wide_open_public_ipv4" } }, "Categories": [ diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json index 3510a573cd..e790e88698 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_default_restrict_traffic", - "CheckTitle": "Ensure the default security group of every VPC restricts all traffic.", + "CheckTitle": "VPC default security group has no inbound or outbound rules", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure the default security group of every VPC restricts all traffic.", - "Risk": "Even having a perimeter firewall, having security groups open allows any user or malware with vpc access to scan for well known and sensitive ports and gain access to instance.", + "Description": "**Default VPC security group** should have **no inbound or outbound rules**. This evaluates whether the group allows any traffic-ingress, egress, or self-referencing-instead of remaining empty.", + "Risk": "Permissive rules in the **default security group** mean instances that inherit it can communicate widely. This enables **lateral movement**, **port scanning**, and **data exfiltration**; unrestricted egress aids **C2**. Confidentiality and integrity are reduced, and the blast radius of a compromise grows.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html", + "https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html" + ], "Remediation": { "Code": { "CLI": "", "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_4#aws-console", - "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_4#terraform" + "Other": "1. Open the AWS Console and go to VPC > Security > Security groups\n2. Select the security group named \"default\" for the affected VPC\n3. In Inbound rules, click Edit inbound rules, delete all rules, and Save\n4. In Outbound rules, click Edit outbound rules, delete all rules, and Save\n5. Repeat for each VPC that has this finding", + "Terraform": "```hcl\nresource \"aws_default_security_group\" \"\" {\n vpc_id = \"\"\n\n ingress = [] # Critical: removes all inbound rules from the default SG\n egress = [] # Critical: removes all outbound rules from the default SG\n}\n```" }, "Recommendation": { - "Text": "Apply Zero Trust approach. Implement a process to scan and remediate unrestricted or overly permissive security groups. Recommended best practices is to narrow the definition for the minimum ports required.", - "Url": "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html" + "Text": "Enforce **least privilege**: keep the default group empty by removing all ingress and egress rules. Use dedicated security groups per workload with explicit sources, destinations, and ports. Regularly review for broad CIDRs like `0.0.0.0/0` and apply **defense in depth** via automation and policy guardrails.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_default_restrict_traffic" } }, - "Categories": [], + "Categories": [ + "trust-boundaries" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.metadata.json index f5ad2a7559..9244ade62f 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.metadata.json @@ -1,29 +1,33 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_from_launch_wizard", - "CheckTitle": "Security Groups created by EC2 Launch Wizard.", + "CheckTitle": "Security group not created using the EC2 Launch Wizard", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Security Groups created by EC2 Launch Wizard.", - "Risk": "Security Groups Created on the AWS Console using the EC2 wizard may allow port 22 from 0.0.0.0/0.", + "Description": "**EC2 security groups** whose names include `launch-wizard` are identified as created by the **EC2 Launch Wizard**, distinguishing auto-generated groups from curated, baseline-controlled groups.", + "Risk": "Wizard-generated groups often include **overly permissive rules** (e.g., `0.0.0.0/0` to admin ports), expanding exposure. Attackers can run **port scans** and **brute-force** to gain entry, then **lateral movement** and **data exfiltration**, impacting **confidentiality** and **integrity**; broad egress aids command-and-control.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-prefixed-with-launch-wizard.html", + "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-prefixed-with-launch-wizard.html", - "Terraform": "" + "CLI": "aws ec2 delete-security-group --group-id ", + "NativeIaC": "```yaml\n# CloudFormation: create a security group not named by Launch Wizard\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: SG not created by Launch Wizard\n VpcId: \n GroupName: # Critical: name does NOT contain \"launch-wizard\" to avoid FAIL\n```", + "Other": "1. In the AWS console, go to EC2 > Network & Security > Security Groups\n2. In the search box, filter by Name contains \"launch-wizard\"\n3. For each matching group, open the References tab and remove it from any ENIs/instances by replacing it with a different security group\n4. Select the launch-wizard security group and choose Actions > Delete security group > Delete\n5. Verify no security groups remain with names containing \"launch-wizard\"", + "Terraform": "```hcl\n# Create a security group not named by Launch Wizard\nresource \"aws_security_group\" \"\" {\n name = \"\" # Critical: name does NOT contain \"launch-wizard\" to avoid FAIL\n vpc_id = \"\"\n}\n```" }, "Recommendation": { - "Text": "Apply Zero Trust approach. Implement a process to scan and remediate security groups created by the EC2 Wizard. Recommended best practices is to use an authorized security group.", - "Url": "https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html" + "Text": "Replace or harden these groups. Apply **least privilege**: restrict inbound to required sources, avoid public admin ports, and minimize egress. Use approved baseline security groups, enforce change control with IaC and guardrails, prefer private administration (bastion or Session Manager), and remove unused rules.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_from_launch_wizard" } }, "Categories": [], diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.metadata.json index b27394371b..d2b3768dca 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.metadata.json @@ -1,32 +1,38 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_not_used", - "CheckTitle": "Ensure there are no Security Groups not being used.", + "CheckTitle": "Non-default EC2 security group is in use", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Ensure there are no Security Groups not being used.", - "Risk": "Having clear definition and scope for Security Groups creates a better administration environment.", + "Description": "EC2 security groups, except `default`, are assessed for **unused** status: zero attached network interfaces, no AWS Lambda associations, and no references from other security groups.", + "Risk": "Orphaned security groups may later be attached with **overly permissive rules** without review, enabling unintended inbound or lateral access that compromises **confidentiality** and **integrity**. They also create **configuration drift**, increasing the chance of misapplied access controls.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/default-security-group-unrestricted.html", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "aws ec2 delete-security-group --group-id ", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In the AWS Console, go to EC2 > Security Groups\n2. Select the non-default security group that shows Used by = 0 (no network interfaces or resources)\n3. Click Actions > Delete security group > Delete", + "Terraform": "```hcl\n# Destroy the unused non-default security group\nresource \"aws_security_group\" \"\" {\n count = 0 # Critical: setting count=0 removes/destroys this unused SG\n}\n```" }, "Recommendation": { - "Text": "List all the security groups and then use the cli to check if they are attached to an instance.", - "Url": "https://aws.amazon.com/premiumsupport/knowledge-center/ec2-find-security-group-resources/" + "Text": "Apply **least privilege** and strong lifecycle management: delete or quarantine **unused security groups**, enforce ownership tags and retention policies, review regularly, and manage changes via IaC with approvals. Restrict who can attach groups and use guardrails to prevent reuse of stale or permissive groups.", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_not_used" } }, - "Categories": [], + "Categories": [ + "trust-boundaries" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.metadata.json index 99d3b93e03..75be326e95 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_securitygroup_with_many_ingress_egress_rules", - "CheckTitle": "Find security groups with more than 50 ingress or egress rules.", + "CheckTitle": "Security group has 50 or fewer inbound rules and 50 or fewer outbound rules", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "ec2", - "SubServiceName": "securitygroup", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "high", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsEc2SecurityGroup", "ResourceGroup": "network", - "Description": "Find security groups with more than 50 ingress or egress rules.", - "Risk": "If Security groups are not properly configured the attack surface is increased.", + "Description": "**EC2 security groups** are evaluated for excessive rule counts, flagging groups where `ingress` or `egress` entries exceed the configured threshold (default `50`). This targets groups with unusually large rule sets that complicate access control.", + "Risk": "**Rule sprawl** weakens **least privilege**: large rule sets can hide overly permissive entries, exposing services to the Internet or unintended peers. This enables unauthorized access, data exfiltration, and lateral movement, impacting **confidentiality** and **integrity**, and can threaten **availability** via abuse of exposed services.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EC2/security-group-rules-counts.html" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Security group with limited number of rules\nResources:\n :\n Type: AWS::EC2::SecurityGroup\n Properties:\n GroupDescription: \"\"\n VpcId: \n SecurityGroupIngress:\n - IpProtocol: tcp\n FromPort: 443\n ToPort: 443\n CidrIp: 10.0.0.0/8 # Critical: keep total inbound rules 50; this example defines only 1 rule to ensure compliance\n```", + "Other": "1. In the AWS console, go to EC2 > Security Groups\n2. Select the security group that FAILED\n3. In Inbound rules, click Edit inbound rules\n4. Delete rules until the inbound rule count is 50 or fewer, then Save\n5. In Outbound rules, click Edit outbound rules\n6. Delete rules until the outbound rule count is 50 or fewer, then Save", + "Terraform": "```hcl\n# Terraform: Security group with limited number of rules\nresource \"aws_security_group\" \"\" {\n name = \"\"\n vpc_id = \"\"\n\n ingress { # Critical: keep total ingress/egress rules 50; single rule ensures PASS\n from_port = 443\n to_port = 443\n protocol = \"tcp\"\n cidr_blocks = [\"10.0.0.0/8\"]\n }\n}\n```" }, "Recommendation": { - "Text": "Use a Zero Trust approach. Narrow ingress traffic as much as possible. Consider north-south as well as east-west traffic.", - "Url": "https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" + "Text": "Apply **least privilege** and **segmentation**:\n- Limit rules to required ports, protocols, and sources\n- Split workloads into dedicated security groups per role\n- Prefer SG-to-SG references over broad CIDRs\n- Regularly review, deduplicate, and remove stale rules\n- Layer controls (NACLs, private endpoints) for **defense in depth**", + "Url": "https://hub.prowler.com/check/ec2_securitygroup_with_many_ingress_egress_rules" } }, - "Categories": [], + "Categories": [ + "trust-boundaries" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.metadata.json b/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.metadata.json index 130d569913..97b0b11eea 100644 --- a/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "ec2_transitgateway_auto_accept_vpc_attachments", - "CheckTitle": "Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests", + "CheckTitle": "Amazon EC2 Transit Gateway does not automatically accept shared VPC attachments", "CheckType": [ - "Infrastructure Security" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Lateral Movement" ], "ServiceName": "ec2", - "SubServiceName": "transit-gateway", - "ResourceIdTemplate": "arn:aws:ec2:region:account-id:transit-gateway/tgw-id", + "SubServiceName": "", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsEc2TransitGateway", "ResourceGroup": "network", - "Description": "Ensure EC2 transit gateways are not automatically accepting shared VPC attachments. We get a fail if a transit gateway is configured to automatically accept shared VPC attachment requests.", - "Risk": "Turning on AutoAcceptSharedAttachments allows a transit gateway to automatically accept any cross-account VPC attachment requests without verification. This increases the risk of unauthorized VPC attachments, compromising network security.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ec2-transit-gateway-auto-vpc-attach-disabled.html", + "Description": "**EC2 Transit Gateways** with `AutoAcceptSharedAttachments=enable` automatically approve cross-account **VPC attachments**.\n\nThe evaluation identifies transit gateways configured to auto-accept shared attachments.", + "Risk": "Auto-accepting cross-account attachments can link untrusted VPCs to your routing domain, impacting:\n- **Confidentiality**: unintended visibility and data exfiltration\n- **Integrity**: route injection or traffic tampering\n- **Availability**: misrouting/blackholing and lateral movement", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/config/latest/developerguide/ec2-transit-gateway-auto-vpc-attach-disabled.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-23", + "https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html#tgw-modifying" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-23", - "Terraform": "" + "CLI": "aws ec2 modify-transit-gateway --transit-gateway-id --options AutoAcceptSharedAttachments=disable", + "NativeIaC": "```yaml\n# CloudFormation: Disable auto-accept for shared attachments on a Transit Gateway\nResources:\n :\n Type: AWS::EC2::TransitGateway\n Properties:\n Options:\n AutoAcceptSharedAttachments: disable # Critical: turns off automatic acceptance of shared VPC attachments\n```", + "Other": "1. In the AWS Console, go to VPC > Transit Gateways\n2. Select the transit gateway and click Actions > Modify transit gateway\n3. Under Cross-account sharing options, uncheck Auto-accept shared attachments\n4. Click Save changes", + "Terraform": "```hcl\n# Terraform: Disable auto-accept for shared attachments on a Transit Gateway\nresource \"aws_ec2_transit_gateway\" \"\" {\n auto_accept_shared_attachments = \"disable\" # Critical: prevents automatic acceptance of cross-account VPC attachments\n}\n```" }, "Recommendation": { - "Text": "Turn off AutoAcceptSharedAttachments to ensure that only authorized VPC attachment requests are accepted", - "Url": "https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html#tgw-modifying" + "Text": "Disable `AutoAcceptSharedAttachments` and require **explicit approval** for every attachment.\n\nApply **least privilege** and **separation of duties** for approvers, limit shares to trusted accounts, and use **defense in depth** with segmentation and logging to audit the attachment lifecycle.", + "Url": "https://hub.prowler.com/check/ec2_transitgateway_auto_accept_vpc_attachments" } }, - "Categories": [], + "Categories": [ + "trust-boundaries" + ], "DependsOn": [], "RelatedTo": [], "Notes": ""