diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 43b7af0810..5341928ae4 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -58,6 +58,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Fix logic in VPC and ELBv2 checks [(#8077)](https://github.com/prowler-cloud/prowler/pull/8077) - Retrieve correctly ECS Container insights settings [(#8097)](https://github.com/prowler-cloud/prowler/pull/8097) - Fix correct handling for different accounts-dates in prowler dashboard compliance page [(#8108)](https://github.com/prowler-cloud/prowler/pull/8108) +- Handling of `block-project-ssh-keys` in GCP check `compute_instance_block_project_wide_ssh_keys_disabled` [(#8115)](https://github.com/prowler-cloud/prowler/pull/8115) - Handle empty name in Azure Defender and GCP checks [(#8120)](https://github.com/prowler-cloud/prowler/pull/8120) --- diff --git a/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py b/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py index 4ee3c9f029..d49aed45bd 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py +++ b/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py @@ -13,7 +13,7 @@ class compute_instance_block_project_wide_ssh_keys_disabled(Check): for item in instance.metadata["items"]: if ( item["key"] == "block-project-ssh-keys" - and item["value"] == "true" + and item["value"].lower() == "true" ): report.status = "PASS" report.status_extended = f"The VM Instance {instance.name} is not making use of common/shared project-wide SSH key(s)." diff --git a/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py b/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py index 657e9a6489..8bc01c7eae 100644 --- a/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py @@ -77,6 +77,55 @@ class Test_compute_instance_block_project_wide_ssh_keys_disabled: assert result[0].resource_id == instance.id assert result[0].location == "us-central1" + def test_one_compliant_instance_with_block_project_ssh_keys_true_uppercase(self): + from prowler.providers.gcp.services.compute.compute_service import Instance + + instance = Instance( + name="test", + id="1234567890", + zone="us-central1-a", + region="us-central1", + public_ip=True, + metadata={"items": [{"key": "block-project-ssh-keys", "value": "TRUE"}]}, + shielded_enabled_vtpm=True, + shielded_enabled_integrity_monitoring=True, + confidential_computing=True, + service_accounts=[], + ip_forward=False, + disks_encryption=[("disk1", False), ("disk2", False)], + project_id=GCP_PROJECT_ID, + ) + + compute_client = mock.MagicMock() + compute_client.project_ids = [GCP_PROJECT_ID] + compute_client.instances = [instance] + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.compute.compute_instance_block_project_wide_ssh_keys_disabled.compute_instance_block_project_wide_ssh_keys_disabled.compute_client", + new=compute_client, + ), + ): + from prowler.providers.gcp.services.compute.compute_instance_block_project_wide_ssh_keys_disabled.compute_instance_block_project_wide_ssh_keys_disabled import ( + compute_instance_block_project_wide_ssh_keys_disabled, + ) + + check = compute_instance_block_project_wide_ssh_keys_disabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert search( + f"The VM Instance {instance.name} is not making use of common/shared project-wide SSH key", + result[0].status_extended, + ) + assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" + def test_one_instance_without_metadata(self): from prowler.providers.gcp.services.compute.compute_service import Instance