From bcdcfe095c7fd12fa329ee3b86ceea8d781ff4cb Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Thu, 17 Sep 2026 13:27:44 +0200 Subject: [PATCH] fix(sdk): report all-users 2sv override failures (#12835) Co-authored-by: Haitao Zheng --- ...leworkspace-2sv-all-users-overrides.fixed.md | 1 + .../security_2sv_enforced.py | 17 +---------------- .../security_2sv_enforced_test.py | 10 ++++------ 3 files changed, 6 insertions(+), 22 deletions(-) create mode 100644 prowler/changelog.d/googleworkspace-2sv-all-users-overrides.fixed.md diff --git a/prowler/changelog.d/googleworkspace-2sv-all-users-overrides.fixed.md b/prowler/changelog.d/googleworkspace-2sv-all-users-overrides.fixed.md new file mode 100644 index 0000000000..1283ac91ad --- /dev/null +++ b/prowler/changelog.d/googleworkspace-2sv-all-users-overrides.fixed.md @@ -0,0 +1 @@ +`security_2sv_enforced` reports domain-wide 2-Step Verification failures as FAIL even when every failing setting is overridden for a group or organizational unit diff --git a/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.py b/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.py index e5bf69c5ca..3c12091f81 100644 --- a/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.py +++ b/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.py @@ -8,7 +8,6 @@ from prowler.providers.googleworkspace.services.security.lib.durations import ( parse_duration_seconds, ) from prowler.providers.googleworkspace.services.security.lib.scope import ( - failures_shadowed_by_overrides, override_caveat, unevaluable_reason, ) @@ -145,23 +144,9 @@ class security_2sv_enforced(Check): ) ) - failing_settings = frozenset(setting for setting, _ in issues) reasons = "; ".join(text for _, text in issues) - if issues and failures_shadowed_by_overrides(policies, failing_settings): - # The audited scope (e.g. the admin group of 4.1.1.1) may get - # the overriding value, which the Policy API does not expose, - # so the domain-wide failure cannot be confirmed for it. - report.status = "MANUAL" - report.status_extended = ( - f"2-Step Verification is not enforced as required in the " - f"domain-wide policy of {domain}: {reasons}. However, every " - f"failing setting is also overridden for at least one group " - f"or organizational unit, so the audited scope may be " - f"configured correctly. Review those overrides in the Admin " - f"console." - ) - elif issues: + if issues: report.status = "FAIL" report.status_extended = ( f"2-Step Verification is not enforced as required in domain " diff --git a/tests/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced_test.py b/tests/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced_test.py index 1da5b1bcc8..0c317a1be2 100644 --- a/tests/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced_test.py +++ b/tests/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced_test.py @@ -224,8 +224,8 @@ class TestSecurity2svEnforced: assert "trust their device" in findings[0].status_extended assert "also overridden" in findings[0].status_extended - def test_manual_when_every_failing_setting_is_overridden(self): - """The overriding value is not exposed, so the failure is unconfirmed""" + def test_fail_when_every_failing_setting_is_overridden(self): + """The all-users requirement still fails for users outside the override""" findings = run_check( **{ **COMPLIANT, @@ -235,11 +235,9 @@ class TestSecurity2svEnforced: ) assert len(findings) == 1 - assert findings[0].status == "MANUAL" + assert findings[0].status == "FAIL" assert "trust their device" in findings[0].status_extended - assert "every failing setting is also overridden" in ( - findings[0].status_extended - ) + assert "also overridden" in findings[0].status_extended def test_fail_when_only_some_failing_settings_are_overridden(self): """A failure no override reaches is still proven for the whole domain"""