fix(aws): Extend opensearch_service_domains_use_cognito_authentication_for_kibana with SAML (#3864)

prowler/providers/aws/services/opensearch/opensearch_service.py

@@ -117,6 +117,9 @@ class OpenSearchService(AWSService):
                 domain.internal_user_database = describe_domain["DomainStatus"][
                     "AdvancedSecurityOptions"
                 ]["InternalUserDatabaseEnabled"]
+                domain.saml_enabled = describe_domain["DomainStatus"][
+                    "AdvancedSecurityOptions"
+                ]["SAMLOptions"]["Enabled"]
                 domain.update_available = describe_domain["DomainStatus"][
                     "ServiceSoftwareOptions"
                 ]["UpdateAvailable"]
@@ -159,6 +162,7 @@ class OpenSearchDomain(BaseModel):
     node_to_node_encryption: bool = None
     enforce_https: bool = None
     internal_user_database: bool = None
+    saml_enabled: bool = None
     update_available: bool = None
     version: str = None
     tags: Optional[list] = []

prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.metadata.json

@@ -1,7 +1,7 @@
 {
   "Provider": "aws",
   "CheckID": "opensearch_service_domains_use_cognito_authentication_for_kibana",
-  "CheckTitle": "Check if Amazon Elasticsearch/Opensearch Service domains has Amazon Cognito authentication for Kibana enabled",
+  "CheckTitle": "Check if Amazon Elasticsearch/Opensearch Service domains has either Amazon Cognito or SAML authentication for Kibana enabled",
   "CheckType": [
     "Identify",
     "Logging"
@@ -11,8 +11,8 @@
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
   "Severity": "high",
   "ResourceType": "AwsOpenSearchDomain",
-  "Description": "Check if Amazon Elasticsearch/Opensearch Service domains has Amazon Cognito authentication for Kibana enabled",
-  "Risk": "Amazon Elasticsearch Service supports Amazon Cognito for Kibana authentication.",
+  "Description": "Check if Amazon Elasticsearch/Opensearch Service domains has Amazon Cognito or SAML authentication for Kibana enabled",
+  "Risk": "Not enabling Amazon Cognito or SAML authentication for Kibana in AWS Elasticsearch/OpenSearch Service domains increases the likelihood of unauthorized access to sensitive data, potentially compromising system integrity.",
   "RelatedUrl": "",
   "Remediation": {
     "Code": {
@@ -22,7 +22,7 @@
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "If you do not configure Amazon Cognito authentication; you can still protect Kibana using an IP-based access policy and a proxy server; HTTP basic authentication; or SAML.",
+      "Text": "If you do not configure Amazon Cognito or SAML authentication; you can still protect Kibana using an IP-based access policy and a proxy server; HTTP basic authentication.",
       "Url": "https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html"
     }
   },

prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py

@@ -14,10 +14,10 @@ class opensearch_service_domains_use_cognito_authentication_for_kibana(Check):
             report.resource_arn = domain.arn
             report.resource_tags = domain.tags
             report.status = "PASS"
-            report.status_extended = f"Opensearch domain {domain.name} has Amazon Cognito authentication for Kibana enabled."
-            if not domain.cognito_options:
+            report.status_extended = f"Opensearch domain {domain.name} has either Amazon Cognito or SAML authentication for Kibana enabled."
+            if not domain.cognito_options and not domain.saml_enabled:
                 report.status = "FAIL"
-                report.status_extended = f"Opensearch domain {domain.name} does not have Amazon Cognito authentication for Kibana enabled."
+                report.status_extended = f"Opensearch domain {domain.name} has neither Amazon Cognito nor SAML authentication for Kibana enabled."
 
             findings.append(report)
 

tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py

@@ -1,4 +1,3 @@
-from re import search
 from unittest import mock
 
 from prowler.providers.aws.services.opensearch.opensearch_service import (
@@ -26,7 +25,7 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana:
             result = check.execute()
             assert len(result) == 0
 
-    def test_no_cognito_enabled(self):
+    def test_neither_cognito_nor_saml_enabled(self):
         opensearch_client = mock.MagicMock
         opensearch_client.opensearch_domains = []
         opensearch_client.opensearch_domains.append(
@@ -35,9 +34,9 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana:
                 region=AWS_REGION_EU_WEST_1,
                 arn=domain_arn,
                 cognito_options=False,
+                saml_enabled=False,
             )
         )
-        opensearch_client.opensearch_domains[0].logging = []
 
         with mock.patch(
             "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService",
@@ -51,12 +50,14 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana:
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "FAIL"
-            assert search(
-                "does not have Amazon Cognito authentication for Kibana enabled",
-                result[0].status_extended,
+            assert (
+                result[0].status_extended
+                == f"Opensearch domain {domain_name} has neither Amazon Cognito nor SAML authentication for Kibana enabled."
             )
+            assert result[0].region == AWS_REGION_EU_WEST_1
             assert result[0].resource_id == domain_name
             assert result[0].resource_arn == domain_arn
+            assert result[0].resource_tags == []
 
     def test_cognito_enabled(self):
         opensearch_client = mock.MagicMock
@@ -69,7 +70,6 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana:
                 cognito_options=True,
             )
         )
-        opensearch_client.opensearch_domains[0].logging = []
 
         with mock.patch(
             "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService",
@@ -83,9 +83,46 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana:
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "PASS"
-            assert search(
-                "has Amazon Cognito authentication for Kibana enabled",
-                result[0].status_extended,
+            assert (
+                result[0].status_extended
+                == f"Opensearch domain {domain_name} has either Amazon Cognito or SAML authentication for Kibana enabled."
             )
+            assert result[0].region == AWS_REGION_EU_WEST_1
             assert result[0].resource_id == domain_name
             assert result[0].resource_arn == domain_arn
+            assert result[0].resource_tags == []
+            assert result[0].resource_arn == domain_arn
+
+    def test_saml_enabled(self):
+        opensearch_client = mock.MagicMock
+        opensearch_client.opensearch_domains = []
+        opensearch_client.opensearch_domains.append(
+            OpenSearchDomain(
+                name=domain_name,
+                region=AWS_REGION_EU_WEST_1,
+                arn=domain_arn,
+                saml_enabled=True,
+            )
+        )
+
+        with mock.patch(
+            "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService",
+            opensearch_client,
+        ):
+            from prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana import (
+                opensearch_service_domains_use_cognito_authentication_for_kibana,
+            )
+
+            check = opensearch_service_domains_use_cognito_authentication_for_kibana()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Opensearch domain {domain_name} has either Amazon Cognito or SAML authentication for Kibana enabled."
+            )
+            assert result[0].region == AWS_REGION_EU_WEST_1
+            assert result[0].resource_id == domain_name
+            assert result[0].resource_arn == domain_arn
+            assert result[0].resource_tags == []
+            assert result[0].resource_arn == domain_arn

tests/providers/aws/services/opensearch/opensearch_service_test.py

@@ -79,7 +79,10 @@ def mock_make_api_call(self, operation_name, kwarg):
                 },
                 "ServiceSoftwareOptions": {"UpdateAvailable": True},
                 "DomainEndpointOptions": {"EnforceHTTPS": True},
-                "AdvancedSecurityOptions": {"InternalUserDatabaseEnabled": True},
+                "AdvancedSecurityOptions": {
+                    "InternalUserDatabaseEnabled": True,
+                    "SAMLOptions": {"Enabled": True},
+                },
             }
         }
     if operation_name == "ListTags":
@@ -166,6 +169,7 @@ class Test_OpenSearchService_Service:
         assert opensearch.opensearch_domains[0].node_to_node_encryption
         assert opensearch.opensearch_domains[0].enforce_https
         assert opensearch.opensearch_domains[0].internal_user_database
+        assert opensearch.opensearch_domains[0].saml_enabled
         assert opensearch.opensearch_domains[0].update_available
         assert opensearch.opensearch_domains[0].version == "opensearch-version1"
         assert opensearch.opensearch_domains[0].tags == [