diff --git a/prowler/providers/aws/services/opensearch/opensearch_service.py b/prowler/providers/aws/services/opensearch/opensearch_service.py index 231df1ae53..cee8005266 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service.py @@ -117,6 +117,9 @@ class OpenSearchService(AWSService): domain.internal_user_database = describe_domain["DomainStatus"][ "AdvancedSecurityOptions" ]["InternalUserDatabaseEnabled"] + domain.saml_enabled = describe_domain["DomainStatus"][ + "AdvancedSecurityOptions" + ]["SAMLOptions"]["Enabled"] domain.update_available = describe_domain["DomainStatus"][ "ServiceSoftwareOptions" ]["UpdateAvailable"] @@ -159,6 +162,7 @@ class OpenSearchDomain(BaseModel): node_to_node_encryption: bool = None enforce_https: bool = None internal_user_database: bool = None + saml_enabled: bool = None update_available: bool = None version: str = None tags: Optional[list] = [] diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.metadata.json b/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.metadata.json index f787ccef82..6914e40868 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.metadata.json +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.metadata.json @@ -1,7 +1,7 @@ { "Provider": "aws", "CheckID": "opensearch_service_domains_use_cognito_authentication_for_kibana", - "CheckTitle": "Check if Amazon Elasticsearch/Opensearch Service domains has Amazon Cognito authentication for Kibana enabled", + "CheckTitle": "Check if Amazon Elasticsearch/Opensearch Service domains has either Amazon Cognito or SAML authentication for Kibana enabled", "CheckType": [ "Identify", "Logging" @@ -11,8 +11,8 @@ "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", "Severity": "high", "ResourceType": "AwsOpenSearchDomain", - "Description": "Check if Amazon Elasticsearch/Opensearch Service domains has Amazon Cognito authentication for Kibana enabled", - "Risk": "Amazon Elasticsearch Service supports Amazon Cognito for Kibana authentication.", + "Description": "Check if Amazon Elasticsearch/Opensearch Service domains has Amazon Cognito or SAML authentication for Kibana enabled", + "Risk": "Not enabling Amazon Cognito or SAML authentication for Kibana in AWS Elasticsearch/OpenSearch Service domains increases the likelihood of unauthorized access to sensitive data, potentially compromising system integrity.", "RelatedUrl": "", "Remediation": { "Code": { @@ -22,7 +22,7 @@ "Terraform": "" }, "Recommendation": { - "Text": "If you do not configure Amazon Cognito authentication; you can still protect Kibana using an IP-based access policy and a proxy server; HTTP basic authentication; or SAML.", + "Text": "If you do not configure Amazon Cognito or SAML authentication; you can still protect Kibana using an IP-based access policy and a proxy server; HTTP basic authentication.", "Url": "https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html" } }, diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py index 9d9e858c84..cee09fcd41 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py @@ -14,10 +14,10 @@ class opensearch_service_domains_use_cognito_authentication_for_kibana(Check): report.resource_arn = domain.arn report.resource_tags = domain.tags report.status = "PASS" - report.status_extended = f"Opensearch domain {domain.name} has Amazon Cognito authentication for Kibana enabled." - if not domain.cognito_options: + report.status_extended = f"Opensearch domain {domain.name} has either Amazon Cognito or SAML authentication for Kibana enabled." + if not domain.cognito_options and not domain.saml_enabled: report.status = "FAIL" - report.status_extended = f"Opensearch domain {domain.name} does not have Amazon Cognito authentication for Kibana enabled." + report.status_extended = f"Opensearch domain {domain.name} has neither Amazon Cognito nor SAML authentication for Kibana enabled." findings.append(report) diff --git a/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py b/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py index 56cc1909cd..4e2a412671 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana_test.py @@ -1,4 +1,3 @@ -from re import search from unittest import mock from prowler.providers.aws.services.opensearch.opensearch_service import ( @@ -26,7 +25,7 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: result = check.execute() assert len(result) == 0 - def test_no_cognito_enabled(self): + def test_neither_cognito_nor_saml_enabled(self): opensearch_client = mock.MagicMock opensearch_client.opensearch_domains = [] opensearch_client.opensearch_domains.append( @@ -35,9 +34,9 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: region=AWS_REGION_EU_WEST_1, arn=domain_arn, cognito_options=False, + saml_enabled=False, ) ) - opensearch_client.opensearch_domains[0].logging = [] with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", @@ -51,12 +50,14 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" - assert search( - "does not have Amazon Cognito authentication for Kibana enabled", - result[0].status_extended, + assert ( + result[0].status_extended + == f"Opensearch domain {domain_name} has neither Amazon Cognito nor SAML authentication for Kibana enabled." ) + assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_id == domain_name assert result[0].resource_arn == domain_arn + assert result[0].resource_tags == [] def test_cognito_enabled(self): opensearch_client = mock.MagicMock @@ -69,7 +70,6 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: cognito_options=True, ) ) - opensearch_client.opensearch_domains[0].logging = [] with mock.patch( "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", @@ -83,9 +83,46 @@ class Test_opensearch_service_domains_use_cognito_authentication_for_kibana: result = check.execute() assert len(result) == 1 assert result[0].status == "PASS" - assert search( - "has Amazon Cognito authentication for Kibana enabled", - result[0].status_extended, + assert ( + result[0].status_extended + == f"Opensearch domain {domain_name} has either Amazon Cognito or SAML authentication for Kibana enabled." ) + assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_id == domain_name assert result[0].resource_arn == domain_arn + assert result[0].resource_tags == [] + assert result[0].resource_arn == domain_arn + + def test_saml_enabled(self): + opensearch_client = mock.MagicMock + opensearch_client.opensearch_domains = [] + opensearch_client.opensearch_domains.append( + OpenSearchDomain( + name=domain_name, + region=AWS_REGION_EU_WEST_1, + arn=domain_arn, + saml_enabled=True, + ) + ) + + with mock.patch( + "prowler.providers.aws.services.opensearch.opensearch_service.OpenSearchService", + opensearch_client, + ): + from prowler.providers.aws.services.opensearch.opensearch_service_domains_use_cognito_authentication_for_kibana.opensearch_service_domains_use_cognito_authentication_for_kibana import ( + opensearch_service_domains_use_cognito_authentication_for_kibana, + ) + + check = opensearch_service_domains_use_cognito_authentication_for_kibana() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Opensearch domain {domain_name} has either Amazon Cognito or SAML authentication for Kibana enabled." + ) + assert result[0].region == AWS_REGION_EU_WEST_1 + assert result[0].resource_id == domain_name + assert result[0].resource_arn == domain_arn + assert result[0].resource_tags == [] + assert result[0].resource_arn == domain_arn diff --git a/tests/providers/aws/services/opensearch/opensearch_service_test.py b/tests/providers/aws/services/opensearch/opensearch_service_test.py index 9e091ee851..80aece7ab7 100644 --- a/tests/providers/aws/services/opensearch/opensearch_service_test.py +++ b/tests/providers/aws/services/opensearch/opensearch_service_test.py @@ -79,7 +79,10 @@ def mock_make_api_call(self, operation_name, kwarg): }, "ServiceSoftwareOptions": {"UpdateAvailable": True}, "DomainEndpointOptions": {"EnforceHTTPS": True}, - "AdvancedSecurityOptions": {"InternalUserDatabaseEnabled": True}, + "AdvancedSecurityOptions": { + "InternalUserDatabaseEnabled": True, + "SAMLOptions": {"Enabled": True}, + }, } } if operation_name == "ListTags": @@ -166,6 +169,7 @@ class Test_OpenSearchService_Service: assert opensearch.opensearch_domains[0].node_to_node_encryption assert opensearch.opensearch_domains[0].enforce_https assert opensearch.opensearch_domains[0].internal_user_database + assert opensearch.opensearch_domains[0].saml_enabled assert opensearch.opensearch_domains[0].update_available assert opensearch.opensearch_domains[0].version == "opensearch-version1" assert opensearch.opensearch_domains[0].tags == [