From c239ede3f9c8f33508b7399064f834a6e6d71ead Mon Sep 17 00:00:00 2001 From: Lefteris <136985982+LefterisXefteris@users.noreply.github.com> Date: Fri, 4 Oct 2024 19:13:11 +0100 Subject: [PATCH] feat(glue): add check `glue_ml_transform_encrypted_at_rest` (#5272) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Lefteris Gilmaz Co-authored-by: Rubén De la Torre Vico Co-authored-by: Sergio --- .../__init__.py | 0 ..._transform_encrypted_at_rest.metadata.json | 32 +++++ .../glue_ml_transform_encrypted_at_rest.py | 28 +++++ .../aws/services/glue/glue_service.py | 36 ++++++ ...ction_passwords_encryption_enabled_test.py | 55 +++++---- ...talogs_metadata_encryption_enabled_test.py | 55 +++++---- ...e_database_connections_ssl_enabled_test.py | 29 +++-- ...cloudwatch_logs_encryption_enabled_test.py | 38 +++--- ...ts_job_bookmark_encryption_enabled_test.py | 38 +++--- ...nt_endpoints_s3_encryption_enabled_test.py | 38 +++--- ..._jobs_amazon_s3_encryption_enabled_test.py | 47 +++++--- ...cloudwatch_logs_encryption_enabled_test.py | 38 +++--- ...bs_job_bookmark_encryption_enabled_test.py | 38 +++--- ...lue_ml_transform_encrypted_at_rest_test.py | 109 ++++++++++++++++++ .../aws/services/glue/glue_service_test.py | 24 ++++ 15 files changed, 474 insertions(+), 131 deletions(-) create mode 100644 prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/__init__.py create mode 100644 prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.metadata.json create mode 100644 prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py create mode 100644 tests/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest_test.py diff --git a/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/__init__.py b/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.metadata.json b/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.metadata.json new file mode 100644 index 0000000000..0b8cbc25b0 --- /dev/null +++ b/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.metadata.json @@ -0,0 +1,32 @@ +{ + "Provider": "aws", + "CheckID": "glue_ml_transform_encrypted_at_rest", + "CheckTitle": "Check if Glue ML Transform Encryption at Rest is Enabled", + "CheckType": [], + "ServiceName": "glue", + "SubServiceName": "", + "ResourceIdTemplate": "arn:aws:glue:region:account-id:mlTransform/transform-id", + "Severity": "medium", + "ResourceType": "Other", + "Description": "This control checks whether an AWS Glue machine learning transform is encrypted at rest. The control fails if the machine learning transform isn't encrypted at rest.", + "Risk": "Data at rest refers to data that's stored in persistent, non-volatile storage for any duration. Encrypting data at rest helps you protect its confidentiality, which reduces the risk that an unauthorized user can access it.", + "RelatedUrl": "https://docs.aws.amazon.com/glue/latest/dg/encryption-at-rest.html", + "Remediation": { + "Code": { + "CLI": "aws glue update-ml-transform --transform-id --encryption-at-rest {\"Enabled\":true,\"KmsKey\":\"\"}", + "NativeIaC": "", + "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/glue-controls.html#glue-3", + "Terraform": "" + }, + "Recommendation": { + "Text": "Enable encryption at rest for Glue ML Transforms using AWS KMS keys.", + "Url": "https://docs.aws.amazon.com/glue/latest/dg/encryption-at-rest.html" + } + }, + "Categories": [ + "encryption" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py b/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py new file mode 100644 index 0000000000..fe56aa6113 --- /dev/null +++ b/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py @@ -0,0 +1,28 @@ +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.glue.glue_client import glue_client + + +class glue_ml_transform_encrypted_at_rest(Check): + def execute(self): + findings = [] + + for ml_transform_arn, ml_transform in glue_client.ml_transforms.items(): + report = Check_Report_AWS(self.metadata()) + report.resource_id = ml_transform.id + report.resource_arn = ml_transform_arn + report.region = ml_transform.region + report.resource_tags = ml_transform.tags + report.status = "PASS" + report.status_extended = ( + f"Glue ML Transform {ml_transform.name} is encrypted at rest." + ) + + if ml_transform.user_data_encryption == "DISABLED": + report.status = "FAIL" + report.status_extended = ( + f"Glue ML Transform {ml_transform.name} is not encrypted at rest." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/aws/services/glue/glue_service.py b/prowler/providers/aws/services/glue/glue_service.py index a11b137fcd..8085368b1a 100644 --- a/prowler/providers/aws/services/glue/glue_service.py +++ b/prowler/providers/aws/services/glue/glue_service.py @@ -27,6 +27,9 @@ class Glue(AWSService): self.jobs = [] self.__threading_call__(self._get_jobs) self.__threading_call__(self._list_tags, self.jobs) + self.ml_transforms = {} + self.__threading_call__(self._get_ml_transforms) + self.__threading_call__(self._list_tags, self.ml_transforms.values()) def _get_data_catalog_arn_template(self, region): return f"arn:{self.audited_partition}:glue:{region}:{self.audited_account}:data-catalog" @@ -219,6 +222,30 @@ class Glue(AWSService): f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + def _get_ml_transforms(self, regional_client): + logger.info("Glue - Getting ML Transforms...") + try: + transforms = regional_client.get_ml_transforms()["Transforms"] + for transform in transforms: + ml_transform_arn = f"arn:{self.audited_partition}:glue:{regional_client.region}:{self.audited_account}:mlTransform/{transform['TransformId']}" + if not self.audit_resources or is_resource_filtered( + ml_transform_arn, self.audit_resources + ): + self.ml_transforms[ml_transform_arn] = MLTransform( + arn=ml_transform_arn, + id=transform["TransformId"], + name=transform["Name"], + user_data_encryption=transform.get("TransformEncryption", {}) + .get("MlUserDataEncryption", {}) + .get("MlUserDataEncryptionMode", "DISABLED"), + region=regional_client.region, + ) + + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + class Connection(BaseModel): name: str @@ -272,3 +299,12 @@ class SecurityConfig(BaseModel): jb_encryption: str jb_key_arn: Optional[str] region: str + + +class MLTransform(BaseModel): + arn: str + id: str + name: str + user_data_encryption: str + region: str + tags: Optional[list] diff --git a/tests/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled_test.py index 631b0a6bb0..93042bcf4f 100644 --- a/tests/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled_test.py @@ -1,4 +1,4 @@ -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import CatalogEncryptionSetting from tests.providers.aws.utils import ( @@ -11,13 +11,16 @@ from tests.providers.aws.utils import ( class Test_glue_data_catalogs_connection_passwords_encryption_enabled: def test_glue_no_settings(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_connection_passwords_encryption_enabled.glue_data_catalogs_connection_passwords_encryption_enabled import ( @@ -30,7 +33,7 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: assert len(result) == 0 def test_glue_catalog_password_unencrypted(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -46,12 +49,15 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: glue_client.audited_partition = AWS_COMMERCIAL_PARTITION glue_client.region = AWS_REGION_US_EAST_1 glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_connection_passwords_encryption_enabled.glue_data_catalogs_connection_passwords_encryption_enabled import ( @@ -72,7 +78,7 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: assert result[0].region == AWS_REGION_US_EAST_1 def test_glue_catalog_password_unencrypted_ignoring(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -88,13 +94,16 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: glue_client.audited_partition = AWS_COMMERCIAL_PARTITION glue_client.region = AWS_REGION_US_EAST_1 glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) glue_client.provider._scan_unused_services = False - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_connection_passwords_encryption_enabled.glue_data_catalogs_connection_passwords_encryption_enabled import ( @@ -107,7 +116,7 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: assert len(result) == 0 def test_glue_catalog_password_unencrypted_ignoring_with_tables(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -123,13 +132,16 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: glue_client.region = AWS_REGION_US_EAST_1 glue_client.audited_account = AWS_ACCOUNT_NUMBER glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) glue_client.provider._scan_unused_services = False - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_connection_passwords_encryption_enabled.glue_data_catalogs_connection_passwords_encryption_enabled import ( @@ -150,7 +162,7 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: assert result[0].region == AWS_REGION_US_EAST_1 def test_glue_catalog_encrypted(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -165,13 +177,16 @@ class Test_glue_data_catalogs_connection_passwords_encryption_enabled: glue_client.region = AWS_REGION_US_EAST_1 glue_client.audited_account = AWS_ACCOUNT_NUMBER glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_connection_passwords_encryption_enabled.glue_data_catalogs_connection_passwords_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled_test.py index bcd244056a..c13b0dc3a5 100644 --- a/tests/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import CatalogEncryptionSetting from tests.providers.aws.utils import ( @@ -12,13 +12,16 @@ from tests.providers.aws.utils import ( class Test_glue_data_catalogs_metadata_encryption_enabled: def test_glue_no_settings(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider glue_client.catalog_encryption_settings = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_metadata_encryption_enabled.glue_data_catalogs_metadata_encryption_enabled import ( @@ -31,7 +34,7 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: assert len(result) == 0 def test_glue_catalog_unencrypted(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -47,12 +50,15 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: glue_client.audited_account = AWS_ACCOUNT_NUMBER glue_client.audited_partition = AWS_COMMERCIAL_PARTITION glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_metadata_encryption_enabled.glue_data_catalogs_metadata_encryption_enabled import ( @@ -73,7 +79,7 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: assert result[0].region == AWS_REGION_US_EAST_1 def test_glue_catalog_unencrypted_ignoring(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -90,12 +96,15 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: glue_client.audited_account = AWS_ACCOUNT_NUMBER glue_client.audited_partition = AWS_COMMERCIAL_PARTITION glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_metadata_encryption_enabled.glue_data_catalogs_metadata_encryption_enabled import ( @@ -108,7 +117,7 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: assert len(result) == 0 def test_glue_catalog_unencrypted_ignoring_with_tables(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -125,12 +134,15 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: glue_client.audited_account = AWS_ACCOUNT_NUMBER glue_client.audited_partition = AWS_COMMERCIAL_PARTITION glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_metadata_encryption_enabled.glue_data_catalogs_metadata_encryption_enabled import ( @@ -151,7 +163,7 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: assert result[0].region == AWS_REGION_US_EAST_1 def test_glue_catalog_encrypted(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.provider = set_mocked_aws_provider() glue_client.catalog_encryption_settings = [ CatalogEncryptionSetting( @@ -167,12 +179,15 @@ class Test_glue_data_catalogs_metadata_encryption_enabled: glue_client.audited_account = AWS_ACCOUNT_NUMBER glue_client.audited_partition = AWS_COMMERCIAL_PARTITION glue_client.data_catalog_arn_template = f"arn:{glue_client.audited_partition}:glue:{glue_client.region}:{glue_client.audited_account}:data-catalog" - glue_client._get_data_catalog_arn_template = mock.MagicMock( + glue_client._get_data_catalog_arn_template = MagicMock( return_value=glue_client.data_catalog_arn_template ) - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_data_catalogs_metadata_encryption_enabled.glue_data_catalogs_metadata_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled_test.py b/tests/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled_test.py index b7cff5a676..1794d9cf7c 100644 --- a/tests/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import Connection from tests.providers.aws.utils import AWS_REGION_US_EAST_1 @@ -7,12 +7,15 @@ from tests.providers.aws.utils import AWS_REGION_US_EAST_1 class Test_glue_database_connections_ssl_enabled: def test_glue_no_conns(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.connections = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_database_connections_ssl_enabled.glue_database_connections_ssl_enabled import ( @@ -25,7 +28,7 @@ class Test_glue_database_connections_ssl_enabled: assert len(result) == 0 def test_glue_table_no_SSL(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.connections = [ Connection( name="test", @@ -42,9 +45,12 @@ class Test_glue_database_connections_ssl_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_database_connections_ssl_enabled.glue_database_connections_ssl_enabled import ( @@ -65,7 +71,7 @@ class Test_glue_database_connections_ssl_enabled: assert result[0].resource_tags == [{"test": "test"}] def test_glue_table_with_SSL(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.connections = [ Connection( name="test", @@ -83,9 +89,12 @@ class Test_glue_database_connections_ssl_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_database_connections_ssl_enabled.glue_database_connections_ssl_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled_test.py index 49a21bd768..01151d53f9 100644 --- a/tests/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import DevEndpoint, SecurityConfig from tests.providers.aws.utils import AWS_REGION_US_EAST_1 @@ -7,12 +7,15 @@ from tests.providers.aws.utils import AWS_REGION_US_EAST_1 class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled: def test_glue_no_endpoints(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_cloudwatch_logs_encryption_enabled.glue_development_endpoints_cloudwatch_logs_encryption_enabled import ( @@ -25,7 +28,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled: assert len(result) == 0 def test_glue_encrypted_endpoint(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -46,9 +49,12 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_cloudwatch_logs_encryption_enabled.glue_development_endpoints_cloudwatch_logs_encryption_enabled import ( @@ -69,7 +75,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_unencrypted_endpoint(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -89,9 +95,12 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_cloudwatch_logs_encryption_enabled.glue_development_endpoints_cloudwatch_logs_encryption_enabled import ( @@ -112,7 +121,7 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_no_sec_configs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -124,9 +133,12 @@ class Test_glue_development_endpoints_cloudwatch_logs_encryption_enabled: ] glue_client.security_configs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_cloudwatch_logs_encryption_enabled.glue_development_endpoints_cloudwatch_logs_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled_test.py index 4c3011faeb..d92003b817 100644 --- a/tests/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import DevEndpoint, SecurityConfig from tests.providers.aws.utils import AWS_REGION_US_EAST_1 @@ -7,12 +7,15 @@ from tests.providers.aws.utils import AWS_REGION_US_EAST_1 class Test_glue_development_endpoints_job_bookmark_encryption_enabled: def test_glue_no_endpoints(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_job_bookmark_encryption_enabled.glue_development_endpoints_job_bookmark_encryption_enabled import ( @@ -25,7 +28,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled: assert len(result) == 0 def test_glue_encrypted_endpoint(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -46,9 +49,12 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_job_bookmark_encryption_enabled.glue_development_endpoints_job_bookmark_encryption_enabled import ( @@ -69,7 +75,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled: assert result[0].resource_tags == [{"test": "value"}] def test_glue_unencrypted_endpoint(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -89,9 +95,12 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_job_bookmark_encryption_enabled.glue_development_endpoints_job_bookmark_encryption_enabled import ( @@ -112,7 +121,7 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled: assert result[0].resource_tags == [{"test": "value"}] def test_glue_no_sec_configs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -124,9 +133,12 @@ class Test_glue_development_endpoints_job_bookmark_encryption_enabled: ] glue_client.security_configs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_job_bookmark_encryption_enabled.glue_development_endpoints_job_bookmark_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled_test.py index c0b88ce77a..8859e5faba 100644 --- a/tests/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import DevEndpoint, SecurityConfig from tests.providers.aws.utils import AWS_REGION_US_EAST_1 @@ -7,12 +7,15 @@ from tests.providers.aws.utils import AWS_REGION_US_EAST_1 class Test_glue_development_endpoints_s3_encryption_enabled: def test_glue_no_endpoints(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_s3_encryption_enabled.glue_development_endpoints_s3_encryption_enabled import ( @@ -25,7 +28,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled: assert len(result) == 0 def test_glue_encrypted_endpoint(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -46,9 +49,12 @@ class Test_glue_development_endpoints_s3_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_s3_encryption_enabled.glue_development_endpoints_s3_encryption_enabled import ( @@ -69,7 +75,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_unencrypted_endpoint(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -89,9 +95,12 @@ class Test_glue_development_endpoints_s3_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_s3_encryption_enabled.glue_development_endpoints_s3_encryption_enabled import ( @@ -112,7 +121,7 @@ class Test_glue_development_endpoints_s3_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_no_sec_configs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.dev_endpoints = [ DevEndpoint( name="test", @@ -124,9 +133,12 @@ class Test_glue_development_endpoints_s3_encryption_enabled: ] glue_client.security_configs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_development_endpoints_s3_encryption_enabled.glue_development_endpoints_s3_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled_test.py index e617fa81f9..81fa6a669b 100644 --- a/tests/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import Job, SecurityConfig from tests.providers.aws.utils import AWS_REGION_US_EAST_1 @@ -7,12 +7,15 @@ from tests.providers.aws.utils import AWS_REGION_US_EAST_1 class Test_glue_etl_jobs_amazon_s3_encryption_enabled: def test_glue_no_jobs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_amazon_s3_encryption_enabled.glue_etl_jobs_amazon_s3_encryption_enabled import ( @@ -25,7 +28,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: assert len(result) == 0 def test_glue_encrypted_job(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -47,9 +50,12 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_amazon_s3_encryption_enabled.glue_etl_jobs_amazon_s3_encryption_enabled import ( @@ -70,7 +76,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_unencrypted_job(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -91,9 +97,12 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_amazon_s3_encryption_enabled.glue_etl_jobs_amazon_s3_encryption_enabled import ( @@ -114,7 +123,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_no_sec_configs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -126,9 +135,12 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: ] glue_client.security_configs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_amazon_s3_encryption_enabled.glue_etl_jobs_amazon_s3_encryption_enabled import ( @@ -149,7 +161,7 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_encrypted_job_with_argument(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -165,9 +177,12 @@ class Test_glue_etl_jobs_amazon_s3_encryption_enabled: ] glue_client.security_configs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_amazon_s3_encryption_enabled.glue_etl_jobs_amazon_s3_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled_test.py index 1841f93db4..2147542e4a 100644 --- a/tests/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import Job, SecurityConfig from tests.providers.aws.utils import AWS_REGION_US_EAST_1 @@ -7,12 +7,15 @@ from tests.providers.aws.utils import AWS_REGION_US_EAST_1 class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled: def test_glue_no_jobs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_cloudwatch_logs_encryption_enabled.glue_etl_jobs_cloudwatch_logs_encryption_enabled import ( @@ -25,7 +28,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled: assert len(result) == 0 def test_glue_encrypted_job(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -47,9 +50,12 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_cloudwatch_logs_encryption_enabled.glue_etl_jobs_cloudwatch_logs_encryption_enabled import ( @@ -70,7 +76,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_unencrypted_job(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -91,9 +97,12 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_cloudwatch_logs_encryption_enabled.glue_etl_jobs_cloudwatch_logs_encryption_enabled import ( @@ -114,7 +123,7 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_no_sec_configs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -126,9 +135,12 @@ class Test_glue_etl_jobs_cloudwatch_logs_encryption_enabled: ] glue_client.security_configs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_cloudwatch_logs_encryption_enabled.glue_etl_jobs_cloudwatch_logs_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled_test.py b/tests/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled_test.py index 1431369fd6..4bd10d30e9 100644 --- a/tests/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled_test.py +++ b/tests/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled_test.py @@ -1,5 +1,5 @@ from re import search -from unittest import mock +from unittest.mock import MagicMock, patch from prowler.providers.aws.services.glue.glue_service import Job, SecurityConfig from tests.providers.aws.utils import AWS_REGION_US_EAST_1 @@ -7,12 +7,15 @@ from tests.providers.aws.utils import AWS_REGION_US_EAST_1 class Test_glue_etl_jobs_job_bookmark_encryption_enabled: def test_glue_no_jobs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_job_bookmark_encryption_enabled.glue_etl_jobs_job_bookmark_encryption_enabled import ( @@ -25,7 +28,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled: assert len(result) == 0 def test_glue_encrypted_job(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -47,9 +50,12 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_job_bookmark_encryption_enabled.glue_etl_jobs_job_bookmark_encryption_enabled import ( @@ -70,7 +76,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_unencrypted_job(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -91,9 +97,12 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled: ) ] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_job_bookmark_encryption_enabled.glue_etl_jobs_job_bookmark_encryption_enabled import ( @@ -114,7 +123,7 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled: assert result[0].resource_tags == [{"key_test": "value_test"}] def test_glue_no_sec_configs(self): - glue_client = mock.MagicMock + glue_client = MagicMock glue_client.jobs = [ Job( name="test", @@ -126,9 +135,12 @@ class Test_glue_etl_jobs_job_bookmark_encryption_enabled: ] glue_client.security_configs = [] - with mock.patch( + with patch( "prowler.providers.aws.services.glue.glue_service.Glue", - glue_client, + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, ): # Test Check from prowler.providers.aws.services.glue.glue_etl_jobs_job_bookmark_encryption_enabled.glue_etl_jobs_job_bookmark_encryption_enabled import ( diff --git a/tests/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest_test.py b/tests/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest_test.py new file mode 100644 index 0000000000..19e9f88cbe --- /dev/null +++ b/tests/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest_test.py @@ -0,0 +1,109 @@ +from unittest.mock import MagicMock, patch + +from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1 + + +class Test_glue_ml_transform_encrypted_at_rest: + def test_no_ml_transfroms(self): + glue_client = MagicMock + glue_client.ml_transforms = {} + + with patch( + "prowler.providers.aws.services.glue.glue_service.Glue", + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, + ): + from prowler.providers.aws.services.glue.glue_ml_transform_encrypted_at_rest.glue_ml_transform_encrypted_at_rest import ( + glue_ml_transform_encrypted_at_rest, + ) + + check = glue_ml_transform_encrypted_at_rest() + result = check.execute() + + assert len(result) == 0 + + def test_ml_transform_encryption_disabled(self): + glue_client = MagicMock + ml_transform_id = "transform1" + ml_transform_arn = f"arn:aws:glue:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:mlTransform/{ml_transform_id}" + + from prowler.providers.aws.services.glue.glue_service import MLTransform + + glue_client.ml_transforms = { + ml_transform_arn: MLTransform( + arn=ml_transform_arn, + id=ml_transform_id, + name="ml-transform1", + user_data_encryption="DISABLED", + region=AWS_REGION_EU_WEST_1, + tags=[{"test_key": "test_value"}], + ) + } + + with patch( + "prowler.providers.aws.services.glue.glue_service.Glue", + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, + ): + from prowler.providers.aws.services.glue.glue_ml_transform_encrypted_at_rest.glue_ml_transform_encrypted_at_rest import ( + glue_ml_transform_encrypted_at_rest, + ) + + check = glue_ml_transform_encrypted_at_rest() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_id == ml_transform_id + assert result[0].resource_arn == ml_transform_arn + assert result[0].region == AWS_REGION_EU_WEST_1 + assert ( + result[0].status_extended + == "Glue ML Transform ml-transform1 is not encrypted at rest." + ) + + def test_ml_transform_encryption_enabled(self): + glue_client = MagicMock + ml_transform_id = "transform2" + ml_transform_arn = f"arn:aws:glue:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:mlTransform/{ml_transform_id}" + + from prowler.providers.aws.services.glue.glue_service import MLTransform + + glue_client.ml_transforms = { + ml_transform_arn: MLTransform( + arn=ml_transform_arn, + id=ml_transform_id, + name="ml-transform2", + user_data_encryption="SSE-KMS", + region=AWS_REGION_EU_WEST_1, + tags=[{"test_key": "test_value"}], + ) + } + + with patch( + "prowler.providers.aws.services.glue.glue_service.Glue", + new=glue_client, + ), patch( + "prowler.providers.aws.services.glue.glue_client.glue_client", + new=glue_client, + ): + from prowler.providers.aws.services.glue.glue_ml_transform_encrypted_at_rest.glue_ml_transform_encrypted_at_rest import ( + glue_ml_transform_encrypted_at_rest, + ) + + check = glue_ml_transform_encrypted_at_rest() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].resource_id == ml_transform_id + assert result[0].resource_arn == ml_transform_arn + assert result[0].region == AWS_REGION_EU_WEST_1 + assert ( + result[0].status_extended + == "Glue ML Transform ml-transform2 is encrypted at rest." + ) diff --git a/tests/providers/aws/services/glue/glue_service_test.py b/tests/providers/aws/services/glue/glue_service_test.py index 7a1a69ee50..9a2c72c81c 100644 --- a/tests/providers/aws/services/glue/glue_service_test.py +++ b/tests/providers/aws/services/glue/glue_service_test.py @@ -100,6 +100,16 @@ def mock_make_api_call(self, operation_name, kwarg): }, ], } + elif operation_name == "GetMLTransforms": + return { + "Transforms": [ + { + "Name": "ml-transform1", + "TransformId": "transform1", + "UserDefinedEncryption": "DISABLED", + } + ] + } elif operation_name == "GetTags": return { "Tags": { @@ -234,6 +244,20 @@ class Test_Glue_Service: } assert glue.jobs[0].region == AWS_REGION_US_EAST_1 + @mock_aws + def test_get_ml_transforms(self): + aws_provider = set_mocked_aws_provider() + glue = Glue(aws_provider) + arn_transform = f"arn:aws:glue:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:mlTransform/transform1" + + assert len(glue.ml_transforms) == 1 + assert arn_transform in glue.ml_transforms + assert glue.ml_transforms[arn_transform].arn == arn_transform + assert glue.ml_transforms[arn_transform].id == "transform1" + assert glue.ml_transforms[arn_transform].name == "ml-transform1" + assert glue.ml_transforms[arn_transform].user_data_encryption == "DISABLED" + assert glue.ml_transforms[arn_transform].region == AWS_REGION_US_EAST_1 + @mock_aws def test_get_tags(self): aws_provider = set_mocked_aws_provider()