From c3d129a4b2c833c0146b4281c19ecb6d5b168ea0 Mon Sep 17 00:00:00 2001 From: Nacho Rivera Date: Mon, 27 Nov 2023 13:58:45 +0100 Subject: [PATCH] chore(update): rebase from master (#3067) Signed-off-by: dependabot[bot] Signed-off-by: r3drun3 Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Mastron <14130495+mtronrd@users.noreply.github.com> Co-authored-by: John Mastron Co-authored-by: Sergio Garcia Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com> Co-authored-by: sergargar Co-authored-by: Pepe Fagoaga Co-authored-by: github-actions Co-authored-by: simone ragonesi <102741679+R3DRUN3@users.noreply.github.com> Co-authored-by: Johnny Lu Co-authored-by: Vajrala Venkateswarlu <59252985+venkyvajrala@users.noreply.github.com> Co-authored-by: Ignacio Dominguez --- prowler/__main__.py | 11 +++ .../policy_condition_parser.py | 3 + prowler/providers/common/clean.py | 32 +++++++ tests/providers/aws/audit_info_utils.py | 1 + ...uardduty_no_high_severity_findings_test.py | 23 +++++ tests/providers/common/clean_test.py | 87 +++++++++++++++++++ 6 files changed, 157 insertions(+) create mode 100644 prowler/providers/common/clean.py create mode 100644 tests/providers/common/clean_test.py diff --git a/prowler/__main__.py b/prowler/__main__.py index c856b8e3eb..19da72c3ed 100644 --- a/prowler/__main__.py +++ b/prowler/__main__.py @@ -28,7 +28,10 @@ from prowler.lib.check.custom_checks_metadata import ( parse_custom_checks_metadata_file, update_checks_metadata, ) +<<<<<<< HEAD from prowler.lib.check.managers import ExecutionManager +======= +>>>>>>> 856afb396 (chore(update): rebase from master (#3067)) from prowler.lib.cli.parser import ProwlerArgumentParser from prowler.lib.logger import logger, set_logging_config from prowler.lib.outputs.compliance import display_compliance_table @@ -51,6 +54,7 @@ from prowler.providers.common.audit_info import ( set_provider_audit_info, set_provider_execution_parameters, ) +from prowler.providers.common.clean import clean_provider_local_output_directories from prowler.providers.common.outputs import set_provider_output_options from prowler.providers.common.quick_inventory import run_provider_quick_inventory @@ -191,7 +195,11 @@ def prowler(): findings = [] if len(checks_to_execute): +<<<<<<< HEAD execution_manager = ExecutionManager( +======= + findings = execute_checks( +>>>>>>> 856afb396 (chore(update): rebase from master (#3067)) checks_to_execute, provider, audit_info, @@ -327,6 +335,9 @@ def prowler(): if checks_folder: remove_custom_checks_module(checks_folder, provider) + # clean local directories + clean_provider_local_output_directories(args) + # If there are failed findings exit code 3, except if -z is input if not args.ignore_exit_code_3 and stats["total_fail"] > 0: sys.exit(3) diff --git a/prowler/providers/aws/lib/policy_condition_parser/policy_condition_parser.py b/prowler/providers/aws/lib/policy_condition_parser/policy_condition_parser.py index 7dde2bdd31..d88d63bce7 100644 --- a/prowler/providers/aws/lib/policy_condition_parser/policy_condition_parser.py +++ b/prowler/providers/aws/lib/policy_condition_parser/policy_condition_parser.py @@ -71,6 +71,9 @@ def is_condition_block_restrictive( if is_condition_key_restrictive: is_condition_valid = True + if is_condition_key_restrictive: + is_condition_valid = True + # value is a string elif isinstance( condition_statement[condition_operator][value], diff --git a/prowler/providers/common/clean.py b/prowler/providers/common/clean.py new file mode 100644 index 0000000000..d06e1e6941 --- /dev/null +++ b/prowler/providers/common/clean.py @@ -0,0 +1,32 @@ +import importlib +import sys +from shutil import rmtree + +from prowler.config.config import default_output_directory +from prowler.lib.logger import logger + + +def clean_provider_local_output_directories(args): + """ + clean_provider_local_output_directories cleans deletes local custom dirs when output is sent to remote provider storage + """ + try: + # import provider cleaning function + provider_clean_function = f"clean_{args.provider}_local_output_directories" + getattr(importlib.import_module(__name__), provider_clean_function)(args) + except AttributeError as attribute_exception: + logger.info( + f"Cleaning local output directories not initialized for provider {args.provider}: {attribute_exception}" + ) + except Exception as error: + logger.critical( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + sys.exit(1) + + +def clean_aws_local_output_directories(args): + """clean_aws_provider_local_output_directories deletes local custom dirs when output is sent to remote provider storage for aws provider""" + if args.output_bucket or args.output_bucket_no_assume: + if args.output_directory != default_output_directory: + rmtree(args.output_directory) diff --git a/tests/providers/aws/audit_info_utils.py b/tests/providers/aws/audit_info_utils.py index 821ef32ce3..6f0c7e4f67 100644 --- a/tests/providers/aws/audit_info_utils.py +++ b/tests/providers/aws/audit_info_utils.py @@ -6,6 +6,7 @@ from prowler.providers.common.models import Audit_Metadata # Root AWS Account AWS_ACCOUNT_NUMBER = "123456789012" AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" +AWS_COMMERCIAL_PARTITION = "aws" # Commercial Regions AWS_REGION_US_EAST_1 = "us-east-1" diff --git a/tests/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings_test.py b/tests/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings_test.py index fe1ea54bc1..fa416237eb 100644 --- a/tests/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings_test.py +++ b/tests/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings_test.py @@ -80,6 +80,29 @@ class Test_guardduty_no_high_severity_findings: result = check.execute() assert len(result) == 0 + def test_not_enabled_account_detector(self): + guardduty_client = mock.MagicMock + guardduty_client.detectors = [] + guardduty_client.detectors.append( + Detector( + id=AWS_ACCOUNT_NUMBER, + arn=DETECTOR_ARN, + region=AWS_REGION, + enabled_in_account=False, + ) + ) + with mock.patch( + "prowler.providers.aws.services.guardduty.guardduty_service.GuardDuty", + guardduty_client, + ): + from prowler.providers.aws.services.guardduty.guardduty_no_high_severity_findings.guardduty_no_high_severity_findings import ( + guardduty_no_high_severity_findings, + ) + + check = guardduty_no_high_severity_findings() + result = check.execute() + assert len(result) == 0 + def test_high_findings(self): guardduty_client = mock.MagicMock guardduty_client.detectors = [] diff --git a/tests/providers/common/clean_test.py b/tests/providers/common/clean_test.py new file mode 100644 index 0000000000..7b58217a77 --- /dev/null +++ b/tests/providers/common/clean_test.py @@ -0,0 +1,87 @@ +import importlib +import logging +import tempfile +from argparse import Namespace +from os import path + +from mock import patch + +from prowler.providers.common.clean import clean_provider_local_output_directories + + +class Test_Common_Clean: + def set_provider_input_args(self, provider): + set_args_function = f"set_{provider}_input_args" + args = getattr( + getattr(importlib.import_module(__name__), __class__.__name__), + set_args_function, + )(self) + return args + + def set_aws_input_args(self): + args = Namespace() + args.provider = "aws" + args.output_bucket = "test-bucket" + args.output_bucket_no_assume = None + return args + + def set_azure_input_args(self): + args = Namespace() + args.provider = "azure" + return args + + def test_clean_provider_local_output_directories_non_initialized(self, caplog): + provider = "azure" + input_args = self.set_provider_input_args(provider) + caplog.set_level(logging.INFO) + clean_provider_local_output_directories(input_args) + assert ( + f"Cleaning local output directories not initialized for provider {provider}:" + in caplog.text + ) + + def test_clean_aws_local_output_directories_non_default_dir_output_bucket(self): + provider = "aws" + input_args = self.set_provider_input_args(provider) + with tempfile.TemporaryDirectory() as temp_dir: + input_args.output_directory = temp_dir + clean_provider_local_output_directories(input_args) + assert not path.exists(input_args.output_directory) + + def test_clean_aws_local_output_directories_non_default_dir_output_bucket_no_assume( + self, + ): + provider = "aws" + input_args = self.set_provider_input_args(provider) + input_args.output_bucket = None + input_args.output_bucket_no_assume = "test" + with tempfile.TemporaryDirectory() as temp_dir: + input_args.output_directory = temp_dir + clean_provider_local_output_directories(input_args) + assert not path.exists(input_args.output_directory) + + def test_clean_aws_local_output_directories_default_dir_output_bucket(self): + provider = "aws" + input_args = self.set_provider_input_args(provider) + with tempfile.TemporaryDirectory() as temp_dir: + with patch( + "prowler.providers.common.clean.default_output_directory", new=temp_dir + ): + input_args.output_directory = temp_dir + clean_provider_local_output_directories(input_args) + assert path.exists(input_args.output_directory) + + def test_clean_aws_local_output_directories_default_dir_output_bucket_no_assume( + self, + ): + provider = "aws" + input_args = self.set_provider_input_args(provider) + input_args.output_bucket_no_assume = "test" + input_args.ouput_bucket = None + with tempfile.TemporaryDirectory() as temp_dir: + with patch( + "prowler.providers.common.clean.default_output_directory", new=temp_dir + ): + input_args.output_directory = temp_dir + clean_provider_local_output_directories(input_args) + assert path.exists(input_args.output_directory)