ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(merge): update v4 with latest changes (#3670)

Browse Source
This commit is contained in:
Sergio Garcia
2024-04-04 15:37:41 +02:00
committed by GitHub
parent eaa8900758
commit c6f9936292
9 changed files with 44 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/lib/banner.py
+1 -1
View File
@@ -18,7 +18,7 @@ def print_banner(verbose: bool, fixer: bool = False):
if verbose or fixer:
print(
f"""
Color code for results:
{Style.BRIGHT}Color code for results:{Style.RESET_ALL}
- {Fore.YELLOW}MANUAL (Manual check){Style.RESET_ALL}
- {Fore.GREEN}PASS (Recommended value){Style.RESET_ALL}
- {orange_color}MUTED (Muted by muted list){Style.RESET_ALL}
prowler/lib/check/check.py
+4 -6
View File
@@ -573,16 +573,14 @@ def execute_checks(
)
else:
# Prepare your messages
messages = [
f"{Style.BRIGHT}Config File: {Style.RESET_ALL}{Fore.YELLOW}{config_file}{Style.RESET_ALL}"
]
messages = [f"Config File: {Fore.YELLOW}{config_file}{Style.RESET_ALL}"]
if mutelist_file:
messages.append(
f"{Style.BRIGHT}Mute List File: {Style.RESET_ALL}{Fore.YELLOW}{mutelist_file}{Style.RESET_ALL}"
f"Mute List File: {Fore.YELLOW}{mutelist_file}{Style.RESET_ALL}"
)
if global_provider.type == "aws":
messages.append(
f"{Style.BRIGHT}Scanning unused services and resources: {Style.RESET_ALL}{Fore.YELLOW}{global_provider.scan_unused_services}{Style.RESET_ALL}"
f"Scanning unused services and resources: {Fore.YELLOW}{global_provider.scan_unused_services}{Style.RESET_ALL}"
)
report_title = (
f"{Style.BRIGHT}Using the following configuration:{Style.RESET_ALL}"
@@ -595,7 +593,7 @@ def execute_checks(
check_noun = plural_string if checks_num > 1 else singular_string
print(
f"{Style.BRIGHT}Executing {checks_num} {check_noun}, please wait...{Style.RESET_ALL}\n"
f"{Style.BRIGHT}Executing {checks_num} {check_noun}, please wait...{Style.RESET_ALL}"
)
with alive_bar(
total=len(checks_to_execute),
prowler/lib/utils/utils.py
+2 -14
View File
@@ -184,21 +184,9 @@ def print_boxes(messages: list, report_title: str):
Args:
messages (list): A list of messages to print.
"""
max_length = 100
# Adding a bit of padding for aesthetics
padding = 4
box_width = max_length + padding
# Print the top border
print(f"{Style.BRIGHT}+{'-' * (box_width)}+{Style.RESET_ALL}")
# Print report title
space_padding = box_width - len(strip_ansi_codes(report_title)) - 1
print(
f"{Style.BRIGHT}|{Style.RESET_ALL} {report_title}{' ' * space_padding}{Style.BRIGHT}|{Style.RESET_ALL}"
)
print(f"{Style.BRIGHT}+{'-' * (box_width)}+{Style.RESET_ALL}")
print(f"{Style.BRIGHT}-> {report_title}{Style.RESET_ALL}")
for message in messages:
print(
f"{Style.BRIGHT}{Style.RESET_ALL} ·{message}{Style.BRIGHT}{Style.RESET_ALL}"
f"{Style.BRIGHT}{Style.RESET_ALL} · {message}{Style.BRIGHT}{Style.RESET_ALL}"
)
print()
prowler/providers/aws/aws_provider.py
+5 -5
View File
@@ -492,11 +492,11 @@ class AwsProvider(Provider):
self._identity.profile if self._identity.profile is not None else "default"
)
report_lines = [
f"{Style.BRIGHT}AWS-CLI Profile: {Style.RESET_ALL}{Fore.YELLOW}{profile}{Style.RESET_ALL}",
f"{Style.BRIGHT}AWS Regions: {Style.RESET_ALL}{Fore.YELLOW}{regions}{Style.RESET_ALL}",
f"{Style.BRIGHT}AWS Account: {Style.RESET_ALL}{Fore.YELLOW}{self._identity.account}{Style.RESET_ALL}",
f"{Style.BRIGHT}User Id: {Style.RESET_ALL}{Fore.YELLOW}{self._identity.user_id}{Style.RESET_ALL}",
f"{Style.BRIGHT}Caller Identity ARN: {Style.RESET_ALL}{Fore.YELLOW}{self._identity.identity_arn}{Style.RESET_ALL}",
f"AWS-CLI Profile: {Fore.YELLOW}{profile}{Style.RESET_ALL}",
f"AWS Regions: {Fore.YELLOW}{regions}{Style.RESET_ALL}",
f"AWS Account: {Fore.YELLOW}{self._identity.account}{Style.RESET_ALL}",
f"User Id: {Fore.YELLOW}{self._identity.user_id}{Style.RESET_ALL}",
f"Caller Identity ARN: {Fore.YELLOW}{self._identity.identity_arn}{Style.RESET_ALL}",
]
# If -A is set, print Assumed Role ARN
if (
prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.py
+10 -8
View File
@@ -51,19 +51,21 @@ class cloudtrail_threat_detection_enumeration(Check):
if len(actions) / len(ENUMERATION_ACTIONS) > THRESHOLD:
found_potential_enumeration = True
report = Check_Report_AWS(self.metadata())
report.region = trail.region
report.resource_id = trail.name
report.resource_arn = trail.arn
report.resource_tags = trail.tags
report.region = cloudtrail_client.region
report.resource_id = cloudtrail_client.audited_account
report.resource_arn = cloudtrail_client.__get_trail_arn_template__(
cloudtrail_client.region
)
report.status = "FAIL"
report.status_extended = f"Potential enumeration attack detected from source IP {source_ip} with an threshold of {ip_threshold}."
findings.append(report)
if not found_potential_enumeration:
report = Check_Report_AWS(self.metadata())
report.region = trail.region
report.resource_id = trail.name
report.resource_arn = trail.arn
report.resource_tags = trail.tags
report.region = cloudtrail_client.region
report.resource_id = cloudtrail_client.audited_account
report.resource_arn = cloudtrail_client.__get_trail_arn_template__(
cloudtrail_client.region
)
report.status = "PASS"
report.status_extended = "No potential enumeration attack detected."
findings.append(report)
prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.py
+10 -8
View File
@@ -56,19 +56,21 @@ class cloudtrail_threat_detection_privilege_escalation(Check):
if len(actions) / len(PRIVILEGE_ESCALATION_ACTIONS) > THRESHOLD:
found_potential_privilege_escalation = True
report = Check_Report_AWS(self.metadata())
report.region = trail.region
report.resource_id = trail.name
report.resource_arn = trail.arn
report.resource_tags = trail.tags
report.region = cloudtrail_client.region
report.resource_id = cloudtrail_client.audited_account
report.resource_arn = cloudtrail_client.__get_trail_arn_template__(
cloudtrail_client.region
)
report.status = "FAIL"
report.status_extended = f"Potential privilege escalation attack detected from source IP {source_ip} with an threshold of {ip_threshold}."
findings.append(report)
if not found_potential_privilege_escalation:
report = Check_Report_AWS(self.metadata())
report.region = trail.region
report.resource_id = trail.name
report.resource_arn = trail.arn
report.resource_tags = trail.tags
report.region = cloudtrail_client.region
report.resource_id = cloudtrail_client.audited_account
report.resource_arn = cloudtrail_client.__get_trail_arn_template__(
cloudtrail_client.region
)
report.status = "PASS"
report.status_extended = (
"No potential privilege escalation attack detected."
prowler/providers/azure/azure_provider.py
+4 -4
View File
@@ -177,10 +177,10 @@ class AzureProvider(Provider):
intermediate = key + ": " + value
printed_subscriptions.append(intermediate)
report_lines = [
f"{Style.BRIGHT}Azure Tenant Domain:{Style.RESET_ALL} {Fore.YELLOW}{self._identity.tenant_domain}{Style.RESET_ALL} {Style.BRIGHT}Azure Tenant ID:{Style.RESET_ALL} {Fore.YELLOW}{self._identity.tenant_ids[0]}{Style.RESET_ALL}",
f"{Style.BRIGHT}Azure Region:{Style.RESET_ALL} {Fore.YELLOW}{self.region_config.name}{Style.RESET_ALL}",
f"{Style.BRIGHT}Azure Subscriptions:{Style.RESET_ALL} {Fore.YELLOW}{printed_subscriptions}{Style.RESET_ALL}",
f"{Style.BRIGHT}Azure Identity Type:{Style.RESET_ALL} {Fore.YELLOW}{self._identity.identity_type}{Style.RESET_ALL} {Style.BRIGHT}Azure Identity ID:{Style.RESET_ALL} {Fore.YELLOW}{self._identity.identity_id}{Style.RESET_ALL}",
f"Azure Tenant Domain: {Fore.YELLOW}{self._identity.tenant_domain}{Style.RESET_ALL} Azure Tenant ID: {Fore.YELLOW}{self._identity.tenant_ids[0]}{Style.RESET_ALL}",
f"Azure Region: {Fore.YELLOW}{self.region_config.name}{Style.RESET_ALL}",
f"Azure Subscriptions: {Fore.YELLOW}{printed_subscriptions}{Style.RESET_ALL}",
f"Azure Identity Type: {Fore.YELLOW}{self._identity.identity_type}{Style.RESET_ALL} Azure Identity ID: {Fore.YELLOW}{self._identity.identity_id}{Style.RESET_ALL}",
]
report_title = (
f"{Style.BRIGHT}Using the Azure credentials below:{Style.RESET_ALL}"
prowler/providers/gcp/gcp_provider.py
+2 -2
View File
@@ -169,8 +169,8 @@ class GcpProvider(Provider):
# TODO: Beautify audited profile, set "default" if there is no profile set
# TODO: improve print_credentials with more data like name, number, organization
report_lines = [
f"{Style.BRIGHT}GCP Account:{Style.RESET_ALL} {Fore.YELLOW}{self.identity.profile}{Style.RESET_ALL}",
f"{Style.BRIGHT}GCP Project IDs:{Style.RESET_ALL} {Fore.YELLOW}{', '.join(self.project_ids)}{Style.RESET_ALL}",
f"GCP Account: {Fore.YELLOW}{self.identity.profile}{Style.RESET_ALL}",
f"GCP Project IDs: {Fore.YELLOW}{', '.join(self.project_ids)}{Style.RESET_ALL}",
]
report_title = (
f"{Style.BRIGHT}Using the GCP credentials below:{Style.RESET_ALL}"
prowler/providers/kubernetes/kubernetes_provider.py
+6 -6
View File
@@ -267,17 +267,17 @@ class KubernetesProvider(Provider):
"""
if self._identity.context == "In-Cluster":
report_lines = [
f"{Style.BRIGHT}Kubernetes Pod:{Style.RESET_ALL} {Fore.YELLOW}prowler{Style.RESET_ALL}",
f"{Style.BRIGHT}Namespace:{Style.RESET_ALL} {Fore.YELLOW}{self.get_pod_current_namespace()}{Style.RESET_ALL}",
f"Kubernetes Pod: {Fore.YELLOW}prowler{Style.RESET_ALL}",
f"Namespace: {Fore.YELLOW}{self.get_pod_current_namespace()}{Style.RESET_ALL}",
]
else:
roles = self.get_context_user_roles()
roles_str = ", ".join(roles) if roles else "No associated Roles"
report_lines = [
f"{Style.BRIGHT}Kubernetes Cluster:{Style.RESET_ALL} {Fore.YELLOW}{self._identity.cluster}{Style.RESET_ALL}",
f"{Style.BRIGHT}User:{Style.RESET_ALL} {Fore.YELLOW}{self._identity.user}{Style.RESET_ALL}",
f"{Style.BRIGHT}Namespaces:{Style.RESET_ALL} {Fore.YELLOW}{', '.join(self.namespaces)}{Style.RESET_ALL}",
f"{Style.BRIGHT}Roles:{Style.RESET_ALL} {Fore.YELLOW}{roles_str}{Style.RESET_ALL}",
f"Kubernetes Cluster: {Fore.YELLOW}{self._identity.cluster}{Style.RESET_ALL}",
f"User: {Fore.YELLOW}{self._identity.user}{Style.RESET_ALL}",
f"Namespaces: {Fore.YELLOW}{', '.join(self.namespaces)}{Style.RESET_ALL}",
f"Roles: {Fore.YELLOW}{roles_str}{Style.RESET_ALL}",
]
report_title = (
f"{Style.BRIGHT}Using the Kubernetes credentials below:{Style.RESET_ALL}"