From c9ff96144d006057dc8d64f213392f2530c8fd3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 30 Sep 2024 18:00:43 +0200 Subject: [PATCH] chore(ssm): add tags to `ssm_managed_compliant_patching` (#5245) Co-authored-by: Sergio --- .../ssm_managed_compliant_patching.py | 6 +++ .../ssm_managed_compliant_patching_test.py | 46 ++++++++++++++++++- 2 files changed, 51 insertions(+), 1 deletion(-) diff --git a/prowler/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching.py b/prowler/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching.py index 178775c227..b61e1d6119 100644 --- a/prowler/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching.py +++ b/prowler/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching.py @@ -1,4 +1,5 @@ from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.ec2.ec2_client import ec2_client from prowler.providers.aws.services.ssm.ssm_client import ssm_client from prowler.providers.aws.services.ssm.ssm_service import ResourceStatus @@ -11,6 +12,11 @@ class ssm_managed_compliant_patching(Check): report.region = resource.region report.resource_id = resource.id report.resource_arn = resource.arn + # Find tags of the instance in ec2_client + for instance in ec2_client.instances: + if instance.id == resource.id: + report.resource_tags = instance.tags + if resource.status == ResourceStatus.COMPLIANT: report.status = "PASS" report.status_extended = ( diff --git a/tests/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching_test.py b/tests/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching_test.py index 56620a86f4..9c9ec9ff52 100644 --- a/tests/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching_test.py +++ b/tests/providers/aws/services/ssm/ssm_managed_compliant_patching/ssm_managed_compliant_patching_test.py @@ -4,7 +4,11 @@ from prowler.providers.aws.services.ssm.ssm_service import ( ComplianceResource, ResourceStatus, ) -from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_US_EAST_1 +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_US_EAST_1, + set_mocked_aws_provider, +) class Test_ssm_managed_compliant_patching: @@ -37,10 +41,26 @@ class Test_ssm_managed_compliant_patching: status=ResourceStatus.COMPLIANT, ) } + ec2_client = mock.MagicMock + ec2_client.instances = [ + mock.MagicMock( + id=instance_id, + tags=[ + {"Key": "Name", "Value": "test_instance"}, + {"Key": "Environment", "Value": "development"}, + ], + ) + ] with mock.patch( "prowler.providers.aws.services.ssm.ssm_service.SSM", new=ssm_client, + ), mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider([AWS_REGION_US_EAST_1]), + ), mock.patch( + "prowler.providers.aws.services.ssm.ssm_managed_compliant_patching.ssm_managed_compliant_patching.ec2_client", + new=ec2_client, ): # Test Check from prowler.providers.aws.services.ssm.ssm_managed_compliant_patching.ssm_managed_compliant_patching import ( @@ -62,6 +82,10 @@ class Test_ssm_managed_compliant_patching: result[0].status_extended == f"EC2 managed instance {instance_id} is compliant." ) + assert result[0].resource_tags == [ + {"Key": "Name", "Value": "test_instance"}, + {"Key": "Environment", "Value": "development"}, + ] def test_compliance_resources_non_compliant(self): ssm_client = mock.MagicMock @@ -75,10 +99,26 @@ class Test_ssm_managed_compliant_patching: status=ResourceStatus.NON_COMPLIANT, ) } + ec2_client = mock.MagicMock + ec2_client.instances = [ + mock.MagicMock( + id=instance_id, + tags=[ + {"Key": "Name", "Value": "test_instance"}, + {"Key": "Environment", "Value": "development"}, + ], + ) + ] with mock.patch( "prowler.providers.aws.services.ssm.ssm_service.SSM", new=ssm_client, + ), mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider([AWS_REGION_US_EAST_1]), + ), mock.patch( + "prowler.providers.aws.services.ssm.ssm_managed_compliant_patching.ssm_managed_compliant_patching.ec2_client", + new=ec2_client, ): # Test Check from prowler.providers.aws.services.ssm.ssm_managed_compliant_patching.ssm_managed_compliant_patching import ( @@ -100,3 +140,7 @@ class Test_ssm_managed_compliant_patching: result[0].status_extended == f"EC2 managed instance {instance_id} is non-compliant." ) + assert result[0].resource_tags == [ + {"Key": "Name", "Value": "test_instance"}, + {"Key": "Environment", "Value": "development"}, + ]