diff --git a/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py b/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py index 5d0309ec55..7c0dab3935 100644 --- a/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py +++ b/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py @@ -5,32 +5,32 @@ from prowler.providers.gcp.services.compute.compute_client import compute_client class compute_network_default_in_use(Check): def execute(self) -> Check_Report_GCP: findings = [] - # Check if default network is in use for each project projects_with_default_network = set() + + # Identify projects with the default network for network in compute_client.networks: if network.name == "default": projects_with_default_network.add(network.project_id) - report = Check_Report_GCP(self.metadata()) - report.project_id = network.project_id - report.resource_id = "default" - report.resource_name = "default" - report.location = "global" + + # Generate reports for all projects + for project in compute_client.project_ids: + report = Check_Report_GCP(self.metadata()) + report.project_id = project + report.resource_id = "default" + report.resource_name = "default" + report.location = "global" + + if project in projects_with_default_network: report.status = "FAIL" report.status_extended = ( - f"Default network is in use in project {network.project_id}." + f"Default network is in use in project {project}." ) - findings.append(report) - - for project in compute_client.project_ids: - if project not in projects_with_default_network: - report = Check_Report_GCP(self.metadata()) - report.project_id = project - report.resource_id = "default" - report.resource_name = "default" - report.location = "global" + else: report.status = "PASS" report.status_extended = ( f"Default network does not exist in project {project}." ) + findings.append(report) + return findings diff --git a/tests/providers/gcp/services/compute/compute_rdp_access_from_the_internet_allowed/compute_rdp_access_from_the_internet_allowed_test.py b/tests/providers/gcp/services/compute/compute_firewall_rdp_access_from_the_internet_allowed/compute_firewall_rdp_access_from_the_internet_allowed_test.py similarity index 100% rename from tests/providers/gcp/services/compute/compute_rdp_access_from_the_internet_allowed/compute_rdp_access_from_the_internet_allowed_test.py rename to tests/providers/gcp/services/compute/compute_firewall_rdp_access_from_the_internet_allowed/compute_firewall_rdp_access_from_the_internet_allowed_test.py diff --git a/tests/providers/gcp/services/compute/compute_ssh_access_from_the_internet_allowed/compute_ssh_access_from_the_internet_allowed_test.py b/tests/providers/gcp/services/compute/compute_firewall_ssh_access_from_the_internet_allowed/compute_firewall_ssh_access_from_the_internet_allowed_test.py similarity index 100% rename from tests/providers/gcp/services/compute/compute_ssh_access_from_the_internet_allowed/compute_ssh_access_from_the_internet_allowed_test.py rename to tests/providers/gcp/services/compute/compute_firewall_ssh_access_from_the_internet_allowed/compute_firewall_ssh_access_from_the_internet_allowed_test.py diff --git a/tests/providers/gcp/services/compute/compute_block_project_wide_ssh_keys_disabled/compute_block_project_wide_ssh_keys_disabled_test.py b/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py similarity index 100% rename from tests/providers/gcp/services/compute/compute_block_project_wide_ssh_keys_disabled/compute_block_project_wide_ssh_keys_disabled_test.py rename to tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py diff --git a/tests/providers/gcp/services/compute/compute_default_service_account_in_use/compute_default_service_account_in_use_test.py b/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use_test.py similarity index 100% rename from tests/providers/gcp/services/compute/compute_default_service_account_in_use/compute_default_service_account_in_use_test.py rename to tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use_test.py diff --git a/tests/providers/gcp/services/compute/compute_default_service_account_in_use_with_full_api_access/compute_default_service_account_in_use_with_full_api_access_test.py b/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access_test.py similarity index 100% rename from tests/providers/gcp/services/compute/compute_default_service_account_in_use_with_full_api_access/compute_default_service_account_in_use_with_full_api_access_test.py rename to tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access_test.py diff --git a/tests/providers/gcp/services/compute/compute_encryption_with_csek_is_disabled/compute_encryption_with_csek_is_disabled_test.py b/tests/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled_test.py similarity index 100% rename from tests/providers/gcp/services/compute/compute_encryption_with_csek_is_disabled/compute_encryption_with_csek_is_disabled_test.py rename to tests/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled_test.py diff --git a/tests/providers/gcp/services/compute/compute_ip_forwarding_is_enabled/compute_ip_forwarding_is_enabled_test.py b/tests/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled_test.py similarity index 100% rename from tests/providers/gcp/services/compute/compute_ip_forwarding_is_enabled/compute_ip_forwarding_is_enabled_test.py rename to tests/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled_test.py diff --git a/tests/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip_test.py b/tests/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip_test.py new file mode 100644 index 0000000000..9c3b20020a --- /dev/null +++ b/tests/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip_test.py @@ -0,0 +1,119 @@ +from unittest import mock + +from tests.providers.gcp.gcp_fixtures import GCP_PROJECT_ID, set_mocked_gcp_provider + + +class Test_compute_instance_public_ip: + def test_compute_no_instances(self): + compute_client = mock.MagicMock + compute_client.instances = [] + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.compute.compute_instance_public_ip.compute_instance_public_ip.compute_client", + new=compute_client, + ): + from prowler.providers.gcp.services.compute.compute_instance_public_ip.compute_instance_public_ip import ( + compute_instance_public_ip, + ) + + check = compute_instance_public_ip() + result = check.execute() + assert len(result) == 0 + + def test_no_public_ip_instance(self): + compute_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.compute.compute_instance_public_ip.compute_instance_public_ip.compute_client", + new=compute_client, + ): + from prowler.providers.gcp.services.compute.compute_instance_public_ip.compute_instance_public_ip import ( + compute_instance_public_ip, + ) + from prowler.providers.gcp.services.compute.compute_service import Instance + + instance = Instance( + name="test", + id="1234567890", + zone="us-central1-a", + public_ip=False, + metadata={}, + shielded_enabled_vtpm=True, + shielded_enabled_integrity_monitoring=True, + confidential_computing=True, + service_accounts=[ + {"email": "123-compute@developer.gserviceaccount.com"} + ], + ip_forward=False, + disks_encryption=[], + project_id=GCP_PROJECT_ID, + ) + + compute_client.project_ids = [GCP_PROJECT_ID] + compute_client.instances = [instance] + + check = compute_instance_public_ip() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "VM Instance test does not have a public IP." + ) + assert result[0].resource_id == "1234567890" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].resource_name == "test" + assert result[0].location == "us-central1-a" + + def test_public_ip_instance(self): + from prowler.providers.gcp.services.compute.compute_service import Instance + + instance = Instance( + name="test", + id="1234567890", + zone="us-central1-a", + public_ip=True, + metadata={}, + shielded_enabled_vtpm=True, + shielded_enabled_integrity_monitoring=True, + confidential_computing=True, + service_accounts=[ + {"email": f"{GCP_PROJECT_ID}-compute@developer.gserviceaccount.com"} + ], + ip_forward=True, + disks_encryption=[], + project_id=GCP_PROJECT_ID, + ) + + compute_client = mock.MagicMock + compute_client.project_ids = [GCP_PROJECT_ID] + compute_client.instances = [instance] + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.compute.compute_instance_public_ip.compute_instance_public_ip.compute_client", + new=compute_client, + ): + from prowler.providers.gcp.services.compute.compute_instance_public_ip.compute_instance_public_ip import ( + compute_instance_public_ip, + ) + + check = compute_instance_public_ip() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].status_extended == "VM Instance test has a public IP." + assert result[0].resource_id == "1234567890" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].resource_name == "test" + assert result[0].location == "us-central1-a" diff --git a/tests/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use_test.py b/tests/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use_test.py new file mode 100644 index 0000000000..c8360a1c32 --- /dev/null +++ b/tests/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use_test.py @@ -0,0 +1,132 @@ +from unittest import mock + +from tests.providers.gcp.gcp_fixtures import GCP_PROJECT_ID, set_mocked_gcp_provider + + +class Test_compute_network_default_in_use: + def test_compute_no_projects(self): + compute_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use.compute_client", + new=compute_client, + ): + from prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use import ( + compute_network_default_in_use, + ) + + compute_client.project_ids = [] + compute_client.networks = [] + + check = compute_network_default_in_use() + result = check.execute() + assert len(result) == 0 + + def test_compute_no_networks(self): + compute_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use.compute_client", + new=compute_client, + ): + from prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use import ( + compute_network_default_in_use, + ) + + compute_client.project_ids = [GCP_PROJECT_ID] + compute_client.networks = [] + + check = compute_network_default_in_use() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Default network does not exist in project {GCP_PROJECT_ID}." + ) + assert result[0].resource_id == "default" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].resource_name == "default" + assert result[0].location == "global" + + def test_compute_one_project_default_network(self): + compute_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use.compute_client", + new=compute_client, + ): + from prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use import ( + compute_network_default_in_use, + ) + from prowler.providers.gcp.services.compute.compute_service import Network + + compute_client.project_ids = [GCP_PROJECT_ID] + compute_client.networks = [ + Network( + name="default", + id="default", + subnet_mode="custom", + project_id=GCP_PROJECT_ID, + ) + ] + + check = compute_network_default_in_use() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Default network is in use in project {GCP_PROJECT_ID}." + ) + assert result[0].resource_id == "default" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].resource_name == "default" + assert result[0].location == "global" + + def test_compute_one_project_no_default_network(self): + compute_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use.compute_client", + new=compute_client, + ): + from prowler.providers.gcp.services.compute.compute_network_default_in_use.compute_network_default_in_use import ( + compute_network_default_in_use, + ) + from prowler.providers.gcp.services.compute.compute_service import Network + + compute_client.project_ids = [GCP_PROJECT_ID] + compute_client.networks = [ + Network( + name="not-default", + id="not-default", + subnet_mode="custom", + project_id=GCP_PROJECT_ID, + ) + ] + + check = compute_network_default_in_use() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Default network does not exist in project {GCP_PROJECT_ID}." + ) + assert result[0].resource_id == "default" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].resource_name == "default" + assert result[0].location == "global"