diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index da182a53f8..7e14f36275 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -17,6 +17,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update Kubernetes Kubelet service metadata to new format [(#9677)](https://github.com/prowler-cloud/prowler/pull/9677) - Update Kubernetes RBAC service metadata to new format [(#9678)](https://github.com/prowler-cloud/prowler/pull/9678) - Update Kubernetes Scheduler service metadata to new format [(#9679)](https://github.com/prowler-cloud/prowler/pull/9679) +- Update MongoDB Atlas Organizations service metadata to new format [(#9658)](https://github.com/prowler-cloud/prowler/pull/9658) --- diff --git a/prowler/providers/mongodbatlas/services/organizations/organizations_api_access_list_required/organizations_api_access_list_required.metadata.json b/prowler/providers/mongodbatlas/services/organizations/organizations_api_access_list_required/organizations_api_access_list_required.metadata.json index 16d93fb9c9..673345d983 100644 --- a/prowler/providers/mongodbatlas/services/organizations/organizations_api_access_list_required/organizations_api_access_list_required.metadata.json +++ b/prowler/providers/mongodbatlas/services/organizations/organizations_api_access_list_required/organizations_api_access_list_required.metadata.json @@ -1,30 +1,40 @@ { "Provider": "mongodbatlas", "CheckID": "organizations_api_access_list_required", - "CheckTitle": "Ensure organization requires API access list", + "CheckTitle": "Organization requires API operations to originate from an IP address on the API access list", "CheckType": [], "ServiceName": "organizations", "SubServiceName": "", "ResourceIdTemplate": "", - "Severity": "medium", - "ResourceType": "MongoDBAtlasOrganization", + "Severity": "high", + "ResourceType": "NotDefined", "ResourceGroup": "governance", - "Description": "Ensure organization requires API operations to originate from an IP Address added to the API access list", - "Risk": "Without API access list requirement, API operations can originate from any IP address, increasing the risk of unauthorized access", + "Description": "**MongoDB Atlas organizations** can require Atlas Administration API requests to originate only from IPs or CIDRs listed in the organization's **API access list** (`apiAccessListRequired`).", + "Risk": "Without IP allowlisting, the Atlas Administration API is reachable from any network. A leaked token can be used from arbitrary hosts to:\n- change org/project settings and users\n- create, modify, or delete clusters\nThis undermines **integrity** and **availability** and expands the blast radius of credential compromise.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.mongodb.com/docs/atlas/access/orgs-create-view-edit-delete/", + "https://www.mongodb.com/docs/atlas/configure-api-access/", + "https://www.mongodb.com/docs/atlas/configure-api-access-mult-org/", + "https://www.mongodb.com/docs/atlas/tutorial/manage-organizations/", + "https://www.mongodb.com/docs/atlas/security/ip-access-list/" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "curl --digest -u \":\" -H \"Content-Type: application/json\" -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/orgs//settings\" -d '{\"apiAccessListRequired\":true}'", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In the MongoDB Atlas UI, open the target organization and go to Organization Settings\n2. Toggle \"Require IP Access List for the Atlas Administration API\" to On\n3. Click Save", + "Terraform": "```hcl\nresource \"mongodbatlas_organization_settings\" \"\" {\n org_id = \"\"\n\n api_access_list_required = true # Critical: Enforces that Atlas Admin API calls must originate from IPs on the org's API access list\n}\n```" }, "Recommendation": { - "Text": "Enable API access list requirement for the organization by setting apiAccessListRequired to true in the organization settings.", - "Url": "https://www.mongodb.com/docs/atlas/security/ip-access-list/" + "Text": "Require the org **API access list** and restrict it to trusted, fixed egress IPs/CIDRs. Enforce **least privilege** on service accounts, prefer short-lived tokens, rotate secrets, and review entries regularly. Pair with **MFA/SSO** and monitoring for **defense in depth**.", + "Url": "https://hub.prowler.com/check/organizations_api_access_list_required" } }, - "Categories": [], + "Categories": [ + "internet-exposed", + "trust-boundaries" + ], "DependsOn": [], "RelatedTo": [], "Notes": "If you are running this check from Prowler Cloud, you will need to add our IP to the API access list of your API Key and then enable apiAccessListRequired to make this check pass." diff --git a/prowler/providers/mongodbatlas/services/organizations/organizations_mfa_required/organizations_mfa_required.metadata.json b/prowler/providers/mongodbatlas/services/organizations/organizations_mfa_required/organizations_mfa_required.metadata.json index e2b5d0dfb5..30546359de 100644 --- a/prowler/providers/mongodbatlas/services/organizations/organizations_mfa_required/organizations_mfa_required.metadata.json +++ b/prowler/providers/mongodbatlas/services/organizations/organizations_mfa_required/organizations_mfa_required.metadata.json @@ -1,30 +1,35 @@ { "Provider": "mongodbatlas", "CheckID": "organizations_mfa_required", - "CheckTitle": "Ensure organization requires MFA", + "CheckTitle": "Organization requires multi-factor authentication for user access", "CheckType": [], "ServiceName": "organizations", "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", - "ResourceType": "MongoDBAtlasOrganization", + "ResourceType": "NotDefined", "ResourceGroup": "governance", - "Description": "Ensure organization requires users to set up Multi-Factor Authentication (MFA) before accessing the organization", - "Risk": "Without MFA requirement, user accounts are vulnerable to credential-based attacks and unauthorized access", + "Description": "**MongoDB Atlas organization** mandates **multi-factor authentication** for all members before accessing organization resources (`multi_factor_auth_required`).", + "Risk": "Without enforced **MFA**, compromised passwords can grant organization access, enabling:\n- Data exposure (confidentiality)\n- Unauthorized configuration or role changes (integrity)\n- Resource deletion or disruption (availability)\nIncreases success of phishing, brute force, and session takeover.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.mongodb.com/docs/atlas/security-multi-factor-authentication/" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "curl --digest -u \":\" -H \"Content-Type: application/json\" -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/orgs/\" -d '{\"multiFactorAuthRequired\":true}'", "NativeIaC": "", - "Other": "https://www.mongodb.com/docs/atlas/security-multi-factor-authentication/", + "Other": "1. Sign in to MongoDB Atlas\n2. Select the target Organization (top-left org selector)\n3. Go to Organization Settings > Security > Multi-Factor Authentication\n4. Enable \"Require Multi-Factor Authentication\" for the organization\n5. Click Save", "Terraform": "" }, "Recommendation": { - "Text": "Enable MFA requirement for the organization by setting multiFactorAuthRequired to true in the organization settings.", - "Url": "https://www.mongodb.com/docs/atlas/security-multi-factor-authentication/" + "Text": "Enforce org-wide **MFA** (`multi_factor_auth_required`). Prefer **phishing-resistant factors** (security keys/biometrics) over SMS, and require at least two methods for recovery. Integrate with **SSO**, apply **least privilege**, and block access until all users enroll.", + "Url": "https://hub.prowler.com/check/organizations_mfa_required" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/mongodbatlas/services/organizations/organizations_security_contact_defined/organizations_security_contact_defined.metadata.json b/prowler/providers/mongodbatlas/services/organizations/organizations_security_contact_defined/organizations_security_contact_defined.metadata.json index 6cd75c66d9..8d29a6dde4 100644 --- a/prowler/providers/mongodbatlas/services/organizations/organizations_security_contact_defined/organizations_security_contact_defined.metadata.json +++ b/prowler/providers/mongodbatlas/services/organizations/organizations_security_contact_defined/organizations_security_contact_defined.metadata.json @@ -1,30 +1,35 @@ { "Provider": "mongodbatlas", "CheckID": "organizations_security_contact_defined", - "CheckTitle": "Ensure organization has a Security Contact defined", + "CheckTitle": "Organization has a security contact defined", "CheckType": [], "ServiceName": "organizations", "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "MongoDBAtlasOrganization", + "ResourceType": "NotDefined", "ResourceGroup": "governance", - "Description": "Ensure organization has a security contact defined to receive security-related notifications", - "Risk": "Without a security contact, the organization may not receive important security notifications and alerts", + "Description": "**MongoDB Atlas organizations** specify a designated **security contact** email to receive **security notifications** and advisories.\n\nAssesses whether this contact is configured at the organization level.", + "Risk": "Missing or stale **security contact** causes critical advisories and incident alerts to be missed or delayed, slowing containment and patching. This elevates risks to **confidentiality** (undetected data access), **integrity** (malicious changes persist), and **availability** (abuse or outages escalate).", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.mongodb.com/docs/atlas/tutorial/manage-organization-settings/#add-security-contact-information" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "curl --digest -u \":\" -H \"Content-Type: application/json\" -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/orgs//settings\" -d '{\"securityContact\":\"\"}'", "NativeIaC": "", - "Other": "", + "Other": "1. Sign in to MongoDB Atlas\n2. In the top bar, select your organization from the Organizations menu\n3. Go to Organization Settings\n4. In Atlas Security Contact Information, click Edit\n5. Enter the security contact email and click Save", "Terraform": "" }, "Recommendation": { - "Text": "Set a security contact email address in the organization settings to receive security-related notifications.", - "Url": "https://www.mongodb.com/docs/atlas/tutorial/manage-organization-settings/#add-security-contact-information" + "Text": "Define a monitored distribution list as the **security contact**.\n\n- Ensure 24/7 coverage and escalation\n- Keep it current and test delivery\n- Integrate with IR/ticketing workflows\n- Apply **least privilege** and document ownership", + "Url": "https://hub.prowler.com/check/organizations_security_contact_defined" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/mongodbatlas/services/organizations/organizations_service_account_secrets_expiration/organizations_service_account_secrets_expiration.metadata.json b/prowler/providers/mongodbatlas/services/organizations/organizations_service_account_secrets_expiration/organizations_service_account_secrets_expiration.metadata.json index 5fe2ca92b1..0d41d98dc8 100644 --- a/prowler/providers/mongodbatlas/services/organizations/organizations_service_account_secrets_expiration/organizations_service_account_secrets_expiration.metadata.json +++ b/prowler/providers/mongodbatlas/services/organizations/organizations_service_account_secrets_expiration/organizations_service_account_secrets_expiration.metadata.json @@ -1,30 +1,36 @@ { "Provider": "mongodbatlas", "CheckID": "organizations_service_account_secrets_expiration", - "CheckTitle": "Ensure organization has maximum period expiration for Admin API Service Account Secrets", + "CheckTitle": "Organization has maximum validity period of 8 hours or less for Admin API Service Account secrets", "CheckType": [], "ServiceName": "organizations", "SubServiceName": "", "ResourceIdTemplate": "", - "Severity": "medium", - "ResourceType": "MongoDBAtlasOrganization", + "Severity": "high", + "ResourceType": "NotDefined", "ResourceGroup": "governance", - "Description": "Ensure organization has a maximum period before expiry for new Atlas Admin API Service Account secrets", - "Risk": "Without proper expiration limits, service account secrets may remain valid for extended periods, increasing security risks", + "Description": "**MongoDB Atlas organization** setting `maxServiceAccountSecretValidityInHours` caps the lifetime of new **Admin API service account secrets**. Evaluation focuses on whether a limit is configured and whether it is at or below the defined policy threshold (default `8` hours).", + "Risk": "Overlong or unset lifetimes for **Admin API service account secrets** expand the attack window. If leaked, an adversary can maintain API access to:\n- Exfiltrate data (confidentiality)\n- Alter org or project configs (integrity)\n- Disable services or change access controls (availability)", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/2025-03-12/operation/operation-getorganizationsettings#operation-getorganizationsettings-200-body-application-vnd-atlas-2023-01-01-json-maxserviceaccountsecretvalidityinhours", + "https://mongodb.prakticum-team.ru/docs/atlas/tutorial/activity-feed/" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "curl --user \":\" --digest -H \"Content-Type: application/json\" -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/orgs//settings\" --data '{\"maxServiceAccountSecretValidityInHours\":8}'", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In the MongoDB Atlas UI, select your organization\n2. Go to Organization > Settings\n3. Set \"Maximum validity for Admin API Service Account secrets\" to 8 hours (or less)\n4. Click Save", + "Terraform": "```hcl\nresource \"mongodbatlas_organization_settings\" \"\" {\n org_id = \"\"\n\n max_service_account_secret_validity_in_hours = 8 # Critical: enforce <= 8 hours for Admin API Service Account secrets\n}\n```" }, "Recommendation": { - "Text": "Set maxServiceAccountSecretValidityInHours to 8 hours or less in the organization settings to ensure service account secrets expire regularly.", - "Url": "https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/2025-03-12/operation/operation-getorganizationsettings#operation-getorganizationsettings-200-body-application-vnd-atlas-2023-01-01-json-maxserviceaccountsecretvalidityinhours" + "Text": "Set a strict cap via `maxServiceAccountSecretValidityInHours` to `8` hours or less. Apply **least privilege** to service accounts, automate secret **rotation/revocation**, and monitor usage. Store secrets in a secure vault and limit where they can be used *e.g., network allowlisting* as part of **defense in depth**.", + "Url": "https://hub.prowler.com/check/organizations_service_account_secrets_expiration" } }, - "Categories": [], + "Categories": [ + "secrets" + ], "DependsOn": [], "RelatedTo": [], "Notes": ""