ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 12:31:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cloudfront): fix false positive in s3 origins (#6838)

Browse Source 
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
This commit is contained in:
Prowler Bot
2025-02-05 19:36:49 +01:00
committed by GitHub
parent 4c2ec094f6
commit d60f4b5ded
2 changed files with 65 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/cloudfront/cloudfront_distributions_origin_traffic_encrypted/cloudfront_distributions_origin_traffic_encrypted.py
+14 -8
View File
@@ -14,14 +14,20 @@ class cloudfront_distributions_origin_traffic_encrypted(Check):
unencrypted_origins = []
for origin in distribution.origins:
if (
origin.origin_protocol_policy == ""
or origin.origin_protocol_policy == "http-only"
) or (
origin.origin_protocol_policy == "match-viewer"
and distribution.viewer_protocol_policy == "allow-all"
):
unencrypted_origins.append(origin.id)
if origin.s3_origin_config:
# For S3, only check the viewer protocol policy
if distribution.viewer_protocol_policy == "allow-all":
unencrypted_origins.append(origin.id)
else:
# Regular check for custom origins (ALB, EC2, API Gateway, etc.)
if (
origin.origin_protocol_policy == ""
or origin.origin_protocol_policy == "http-only"
) or (
origin.origin_protocol_policy == "match-viewer"
and distribution.viewer_protocol_policy == "allow-all"
):
unencrypted_origins.append(origin.id)
if unencrypted_origins:
report.status = "FAIL"
tests/providers/aws/services/cloudfront/cloudfront_distributions_origin_traffic_encrypted/cloudfront_distributions_origin_traffic_encrypted_test.py
+51
View File
@@ -225,3 +225,54 @@ class Test_cloudfront_distributions_origin_traffic_encrypted:
== f"CloudFront Distribution {DISTRIBUTION_ID} does encrypt traffic to custom origins."
)
assert result[0].resource_tags == []
def test_distribution_traffic_encrypted_with_s3_config(self):
cloudfront_client = mock.MagicMock
cloudfront_client.distributions = {
DISTRIBUTION_ID: Distribution(
arn=DISTRIBUTION_ARN,
id=DISTRIBUTION_ID,
region=REGION,
origins=[
Origin(
id="origin1",
domain_name="asdf.s3.us-east-1.amazonaws.com",
origin_protocol_policy="",
origin_ssl_protocols=[],
s3_origin_config={
"OriginAccessIdentity": "origin-access-identity/cloudfront/1234567890123456"
},
)
],
default_cache_config=DefaultCacheConfigBehaviour(
realtime_log_config_arn="",
viewer_protocol_policy=ViewerProtocolPolicy.redirect_to_https,
field_level_encryption_id="",
),
default_root_object="index.html",
viewer_protocol_policy="redirect-to-https",
)
}
with mock.patch(
"prowler.providers.aws.services.cloudfront.cloudfront_service.CloudFront",
new=cloudfront_client,
):
# Test Check
from prowler.providers.aws.services.cloudfront.cloudfront_distributions_origin_traffic_encrypted.cloudfront_distributions_origin_traffic_encrypted import (
cloudfront_distributions_origin_traffic_encrypted,
)
check = cloudfront_distributions_origin_traffic_encrypted()
result = check.execute()
assert len(result) == 1
assert result[0].region == REGION
assert result[0].resource_arn == DISTRIBUTION_ARN
assert result[0].resource_id == DISTRIBUTION_ID
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"CloudFront Distribution {DISTRIBUTION_ID} does encrypt traffic to custom origins."
)
assert result[0].resource_tags == []