diff --git a/prowler/config/config.py b/prowler/config/config.py index 3975d59dec..c0ebf43d2e 100644 --- a/prowler/config/config.py +++ b/prowler/config/config.py @@ -8,6 +8,7 @@ import requests import yaml from prowler.lib.logger import logger +from prowler.providers.common.common import get_global_provider timestamp = datetime.today() timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc) @@ -84,15 +85,29 @@ def check_current_version(): return f"{prowler_version_string}" -def change_config_var(variable: str, value: str, audit_info): +# TODO: remove after changing tests for this function +# def change_config_var(variable: str, value: str, audit_info): +# try: +# if ( +# hasattr(audit_info, "audit_config") +# and audit_info.audit_config is not None +# and variable in audit_info.audit_config +# ): +# audit_info.audit_config[variable] = value +# return audit_info +# except Exception as error: +# logger.error( +# f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" +# ) + + +# TODO: revisit this function +def update_provider_config(variable: str, value: str): try: - if ( - hasattr(audit_info, "audit_config") - and audit_info.audit_config is not None - and variable in audit_info.audit_config - ): - audit_info.audit_config[variable] = value - return audit_info + global_provider = get_global_provider() + if global_provider.audit_config and variable in global_provider.audit_config: + global_provider.audit_config[variable] = value + except Exception as error: logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml index 277b919bd7..4483c5fd97 100644 --- a/prowler/config/config.yaml +++ b/prowler/config/config.yaml @@ -23,6 +23,7 @@ aws: # AWS EC2 Configuration # aws.ec2_elastic_ip_shodan + # TODO: create common config shodan_api_key: null # aws.ec2_securitygroup_with_many_ingress_egress_rules --> by default is 50 rules max_security_group_rules: 50 @@ -90,6 +91,7 @@ aws: azure: # Azure Network Configuration # azure.network_public_ip_shodan + # TODO: create common config shodan_api_key: null # Azure App Service @@ -113,14 +115,16 @@ kubernetes: # kubernetes.apiserver_audit_log_maxage_set audit_log_maxage: 30 # kubernetes.apiserver_strong_ciphers_only - apiserver_strong_ciphers: [ + apiserver_strong_ciphers: + [ "TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256", - ] + ] # Kubelet # kubernetes.kubelet_strong_ciphers_only - kubelet_strong_ciphers: [ + kubelet_strong_ciphers: + [ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", @@ -129,4 +133,4 @@ kubernetes: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", - ] + ] diff --git a/prowler/lib/cli/parser.py b/prowler/lib/cli/parser.py index 881c9395e0..7568f15f46 100644 --- a/prowler/lib/cli/parser.py +++ b/prowler/lib/cli/parser.py @@ -52,6 +52,7 @@ Detailed documentation at https://docs.prowler.cloud self.__init_list_checks_parser__() self.__init_config_parser__() self.__init_custom_checks_metadata_parser__() + self.__init_third_party_integrations_parser__() # Init Providers Arguments init_providers_parser(self) @@ -301,3 +302,16 @@ Detailed documentation at https://docs.prowler.cloud default=None, help="Path for the custom checks metadata YAML file. See example prowler/config/custom_checks_metadata_example.yaml for reference and format. See more in https://docs.prowler.cloud/en/latest/tutorials/custom-checks-metadata/", ) + + def __init_third_party_integrations_parser__(self): + third_party_subparser = self.common_providers_parser.add_argument_group( + "3rd Party Integrations" + ) + third_party_subparser.add_argument( + "-N", + "--shodan", + nargs="?", + default=None, + metavar="SHODAN_API_KEY", + help="Shodan API key.", + ) diff --git a/prowler/providers/aws/lib/arguments/arguments.py b/prowler/providers/aws/lib/arguments/arguments.py index a4ffc85ac9..97eb00fba9 100644 --- a/prowler/providers/aws/lib/arguments/arguments.py +++ b/prowler/providers/aws/lib/arguments/arguments.py @@ -119,14 +119,7 @@ def init_parser(self): default=None, help="Same as -B but do not use the assumed role credentials to put objects to the bucket, instead uses the initial credentials.", ) - aws_3rd_party_subparser = aws_parser.add_argument_group("3rd Party Integrations") - aws_3rd_party_subparser.add_argument( - "-N", - "--shodan", - nargs="?", - default=None, - help="Shodan API key used by check ec2_elastic_ip_shodan.", - ) + # Mute List mutelist_subparser = aws_parser.add_argument_group("Mute List") mutelist_subparser.add_argument( diff --git a/prowler/providers/aws/models.py b/prowler/providers/aws/models.py index 26bd6c4a5b..64cc0c9eba 100644 --- a/prowler/providers/aws/models.py +++ b/prowler/providers/aws/models.py @@ -86,13 +86,6 @@ class AWSOutputOptions(ProviderOutputOptions): # First call Provider_Output_Options init super().__init__(arguments, bulk_checks_metadata) - # Confire Shodan API - # TODO: review shodan for the new AWS provider - # if arguments.shodan: - # audit_info = change_config_var( - # "shodan_api_key", arguments.shodan, audit_info - # ) - # Check if custom output filename was input, if not, set the default if ( not hasattr(arguments, "output_filename") diff --git a/prowler/providers/azure/lib/arguments/arguments.py b/prowler/providers/azure/lib/arguments/arguments.py index 0be2629233..30cf7a33d7 100644 --- a/prowler/providers/azure/lib/arguments/arguments.py +++ b/prowler/providers/azure/lib/arguments/arguments.py @@ -52,17 +52,6 @@ def init_parser(self): type=validate_azure_region, help="Azure region from `az cloud list --output table`, by default AzureCloud", ) - # 3rd Party Integrations - azure_3rd_party_subparser = azure_parser.add_argument_group( - "3rd Party Integrations" - ) - azure_3rd_party_subparser.add_argument( - "-N", - "--shodan", - nargs="?", - default=None, - help="Shodan API key used by check network_public_ip_shodan.", - ) def validate_azure_region(region): diff --git a/prowler/providers/common/models.py b/prowler/providers/common/models.py index 8d4c8bb726..189ead571b 100644 --- a/prowler/providers/common/models.py +++ b/prowler/providers/common/models.py @@ -3,6 +3,8 @@ from os.path import isdir from pydantic import BaseModel +from prowler.config.config import update_provider_config + # TODO: include this for all the providers class Audit_Metadata(BaseModel): @@ -32,6 +34,12 @@ class ProviderOutputOptions: self.bulk_checks_metadata = bulk_checks_metadata self.only_logs = arguments.only_logs self.unix_timestamp = arguments.unix_timestamp + self.shodan_api_key = arguments.shodan + + # Shodan API Key + if arguments.shodan: + update_provider_config("shodan_api_key", arguments.shodan) + # Check output directory, if it is not created -> create it if arguments.output_directory: if not isdir(arguments.output_directory): diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py index 6477f62897..dfba43f969 100644 --- a/prowler/providers/common/provider.py +++ b/prowler/providers/common/provider.py @@ -12,6 +12,7 @@ from abc import ABC, abstractmethod # class Provider(metaclass=ProviderMeta): +# TODO: enforce audit_metadata for all the providers class Provider(ABC): @property diff --git a/tests/lib/cli/parser_test.py b/tests/lib/cli/parser_test.py index bbc11c95fa..fc09f8371b 100644 --- a/tests/lib/cli/parser_test.py +++ b/tests/lib/cli/parser_test.py @@ -967,6 +967,7 @@ class Test_Parser: parsed = self.parser.parse(command) assert parsed.output_bucket_no_assume == bucket + # TODO: change for the global parser def test_aws_parser_shodan_short(self): argument = "-N" shodan_api_key = str(uuid.uuid4()) @@ -974,6 +975,7 @@ class Test_Parser: parsed = self.parser.parse(command) assert parsed.shodan == shodan_api_key + # TODO: change for the global parser def test_aws_parser_shodan_long(self): argument = "--shodan" shodan_api_key = str(uuid.uuid4()) @@ -1079,6 +1081,7 @@ class Test_Parser: assert parsed.provider == "azure" assert parsed.az_cli_auth + # TODO: change for the global parser def test_azure_parser_shodan_short(self): argument = "-N" shodan_api_key = str(uuid.uuid4()) @@ -1086,6 +1089,7 @@ class Test_Parser: parsed = self.parser.parse(command) assert parsed.shodan == shodan_api_key + # TODO: change for the global parser def test_azure_parser_shodan_long(self): argument = "--shodan" shodan_api_key = str(uuid.uuid4())