From db1edf5ca79bf7776e7f3479e2ff5a944408388c Mon Sep 17 00:00:00 2001 From: Raajhesh Kannaa Chidambaram Date: Mon, 30 Mar 2026 02:59:29 -0400 Subject: [PATCH] feat(aws): add internet-exposed category to 13 checks (#10502) Co-authored-by: Raajhesh Kannaa Chidambaram <495042+raajheshkannaa@users.noreply.github.com> --- prowler/CHANGELOG.md | 1 + ...ront_distributions_s3_origin_access_control.metadata.json | 3 ++- ...ackages_external_public_publishing_disabled.metadata.json | 3 ++- .../ec2_securitygroup_default_restrict_traffic.metadata.json | 3 ++- .../efs_not_publicly_accessible.metadata.json | 3 ++- .../rds_instance_inside_vpc.metadata.json | 3 ++- .../sagemaker_models_network_isolation_enabled.metadata.json | 3 ++- .../sagemaker_models_vpc_settings_configured.metadata.json | 5 +++-- ...ker_training_jobs_network_isolation_enabled.metadata.json | 3 ++- ...maker_training_jobs_vpc_settings_configured.metadata.json | 3 ++- ...vanced_protection_in_associated_elastic_ips.metadata.json | 3 ++- ...vanced_protection_in_classic_load_balancers.metadata.json | 3 ++- ...nced_protection_in_cloudfront_distributions.metadata.json | 3 ++- ...peering_routing_tables_with_least_privilege.metadata.json | 3 ++- 14 files changed, 28 insertions(+), 14 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index f8bb5fcd85..a2fbe4fa8b 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -16,6 +16,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### 🔄 Changed +- Added `internet-exposed` category to 13 AWS checks (CloudFront, CodeArtifact, EC2, EFS, RDS, SageMaker, Shield, VPC) [(#10502)](https://github.com/prowler-cloud/prowler/pull/10502) - Minimum Python version from 3.9 to 3.10 and updated classifiers to reflect supported versions (3.10, 3.11, 3.12) [(#10464)](https://github.com/prowler-cloud/prowler/pull/10464) ### 🐞 Fixed diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_access_control/cloudfront_distributions_s3_origin_access_control.metadata.json b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_access_control/cloudfront_distributions_s3_origin_access_control.metadata.json index 140ae674b2..a0e8772842 100644 --- a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_access_control/cloudfront_distributions_s3_origin_access_control.metadata.json +++ b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_s3_origin_access_control/cloudfront_distributions_s3_origin_access_control.metadata.json @@ -35,7 +35,8 @@ } }, "Categories": [ - "trust-boundaries" + "trust-boundaries", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/codeartifact/codeartifact_packages_external_public_publishing_disabled/codeartifact_packages_external_public_publishing_disabled.metadata.json b/prowler/providers/aws/services/codeartifact/codeartifact_packages_external_public_publishing_disabled/codeartifact_packages_external_public_publishing_disabled.metadata.json index ff96202d30..3f985747be 100644 --- a/prowler/providers/aws/services/codeartifact/codeartifact_packages_external_public_publishing_disabled/codeartifact_packages_external_public_publishing_disabled.metadata.json +++ b/prowler/providers/aws/services/codeartifact/codeartifact_packages_external_public_publishing_disabled/codeartifact_packages_external_public_publishing_disabled.metadata.json @@ -34,7 +34,8 @@ } }, "Categories": [ - "software-supply-chain" + "software-supply-chain", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json index e790e88698..ceeca3ffe0 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.metadata.json @@ -33,7 +33,8 @@ } }, "Categories": [ - "trust-boundaries" + "trust-boundaries", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json index 7bc7c7dc7d..69ed055b3a 100644 --- a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json +++ b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json @@ -32,7 +32,8 @@ } }, "Categories": [ - "identity-access" + "identity-access", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json b/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json index c9f5fd2c96..1c33ebe34e 100644 --- a/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json @@ -33,7 +33,8 @@ } }, "Categories": [ - "trust-boundaries" + "trust-boundaries", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_models_network_isolation_enabled/sagemaker_models_network_isolation_enabled.metadata.json b/prowler/providers/aws/services/sagemaker/sagemaker_models_network_isolation_enabled/sagemaker_models_network_isolation_enabled.metadata.json index 662c26dc19..fc57b9243d 100644 --- a/prowler/providers/aws/services/sagemaker/sagemaker_models_network_isolation_enabled/sagemaker_models_network_isolation_enabled.metadata.json +++ b/prowler/providers/aws/services/sagemaker/sagemaker_models_network_isolation_enabled/sagemaker_models_network_isolation_enabled.metadata.json @@ -34,7 +34,8 @@ "Categories": [ "trust-boundaries", "container-security", - "gen-ai" + "gen-ai", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.metadata.json b/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.metadata.json index 355291570c..fc0eac0fc4 100644 --- a/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.metadata.json +++ b/prowler/providers/aws/services/sagemaker/sagemaker_models_vpc_settings_configured/sagemaker_models_vpc_settings_configured.metadata.json @@ -31,8 +31,9 @@ } }, "Categories": [ - "trust-boundaries", - "gen-ai" + "trust-boundaries", + "gen-ai", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_network_isolation_enabled/sagemaker_training_jobs_network_isolation_enabled.metadata.json b/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_network_isolation_enabled/sagemaker_training_jobs_network_isolation_enabled.metadata.json index 097678546f..249baa841a 100644 --- a/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_network_isolation_enabled/sagemaker_training_jobs_network_isolation_enabled.metadata.json +++ b/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_network_isolation_enabled/sagemaker_training_jobs_network_isolation_enabled.metadata.json @@ -33,7 +33,8 @@ }, "Categories": [ "trust-boundaries", - "gen-ai" + "gen-ai", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_vpc_settings_configured/sagemaker_training_jobs_vpc_settings_configured.metadata.json b/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_vpc_settings_configured/sagemaker_training_jobs_vpc_settings_configured.metadata.json index ba6fa127f0..1e95e50167 100644 --- a/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_vpc_settings_configured/sagemaker_training_jobs_vpc_settings_configured.metadata.json +++ b/prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_vpc_settings_configured/sagemaker_training_jobs_vpc_settings_configured.metadata.json @@ -33,7 +33,8 @@ }, "Categories": [ "trust-boundaries", - "gen-ai" + "gen-ai", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/shield/shield_advanced_protection_in_associated_elastic_ips/shield_advanced_protection_in_associated_elastic_ips.metadata.json b/prowler/providers/aws/services/shield/shield_advanced_protection_in_associated_elastic_ips/shield_advanced_protection_in_associated_elastic_ips.metadata.json index c365bf17f0..f3cfc6b991 100644 --- a/prowler/providers/aws/services/shield/shield_advanced_protection_in_associated_elastic_ips/shield_advanced_protection_in_associated_elastic_ips.metadata.json +++ b/prowler/providers/aws/services/shield/shield_advanced_protection_in_associated_elastic_ips/shield_advanced_protection_in_associated_elastic_ips.metadata.json @@ -32,7 +32,8 @@ } }, "Categories": [ - "resilience" + "resilience", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/shield/shield_advanced_protection_in_classic_load_balancers/shield_advanced_protection_in_classic_load_balancers.metadata.json b/prowler/providers/aws/services/shield/shield_advanced_protection_in_classic_load_balancers/shield_advanced_protection_in_classic_load_balancers.metadata.json index 2f60ba8226..87e5c39234 100644 --- a/prowler/providers/aws/services/shield/shield_advanced_protection_in_classic_load_balancers/shield_advanced_protection_in_classic_load_balancers.metadata.json +++ b/prowler/providers/aws/services/shield/shield_advanced_protection_in_classic_load_balancers/shield_advanced_protection_in_classic_load_balancers.metadata.json @@ -31,7 +31,8 @@ } }, "Categories": [ - "resilience" + "resilience", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/shield/shield_advanced_protection_in_cloudfront_distributions/shield_advanced_protection_in_cloudfront_distributions.metadata.json b/prowler/providers/aws/services/shield/shield_advanced_protection_in_cloudfront_distributions/shield_advanced_protection_in_cloudfront_distributions.metadata.json index 1a7d6996c3..d9c6fdbf85 100644 --- a/prowler/providers/aws/services/shield/shield_advanced_protection_in_cloudfront_distributions/shield_advanced_protection_in_cloudfront_distributions.metadata.json +++ b/prowler/providers/aws/services/shield/shield_advanced_protection_in_cloudfront_distributions/shield_advanced_protection_in_cloudfront_distributions.metadata.json @@ -31,7 +31,8 @@ } }, "Categories": [ - "resilience" + "resilience", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/vpc/vpc_peering_routing_tables_with_least_privilege/vpc_peering_routing_tables_with_least_privilege.metadata.json b/prowler/providers/aws/services/vpc/vpc_peering_routing_tables_with_least_privilege/vpc_peering_routing_tables_with_least_privilege.metadata.json index 2e6891f377..442f60cb7e 100644 --- a/prowler/providers/aws/services/vpc/vpc_peering_routing_tables_with_least_privilege/vpc_peering_routing_tables_with_least_privilege.metadata.json +++ b/prowler/providers/aws/services/vpc/vpc_peering_routing_tables_with_least_privilege/vpc_peering_routing_tables_with_least_privilege.metadata.json @@ -34,7 +34,8 @@ } }, "Categories": [ - "trust-boundaries" + "trust-boundaries", + "internet-exposed" ], "DependsOn": [], "RelatedTo": [],