diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_local_infile_flag/cloudsql_instance_mysql_local_infile_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_local_infile_flag/cloudsql_instance_mysql_local_infile_flag.py index d77c989715..1419b9afac 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_local_infile_flag/cloudsql_instance_mysql_local_infile_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_local_infile_flag/cloudsql_instance_mysql_local_infile_flag.py @@ -15,7 +15,10 @@ class cloudsql_instance_mysql_local_infile_flag(Check): report.status = "FAIL" report.status_extended = f"MySQL Instance {instance.name} does not have 'local_infile' flag set to 'off'." for flag in instance.flags: - if flag["name"] == "local_infile" and flag["value"] == "off": + if ( + flag.get("name", "") == "local_infile" + and flag.get("value", "on") == "off" + ): report.status = "PASS" report.status_extended = f"MySQL Instance {instance.name} has 'local_infile' flag set to 'off'." break diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_skip_show_database_flag/cloudsql_instance_mysql_skip_show_database_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_skip_show_database_flag/cloudsql_instance_mysql_skip_show_database_flag.py index e1070cbc93..baae0329f9 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_skip_show_database_flag/cloudsql_instance_mysql_skip_show_database_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_mysql_skip_show_database_flag/cloudsql_instance_mysql_skip_show_database_flag.py @@ -15,7 +15,10 @@ class cloudsql_instance_mysql_skip_show_database_flag(Check): report.status = "FAIL" report.status_extended = f"MySQL Instance {instance.name} does not have 'skip_show_database' flag set to 'on'." for flag in instance.flags: - if flag["name"] == "skip_show_database" and flag["value"] == "on": + if ( + flag.get("name", "") == "skip_show_database" + and flag.get("value", "off") == "on" + ): report.status = "PASS" report.status_extended = f"MySQL Instance {instance.name} has 'skip_show_database' flag set to 'on'." break diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_enable_pgaudit_flag/cloudsql_instance_postgres_enable_pgaudit_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_enable_pgaudit_flag/cloudsql_instance_postgres_enable_pgaudit_flag.py index d894365018..eb77c8f259 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_enable_pgaudit_flag/cloudsql_instance_postgres_enable_pgaudit_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_enable_pgaudit_flag/cloudsql_instance_postgres_enable_pgaudit_flag.py @@ -16,8 +16,8 @@ class cloudsql_instance_postgres_enable_pgaudit_flag(Check): report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'cloudsql.enable_pgaudit' flag set to 'on'." for flag in instance.flags: if ( - flag["name"] == "cloudsql.enable_pgaudit" - and flag["value"] == "on" + flag.get("name", "") == "cloudsql.enable_pgaudit" + and flag.get("value", "off") == "on" ): report.status = "PASS" report.status_extended = f"PostgreSQL Instance {instance.name} has 'cloudsql.enable_pgaudit' flag set to 'on'." diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_connections_flag/cloudsql_instance_postgres_log_connections_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_connections_flag/cloudsql_instance_postgres_log_connections_flag.py index 63e083e40a..b601f63a01 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_connections_flag/cloudsql_instance_postgres_log_connections_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_connections_flag/cloudsql_instance_postgres_log_connections_flag.py @@ -15,7 +15,10 @@ class cloudsql_instance_postgres_log_connections_flag(Check): report.status = "FAIL" report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_connections' flag set to 'on'." for flag in instance.flags: - if flag["name"] == "log_connections" and flag["value"] == "on": + if ( + flag.get("name", "") == "log_connections" + and flag.get("value", "off") == "on" + ): report.status = "PASS" report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_connections' flag set to 'on'." break diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_disconnections_flag/cloudsql_instance_postgres_log_disconnections_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_disconnections_flag/cloudsql_instance_postgres_log_disconnections_flag.py index cc5078f2d4..21e3b0ba80 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_disconnections_flag/cloudsql_instance_postgres_log_disconnections_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_disconnections_flag/cloudsql_instance_postgres_log_disconnections_flag.py @@ -15,7 +15,10 @@ class cloudsql_instance_postgres_log_disconnections_flag(Check): report.status = "FAIL" report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_disconnections' flag set to 'on'." for flag in instance.flags: - if flag["name"] == "log_disconnections" and flag["value"] == "on": + if ( + flag.get("name", "") == "log_disconnections" + and flag.get("value", "off") == "on" + ): report.status = "PASS" report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_disconnections' flag set to 'on'." break diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag.py index c593ee03e1..1fdbf6fa00 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag.py @@ -12,15 +12,15 @@ class cloudsql_instance_postgres_log_error_verbosity_flag(Check): report.resource_id = instance.name report.resource_name = instance.name report.location = instance.region - report.status = "FAIL" - report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_error_verbosity' flag set to 'default'." + report.status = "PASS" + report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_error_verbosity' flag set to 'default'." for flag in instance.flags: if ( - flag["name"] == "log_error_verbosity" - and flag["value"] == "default" + flag.get("name", "") == "log_error_verbosity" + and flag.get("value", "default") != "default" ): - report.status = "PASS" - report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_error_verbosity' flag set to 'default'." + report.status = "FAIL" + report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_error_verbosity' flag set to 'default'." break findings.append(report) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag.py index 093a9d1e6a..b72c3cc71f 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag.py @@ -12,15 +12,15 @@ class cloudsql_instance_postgres_log_min_duration_statement_flag(Check): report.resource_id = instance.name report.resource_name = instance.name report.location = instance.region - report.status = "FAIL" - report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_duration_statement' flag set to '-1'." + report.status = "PASS" + report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_duration_statement' flag set to '-1'." for flag in instance.flags: if ( - flag["name"] == "log_min_duration_statement" - and flag["value"] == "-1" + flag.get("name", "") == "log_min_duration_statement" + and flag.get("value", "-1") != "-1" ): - report.status = "PASS" - report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_duration_statement' flag set to '-1'." + report.status = "FAIL" + report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_duration_statement' flag set to '-1'." break findings.append(report) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag.py index 1c2a0d5255..b002a0ad3f 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag.py @@ -13,15 +13,17 @@ class cloudsql_instance_postgres_log_min_error_statement_flag(Check): report.resource_id = instance.name report.resource_name = instance.name report.location = instance.region - report.status = "FAIL" - report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_error_statement' flag set minimum to '{desired_log_min_error_statement}'." + report.status = "PASS" + report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_error_statement' flag set minimum to '{desired_log_min_error_statement}'." + for flag in instance.flags: if ( - flag["name"] == "log_min_error_statement" - and flag["value"] == desired_log_min_error_statement + flag.get("name", "") == "log_min_error_statement" + and flag.get("value", "error") + != desired_log_min_error_statement ): - report.status = "PASS" - report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_error_statement' flag set minimum to '{desired_log_min_error_statement}'." + report.status = "FAIL" + report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_error_statement' flag set minimum to '{desired_log_min_error_statement}'." break findings.append(report) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py index 6a5d765496..e8aa126c9a 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_messages_flag/cloudsql_instance_postgres_log_min_messages_flag.py @@ -17,8 +17,8 @@ class cloudsql_instance_postgres_log_min_messages_flag(Check): report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_min_messages' flag set minimum to '{desired_log_min_messages}'." for flag in instance.flags: if ( - flag["name"] == "log_min_messages" - and flag["value"] == desired_log_min_messages + flag.get("name", "") == "log_min_messages" + and flag.get("value", "warning") == desired_log_min_messages ): report.status = "PASS" report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_min_messages' flag set minimum to '{desired_log_min_messages}'." diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_statement_flag/cloudsql_instance_postgres_log_statement_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_statement_flag/cloudsql_instance_postgres_log_statement_flag.py index d57d348b96..37e76fecd9 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_statement_flag/cloudsql_instance_postgres_log_statement_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_statement_flag/cloudsql_instance_postgres_log_statement_flag.py @@ -17,8 +17,8 @@ class cloudsql_instance_postgres_log_statement_flag(Check): report.status_extended = f"PostgreSQL Instance {instance.name} does not have 'log_statement' flag set to '{desired_log_statement}'." for flag in instance.flags: if ( - flag["name"] == "log_statement" - and flag["value"] == desired_log_statement + flag.get("name", "") == "log_statement" + and flag.get("value", "none") == desired_log_statement ): report.status = "PASS" report.status_extended = f"PostgreSQL Instance {instance.name} has 'log_statement' flag set to '{desired_log_statement}'." diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag.py index 136a9d119e..eae90d2b0e 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag.py @@ -16,8 +16,8 @@ class cloudsql_instance_sqlserver_contained_database_authentication_flag(Check): report.status_extended = f"SQL Server Instance {instance.name} has 'contained database authentication' flag set to 'off'." for flag in instance.flags: if ( - flag["name"] == "contained database authentication" - and flag["value"] == "on" + flag.get("name", "") == "contained database authentication" + and flag.get("value", "off") == "on" ): report.status = "FAIL" report.status_extended = f"SQL Server Instance {instance.name} has 'contained database authentication' flag set to 'on'." diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag.py index 98e99bcab3..96e85e294a 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag.py @@ -13,11 +13,14 @@ class cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag(Check): report.resource_name = instance.name report.location = instance.region report.status = "PASS" - report.status_extended = f"SQL Server Instance {instance.name} has 'cross db ownership' flag set to 'off'." + report.status_extended = f"SQL Server Instance {instance.name} has 'cross db ownership chaining' flag set to 'off'." for flag in instance.flags: - if flag["name"] == "cross db ownership" and flag["value"] == "on": + if ( + flag.get("name", "") == "cross db ownership chaining" + and flag.get("value", "off") == "on" + ): report.status = "FAIL" - report.status_extended = f"SQL Server Instance {instance.name} does not have 'cross db ownership' flag set to 'off'." + report.status_extended = f"SQL Server Instance {instance.name} does not have 'cross db ownership chaining' flag set to 'off'." break findings.append(report) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag.py index 1020a03281..573634344d 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag.py @@ -16,8 +16,8 @@ class cloudsql_instance_sqlserver_external_scripts_enabled_flag(Check): report.status_extended = f"SQL Server Instance {instance.name} has 'external scripts enabled' flag set to 'off'." for flag in instance.flags: if ( - flag["name"] == "external scripts enabled" - and flag["value"] == "on" + flag.get("name", "") == "external scripts enabled" + and flag.get("value", "off") == "on" ): report.status = "FAIL" report.status_extended = f"SQL Server Instance {instance.name} does not have 'external scripts enabled' flag set to 'off'." diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag.py index 5d29341af2..7f51d18f61 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag.py @@ -12,12 +12,15 @@ class cloudsql_instance_sqlserver_remote_access_flag(Check): report.resource_id = instance.name report.resource_name = instance.name report.location = instance.region - report.status = "PASS" - report.status_extended = f"SQL Server Instance {instance.name} does not have 'remote access' flag set to 'on'." + report.status = "FAIL" + report.status_extended = f"SQL Server Instance {instance.name} has 'remote access' flag set to 'on'." for flag in instance.flags: - if flag["name"] == "remote access" and flag["value"] == "on": - report.status = "FAIL" - report.status_extended = f"SQL Server Instance {instance.name} has 'remote access' flag set to 'on'." + if ( + flag.get("name", "") == "remote access" + and flag.get("value", "on") != "on" + ): + report.status = "PASS" + report.status_extended = f"SQL Server Instance {instance.name} does not have 'remote access' flag set to 'on'." break findings.append(report) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag.py index 164f8e3831..39e34d17ff 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag.py @@ -12,12 +12,16 @@ class cloudsql_instance_sqlserver_trace_flag(Check): report.resource_id = instance.name report.resource_name = instance.name report.location = instance.region - report.status = "PASS" - report.status_extended = f"SQL Server Instance {instance.name} has '3625 (trace flag)' flag set to 'on'." + report.status = "FAIL" + report.status_extended = f"SQL Server Instance {instance.name} has '3625 (trace flag)' flag set to 'off'." + for flag in instance.flags: - if flag["name"] == "3625" and flag["value"] == "off": - report.status = "FAIL" - report.status_extended = f"SQL Server Instance {instance.name} has '3625 (trace flag)' flag set to 'off'." + if ( + flag.get("name", "") == "3625" + and flag.get("value", "off") == "on" + ): + report.status = "PASS" + report.status_extended = f"SQL Server Instance {instance.name} has '3625 (trace flag)' flag set to 'on'." break findings.append(report) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag.py index 82ae6a74f2..96bc3bce7e 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag.py @@ -12,12 +12,16 @@ class cloudsql_instance_sqlserver_user_connections_flag(Check): report.resource_id = instance.name report.resource_name = instance.name report.location = instance.region - report.status = "FAIL" - report.status_extended = f"SQL Server Instance {instance.name} does not have 'user connections' flag set to '0'." + report.status = "PASS" + report.status_extended = f"SQL Server Instance {instance.name} has 'user connections' flag set to '0'." + for flag in instance.flags: - if flag["name"] == "user connections" and flag["value"] == "0": - report.status = "PASS" - report.status_extended = f"SQL Server Instance {instance.name} has 'user connections' flag set to '0'." + if ( + flag.get("name", "") == "user connections" + and flag.get("value", "0") != "0" + ): + report.status = "FAIL" + report.status_extended = f"SQL Server Instance {instance.name} does not have 'user connections' flag set to '0'." break findings.append(report) diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag.py index 752f1838d5..eb6f905279 100644 --- a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag.py +++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag.py @@ -15,7 +15,10 @@ class cloudsql_instance_sqlserver_user_options_flag(Check): report.status = "PASS" report.status_extended = f"SQL Server Instance {instance.name} does not have 'user options' flag set." for flag in instance.flags: - if flag["name"] == "user options" and flag["value"] != "": + if ( + flag.get("name", "") == "user options" + and flag.get("value", "") != "" + ): report.status = "FAIL" report.status_extended = f"SQL Server Instance {instance.name} has 'user options' flag set." break diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag_test.py index ee0f26420f..da9e61343a 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_error_verbosity_flag/cloudsql_instance_postgres_log_error_verbosity_flag_test.py @@ -99,10 +99,10 @@ class Test_cloudsql_instance_postgres_log_error_verbosity_flag: check = cloudsql_instance_postgres_log_error_verbosity_flag() result = check.execute() assert len(result) == 1 - assert result[0].status == "FAIL" + assert result[0].status == "PASS" assert ( result[0].status_extended - == "PostgreSQL Instance instance1 does not have 'log_error_verbosity' flag set to 'default'." + == "PostgreSQL Instance instance1 has 'log_error_verbosity' flag set to 'default'." ) assert result[0].resource_id == "instance1" assert result[0].resource_name == "instance1" diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag_test.py index fc7f66b024..b009bacde2 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_duration_statement_flag/cloudsql_instance_postgres_log_min_duration_statement_flag_test.py @@ -99,10 +99,10 @@ class Test_cloudsql_instance_postgres_log_min_duration_statement_flag: check = cloudsql_instance_postgres_log_min_duration_statement_flag() result = check.execute() assert len(result) == 1 - assert result[0].status == "FAIL" + assert result[0].status == "PASS" assert ( result[0].status_extended - == "PostgreSQL Instance instance1 does not have 'log_min_duration_statement' flag set to '-1'." + == "PostgreSQL Instance instance1 has 'log_min_duration_statement' flag set to '-1'." ) assert result[0].resource_id == "instance1" assert result[0].resource_name == "instance1" diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag_test.py index 08741bb348..2abe0ded1a 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_postgres_log_min_error_statement_flag/cloudsql_instance_postgres_log_min_error_statement_flag_test.py @@ -99,10 +99,10 @@ class Test_cloudsql_instance_postgres_log_min_error_statement_flag: check = cloudsql_instance_postgres_log_min_error_statement_flag() result = check.execute() assert len(result) == 1 - assert result[0].status == "FAIL" + assert result[0].status == "PASS" assert ( result[0].status_extended - == "PostgreSQL Instance instance1 does not have 'log_min_error_statement' flag set minimum to 'error'." + == "PostgreSQL Instance instance1 has 'log_min_error_statement' flag set minimum to 'error'." ) assert result[0].resource_id == "instance1" assert result[0].resource_name == "instance1" diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag_test.py index 04c0335d14..b8b429a4b9 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_contained_database_authentication_flag/cloudsql_instance_sqlserver_contained_database_authentication_flag_test.py @@ -64,6 +64,51 @@ class Test_cloudsql_instance_sqlserver_contained_database_authentication_flag: result = check.execute() assert len(result) == 0 + def test_cloudsql_instance_no_flags(self): + cloudsql_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_contained_database_authentication_flag.cloudsql_instance_sqlserver_contained_database_authentication_flag.cloudsql_client", + new=cloudsql_client, + ): + from prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_contained_database_authentication_flag.cloudsql_instance_sqlserver_contained_database_authentication_flag import ( + cloudsql_instance_sqlserver_contained_database_authentication_flag, + ) + from prowler.providers.gcp.services.cloudsql.cloudsql_service import ( + Instance, + ) + + cloudsql_client.instances = [ + Instance( + name="instance1", + version="SQLSERVER_2019_STANDARD", + ip_addresses=[], + region=GCP_EU1_LOCATION, + public_ip=False, + ssl=False, + automated_backups=True, + authorized_networks=[], + flags=[], + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudsql_instance_sqlserver_contained_database_authentication_flag() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "SQL Server Instance instance1 has 'contained database authentication' flag set to 'off'." + ) + assert result[0].resource_id == "instance1" + assert result[0].resource_name == "instance1" + assert result[0].location == GCP_EU1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_instance_contained_database_authentication_flag_on(self): cloudsql_client = mock.MagicMock diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag_test.py index a90703647d..998933e4a7 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag/cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag_test.py @@ -64,6 +64,51 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag: result = check.execute() assert len(result) == 0 + def test_cloudsql_instance_no_flags(self): + cloudsql_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag.cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag.cloudsql_client", + new=cloudsql_client, + ): + from prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag.cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag import ( + cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag, + ) + from prowler.providers.gcp.services.cloudsql.cloudsql_service import ( + Instance, + ) + + cloudsql_client.instances = [ + Instance( + name="instance1", + version="SQLSERVER_2019_STANDARD", + ip_addresses=[], + region=GCP_EU1_LOCATION, + public_ip=False, + ssl=False, + automated_backups=True, + authorized_networks=[], + flags=[], + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "SQL Server Instance instance1 has 'cross db ownership chaining' flag set to 'off'." + ) + assert result[0].resource_id == "instance1" + assert result[0].resource_name == "instance1" + assert result[0].location == GCP_EU1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_instance_cross_db_ownership_flag_on(self): cloudsql_client = mock.MagicMock @@ -91,7 +136,7 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag: ssl=False, automated_backups=True, authorized_networks=[], - flags=[{"name": "cross db ownership", "value": "on"}], + flags=[{"name": "cross db ownership chaining", "value": "on"}], project_id=GCP_PROJECT_ID, ) ] @@ -102,7 +147,7 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag: assert result[0].status == "FAIL" assert ( result[0].status_extended - == "SQL Server Instance instance1 does not have 'cross db ownership' flag set to 'off'." + == "SQL Server Instance instance1 does not have 'cross db ownership chaining' flag set to 'off'." ) assert result[0].resource_id == "instance1" assert result[0].resource_name == "instance1" @@ -136,7 +181,7 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag: ssl=False, automated_backups=True, authorized_networks=[], - flags=[{"name": "cross db ownership", "value": "off"}], + flags=[{"name": "cross db ownership chaining", "value": "off"}], project_id=GCP_PROJECT_ID, ) ] @@ -147,7 +192,7 @@ class Test_cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag: assert result[0].status == "PASS" assert ( result[0].status_extended - == "SQL Server Instance instance1 has 'cross db ownership' flag set to 'off'." + == "SQL Server Instance instance1 has 'cross db ownership chaining' flag set to 'off'." ) assert result[0].resource_id == "instance1" assert result[0].resource_name == "instance1" diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag_test.py index c777e7ab28..e7b2035361 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_external_scripts_enabled_flag/cloudsql_instance_sqlserver_external_scripts_enabled_flag_test.py @@ -64,6 +64,51 @@ class Test_cloudsql_instance_sqlserver_external_scripts_enabled_flag: result = check.execute() assert len(result) == 0 + def test_cloudsql_sqlserver_instance_no_flags(self): + cloudsql_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_external_scripts_enabled_flag.cloudsql_instance_sqlserver_external_scripts_enabled_flag.cloudsql_client", + new=cloudsql_client, + ): + from prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_external_scripts_enabled_flag.cloudsql_instance_sqlserver_external_scripts_enabled_flag import ( + cloudsql_instance_sqlserver_external_scripts_enabled_flag, + ) + from prowler.providers.gcp.services.cloudsql.cloudsql_service import ( + Instance, + ) + + cloudsql_client.instances = [ + Instance( + name="instance1", + version="SQLSERVER_2019", + ip_addresses=[], + region=GCP_EU1_LOCATION, + public_ip=False, + ssl=False, + automated_backups=True, + authorized_networks=[], + flags=[], + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudsql_instance_sqlserver_external_scripts_enabled_flag() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "SQL Server Instance instance1 has 'external scripts enabled' flag set to 'off'." + ) + assert result[0].resource_id == "instance1" + assert result[0].resource_name == "instance1" + assert result[0].location == GCP_EU1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_sqlserver_instance_external_scripts_enabled_flag_on(self): cloudsql_client = mock.MagicMock diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag_test.py index d16a929afd..8f3a9490cb 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_remote_access_flag/cloudsql_instance_sqlserver_remote_access_flag_test.py @@ -64,6 +64,51 @@ class Test_cloudsql_instance_sqlserver_remote_access_flag: result = check.execute() assert len(result) == 0 + def test_cloudsql_instance_no_flags(self): + cloudsql_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_remote_access_flag.cloudsql_instance_sqlserver_remote_access_flag.cloudsql_client", + new=cloudsql_client, + ): + from prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_remote_access_flag.cloudsql_instance_sqlserver_remote_access_flag import ( + cloudsql_instance_sqlserver_remote_access_flag, + ) + from prowler.providers.gcp.services.cloudsql.cloudsql_service import ( + Instance, + ) + + cloudsql_client.instances = [ + Instance( + name="instance1", + version="SQLSERVER_2019", + ip_addresses=[], + region=GCP_EU1_LOCATION, + public_ip=False, + ssl=False, + automated_backups=True, + authorized_networks=[], + flags=[], + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudsql_instance_sqlserver_remote_access_flag() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "SQL Server Instance instance1 has 'remote access' flag set to 'on'." + ) + assert result[0].resource_id == "instance1" + assert result[0].resource_name == "instance1" + assert result[0].location == GCP_EU1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_instance_remote_access_flag_on(self): cloudsql_client = mock.MagicMock diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag_test.py index a4c2b388fd..3088c8e2dd 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_trace_flag/cloudsql_instance_sqlserver_trace_flag_test.py @@ -64,6 +64,51 @@ class Test_cloudsql_instance_sqlserver_trace_flag: result = check.execute() assert len(result) == 0 + def test_cloudsql_instance_no_flags(self): + cloudsql_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_trace_flag.cloudsql_instance_sqlserver_trace_flag.cloudsql_client", + new=cloudsql_client, + ): + from prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_trace_flag.cloudsql_instance_sqlserver_trace_flag import ( + cloudsql_instance_sqlserver_trace_flag, + ) + from prowler.providers.gcp.services.cloudsql.cloudsql_service import ( + Instance, + ) + + cloudsql_client.instances = [ + Instance( + name="instance1", + version="SQLSERVER_2019", + ip_addresses=[], + region=GCP_EU1_LOCATION, + public_ip=False, + ssl=False, + automated_backups=True, + authorized_networks=[], + flags=[], + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudsql_instance_sqlserver_trace_flag() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "SQL Server Instance instance1 has '3625 (trace flag)' flag set to 'off'." + ) + assert result[0].resource_id == "instance1" + assert result[0].resource_name == "instance1" + assert result[0].location == GCP_EU1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_instance_trace_flag_off(self): cloudsql_client = mock.MagicMock diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag_test.py index 60449ba8f4..55143a51e1 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_connections_flag/cloudsql_instance_sqlserver_user_connections_flag_test.py @@ -64,6 +64,51 @@ class Test_cloudsql_instance_sqlserver_user_connections_flag: result = check.execute() assert len(result) == 0 + def test_cloudsql_sqlserver_instance_no_flags(self): + cloudsql_client = mock.MagicMock + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), mock.patch( + "prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_user_connections_flag.cloudsql_instance_sqlserver_user_connections_flag.cloudsql_client", + new=cloudsql_client, + ): + from prowler.providers.gcp.services.cloudsql.cloudsql_instance_sqlserver_user_connections_flag.cloudsql_instance_sqlserver_user_connections_flag import ( + cloudsql_instance_sqlserver_user_connections_flag, + ) + from prowler.providers.gcp.services.cloudsql.cloudsql_service import ( + Instance, + ) + + cloudsql_client.instances = [ + Instance( + name="instance1", + version="SQLSERVER_2019", + ip_addresses=[], + region=GCP_EU1_LOCATION, + public_ip=False, + ssl=False, + automated_backups=True, + authorized_networks=[], + flags=[], + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudsql_instance_sqlserver_user_connections_flag() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "SQL Server Instance instance1 has 'user connections' flag set to '0'." + ) + assert result[0].resource_id == "instance1" + assert result[0].resource_name == "instance1" + assert result[0].location == GCP_EU1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + def test_cloudsql_sqlserver_instance_user_connections_flag_off(self): cloudsql_client = mock.MagicMock diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag_test.py index 4eca982f75..30769cb357 100644 --- a/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag_test.py +++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_sqlserver_user_options_flag/cloudsql_instance_sqlserver_user_options_flag_test.py @@ -181,7 +181,7 @@ class Test_cloudsql_instance_sqlserver_user_options_flag: ssl=False, automated_backups=True, authorized_networks=[], - flags=[{"name": "user options", "value": "some_value"}], + flags=[{"name": "user options", "value": "0"}], project_id=GCP_PROJECT_ID, ) ]