From ded3a0fcae3c52f6e7857844f2fd7d528fa1e268 Mon Sep 17 00:00:00 2001 From: "Andoni A." <14891798+andoniaf@users.noreply.github.com> Date: Tue, 8 Apr 2025 11:23:05 +0200 Subject: [PATCH] fix(emr): resource arn should be the account --- ...er_account_public_block_enabled.metadata.json | 2 +- .../emr_cluster_account_public_block_enabled.py | 2 +- .../providers/aws/services/emr/emr_service.py | 3 +++ ..._cluster_account_public_block_enabled_test.py | 16 ++++++++++++++++ 4 files changed, 21 insertions(+), 2 deletions(-) diff --git a/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.metadata.json b/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.metadata.json index 14616f99c2..791034593c 100644 --- a/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.metadata.json +++ b/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.metadata.json @@ -5,7 +5,7 @@ "CheckType": [], "ServiceName": "emr", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:emr:region:account-id", + "ResourceIdTemplate": "arn:partition:emr:region:account-id", "Severity": "high", "ResourceType": "AwsAccount", "Description": "EMR Account Public Access Block enabled.", diff --git a/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.py b/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.py index c3029e81e3..5548460944 100644 --- a/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.py +++ b/prowler/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled.py @@ -12,7 +12,7 @@ class emr_cluster_account_public_block_enabled(Check): ) report.region = region report.resource_id = emr_client.audited_account - report.resource_arn = emr_client._get_cluster_arn_template(region) + report.resource_arn = emr_client._get_account_arn_template(region) if emr_client.block_public_access_configuration[ region ].block_public_security_group_rules: diff --git a/prowler/providers/aws/services/emr/emr_service.py b/prowler/providers/aws/services/emr/emr_service.py index e1fb7c15da..8e87bfc44d 100644 --- a/prowler/providers/aws/services/emr/emr_service.py +++ b/prowler/providers/aws/services/emr/emr_service.py @@ -22,6 +22,9 @@ class EMR(AWSService): def _get_cluster_arn_template(self, region): return f"arn:{self.audited_partition}:elasticmapreduce:{region}:{self.audited_account}:cluster" + def _get_account_arn_template(self, region): + return f"arn:{self.audited_partition}:elasticmapreduce:{region}:{self.audited_account}:account" + def _list_clusters(self, regional_client): logger.info("EMR - Listing Clusters...") try: diff --git a/tests/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled_test.py b/tests/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled_test.py index 36ca65b6f9..67b63ff227 100644 --- a/tests/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled_test.py +++ b/tests/providers/aws/services/emr/emr_cluster_account_public_block_enabled/emr_cluster_account_public_block_enabled_test.py @@ -18,9 +18,13 @@ class Test_emr_cluster_account_public_block_enabled: emr_client.region = AWS_REGION_EU_WEST_1 emr_client.audited_partition = "aws" emr_client.cluster_arn_template = f"arn:{emr_client.audited_partition}:elasticmapreduce:{emr_client.region}:{emr_client.audited_account}:cluster" + emr_client.account_arn_template = f"arn:{emr_client.audited_partition}:elasticmapreduce:{emr_client.region}:{emr_client.audited_account}:account" emr_client._get_cluster_arn_template = mock.MagicMock( return_value=emr_client.cluster_arn_template ) + emr_client._get_account_arn_template = mock.MagicMock( + return_value=emr_client.account_arn_template + ) with mock.patch( "prowler.providers.aws.services.emr.emr_service.EMR", new=emr_client, @@ -36,6 +40,10 @@ class Test_emr_cluster_account_public_block_enabled: assert len(result) == 1 assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_id == AWS_ACCOUNT_NUMBER + assert ( + result[0].resource_arn + == f"arn:aws:elasticmapreduce:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" + ) assert result[0].status == "PASS" assert ( result[0].status_extended @@ -53,9 +61,13 @@ class Test_emr_cluster_account_public_block_enabled: emr_client.region = AWS_REGION_EU_WEST_1 emr_client.audited_partition = "aws" emr_client.cluster_arn_template = f"arn:{emr_client.audited_partition}:elasticmapreduce:{emr_client.region}:{emr_client.audited_account}:cluster" + emr_client.account_arn_template = f"arn:{emr_client.audited_partition}:elasticmapreduce:{emr_client.region}:{emr_client.audited_account}:account" emr_client._get_cluster_arn_template = mock.MagicMock( return_value=emr_client.cluster_arn_template ) + emr_client._get_account_arn_template = mock.MagicMock( + return_value=emr_client.account_arn_template + ) with mock.patch( "prowler.providers.aws.services.emr.emr_service.EMR", new=emr_client, @@ -71,6 +83,10 @@ class Test_emr_cluster_account_public_block_enabled: assert len(result) == 1 assert result[0].region == AWS_REGION_EU_WEST_1 assert result[0].resource_id == AWS_ACCOUNT_NUMBER + assert ( + result[0].resource_arn + == f"arn:aws:elasticmapreduce:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:account" + ) assert result[0].status == "FAIL" assert ( result[0].status_extended