From e108b2caedaeb8ece164f6ec9d9cd4a4c0c4b0d6 Mon Sep 17 00:00:00 2001 From: crr <42739372+55002ghals@users.noreply.github.com> Date: Tue, 24 Jun 2025 20:13:54 +0900 Subject: [PATCH] fix(aws): fix logic in VPC and ELBv2 checks (#8077) Co-authored-by: Sergio Garcia Co-authored-by: MrCloudSec --- prowler/CHANGELOG.md | 9 ++++++++- .../elbv2_desync_mitigation_mode.py | 2 +- .../vpc_endpoint_multi_az_enabled.py | 4 ++-- .../vpc_endpoint_multi_az_enabled_test.py | 4 ++-- 4 files changed, 13 insertions(+), 6 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 4ce0326c25..ec77a9392e 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -48,7 +48,14 @@ All notable changes to the **Prowler SDK** are documented in this file. --- -## [v5.7.5] (Prowler UNRELEASED) +## [v5.7.6] (Prowler UNRELEASED) + +### Fixed +- Fix logic in VPC and ELBv2 checks [(#8077)](https://github.com/prowler-cloud/prowler/pull/8077) + +--- + +## [v5.7.5] (Prowler 5.7.5) ### Fixed - Use unified timestamp for all requirements [(#8059)](https://github.com/prowler-cloud/prowler/pull/8059) diff --git a/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py b/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py index e0212c133e..a80b20d524 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py +++ b/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py @@ -12,7 +12,7 @@ class elbv2_desync_mitigation_mode(Check): report.status_extended = f"ELBv2 ALB {lb.name} is configured with correct desync mitigation mode." if ( lb.desync_mitigation_mode != "strictest" - or lb.desync_mitigation_mode != "defensive" + and lb.desync_mitigation_mode != "defensive" ): if lb.drop_invalid_header_fields == "false": report.status = "FAIL" diff --git a/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py b/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py index 2a79594172..203522c274 100644 --- a/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py +++ b/prowler/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled.py @@ -9,10 +9,10 @@ class vpc_endpoint_multi_az_enabled(Check): if endpoint.vpc_id in vpc_client.vpcs and endpoint.type == "Interface": report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint) report.status = "FAIL" - report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} has subnets in different AZs." + report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} does not have subnets in different AZs." if len(endpoint.subnet_ids) > 1: report.status = "PASS" - report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} does not have subnets in different AZs." + report.status_extended = f"VPC Endpoint {endpoint.id} in VPC {endpoint.vpc_id} has subnets in different AZs." findings.append(report) diff --git a/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py b/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py index 9a2e0f2b1b..61e40de6c0 100644 --- a/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py +++ b/tests/providers/aws/services/vpc/vpc_endpoint_multi_az_enabled/vpc_endpoint_multi_az_enabled_test.py @@ -87,7 +87,7 @@ class Test_vpc_endpoint_for_multi_az: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} has subnets in different AZs." + == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} does not have subnets in different AZs." ) assert ( result[0].resource_arn @@ -158,7 +158,7 @@ class Test_vpc_endpoint_for_multi_az: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} does not have subnets in different AZs." + == f"VPC Endpoint {vpc_endpoint['VpcEndpointId']} in VPC {vpc['VpcId']} has subnets in different AZs." ) assert ( result[0].resource_arn