feat(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs (#5494)

2026-10-09 21:14:22 +00:00 · 2024-11-04 10:20:35 -05:00
parent be523c11c8
commit e3104ae5ee
12 changed files with 1170 additions and 8 deletions
@@ -0,0 +1,206 @@
+from re import search
+from unittest import mock
+
+from boto3 import client
+from moto import mock_aws
+from moto.core.utils import unix_time_millis
+
+from tests.providers.aws.utils import (
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+
+class Test_cloudwatch_log_group_no_critical_pii_in_logs:
+    def test_cloudwatch_no_log_groups(self):
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            # We need to set this check to call _describe_log_groups
+            expected_checks=["cloudwatch_log_group_no_critical_pii_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs.logs_client",
+            new=Logs(aws_provider),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs import (
+                cloudwatch_log_group_no_critical_pii_in_logs,
+            )
+
+            check = cloudwatch_log_group_no_critical_pii_in_logs()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    @mock_aws
+    def test_cloudwatch_log_group_without_pii(self):
+        # Generate Logs Client
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        # Request Logs group
+        logs_client.create_log_group(logGroupName="test", tags={"test": "test"})
+        logs_client.create_log_stream(logGroupName="test", logStreamName="test stream")
+        logs_client.put_log_events(
+            logGroupName="test",
+            logStreamName="test stream",
+            logEvents=[
+                {
+                    "timestamp": int(unix_time_millis()),
+                    "message": "non sensitive message",
+                }
+            ],
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            # We need to set this check to call _describe_log_groups
+            expected_checks=["cloudwatch_log_group_no_critical_pii_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs.logs_client",
+            new=Logs(aws_provider),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs import (
+                cloudwatch_log_group_no_critical_pii_in_logs,
+            )
+
+            check = cloudwatch_log_group_no_critical_pii_in_logs()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended == "No critical PII found in test log group."
+            )
+            assert result[0].resource_id == "test"
+            assert (
+                result[0].resource_arn
+                == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:123456789012:log-group:test"
+            )
+            assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].resource_tags == [{"test": "test"}]
+
+    @mock_aws
+    def test_cloudwatch_log_group_with_pii(self):
+        # Generate Logs Client
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        # Request Logs group
+        logs_client.create_log_group(logGroupName="test", tags={"test": "test"})
+        logs_client.create_log_stream(logGroupName="test", logStreamName="test stream")
+        logs_client.put_log_events(
+            logGroupName="test",
+            logStreamName="test stream",
+            logEvents=[
+                {
+                    "timestamp": int(unix_time_millis()),
+                    "message": "Credit Card Number = 374752619478856",
+                }
+            ],
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            # We need to set this check to call _describe_log_groups
+            expected_checks=["cloudwatch_log_group_no_critical_pii_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs.logs_client",
+            new=Logs(aws_provider),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs import (
+                cloudwatch_log_group_no_critical_pii_in_logs,
+            )
+
+            check = cloudwatch_log_group_no_critical_pii_in_logs()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert search(
+                "Potential critical PII found in log group", result[0].status_extended
+            )
+            assert result[0].resource_id == "test"
+            assert (
+                result[0].resource_arn
+                == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:123456789012:log-group:test"
+            )
+            assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].resource_tags == [{"test": "test"}]
+
+    @mock_aws
+    def test_access_denied(self):
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import Logs
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            # We need to set this check to call _describe_log_groups
+            expected_checks=["cloudwatch_log_group_no_critical_pii_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs.logs_client",
+            new=Logs(aws_provider),
+        ) as logs_client:
+            # Test Check
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_group_no_critical_pii_in_logs.cloudwatch_log_group_no_critical_pii_in_logs import (
+                cloudwatch_log_group_no_critical_pii_in_logs,
+            )
+
+            logs_client.log_groups = None
+            check = cloudwatch_log_group_no_critical_pii_in_logs()
+            result = check.execute()
+
+            assert len(result) == 0