fix(network): allow 0 as compliant value (#7926)

Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>

prowler/CHANGELOG.md

@@ -27,17 +27,16 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `storage_ensure_file_shares_soft_delete_is_enabled` check for Azure provider [(#7966)](https://github.com/prowler-cloud/prowler/pull/7966)
 - Make `validate_mutelist` method static inside `Mutelist` class [(#7811)](https://github.com/prowler-cloud/prowler/pull/7811)
 
-### Fixed
-- Github provider to `usage` section of `prowler -h`: [(#7906)](https://github.com/prowler-cloud/prowler/pull/7906)
-
 ---
-## [v5.7.5] (Prowler v5.7.5)
+## [v5.7.5] (Prowler UNRELEASED)
 
 ### Fixed
 - `apiserver_strong_ciphers_only` check for K8S provider [(#7952)](https://github.com/prowler-cloud/prowler/pull/7952)
 - Handle `0` at the start and end of account uids in Prowler Dashboard [(#7955)](https://github.com/prowler-cloud/prowler/pull/7955)
 - Typo in PCI 4.0 for K8S provider [(#7971)](https://github.com/prowler-cloud/prowler/pull/7971)
 - AWS root credentials checks always verify if root credentials are enabled [(#7967)](https://github.com/prowler-cloud/prowler/pull/7967)
+- Github provider to `usage` section of `prowler -h`: [(#7906)](https://github.com/prowler-cloud/prowler/pull/7906)
+- `network_flow_log_more_than_90_days` check to pass when retention policy is 0 days [(#7975)](https://github.com/prowler-cloud/prowler/pull/7975)
 - Update SDK Azure call for ftps_state in the App Service [(#7923)](https://github.com/prowler-cloud/prowler/pull/7923)
 
 ---

prowler/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.metadata.json

@@ -1,7 +1,7 @@
 {
   "Provider": "azure",
   "CheckID": "network_flow_log_more_than_90_days",
-  "CheckTitle": "Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'",
+  "CheckTitle": "Ensure that Network Security Group Flow Log retention period is 0, 90 days or greater",
   "CheckType": [],
   "ServiceName": "network",
   "SubServiceName": "",

prowler/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py

@@ -21,7 +21,10 @@ class network_flow_log_more_than_90_days(Check):
                                 report.status = "FAIL"
                                 report.status_extended = f"Network Watcher {network_watcher.name} from subscription {subscription} has flow logs disabled"
                                 has_failed = True
-                            elif flow_log.retention_policy.days < 90 and not has_failed:
+                            elif (
+                                flow_log.retention_policy.days < 90
+                                and flow_log.retention_policy.days != 0
+                            ) and not has_failed:
                                 report.status = "FAIL"
                                 report.status_extended = f"Network Watcher {network_watcher.name} from subscription {subscription} flow logs retention policy is less than 90 days"
                                 has_failed = True

tests/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days_test.py

@@ -188,6 +188,58 @@ class Test_network_flow_log_more_than_90_days:
             assert result[0].resource_id == network_watcher_id
             assert result[0].location == "location"
 
+    def test_network_network_watchers_flow_logs_retention_days_0(self):
+        network_client = mock.MagicMock
+        network_watcher_name = "Network Watcher Name"
+        network_watcher_id = str(uuid4())
+
+        network_client.network_watchers = {
+            AZURE_SUBSCRIPTION_ID: [
+                NetworkWatcher(
+                    id=network_watcher_id,
+                    name=network_watcher_name,
+                    location="location",
+                    flow_logs=[
+                        FlowLog(
+                            enabled=True,
+                            retention_policy=RetentionPolicyParameters(days=0),
+                        )
+                    ],
+                )
+            ]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_service.Network",
+                new=network_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.azure.services.network.network_client.network_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_flow_log_more_than_90_days.network_flow_log_more_than_90_days import (
+                network_flow_log_more_than_90_days,
+            )
+
+            check = network_flow_log_more_than_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Network Watcher {network_watcher_name} from subscription {AZURE_SUBSCRIPTION_ID} has flow logs enabled for more than 90 days"
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == network_watcher_name
+            assert result[0].resource_id == network_watcher_id
+            assert result[0].location == "location"
+
     def test_network_network_watchers_flow_logs_well_configured(self):
         network_client = mock.MagicMock
         network_watcher_name = "Network Watcher Name"