mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 21:11:53 +00:00
chore: rename check
This commit is contained in:
@@ -66,7 +66,7 @@ Manages MongoDB Atlas clusters:
|
||||
|
||||
### Network Access List Security
|
||||
|
||||
**Check**: `projects_network_access_list_not_open_to_world`
|
||||
**Check**: `projects_network_access_list_exposed_to_internet`
|
||||
|
||||
Ensures that MongoDB Atlas projects don't have network access entries that allow unrestricted access from the internet.
|
||||
|
||||
@@ -111,7 +111,7 @@ prowler mongodbatlas --atlas-project-id <project_id>
|
||||
|
||||
```bash
|
||||
# Run only network access checks
|
||||
prowler mongodbatlas --checks projects_network_access_list_not_open_to_world
|
||||
prowler mongodbatlas --checks projects_network_access_list_exposed_to_internet
|
||||
|
||||
# Run only encryption checks
|
||||
prowler mongodbatlas --checks clusters_encryption_at_rest_enabled
|
||||
|
||||
-11
@@ -28,17 +28,6 @@ class clusters_encryption_at_rest_enabled(Check):
|
||||
for cluster in clusters_client.clusters.values():
|
||||
report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=cluster)
|
||||
|
||||
# Skip paused clusters
|
||||
if cluster.paused:
|
||||
report.status = "PASS"
|
||||
report.status_extended = (
|
||||
f"Cluster {cluster.name} in project {cluster.project_name} is paused, "
|
||||
f"encryption at rest check skipped."
|
||||
)
|
||||
findings.append(report)
|
||||
continue
|
||||
|
||||
# Check if cluster has encryption at rest enabled
|
||||
if cluster.encryption_at_rest_provider:
|
||||
if cluster.encryption_at_rest_provider in ATLAS_ENCRYPTION_PROVIDERS:
|
||||
if cluster.encryption_at_rest_provider == "NONE":
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"Provider": "mongodbatlas",
|
||||
"CheckID": "projects_network_access_list_not_open_to_world",
|
||||
"CheckTitle": "Ensure MongoDB Atlas project network access list is not open to the world",
|
||||
"CheckID": "projects_network_access_list_exposed_to_internet",
|
||||
"CheckTitle": "Ensure MongoDB Atlas project network access list is not exposed to the internet",
|
||||
"CheckType": [],
|
||||
"ServiceName": "projects",
|
||||
"SubServiceName": "",
|
||||
+1
-5
@@ -7,7 +7,7 @@ from prowler.providers.mongodbatlas.services.projects.projects_client import (
|
||||
)
|
||||
|
||||
|
||||
class projects_network_access_list_not_open_to_world(Check):
|
||||
class projects_network_access_list_exposed_to_internet(Check):
|
||||
"""Check if MongoDB Atlas project network access list is not open to the world
|
||||
|
||||
This class verifies that MongoDB Atlas projects don't have network access
|
||||
@@ -28,7 +28,6 @@ class projects_network_access_list_not_open_to_world(Check):
|
||||
for project in projects_client.projects.values():
|
||||
report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=project)
|
||||
|
||||
# Check if project has network access entries
|
||||
if not project.network_access_entries:
|
||||
report.status = "FAIL"
|
||||
report.status_extended = (
|
||||
@@ -36,15 +35,12 @@ class projects_network_access_list_not_open_to_world(Check):
|
||||
f"which may allow unrestricted access."
|
||||
)
|
||||
else:
|
||||
# Check for open world access
|
||||
open_entries = []
|
||||
|
||||
for entry in project.network_access_entries:
|
||||
# Check CIDR blocks
|
||||
if entry.cidr_block and entry.cidr_block in ATLAS_OPEN_WORLD_CIDRS:
|
||||
open_entries.append(f"CIDR: {entry.cidr_block}")
|
||||
|
||||
# Check IP addresses that are effectively open world
|
||||
if entry.ip_address and entry.ip_address in ["0.0.0.0", "::"]:
|
||||
open_entries.append(f"IP: {entry.ip_address}")
|
||||
|
||||
-12
@@ -136,18 +136,6 @@ class TestClustersEncryptionAtRestEnabled:
|
||||
assert reports[0].status == "FAIL"
|
||||
assert "does not have encryption at rest enabled" in reports[0].status_extended
|
||||
|
||||
def test_check_with_paused_cluster(self):
|
||||
"""Test check with paused cluster"""
|
||||
cluster = self._create_cluster(
|
||||
encryption_at_rest_provider=None, paused=True, provider_settings={}
|
||||
)
|
||||
reports = self._execute_check_with_cluster(cluster)
|
||||
|
||||
assert len(reports) == 1
|
||||
assert reports[0].status == "PASS"
|
||||
assert "is paused" in reports[0].status_extended
|
||||
assert "encryption at rest check skipped" in reports[0].status_extended
|
||||
|
||||
def test_check_with_empty_provider_settings(self):
|
||||
"""Test check with empty provider settings"""
|
||||
cluster = self._create_cluster(
|
||||
|
||||
+4
-4
@@ -34,15 +34,15 @@ class TestProjectsNetworkAccessListNotOpenToWorld:
|
||||
return_value=set_mocked_mongodbatlas_provider(),
|
||||
),
|
||||
patch(
|
||||
"prowler.providers.mongodbatlas.services.projects.projects_network_access_list_not_open_to_world.projects_network_access_list_not_open_to_world.projects_client",
|
||||
"prowler.providers.mongodbatlas.services.projects.projects_network_access_list_exposed_to_internet.projects_network_access_list_exposed_to_internet.projects_client",
|
||||
new=projects_client,
|
||||
),
|
||||
):
|
||||
from prowler.providers.mongodbatlas.services.projects.projects_network_access_list_not_open_to_world.projects_network_access_list_not_open_to_world import (
|
||||
projects_network_access_list_not_open_to_world,
|
||||
from prowler.providers.mongodbatlas.services.projects.projects_network_access_list_exposed_to_internet.projects_network_access_list_exposed_to_internet import (
|
||||
projects_network_access_list_exposed_to_internet,
|
||||
)
|
||||
|
||||
check = projects_network_access_list_not_open_to_world()
|
||||
check = projects_network_access_list_exposed_to_internet()
|
||||
return check.execute()
|
||||
|
||||
def test_check_with_no_network_access_entries(self):
|
||||
Reference in New Issue
Block a user