chore: rename check

This commit is contained in:
Andoni A.
2025-07-16 16:19:55 +02:00
parent 3ff810405a
commit e4d3a51b9e
7 changed files with 9 additions and 36 deletions
+2 -2
View File
@@ -66,7 +66,7 @@ Manages MongoDB Atlas clusters:
### Network Access List Security
**Check**: `projects_network_access_list_not_open_to_world`
**Check**: `projects_network_access_list_exposed_to_internet`
Ensures that MongoDB Atlas projects don't have network access entries that allow unrestricted access from the internet.
@@ -111,7 +111,7 @@ prowler mongodbatlas --atlas-project-id <project_id>
```bash
# Run only network access checks
prowler mongodbatlas --checks projects_network_access_list_not_open_to_world
prowler mongodbatlas --checks projects_network_access_list_exposed_to_internet
# Run only encryption checks
prowler mongodbatlas --checks clusters_encryption_at_rest_enabled
@@ -28,17 +28,6 @@ class clusters_encryption_at_rest_enabled(Check):
for cluster in clusters_client.clusters.values():
report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=cluster)
# Skip paused clusters
if cluster.paused:
report.status = "PASS"
report.status_extended = (
f"Cluster {cluster.name} in project {cluster.project_name} is paused, "
f"encryption at rest check skipped."
)
findings.append(report)
continue
# Check if cluster has encryption at rest enabled
if cluster.encryption_at_rest_provider:
if cluster.encryption_at_rest_provider in ATLAS_ENCRYPTION_PROVIDERS:
if cluster.encryption_at_rest_provider == "NONE":
@@ -1,7 +1,7 @@
{
"Provider": "mongodbatlas",
"CheckID": "projects_network_access_list_not_open_to_world",
"CheckTitle": "Ensure MongoDB Atlas project network access list is not open to the world",
"CheckID": "projects_network_access_list_exposed_to_internet",
"CheckTitle": "Ensure MongoDB Atlas project network access list is not exposed to the internet",
"CheckType": [],
"ServiceName": "projects",
"SubServiceName": "",
@@ -7,7 +7,7 @@ from prowler.providers.mongodbatlas.services.projects.projects_client import (
)
class projects_network_access_list_not_open_to_world(Check):
class projects_network_access_list_exposed_to_internet(Check):
"""Check if MongoDB Atlas project network access list is not open to the world
This class verifies that MongoDB Atlas projects don't have network access
@@ -28,7 +28,6 @@ class projects_network_access_list_not_open_to_world(Check):
for project in projects_client.projects.values():
report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=project)
# Check if project has network access entries
if not project.network_access_entries:
report.status = "FAIL"
report.status_extended = (
@@ -36,15 +35,12 @@ class projects_network_access_list_not_open_to_world(Check):
f"which may allow unrestricted access."
)
else:
# Check for open world access
open_entries = []
for entry in project.network_access_entries:
# Check CIDR blocks
if entry.cidr_block and entry.cidr_block in ATLAS_OPEN_WORLD_CIDRS:
open_entries.append(f"CIDR: {entry.cidr_block}")
# Check IP addresses that are effectively open world
if entry.ip_address and entry.ip_address in ["0.0.0.0", "::"]:
open_entries.append(f"IP: {entry.ip_address}")
@@ -136,18 +136,6 @@ class TestClustersEncryptionAtRestEnabled:
assert reports[0].status == "FAIL"
assert "does not have encryption at rest enabled" in reports[0].status_extended
def test_check_with_paused_cluster(self):
"""Test check with paused cluster"""
cluster = self._create_cluster(
encryption_at_rest_provider=None, paused=True, provider_settings={}
)
reports = self._execute_check_with_cluster(cluster)
assert len(reports) == 1
assert reports[0].status == "PASS"
assert "is paused" in reports[0].status_extended
assert "encryption at rest check skipped" in reports[0].status_extended
def test_check_with_empty_provider_settings(self):
"""Test check with empty provider settings"""
cluster = self._create_cluster(
@@ -34,15 +34,15 @@ class TestProjectsNetworkAccessListNotOpenToWorld:
return_value=set_mocked_mongodbatlas_provider(),
),
patch(
"prowler.providers.mongodbatlas.services.projects.projects_network_access_list_not_open_to_world.projects_network_access_list_not_open_to_world.projects_client",
"prowler.providers.mongodbatlas.services.projects.projects_network_access_list_exposed_to_internet.projects_network_access_list_exposed_to_internet.projects_client",
new=projects_client,
),
):
from prowler.providers.mongodbatlas.services.projects.projects_network_access_list_not_open_to_world.projects_network_access_list_not_open_to_world import (
projects_network_access_list_not_open_to_world,
from prowler.providers.mongodbatlas.services.projects.projects_network_access_list_exposed_to_internet.projects_network_access_list_exposed_to_internet import (
projects_network_access_list_exposed_to_internet,
)
check = projects_network_access_list_not_open_to_world()
check = projects_network_access_list_exposed_to_internet()
return check.execute()
def test_check_with_no_network_access_entries(self):