From e506eb4dce42b56ded7c59a18caa705503eb84b0 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Wed, 13 Aug 2025 10:11:33 +0200 Subject: [PATCH] fix(kafka): false positives in `kafka_cluster_is_public` check (#8517) Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> --- prowler/CHANGELOG.md | 1 + .../kafka_cluster_is_public/kafka_cluster_is_public.py | 6 +++--- .../kafka_cluster_is_public_test.py | 8 ++++---- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 8824ebff91..7b0f8aa797 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -20,6 +20,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Validation errors in Azure and M365 providers [(#8353)](https://github.com/prowler-cloud/prowler/pull/8353) - Azure `app_http_logs_enabled` check false positives [(#8507)](https://github.com/prowler-cloud/prowler/pull/8507) - Azure `storage_geo_redundant_enabled` check false positives [(#8504)](https://github.com/prowler-cloud/prowler/pull/8504) +- AWS `kafka_cluster_is_public` check false positives [(#8514)](https://github.com/prowler-cloud/prowler/pull/8514) --- diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py b/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py index 597839978d..426ff04490 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py @@ -10,13 +10,13 @@ class kafka_cluster_is_public(Check): report = Check_Report_AWS(metadata=self.metadata(), resource=cluster) report.status = "FAIL" report.status_extended = ( - f"Kafka cluster '{cluster.name}' is publicly accessible." + f"Kafka cluster {cluster.name} is publicly accessible." ) - if cluster.public_access: + if not cluster.public_access: report.status = "PASS" report.status_extended = ( - f"Kafka cluster '{cluster.name}' is not publicly accessible." + f"Kafka cluster {cluster.name} is not publicly accessible." ) findings.append(report) diff --git a/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py b/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py index 5925a435cd..392582b0ee 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py @@ -72,10 +72,10 @@ class Test_kafka_cluster_is_public: result = check.execute() assert len(result) == 1 - assert result[0].status == "FAIL" + assert result[0].status == "PASS" assert ( result[0].status_extended - == "Kafka cluster 'demo-cluster-1' is publicly accessible." + == "Kafka cluster demo-cluster-1 is not publicly accessible." ) assert ( result[0].resource_arn @@ -126,10 +126,10 @@ class Test_kafka_cluster_is_public: result = check.execute() assert len(result) == 1 - assert result[0].status == "PASS" + assert result[0].status == "FAIL" assert ( result[0].status_extended - == "Kafka cluster 'demo-cluster-1' is not publicly accessible." + == "Kafka cluster demo-cluster-1 is publicly accessible." ) assert ( result[0].resource_arn