diff --git a/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py b/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py index 7d9cc26a90..3cf2e70a6c 100644 --- a/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py +++ b/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py @@ -5,22 +5,28 @@ from prowler.providers.aws.services.iam.iam_client import iam_client class iam_check_saml_providers_sts(Check): def execute(self) -> Check_Report_AWS: findings = [] - if not iam_client.saml_providers and iam_client.saml_providers is not None: - report = Check_Report_AWS( - metadata=self.metadata(), resource=iam_client.saml_providers - ) - report.resource_id = iam_client.audited_account - report.resource_arn = iam_client.audited_account_arn - report.region = iam_client.region - report.status = "FAIL" - report.status_extended = "No SAML Providers found." - findings.append(report) + if iam_client.saml_providers is not None: + if not iam_client.saml_providers: + report = Check_Report_AWS( + metadata=self.metadata(), resource=iam_client.saml_providers + ) + report.resource_id = iam_client.audited_account + report.resource_arn = iam_client.audited_account_arn + report.region = iam_client.region + report.status = "FAIL" + report.status_extended = "No SAML Providers found." + findings.append(report) - for provider in iam_client.saml_providers.values(): - report = Check_Report_AWS(metadata=self.metadata(), resource=provider) - report.region = iam_client.region - report.status = "PASS" - report.status_extended = f"SAML Provider {provider.name} has been found." - findings.append(report) + else: + for provider in iam_client.saml_providers.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource=provider + ) + report.region = iam_client.region + report.status = "PASS" + report.status_extended = ( + f"SAML Provider {provider.name} has been found." + ) + findings.append(report) return findings diff --git a/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py b/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py index 87fb82808b..3bf7c3fcbf 100644 --- a/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py +++ b/tests/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts_test.py @@ -123,3 +123,28 @@ nTTxU4a7x1naFxzYXK1iQ1vMARKMjDb19QEJIEJKZlDK4uS7yMlf1nFS assert result[0].resource_arn == "arn:aws:iam::123456789012:root" assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].status_extended == "No SAML Providers found." + + @mock_aws + def test_iam_check_saml_providers_sts_none_saml_providers(self): + from prowler.providers.aws.services.iam.iam_service import IAM + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ): + with mock.patch( + "prowler.providers.aws.services.iam.iam_check_saml_providers_sts.iam_check_saml_providers_sts.iam_client", + new=IAM(aws_provider), + ) as iam_client: + # Test Check + from prowler.providers.aws.services.iam.iam_check_saml_providers_sts.iam_check_saml_providers_sts import ( + iam_check_saml_providers_sts, + ) + + iam_client.saml_providers = None + + check = iam_check_saml_providers_sts() + result = check.execute() + assert len(result) == 0