chore(aws): add resource metadata to services from f to o (#6545)

prowler/providers/aws/services/firehose/firehose_stream_encrypted_at_rest/firehose_stream_encrypted_at_rest.py

@@ -21,11 +21,9 @@ class firehose_stream_encrypted_at_rest(Check):
         """
         findings = []
         for stream in firehose_client.delivery_streams.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = stream.region
-            report.resource_id = stream.name
-            report.resource_arn = stream.arn
-            report.resource_tags = stream.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=stream
+            )
             report.status = "PASS"
             report.status_extended = (
                 f"Firehose Stream {stream.name} does have at rest encryption enabled."

prowler/providers/aws/services/fms/fms_policy_compliant/fms_policy_compliant.py

@@ -6,10 +6,12 @@ class fms_policy_compliant(Check):
     def execute(self):
         findings = []
         if fms_client.fms_admin_account:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=fms_client.fms_policies
+            )
+            report.region = fms_client.region
             report.resource_arn = fms_client.policy_arn_template
             report.resource_id = fms_client.audited_account
-            report.region = fms_client.region
             report.status = "PASS"
             report.status_extended = "FMS enabled with all compliant accounts."
             non_compliant_policy = False
@@ -20,10 +22,12 @@ class fms_policy_compliant(Check):
                             policy_to_account.status == "NON_COMPLIANT"
                             or not policy_to_account.status
                         ):
+                            report = Check_Report_AWS(
+                                metadata=self.metadata(), resource_metadata=policy
+                            )
                             report.status = "FAIL"
                             report.status_extended = f"FMS with non-compliant policy {policy.name} for account {policy_to_account.account_id}."
-                            report.resource_id = policy.id
-                            report.resource_arn = policy.arn
+                            report.region = fms_client.region
                             non_compliant_policy = True
                             break
                     if non_compliant_policy:

prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_backups_enabled/fsx_file_system_copy_tags_to_backups_enabled.py

@@ -7,11 +7,9 @@ class fsx_file_system_copy_tags_to_backups_enabled(Check):
         findings = []
         for file_system in fsx_client.file_systems.values():
             if file_system.copy_tags_to_backups is not None:
-                report = Check_Report_AWS(self.metadata())
-                report.region = file_system.region
-                report.resource_id = file_system.id
-                report.resource_arn = file_system.arn
-                report.resource_tags = file_system.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=file_system
+                )
                 report.status = "PASS"
                 report.status_extended = f"FSx file system {file_system.id} has copy tags to backups enabled."
 

prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_volumes_enabled/fsx_file_system_copy_tags_to_volumes_enabled.py

@@ -7,11 +7,9 @@ class fsx_file_system_copy_tags_to_volumes_enabled(Check):
         findings = []
         for file_system in fsx_client.file_systems.values():
             if file_system.copy_tags_to_volumes is not None:
-                report = Check_Report_AWS(self.metadata())
-                report.region = file_system.region
-                report.resource_id = file_system.id
-                report.resource_arn = file_system.arn
-                report.resource_tags = file_system.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=file_system
+                )
                 report.status = "PASS"
                 report.status_extended = f"FSx file system {file_system.id} has copy tags to volumes enabled."
 

prowler/providers/aws/services/fsx/fsx_windows_file_system_multi_az_enabled/fsx_windows_file_system_multi_az_enabled.py

@@ -7,11 +7,9 @@ class fsx_windows_file_system_multi_az_enabled(Check):
         findings = []
         for file_system in fsx_client.file_systems.values():
             if file_system.type == "WINDOWS":
-                report = Check_Report_AWS(self.metadata())
-                report.region = file_system.region
-                report.resource_id = file_system.id
-                report.resource_arn = file_system.arn
-                report.resource_tags = file_system.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=file_system
+                )
                 if len(file_system.subnet_ids) > 1:
                     report.status = "PASS"
                     report.status_extended = f"FSx Windows file system {file_system.id} is configured for Multi-AZ deployment."

prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access.py

@@ -6,11 +6,7 @@ class glacier_vaults_policy_public_access(Check):
     def execute(self):
         findings = []
         for vault in glacier_client.vaults.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = vault.region
-            report.resource_id = vault.name
-            report.resource_arn = vault.arn
-            report.resource_tags = vault.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=vault)
             report.status = "PASS"
             report.status_extended = f"Vault {vault.name} has policy which does not allow access to everyone."
 

prowler/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled.py

@@ -8,12 +8,13 @@ class glue_data_catalogs_connection_passwords_encryption_enabled(Check):
         for data_catalog in glue_client.data_catalogs.values():
             # Check only if there are Glue Tables
             if data_catalog.tables or glue_client.provider.scan_unused_services:
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=data_catalog
+                )
                 report.resource_id = glue_client.audited_account
                 report.resource_arn = glue_client._get_data_catalog_arn_template(
                     data_catalog.region
                 )
-                report.region = data_catalog.region
                 report.status = "FAIL"
                 report.status = "FAIL"
                 report.status_extended = (

prowler/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled.py

@@ -8,12 +8,13 @@ class glue_data_catalogs_metadata_encryption_enabled(Check):
         for data_catalog in glue_client.data_catalogs.values():
             # Check only if there are Glue Tables
             if data_catalog.tables or glue_client.provider.scan_unused_services:
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=data_catalog
+                )
                 report.resource_id = glue_client.audited_account
                 report.resource_arn = glue_client._get_data_catalog_arn_template(
                     data_catalog.region
                 )
-                report.region = data_catalog.region
                 report.status = "FAIL"
                 report.status_extended = (
                     "Glue data catalog settings have metadata encryption disabled."

prowler/providers/aws/services/glue/glue_data_catalogs_not_publicly_accessible/glue_data_catalogs_not_publicly_accessible.py

@@ -7,8 +7,9 @@ class glue_data_catalogs_not_publicly_accessible(Check):
     def execute(self):
         findings = []
         for data_catalog in glue_client.data_catalogs.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = data_catalog.region
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=data_catalog
+            )
             report.resource_id = glue_client.audited_account
             report.resource_arn = glue_client._get_data_catalog_arn_template(
                 data_catalog.region

prowler/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled.py

@@ -6,11 +6,7 @@ class glue_database_connections_ssl_enabled(Check):
     def execute(self):
         findings = []
         for conn in glue_client.connections:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = conn.name
-            report.resource_arn = conn.arn
-            report.region = conn.region
-            report.resource_tags = conn.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=conn)
             report.status = "FAIL"
             report.status_extended = (
                 f"Glue connection {conn.name} has SSL connection disabled."

prowler/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled.py

@@ -7,11 +7,9 @@ class glue_development_endpoints_cloudwatch_logs_encryption_enabled(Check):
         findings = []
         for endpoint in glue_client.dev_endpoints:
             no_sec_configs = True
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = endpoint.name
-            report.resource_arn = endpoint.arn
-            report.region = endpoint.region
-            report.resource_tags = endpoint.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=endpoint
+            )
             for sec_config in glue_client.security_configs:
                 if sec_config.name == endpoint.security:
                     no_sec_configs = False

prowler/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled.py

@@ -7,11 +7,9 @@ class glue_development_endpoints_job_bookmark_encryption_enabled(Check):
         findings = []
         for endpoint in glue_client.dev_endpoints:
             no_sec_configs = True
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = endpoint.name
-            report.resource_arn = endpoint.arn
-            report.region = endpoint.region
-            report.resource_tags = endpoint.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=endpoint
+            )
             for sec_config in glue_client.security_configs:
                 if sec_config.name == endpoint.security:
                     no_sec_configs = False

prowler/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled.py

@@ -7,11 +7,9 @@ class glue_development_endpoints_s3_encryption_enabled(Check):
         findings = []
         for endpoint in glue_client.dev_endpoints:
             no_sec_configs = True
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = endpoint.name
-            report.resource_arn = endpoint.arn
-            report.region = endpoint.region
-            report.resource_tags = endpoint.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=endpoint
+            )
             for sec_config in glue_client.security_configs:
                 if sec_config.name == endpoint.security:
                     no_sec_configs = False

prowler/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled.py

@@ -7,11 +7,7 @@ class glue_etl_jobs_amazon_s3_encryption_enabled(Check):
         findings = []
         for job in glue_client.jobs:
             no_sec_configs = True
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = job.name
-            report.resource_arn = job.arn
-            report.region = job.region
-            report.resource_tags = job.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job)
             for sec_config in glue_client.security_configs:
                 if sec_config.name == job.security:
                     no_sec_configs = False

prowler/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled.py

@@ -7,11 +7,7 @@ class glue_etl_jobs_cloudwatch_logs_encryption_enabled(Check):
         findings = []
         for job in glue_client.jobs:
             no_sec_configs = True
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = job.name
-            report.resource_arn = job.arn
-            report.region = job.region
-            report.resource_tags = job.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job)
             for sec_config in glue_client.security_configs:
                 if sec_config.name == job.security:
                     no_sec_configs = False

prowler/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled.py

@@ -7,11 +7,7 @@ class glue_etl_jobs_job_bookmark_encryption_enabled(Check):
         findings = []
         for job in glue_client.jobs:
             no_sec_configs = True
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = job.name
-            report.resource_arn = job.arn
-            report.region = job.region
-            report.resource_tags = job.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job)
             for sec_config in glue_client.security_configs:
                 if sec_config.name == job.security:
                     no_sec_configs = False

prowler/providers/aws/services/glue/glue_etl_jobs_logging_enabled/glue_etl_jobs_logging_enabled.py

@@ -20,11 +20,7 @@ class glue_etl_jobs_logging_enabled(Check):
         """
         findings = []
         for job in glue_client.jobs:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = job.name
-            report.resource_arn = job.arn
-            report.region = job.region
-            report.resource_tags = job.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job)
             report.status = "FAIL"
             report.status_extended = (
                 f"Glue job {job.name} does not have logging enabled."

prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py

@@ -6,12 +6,10 @@ class glue_ml_transform_encrypted_at_rest(Check):
     def execute(self):
         findings = []
 
-        for ml_transform_arn, ml_transform in glue_client.ml_transforms.items():
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = ml_transform.id
-            report.resource_arn = ml_transform_arn
-            report.region = ml_transform.region
-            report.resource_tags = ml_transform.tags
+        for ml_transform in glue_client.ml_transforms.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=ml_transform
+            )
             report.status = "PASS"
             report.status_extended = (
                 f"Glue ML Transform {ml_transform.name} is encrypted at rest."

prowler/providers/aws/services/guardduty/guardduty_centrally_managed/guardduty_centrally_managed.py

@@ -7,11 +7,9 @@ class guardduty_centrally_managed(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.id and detector.enabled_in_account:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "FAIL"
                 report.status_extended = (
                     f"GuardDuty detector {detector.id} is not centrally managed."

prowler/providers/aws/services/guardduty/guardduty_ec2_malware_protection_enabled/guardduty_ec2_malware_protection_enabled.py

@@ -7,11 +7,9 @@ class guardduty_ec2_malware_protection_enabled(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.status:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "FAIL"
                 report.status_extended = f"GuardDuty detector {detector.id} does not have Malware Protection for EC2 enabled."
                 if detector.ec2_malware_protection:

prowler/providers/aws/services/guardduty/guardduty_eks_audit_log_enabled/guardduty_eks_audit_log_enabled.py

@@ -7,11 +7,9 @@ class guardduty_eks_audit_log_enabled(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.status:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "FAIL"
                 report.status_extended = f"GuardDuty detector {detector.id} does not have EKS Audit Log Monitoring enabled."
                 if detector.eks_audit_log_protection:

prowler/providers/aws/services/guardduty/guardduty_eks_runtime_monitoring_enabled/guardduty_eks_runtime_monitoring_enabled.py

@@ -7,11 +7,9 @@ class guardduty_eks_runtime_monitoring_enabled(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.status:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "FAIL"
                 report.status_extended = f"GuardDuty detector {detector.id} does not have EKS Runtime Monitoring enabled."
                 if detector.eks_runtime_monitoring:

prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py

@@ -6,11 +6,9 @@ class guardduty_is_enabled(Check):
     def execute(self):
         findings = []
         for detector in guardduty_client.detectors:
-            report = Check_Report_AWS(self.metadata())
-            report.region = detector.region
-            report.resource_id = detector.id
-            report.resource_arn = detector.arn
-            report.resource_tags = detector.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=detector
+            )
             report.status = "PASS"
             report.status_extended = f"GuardDuty detector {detector.id} enabled."
 

prowler/providers/aws/services/guardduty/guardduty_lambda_protection_enabled/guardduty_lambda_protection_enabled.py

@@ -7,11 +7,9 @@ class guardduty_lambda_protection_enabled(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.status:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "FAIL"
                 report.status_extended = f"GuardDuty detector {detector.id} does not have Lambda Protection enabled."
                 if detector.lambda_protection:

prowler/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings.py

@@ -7,11 +7,9 @@ class guardduty_no_high_severity_findings(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.id and detector.enabled_in_account:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "PASS"
                 report.status_extended = f"GuardDuty detector {detector.id} does not have high severity findings."
                 if len(detector.findings) > 0:

prowler/providers/aws/services/guardduty/guardduty_rds_protection_enabled/guardduty_rds_protection_enabled.py

@@ -7,11 +7,9 @@ class guardduty_rds_protection_enabled(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.status:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "FAIL"
                 report.status_extended = (
                     "GuardDuty detector does not have RDS Protection enabled."

prowler/providers/aws/services/guardduty/guardduty_s3_protection_enabled/guardduty_s3_protection_enabled.py

@@ -7,11 +7,9 @@ class guardduty_s3_protection_enabled(Check):
         findings = []
         for detector in guardduty_client.detectors:
             if detector.status:
-                report = Check_Report_AWS(self.metadata())
-                report.region = detector.region
-                report.resource_id = detector.id
-                report.resource_arn = detector.arn
-                report.resource_tags = detector.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=detector
+                )
                 report.status = "FAIL"
                 report.status_extended = (
                     "GuardDuty detector does not have S3 Protection enabled."

prowler/providers/aws/services/iam/iam_administrator_access_with_mfa/iam_administrator_access_with_mfa.py

@@ -8,9 +8,7 @@ class iam_administrator_access_with_mfa(Check):
         response = iam_client.groups
 
         for group in response:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = group.name
-            report.resource_arn = group.arn
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=group)
             report.region = iam_client.region
             report.status = "PASS"
             report.status_extended = f"Group {group.name} has no policies."

prowler/providers/aws/services/iam/iam_avoid_root_usage/iam_avoid_root_usage.py

@@ -16,7 +16,9 @@ class iam_avoid_root_usage(Check):
 
         for user in response:
             if user["user"] == "<root_account>":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=user
+                )
                 report.region = iam_client.region
                 report.resource_id = user["user"]
                 report.resource_arn = user["arn"]

prowler/providers/aws/services/iam/iam_aws_attached_policy_no_administrative_privileges/iam_aws_attached_policy_no_administrative_privileges.py

@@ -9,11 +9,10 @@ class iam_aws_attached_policy_no_administrative_privileges(Check):
         for policy in iam_client.policies:
             # Check only for attached AWS policies
             if policy.attached and policy.type == "AWS":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
-                report.resource_id = policy.name
-                report.resource_tags = policy.tags
                 report.status = "PASS"
                 report.status_extended = f"{policy.type} policy {policy.name} is attached but does not allow '*:*' administrative privileges."
                 if policy.document:

prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py

@@ -6,7 +6,9 @@ class iam_check_saml_providers_sts(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if not iam_client.saml_providers and iam_client.saml_providers is not None:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.saml_providers
+            )
             report.resource_id = iam_client.audited_account
             report.resource_arn = iam_client.audited_account_arn
             report.region = iam_client.region
@@ -14,11 +16,10 @@ class iam_check_saml_providers_sts(Check):
             report.status_extended = "No SAML Providers found."
             findings.append(report)
 
-        for provider_arn, provider in iam_client.saml_providers.items():
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = provider.name
-            report.resource_arn = provider_arn
-            report.resource_tags = provider.tags
+        for provider in iam_client.saml_providers.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=provider
+            )
             report.region = iam_client.region
             report.status = "PASS"
             report.status_extended = f"SAML Provider {provider.name} has been found."

prowler/providers/aws/services/iam/iam_customer_attached_policy_no_administrative_privileges/iam_customer_attached_policy_no_administrative_privileges.py

@@ -9,11 +9,10 @@ class iam_customer_attached_policy_no_administrative_privileges(Check):
         for policy in iam_client.policies:
             # Check only for attached custom policies
             if policy.attached and policy.type == "Custom":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
-                report.resource_id = policy.name
-                report.resource_tags = policy.tags
                 report.status = "PASS"
                 report.status_extended = f"{policy.type} policy {policy.name} is attached but does not allow '*:*' administrative privileges."
                 if policy.document:

prowler/providers/aws/services/iam/iam_customer_unattached_policy_no_administrative_privileges/iam_customer_unattached_policy_no_administrative_privileges.py

@@ -9,11 +9,10 @@ class iam_customer_unattached_policy_no_administrative_privileges(Check):
         for policy in iam_client.policies:
             # Check only for cutomer unattached policies
             if not policy.attached and policy.type == "Custom":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
-                report.resource_id = policy.name
-                report.resource_tags = policy.tags
                 report.status = "PASS"
                 report.status_extended = f"{policy.type} policy {policy.name} is unattached and does not allow '*:*' administrative privileges."
                 if policy.document:

prowler/providers/aws/services/iam/iam_group_administrator_access_policy/iam_group_administrator_access_policy.py

@@ -8,10 +8,8 @@ class iam_group_administrator_access_policy(Check):
     def execute(self) -> List[Check_Report_AWS]:
         findings = []
         for group in iam_client.groups:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=group)
             report.region = iam_client.region
-            report.resource_arn = group.arn
-            report.resource_id = group.name
             report.status = "PASS"
             report.status_extended = (
                 f"IAM Group {group.name} does not have AdministratorAccess policy."

prowler/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation.py

@@ -11,11 +11,11 @@ class iam_inline_policy_allows_privilege_escalation(Check):
 
         for policy in iam_client.policies:
             if policy.type == "Inline":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.resource_id = f"{policy.entity}/{policy.name}"
-                report.resource_arn = policy.arn
                 report.region = iam_client.region
-                report.resource_tags = policy.tags
                 report.status = "PASS"
 
                 resource_type_str = report.resource_arn.split(":")[-1].split("/")[0]

prowler/providers/aws/services/iam/iam_inline_policy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges.py

@@ -8,11 +8,11 @@ class iam_inline_policy_no_administrative_privileges(Check):
         findings = []
         for policy in iam_client.policies:
             if policy.type == "Inline":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
                 report.resource_id = f"{policy.entity}/{policy.name}"
-                report.resource_tags = policy.tags
                 report.status = "PASS"
 
                 resource_type_str = report.resource_arn.split(":")[-1].split("/")[0]

prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_cloudtrail/iam_inline_policy_no_full_access_to_cloudtrail.py

@@ -12,11 +12,11 @@ class iam_inline_policy_no_full_access_to_cloudtrail(Check):
         for policy in iam_client.policies:
             # Check only inline policies
             if policy.type == "Inline":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
                 report.resource_id = f"{policy.entity}/{policy.name}"
-                report.resource_tags = policy.tags
                 report.status = "PASS"
 
                 resource_type_str = report.resource_arn.split(":")[-1].split("/")[0]

prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_kms/iam_inline_policy_no_full_access_to_kms.py

@@ -11,11 +11,11 @@ class iam_inline_policy_no_full_access_to_kms(Check):
 
         for policy in iam_client.policies:
             if policy.type == "Inline":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
                 report.resource_id = f"{policy.entity}/{policy.name}"
-                report.resource_tags = policy.tags
                 report.status = "PASS"
 
                 resource_type_str = report.resource_arn.split(":")[-1].split("/")[0]

prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py

@@ -8,11 +8,10 @@ class iam_no_custom_policy_permissive_role_assumption(Check):
         for policy in iam_client.policies:
             # Check only custom policies
             if policy.type == "Custom":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
-                report.resource_id = policy.name
-                report.resource_tags = policy.tags
                 report.status = "PASS"
                 report.status_extended = f"Custom Policy {policy.name} does not allow permissive STS Role assumption."
                 if policy.document:

prowler/providers/aws/services/iam/iam_no_expired_server_certificates_stored/iam_no_expired_server_certificates_stored.py

@@ -9,11 +9,10 @@ class iam_no_expired_server_certificates_stored(Check):
         findings = []
 
         for certificate in iam_client.server_certificates:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=certificate
+            )
             report.region = iam_client.region
-            report.resource_id = certificate.id
-            report.resource_arn = certificate.arn
-            report.resource_tags = certificate.tags
             expiration_days = (datetime.now(timezone.utc) - certificate.expiration).days
             if expiration_days >= 0:
                 report.status = "FAIL"

prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py

@@ -12,7 +12,9 @@ class iam_no_root_access_key(Check):
         ):
             for user in iam_client.credential_report:
                 if user["user"] == "<root_account>":
-                    report = Check_Report_AWS(self.metadata())
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource_metadata=user
+                    )
                     report.region = iam_client.region
                     report.resource_id = user["user"]
                     report.resource_arn = user["arn"]

prowler/providers/aws/services/iam/iam_password_policy_expires_passwords_within_90_days_or_less/iam_password_policy_expires_passwords_within_90_days_or_less.py

@@ -6,7 +6,9 @@ class iam_password_policy_expires_passwords_within_90_days_or_less(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.password_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.password_policy
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.password_policy_arn_template
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_password_policy_lowercase/iam_password_policy_lowercase.py

@@ -6,7 +6,9 @@ class iam_password_policy_lowercase(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.password_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.password_policy
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.password_policy_arn_template
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_password_policy_minimum_length_14/iam_password_policy_minimum_length_14.py

@@ -6,7 +6,9 @@ class iam_password_policy_minimum_length_14(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.password_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.password_policy
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.password_policy_arn_template
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_password_policy_number/iam_password_policy_number.py

@@ -6,7 +6,9 @@ class iam_password_policy_number(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.password_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.password_policy
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.password_policy_arn_template
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_password_policy_reuse_24/iam_password_policy_reuse_24.py

@@ -6,7 +6,9 @@ class iam_password_policy_reuse_24(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.password_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.password_policy
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.password_policy_arn_template
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_password_policy_symbol/iam_password_policy_symbol.py

@@ -6,7 +6,9 @@ class iam_password_policy_symbol(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.password_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.password_policy
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.password_policy_arn_template
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_password_policy_uppercase/iam_password_policy_uppercase.py

@@ -6,7 +6,9 @@ class iam_password_policy_uppercase(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.password_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=iam_client.password_policy
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.password_policy_arn_template
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py

@@ -11,11 +11,10 @@ class iam_policy_allows_privilege_escalation(Check):
 
         for policy in iam_client.policies:
             if policy.type == "Custom":
-                report = Check_Report_AWS(self.metadata())
-                report.resource_id = policy.name
-                report.resource_arn = policy.arn
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_tags = policy.tags
                 report.status = "PASS"
                 report.status_extended = f"Custom Policy {report.resource_arn} does not allow privilege escalation."
 

prowler/providers/aws/services/iam/iam_policy_attached_only_to_group_or_roles/iam_policy_attached_only_to_group_or_roles.py

@@ -10,31 +10,30 @@ class iam_policy_attached_only_to_group_or_roles(Check):
                 if user.attached_policies or user.inline_policies:
                     if user.attached_policies:
                         for policy in user.attached_policies:
-                            report = Check_Report_AWS(self.metadata())
+                            report = Check_Report_AWS(
+                                metadata=self.metadata(), resource_metadata=user
+                            )
                             report.region = iam_client.region
                             report.status = "FAIL"
                             report.status_extended = f"User {user.name} has the policy {policy['PolicyName']} attached."
                             report.resource_id = f"{user.name}/{policy['PolicyName']}"
-                            report.resource_arn = user.arn
-                            report.resource_tags = user.tags
                             findings.append(report)
                     if user.inline_policies:
                         for policy in user.inline_policies:
-                            report = Check_Report_AWS(self.metadata())
+                            report = Check_Report_AWS(
+                                metadata=self.metadata(), resource_metadata=user
+                            )
                             report.region = iam_client.region
                             report.status = "FAIL"
                             report.status_extended = f"User {user.name} has the inline policy {policy} attached."
                             report.resource_id = f"{user.name}/{policy}"
-                            report.resource_arn = user.arn
-                            report.resource_tags = user.tags
                             findings.append(report)
 
                 else:
-                    report = Check_Report_AWS(self.metadata())
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource_metadata=user
+                    )
                     report.region = iam_client.region
-                    report.resource_id = user.name
-                    report.resource_arn = user.arn
-                    report.resource_tags = user.tags
                     report.status = "PASS"
                     report.status_extended = (
                         f"User {user.name} has no inline or attached policies."

prowler/providers/aws/services/iam/iam_policy_cloudshell_admin_not_attached/iam_policy_cloudshell_admin_not_attached.py

@@ -6,7 +6,10 @@ class iam_policy_cloudshell_admin_not_attached(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.entities_attached_to_cloudshell_policy:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(),
+                resource_metadata=iam_client.entities_attached_to_cloudshell_policy,
+            )
             report.region = iam_client.region
             report.resource_id = iam_client.audited_account
             report.resource_arn = f"arn:{iam_client.audited_partition}:iam::aws:policy/AWSCloudShellFullAccess"

prowler/providers/aws/services/iam/iam_policy_no_full_access_to_cloudtrail/iam_policy_no_full_access_to_cloudtrail.py

@@ -11,11 +11,10 @@ class iam_policy_no_full_access_to_cloudtrail(Check):
         for policy in iam_client.policies:
             # Check only custom policies
             if policy.type == "Custom":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
-                report.resource_id = policy.name
-                report.resource_tags = policy.tags
                 report.status = "PASS"
                 report.status_extended = f"Custom Policy {policy.name} does not allow '{critical_service}:*' privileges."
 

prowler/providers/aws/services/iam/iam_policy_no_full_access_to_kms/iam_policy_no_full_access_to_kms.py

@@ -11,11 +11,10 @@ class iam_policy_no_full_access_to_kms(Check):
         for policy in iam_client.policies:
             # Check only custom policies
             if policy.type == "Custom":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=policy
+                )
                 report.region = iam_client.region
-                report.resource_arn = policy.arn
-                report.resource_id = policy.name
-                report.resource_tags = policy.tags
                 report.status = "PASS"
                 report.status_extended = f"Custom Policy {policy.name} does not allow '{critical_service}:*' privileges."
 

prowler/providers/aws/services/iam/iam_role_administratoraccess_policy/iam_role_administratoraccess_policy.py

@@ -10,11 +10,10 @@ class iam_role_administratoraccess_policy(Check):
                 if (
                     not role.is_service_role
                 ):  # Avoid service roles since they cannot be modified by the user
-                    report = Check_Report_AWS(self.metadata())
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource_metadata=role
+                    )
                     report.region = iam_client.region
-                    report.resource_arn = role.arn
-                    report.resource_id = role.name
-                    report.resource_tags = role.tags
                     report.status = "PASS"
                     report.status_extended = f"IAM Role {role.name} does not have AdministratorAccess policy."
                     for policy in role.attached_policies:

prowler/providers/aws/services/iam/iam_role_cross_account_readonlyaccess_policy/iam_role_cross_account_readonlyaccess_policy.py

@@ -10,11 +10,10 @@ class iam_role_cross_account_readonlyaccess_policy(Check):
                 if (
                     not role.is_service_role
                 ):  # Avoid service roles since they cannot be modified by the user
-                    report = Check_Report_AWS(self.metadata())
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource_metadata=role
+                    )
                     report.region = iam_client.region
-                    report.resource_arn = role.arn
-                    report.resource_id = role.name
-                    report.resource_tags = role.tags
                     report.status = "PASS"
                     report.status_extended = (
                         f"IAM Role {role.name} does not have ReadOnlyAccess policy."

prowler/providers/aws/services/iam/iam_role_cross_service_confused_deputy_prevention/iam_role_cross_service_confused_deputy_prevention.py

@@ -10,11 +10,10 @@ class iam_role_cross_service_confused_deputy_prevention(Check):
             for role in iam_client.roles:
                 # This check should only be performed against service roles (avoid Service Linked Roles since the trust relationship cannot be changed)
                 if role.is_service_role and "aws-service-role" not in role.arn:
-                    report = Check_Report_AWS(self.metadata())
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource_metadata=role
+                    )
                     report.region = iam_client.region
-                    report.resource_arn = role.arn
-                    report.resource_id = role.name
-                    report.resource_tags = role.tags
                     report.status = "FAIL"
                     report.status_extended = f"IAM Service Role {role.name} does not prevent against a cross-service confused deputy attack."
                     if not is_policy_public(

prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py

@@ -13,7 +13,10 @@ class iam_root_credentials_management_enabled(Check):
             and organizations_client.organization.status == "ACTIVE"
             and iam_client.organization_features is not None
         ):
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(),
+                resource_metadata=iam_client.organization_features,
+            )
             report.region = iam_client.region
             report.resource_arn = iam_client.audited_account_arn
             report.resource_id = iam_client.audited_account

prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py

@@ -14,7 +14,10 @@ class iam_root_hardware_mfa_enabled(Check):
             ):
                 if iam_client.account_summary:
                     virtual_mfa = False
-                    report = Check_Report_AWS(self.metadata())
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(),
+                        resource_metadata=iam_client.account_summary,
+                    )
                     report.region = iam_client.region
                     report.resource_id = "<root_account>"
                     report.resource_arn = iam_client.mfa_arn_template

prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py

@@ -13,7 +13,9 @@ class iam_root_mfa_enabled(Check):
             if iam_client.credential_report:
                 for user in iam_client.credential_report:
                     if user["user"] == "<root_account>":
-                        report = Check_Report_AWS(self.metadata())
+                        report = Check_Report_AWS(
+                            metadata=self.metadata(), resource_metadata=user
+                        )
                         report.region = iam_client.region
                         report.resource_id = user["user"]
                         report.resource_arn = user["arn"]

prowler/providers/aws/services/iam/iam_rotate_access_key_90_days/iam_rotate_access_key_90_days.py

@@ -25,7 +25,9 @@ class iam_rotate_access_key_90_days(Check):
                 user["access_key_1_last_rotated"] == "N/A"
                 and user["access_key_2_last_rotated"] == "N/A"
             ):
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=user
+                )
                 report.region = iam_client.region
                 report.resource_id = user["user"]
                 report.resource_arn = user["arn"]
@@ -47,7 +49,9 @@ class iam_rotate_access_key_90_days(Check):
                     ) - parser.parse(user["access_key_1_last_rotated"])
                     if access_key_1_last_rotated.days > maximum_expiration_days:
                         old_access_keys = True
-                        report = Check_Report_AWS(self.metadata())
+                        report = Check_Report_AWS(
+                            metadata=self.metadata(), resource_metadata=user
+                        )
                         report.region = iam_client.region
                         report.resource_id = f"{user['user']}-access-key-1"
                         report.resource_arn = user["arn"]
@@ -64,7 +68,9 @@ class iam_rotate_access_key_90_days(Check):
                     ) - parser.parse(user["access_key_2_last_rotated"])
                     if access_key_2_last_rotated.days > maximum_expiration_days:
                         old_access_keys = True
-                        report = Check_Report_AWS(self.metadata())
+                        report = Check_Report_AWS(
+                            metadata=self.metadata(), resource_metadata=user
+                        )
                         report.region = iam_client.region
                         report.resource_id = f"{user['user']}-access-key-2"
                         report.resource_arn = user["arn"]
@@ -74,7 +80,9 @@ class iam_rotate_access_key_90_days(Check):
                         findings.append(report)
 
                 if not old_access_keys:
-                    report = Check_Report_AWS(self.metadata())
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource_metadata=user
+                    )
                     report.region = iam_client.region
                     report.resource_id = user["user"]
                     report.resource_arn = user["arn"]

prowler/providers/aws/services/iam/iam_securityaudit_role_created/iam_securityaudit_role_created.py

@@ -6,7 +6,10 @@ class iam_securityaudit_role_created(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.entities_role_attached_to_securityaudit_policy is not None:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(),
+                resource_metadata=iam_client.entities_role_attached_to_securityaudit_policy,
+            )
             report.region = iam_client.region
             report.resource_id = "SecurityAudit"
             report.resource_arn = (

prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py

@@ -6,7 +6,10 @@ class iam_support_role_created(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
         if iam_client.entities_role_attached_to_support_policy is not None:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(),
+                resource_metadata=iam_client.entities_role_attached_to_support_policy,
+            )
             report.region = iam_client.region
             report.resource_id = iam_client.audited_account
             report.resource_arn = (

prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py

@@ -25,7 +25,9 @@ class iam_user_accesskey_unused(Check):
                 user["access_key_1_active"] != "true"
                 and user["access_key_2_active"] != "true"
             ):
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=user
+                )
                 report.region = iam_client.region
                 report.resource_id = user["user"]
                 report.resource_arn = user["arn"]

prowler/providers/aws/services/iam/iam_user_administrator_access_policy/iam_user_administrator_access_policy.py

@@ -8,11 +8,8 @@ class iam_user_administrator_access_policy(Check):
     def execute(self) -> List[Check_Report_AWS]:
         findings = []
         for user in iam_client.users:
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user)
             report.region = iam_client.region
-            report.resource_arn = user.arn
-            report.resource_id = user.name
-            report.resource_tags = user.tags
             report.status = "PASS"
             report.status_extended = (
                 f"IAM User {user.name} does not have AdministratorAccess policy."

prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py

@@ -11,10 +11,7 @@ class iam_user_console_access_unused(Check):
         )
         findings = []
         for user in iam_client.users:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = user.name
-            report.resource_arn = user.arn
-            report.resource_tags = user.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user)
             report.region = iam_client.region
             if user.console_access and user.password_last_used:
                 time_since_insertion = (

prowler/providers/aws/services/iam/iam_user_hardware_mfa_enabled/iam_user_hardware_mfa_enabled.py

@@ -8,10 +8,7 @@ class iam_user_hardware_mfa_enabled(Check):
         response = iam_client.users
 
         for user in response:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = user.name
-            report.resource_arn = user.arn
-            report.resource_tags = user.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user)
             report.region = iam_client.region
             if user.mfa_devices:
                 report.status = "PASS"

prowler/providers/aws/services/iam/iam_user_mfa_enabled_console_access/iam_user_mfa_enabled_console_access.py

@@ -9,7 +9,9 @@ class iam_user_mfa_enabled_console_access(Check):
         for user in response:
             # all the users but root (which by default does not support console password)
             if user["user"] != "<root_account>":
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=user
+                )
                 report.resource_id = user["user"]
                 report.resource_arn = user["arn"]
                 report.region = iam_client.region

prowler/providers/aws/services/iam/iam_user_no_setup_initial_access_key/iam_user_no_setup_initial_access_key.py

@@ -48,7 +48,7 @@ class iam_user_no_setup_initial_access_key(Check):
         return findings
 
     def add_finding(self, user, status, status_extended, findings):
-        report = Check_Report_AWS(self.metadata())
+        report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user)
         report.region = iam_client.region
         report.resource_id = user["user"]
         report.resource_arn = user["arn"]

prowler/providers/aws/services/iam/iam_user_two_active_access_key/iam_user_two_active_access_key.py

@@ -9,7 +9,9 @@ class iam_user_two_active_access_key(Check):
             findings = []
             response = iam_client.credential_report
             for user in response:
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=user
+                )
                 report.resource_id = user["user"]
                 report.resource_arn = user["arn"]
                 report.region = iam_client.region

prowler/providers/aws/services/iam/iam_user_with_temporary_credentials/iam_user_with_temporary_credentials.py

@@ -13,7 +13,10 @@ class iam_user_with_temporary_credentials(Check):
             user_name = user_data[0]
             user_arn = user_data[1]
 
-            report = Check_Report_AWS(self.metadata())
+            report = Check_Report_AWS(
+                metadata=self.metadata(),
+                resource_metadata=iam_client.user_temporary_credentials_usage,
+            )
             report.resource_id = user_name
             report.resource_arn = user_arn
             report.region = iam_client.region

prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py

@@ -9,10 +9,9 @@ class inspector2_active_findings_exist(Check):
         findings = []
         for inspector in inspector2_client.inspectors:
             if inspector.status == "ENABLED":
-                report = Check_Report_AWS(self.metadata())
-                report.resource_id = inspector.id
-                report.resource_arn = inspector.arn
-                report.region = inspector.region
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=inspector
+                )
                 report.status = "PASS"
                 report.status_extended = (
                     "Inspector2 is enabled with no active findings."

prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py

@@ -11,10 +11,9 @@ class inspector2_is_enabled(Check):
     def execute(self):
         findings = []
         for inspector in inspector2_client.inspectors:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = inspector.id
-            report.resource_arn = inspector.arn
-            report.region = inspector.region
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=inspector
+            )
             if inspector.status == "ENABLED":
                 report.status = "PASS"
                 report.status_extended = "Inspector2 is enabled for EC2 instances, ECR container images, Lambda functions and code."

prowler/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk.py

@@ -7,12 +7,10 @@ class kafka_cluster_encryption_at_rest_uses_cmk(Check):
     def execute(self):
         findings = []
 
-        for arn_cluster, cluster in kafka_client.clusters.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.id
-            report.resource_arn = arn_cluster
-            report.resource_tags = cluster.tags
+        for cluster in kafka_client.clusters.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             report.status = "FAIL"
             report.status_extended = f"Kafka cluster '{cluster.name}' does not have encryption at rest enabled with a CMK."
 

prowler/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled.py

@@ -6,12 +6,10 @@ class kafka_cluster_enhanced_monitoring_enabled(Check):
     def execute(self):
         findings = []
 
-        for arn_cluster, cluster in kafka_client.clusters.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.id
-            report.resource_arn = arn_cluster
-            report.resource_tags = cluster.tags
+        for cluster in kafka_client.clusters.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             report.status = "PASS"
             report.status_extended = (
                 f"Kafka cluster '{cluster.name}' has enhanced monitoring enabled."

prowler/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled.py

@@ -6,12 +6,10 @@ class kafka_cluster_in_transit_encryption_enabled(Check):
     def execute(self):
         findings = []
 
-        for arn_cluster, cluster in kafka_client.clusters.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.id
-            report.resource_arn = arn_cluster
-            report.resource_tags = cluster.tags
+        for cluster in kafka_client.clusters.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             report.status = "FAIL"
             report.status_extended = f"Kafka cluster '{cluster.name}' does not have encryption in transit enabled."
 

prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py

@@ -6,12 +6,10 @@ class kafka_cluster_is_public(Check):
     def execute(self):
         findings = []
 
-        for arn_cluster, cluster in kafka_client.clusters.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.id
-            report.resource_arn = arn_cluster
-            report.resource_tags = cluster.tags
+        for cluster in kafka_client.clusters.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             report.status = "FAIL"
             report.status_extended = (
                 f"Kafka cluster '{cluster.name}' is publicly accessible."

prowler/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled.py

@@ -6,12 +6,10 @@ class kafka_cluster_mutual_tls_authentication_enabled(Check):
     def execute(self):
         findings = []
 
-        for arn_cluster, cluster in kafka_client.clusters.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.id
-            report.resource_arn = arn_cluster
-            report.resource_tags = cluster.tags
+        for cluster in kafka_client.clusters.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             report.status = "FAIL"
             report.status_extended = f"Kafka cluster '{cluster.name}' does not have mutual TLS authentication enabled."
 

prowler/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled.py

@@ -6,12 +6,10 @@ class kafka_cluster_unrestricted_access_disabled(Check):
     def execute(self):
         findings = []
 
-        for arn_cluster, cluster in kafka_client.clusters.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.id
-            report.resource_arn = arn_cluster
-            report.resource_tags = cluster.tags
+        for cluster in kafka_client.clusters.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             report.status = "FAIL"
             report.status_extended = (
                 f"Kafka cluster '{cluster.name}' has unrestricted access enabled."

prowler/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version.py

@@ -6,12 +6,10 @@ class kafka_cluster_uses_latest_version(Check):
     def execute(self):
         findings = []
 
-        for arn_cluster, cluster in kafka_client.clusters.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.id
-            report.resource_arn = arn_cluster
-            report.resource_tags = cluster.tags
+        for cluster in kafka_client.clusters.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             report.status = "PASS"
             report.status_extended = (
                 f"Kafka cluster '{cluster.name}' is using the latest version."

prowler/providers/aws/services/kafka/kafka_connector_in_transit_encryption_enabled/kafka_connector_in_transit_encryption_enabled.py

@@ -6,11 +6,10 @@ class kafka_connector_in_transit_encryption_enabled(Check):
     def execute(self):
         findings = []
 
-        for arn_connector, connector in kafkaconnect_client.connectors.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = connector.region
-            report.resource_id = connector.name
-            report.resource_arn = arn_connector
+        for connector in kafkaconnect_client.connectors.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=connector
+            )
             report.status = "FAIL"
             report.status_extended = f"Kafka connector {connector.name} does not have encryption in transit enabled."
 

prowler/providers/aws/services/kafka/kafka_service.py

@@ -31,6 +31,7 @@ class Kafka(AWSService):
                         self.clusters[cluster.get("ClusterArn", "")] = Cluster(
                             id=arn.split(":")[-1].split("/")[-1],
                             name=cluster.get("ClusterName", ""),
+                            arn=arn,
                             region=regional_client.region,
                             tags=list(cluster.get("Tags", {})),
                             state=cluster.get("State", ""),
@@ -98,6 +99,7 @@ class EncryptionInTransit(BaseModel):
 class Cluster(BaseModel):
     id: str
     name: str
+    arn: str
     region: str
     tags: list
     kafka_version: str

prowler/providers/aws/services/kinesis/kinesis_stream_data_retention_period/kinesis_stream_data_retention_period.py

@@ -18,11 +18,9 @@ class kinesis_stream_data_retention_period(Check):
         """
         findings = []
         for stream in kinesis_client.streams.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = stream.region
-            report.resource_id = stream.name
-            report.resource_arn = stream.arn
-            report.resource_tags = stream.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=stream
+            )
             report.status = "FAIL"
             report.status_extended = f"Kinesis Stream {stream.name} does not have an adequate data retention period ({stream.retention_period}hrs)."
 

prowler/providers/aws/services/kinesis/kinesis_stream_encrypted_at_rest/kinesis_stream_encrypted_at_rest.py

@@ -7,11 +7,9 @@ class kinesis_stream_encrypted_at_rest(Check):
     def execute(self):
         findings = []
         for stream in kinesis_client.streams.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = stream.region
-            report.resource_id = stream.name
-            report.resource_arn = stream.arn
-            report.resource_tags = stream.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=stream
+            )
             report.status = "FAIL"
             report.status_extended = (
                 f"Kinesis Stream {stream.name} is not encrypted at rest."

prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.py

@@ -8,11 +8,9 @@ class kms_cmk_are_used(Check):
         for key in kms_client.keys:
             # Only check CMKs keys
             if key.manager == "CUSTOMER":
-                report = Check_Report_AWS(self.metadata())
-                report.region = key.region
-                report.resource_id = key.id
-                report.resource_arn = key.arn
-                report.resource_tags = key.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=key
+                )
                 if key.state != "Enabled":
                     if key.state == "PendingDeletion":
                         report.status = "PASS"

prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.py

@@ -8,15 +8,13 @@ class kms_cmk_not_deleted_unintentionally(Check):
         for key in kms_client.keys:
             if key.manager == "CUSTOMER":
                 if key.state != "Disabled" or kms_client.provider.scan_unused_services:
-                    report = Check_Report_AWS(self.metadata())
-                    report.region = key.region
-                    report.resource_tags = key.tags
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource_metadata=key
+                    )
                     report.status = "PASS"
                     report.status_extended = (
                         f"KMS CMK {key.id} is not scheduled for deletion."
                     )
-                    report.resource_id = key.id
-                    report.resource_arn = key.arn
                     if key.state == "PendingDeletion":
                         report.status = "FAIL"
                         report.status_extended = f"KMS CMK {key.id} is scheduled for deletion, revert it if it was unintentionally."

prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.py

@@ -6,9 +6,7 @@ class kms_cmk_rotation_enabled(Check):
     def execute(self):
         findings = []
         for key in kms_client.keys:
-            report = Check_Report_AWS(self.metadata())
-            report.region = key.region
-            report.resource_tags = key.tags
+            report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=key)
             # Only check enabled CMKs keys
             if (
                 key.manager == "CUSTOMER"
@@ -20,14 +18,10 @@ class kms_cmk_rotation_enabled(Check):
                     report.status_extended = (
                         f"KMS CMK {key.id} has automatic rotation enabled."
                     )
-                    report.resource_id = key.id
-                    report.resource_arn = key.arn
                 else:
                     report.status = "FAIL"
                     report.status_extended = (
                         f"KMS CMK {key.id} has automatic rotation disabled."
                     )
-                    report.resource_id = key.id
-                    report.resource_arn = key.arn
                 findings.append(report)
         return findings

prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.py

@@ -10,13 +10,11 @@ class kms_key_not_publicly_accessible(Check):
             if (
                 key.manager == "CUSTOMER" and key.state == "Enabled"
             ):  # only customer KMS have policies
-                report = Check_Report_AWS(self.metadata())
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=key
+                )
                 report.status = "PASS"
                 report.status_extended = f"KMS key {key.id} is not exposed to Public."
-                report.resource_id = key.id
-                report.resource_arn = key.arn
-                report.resource_tags = key.tags
-                report.region = key.region
                 # If the "Principal" element value is set to { "AWS": "*" } and the policy statement is not using any Condition clauses to filter the access, the selected AWS KMS master key is publicly accessible.
                 if is_policy_public(
                     key.policy,

prowler/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public.py

@@ -6,12 +6,10 @@ class lightsail_database_public(Check):
     def execute(self):
         findings = []
 
-        for arn_database, database in lightsail_client.databases.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = database.region
-            report.resource_id = database.id
-            report.resource_arn = arn_database
-            report.resource_tags = database.tags
+        for database in lightsail_client.databases.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=database
+            )
             report.status = "FAIL"
             report.status_extended = f"Database '{database.name}' is public."
 

prowler/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots.py

@@ -5,12 +5,10 @@ from prowler.providers.aws.services.lightsail.lightsail_client import lightsail_
 class lightsail_instance_automated_snapshots(Check):
     def execute(self):
         findings = []
-        for arn_instance, instance in lightsail_client.instances.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = instance.region
-            report.resource_id = instance.id
-            report.resource_arn = arn_instance
-            report.resource_tags = instance.tags
+        for instance in lightsail_client.instances.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=instance
+            )
             report.status = "FAIL"
             report.status_extended = (
                 f"Instance '{instance.name}' does not have automated snapshots enabled."

prowler/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public.py

@@ -6,12 +6,10 @@ class lightsail_instance_public(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
 
-        for arn_instance, instance in lightsail_client.instances.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = instance.region
-            report.resource_id = instance.id
-            report.resource_arn = arn_instance
-            report.resource_tags = instance.tags
+        for instance in lightsail_client.instances.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=instance
+            )
             report.status = "PASS"
             report.status_extended = (
                 f"Instance '{instance.name}' is not publicly exposed."

prowler/providers/aws/services/lightsail/lightsail_service.py

@@ -66,6 +66,7 @@ class Lightsail(AWSService):
                         self.instances[arn] = Instance(
                             name=instance.get("name", ""),
                             id=instance.get("supportCode", ""),
+                            arn=arn,
                             tags=instance.get("tags", []),
                             region=instance.get(
                                 "location", {"regionName": regional_client.region}
@@ -106,6 +107,7 @@ class Lightsail(AWSService):
                         self.databases[arn] = Database(
                             name=database.get("name", ""),
                             id=database.get("supportCode", ""),
+                            arn=arn,
                             tags=database.get("tags", []),
                             region=database.get(
                                 "location", {"regionName": regional_client.region}
@@ -142,6 +144,7 @@ class Lightsail(AWSService):
                         self.static_ips[arn] = StaticIP(
                             name=static_ip.get("name", ""),
                             id=static_ip.get("supportCode", ""),
+                            arn=arn,
                             region=static_ip.get(
                                 "location", {"regionName": regional_client.region}
                             ).get("regionName", ""),
@@ -169,6 +172,7 @@ class PortRange(BaseModel):
 class Instance(BaseModel):
     name: str
     id: str
+    arn: str
     tags: List[Dict[str, str]]
     region: str
     availability_zone: str
@@ -184,6 +188,7 @@ class Instance(BaseModel):
 class Database(BaseModel):
     name: str
     id: str
+    arn: str
     tags: List[Dict[str, str]]
     region: str
     availability_zone: str
@@ -197,6 +202,7 @@ class Database(BaseModel):
 class StaticIP(BaseModel):
     name: str
     id: str
+    arn: str
     region: str
     availability_zone: str
     ip_address: str

prowler/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused.py

@@ -6,12 +6,10 @@ class lightsail_static_ip_unused(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
 
-        for arn_static_ip, static_ip in lightsail_client.static_ips.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = static_ip.region
-            report.resource_id = static_ip.id
-            report.resource_arn = arn_static_ip
-            report.resource_tags = []
+        for static_ip in lightsail_client.static_ips.values():
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=static_ip
+            )
             report.status = "FAIL"
             report.status_extended = (
                 f"Static IP '{static_ip.name}' is not associated with any instance."

prowler/providers/aws/services/macie/macie_automated_sensitive_data_discovery_enabled/macie_automated_sensitive_data_discovery_enabled.py

@@ -7,8 +7,9 @@ class macie_automated_sensitive_data_discovery_enabled(Check):
         findings = []
         for session in macie_client.sessions:
             if session.status == "ENABLED":
-                report = Check_Report_AWS(self.metadata())
-                report.region = session.region
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=session
+                )
                 report.resource_arn = macie_client._get_session_arn_template(
                     session.region
                 )

prowler/providers/aws/services/macie/macie_is_enabled/macie_is_enabled.py

@@ -7,8 +7,9 @@ class macie_is_enabled(Check):
     def execute(self):
         findings = []
         for session in macie_client.sessions:
-            report = Check_Report_AWS(self.metadata())
-            report.region = session.region
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=session
+            )
             report.resource_arn = macie_client._get_session_arn_template(session.region)
             report.resource_id = macie_client.audited_account
             if session.status == "ENABLED":

prowler/providers/aws/services/memorydb/memorydb_cluster_auto_minor_version_upgrades/memorydb_cluster_auto_minor_version_upgrades.py

@@ -6,10 +6,9 @@ class memorydb_cluster_auto_minor_version_upgrades(Check):
     def execute(self):
         findings = []
         for cluster in memorydb_client.clusters.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = cluster.region
-            report.resource_id = cluster.name
-            report.resource_arn = cluster.arn
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=cluster
+            )
             if cluster.auto_minor_version_upgrade:
                 report.status = "PASS"
                 report.status_extended = f"Memory DB Cluster {cluster.name} has minor version upgrade enabled."

prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py

@@ -8,11 +8,9 @@ class mq_broker_active_deployment_mode(Check):
         findings = []
         for broker in mq_client.brokers.values():
             if broker.engine_type == EngineType.ACTIVEMQ:
-                report = Check_Report_AWS(self.metadata())
-                report.region = broker.region
-                report.resource_id = broker.id
-                report.resource_arn = broker.arn
-                report.resource_tags = broker.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=broker
+                )
                 report.status = "FAIL"
                 report.status_extended = f"MQ Apache ActiveMQ Broker {broker.name} does not have an active/standby deployment mode."
                 if broker.deployment_mode == DeploymentMode.ACTIVE_STANDBY_MULTI_AZ:

prowler/providers/aws/services/mq/mq_broker_auto_minor_version_upgrades/mq_broker_auto_minor_version_upgrades.py

@@ -6,11 +6,9 @@ class mq_broker_auto_minor_version_upgrades(Check):
     def execute(self):
         findings = []
         for broker in mq_client.brokers.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = broker.region
-            report.resource_id = broker.id
-            report.resource_arn = broker.arn
-            report.resource_tags = broker.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=broker
+            )
             report.status = "PASS"
             report.status_extended = f"MQ Broker {broker.name} does have automated minor version upgrades enabled."
 

prowler/providers/aws/services/mq/mq_broker_cluster_deployment_mode/mq_broker_cluster_deployment_mode.py

@@ -20,11 +20,9 @@ class mq_broker_cluster_deployment_mode(Check):
         findings = []
         for broker in mq_client.brokers.values():
             if broker.engine_type == EngineType.RABBITMQ:
-                report = Check_Report_AWS(self.metadata())
-                report.region = broker.region
-                report.resource_id = broker.id
-                report.resource_arn = broker.arn
-                report.resource_tags = broker.tags
+                report = Check_Report_AWS(
+                    metadata=self.metadata(), resource_metadata=broker
+                )
                 report.status = "FAIL"
                 report.status_extended = f"MQ RabbitMQ Broker {broker.name} does not have a cluster deployment mode."
                 if broker.deployment_mode == DeploymentMode.CLUSTER_MULTI_AZ:

prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py

@@ -16,11 +16,9 @@ class mq_broker_logging_enabled(Check):
         """
         findings = []
         for broker in mq_client.brokers.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = broker.region
-            report.resource_id = broker.id
-            report.resource_arn = broker.arn
-            report.resource_tags = broker.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=broker
+            )
             report.status = "FAIL"
             report.status_extended = (
                 f"MQ Broker {broker.name} does not have logging enabled."

prowler/providers/aws/services/mq/mq_broker_not_publicly_accessible/mq_broker_not_publicly_accessible.py

@@ -6,11 +6,9 @@ class mq_broker_not_publicly_accessible(Check):
     def execute(self):
         findings = []
         for broker in mq_client.brokers.values():
-            report = Check_Report_AWS(self.metadata())
-            report.region = broker.region
-            report.resource_id = broker.id
-            report.resource_arn = broker.arn
-            report.resource_tags = broker.tags
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource_metadata=broker
+            )
             report.status = "FAIL"
             report.status_extended = f"MQ Broker {broker.name} is publicly accessible."