From ec5f2b3753bdf57ac67d8d2472b8c42ab02df816 Mon Sep 17 00:00:00 2001 From: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com> Date: Wed, 15 Jan 2025 23:15:50 +0100 Subject: [PATCH] chore(aws): add resource metadata to services from `f` to `o` (#6545) --- .../firehose_stream_encrypted_at_rest.py | 8 +++----- .../fms_policy_compliant.py | 12 ++++++++---- ...ile_system_copy_tags_to_backups_enabled.py | 8 +++----- ...ile_system_copy_tags_to_volumes_enabled.py | 8 +++----- ...sx_windows_file_system_multi_az_enabled.py | 8 +++----- .../glacier_vaults_policy_public_access.py | 6 +----- ...connection_passwords_encryption_enabled.py | 5 +++-- ...ta_catalogs_metadata_encryption_enabled.py | 5 +++-- ...e_data_catalogs_not_publicly_accessible.py | 5 +++-- .../glue_database_connections_ssl_enabled.py | 6 +----- ...ints_cloudwatch_logs_encryption_enabled.py | 8 +++----- ...dpoints_job_bookmark_encryption_enabled.py | 8 +++----- ...lopment_endpoints_s3_encryption_enabled.py | 8 +++----- ...e_etl_jobs_amazon_s3_encryption_enabled.py | 6 +----- ...jobs_cloudwatch_logs_encryption_enabled.py | 6 +----- ...tl_jobs_job_bookmark_encryption_enabled.py | 6 +----- .../glue_etl_jobs_logging_enabled.py | 6 +----- .../glue_ml_transform_encrypted_at_rest.py | 10 ++++------ .../guardduty_centrally_managed.py | 8 +++----- ...uardduty_ec2_malware_protection_enabled.py | 8 +++----- .../guardduty_eks_audit_log_enabled.py | 8 +++----- ...uardduty_eks_runtime_monitoring_enabled.py | 8 +++----- .../guardduty_is_enabled.py | 8 +++----- .../guardduty_lambda_protection_enabled.py | 8 +++----- .../guardduty_no_high_severity_findings.py | 8 +++----- .../guardduty_rds_protection_enabled.py | 8 +++----- .../guardduty_s3_protection_enabled.py | 8 +++----- .../iam_administrator_access_with_mfa.py | 4 +--- .../iam_avoid_root_usage.py | 4 +++- ...hed_policy_no_administrative_privileges.py | 7 +++---- .../iam_check_saml_providers_sts.py | 13 +++++++------ ...hed_policy_no_administrative_privileges.py | 7 +++---- ...hed_policy_no_administrative_privileges.py | 7 +++---- .../iam_group_administrator_access_policy.py | 4 +--- ...line_policy_allows_privilege_escalation.py | 6 +++--- ...ine_policy_no_administrative_privileges.py | 6 +++--- ...ine_policy_no_full_access_to_cloudtrail.py | 6 +++--- ...iam_inline_policy_no_full_access_to_kms.py | 6 +++--- ...ustom_policy_permissive_role_assumption.py | 7 +++---- ...m_no_expired_server_certificates_stored.py | 7 +++---- .../iam_no_root_access_key.py | 4 +++- ...xpires_passwords_within_90_days_or_less.py | 4 +++- .../iam_password_policy_lowercase.py | 4 +++- .../iam_password_policy_minimum_length_14.py | 4 +++- .../iam_password_policy_number.py | 4 +++- .../iam_password_policy_reuse_24.py | 4 +++- .../iam_password_policy_symbol.py | 4 +++- .../iam_password_policy_uppercase.py | 4 +++- .../iam_policy_allows_privilege_escalation.py | 7 +++---- ..._policy_attached_only_to_group_or_roles.py | 19 +++++++++---------- ...am_policy_cloudshell_admin_not_attached.py | 5 ++++- ...iam_policy_no_full_access_to_cloudtrail.py | 7 +++---- .../iam_policy_no_full_access_to_kms.py | 7 +++---- .../iam_role_administratoraccess_policy.py | 7 +++---- ...ole_cross_account_readonlyaccess_policy.py | 7 +++---- ...ross_service_confused_deputy_prevention.py | 7 +++---- ...iam_root_credentials_management_enabled.py | 5 ++++- .../iam_root_hardware_mfa_enabled.py | 5 ++++- .../iam_root_mfa_enabled.py | 4 +++- .../iam_rotate_access_key_90_days.py | 16 ++++++++++++---- .../iam_securityaudit_role_created.py | 5 ++++- .../iam_support_role_created.py | 5 ++++- .../iam_user_accesskey_unused.py | 4 +++- .../iam_user_administrator_access_policy.py | 5 +---- .../iam_user_console_access_unused.py | 5 +---- .../iam_user_hardware_mfa_enabled.py | 5 +---- .../iam_user_mfa_enabled_console_access.py | 4 +++- .../iam_user_no_setup_initial_access_key.py | 2 +- .../iam_user_two_active_access_key.py | 4 +++- .../iam_user_with_temporary_credentials.py | 5 ++++- .../inspector2_active_findings_exist.py | 7 +++---- .../inspector2_is_enabled.py | 7 +++---- ...fka_cluster_encryption_at_rest_uses_cmk.py | 10 ++++------ ...fka_cluster_enhanced_monitoring_enabled.py | 10 ++++------ ...a_cluster_in_transit_encryption_enabled.py | 10 ++++------ .../kafka_cluster_is_public.py | 10 ++++------ ...uster_mutual_tls_authentication_enabled.py | 10 ++++------ ...ka_cluster_unrestricted_access_disabled.py | 10 ++++------ .../kafka_cluster_uses_latest_version.py | 10 ++++------ ...connector_in_transit_encryption_enabled.py | 9 ++++----- .../aws/services/kafka/kafka_service.py | 2 ++ .../kinesis_stream_data_retention_period.py | 8 +++----- .../kinesis_stream_encrypted_at_rest.py | 8 +++----- .../kms/kms_cmk_are_used/kms_cmk_are_used.py | 8 +++----- .../kms_cmk_not_deleted_unintentionally.py | 8 +++----- .../kms_cmk_rotation_enabled.py | 8 +------- .../kms_key_not_publicly_accessible.py | 8 +++----- .../lightsail_database_public.py | 10 ++++------ .../lightsail_instance_automated_snapshots.py | 10 ++++------ .../lightsail_instance_public.py | 10 ++++------ .../services/lightsail/lightsail_service.py | 6 ++++++ .../lightsail_static_ip_unused.py | 10 ++++------ ...omated_sensitive_data_discovery_enabled.py | 5 +++-- .../macie_is_enabled/macie_is_enabled.py | 5 +++-- ...ydb_cluster_auto_minor_version_upgrades.py | 7 +++---- .../mq_broker_active_deployment_mode.py | 8 +++----- .../mq_broker_auto_minor_version_upgrades.py | 8 +++----- .../mq_broker_cluster_deployment_mode.py | 8 +++----- .../mq_broker_logging_enabled.py | 8 +++----- .../mq_broker_not_publicly_accessible.py | 8 +++----- .../neptune_cluster_backup_enabled.py | 7 +++---- .../neptune_cluster_copy_tags_to_snapshots.py | 10 ++++------ .../neptune_cluster_deletion_protection.py | 7 +++---- ...tune_cluster_iam_authentication_enabled.py | 7 +++---- ...une_cluster_integration_cloudwatch_logs.py | 7 +++---- .../neptune_cluster_multi_az.py | 7 +++---- .../neptune_cluster_public_snapshot.py | 8 +++----- .../neptune_cluster_snapshot_encrypted.py | 8 +++----- .../neptune_cluster_storage_encrypted.py | 7 +++---- .../neptune_cluster_uses_public_subnet.py | 8 +++----- .../networkfirewall_deletion_protection.py | 10 ++++------ .../networkfirewall_in_all_vpc.py | 8 +++----- .../networkfirewall_logging_enabled.py | 10 ++++------ .../networkfirewall_multi_az.py | 8 +++----- ...olicy_default_action_fragmented_packets.py | 10 ++++------ ...wall_policy_default_action_full_packets.py | 10 ++++------ ...rkfirewall_policy_rule_group_associated.py | 8 +++----- ..._service_domains_access_control_enabled.py | 8 +++----- ...h_service_domains_audit_logging_enabled.py | 8 +++----- ...vice_domains_cloudwatch_logging_enabled.py | 8 +++----- ...vice_domains_encryption_at_rest_enabled.py | 8 +++----- ...rvice_domains_fault_tolerant_data_nodes.py | 8 +++----- ...ice_domains_fault_tolerant_master_nodes.py | 8 +++----- ...e_domains_https_communications_enforced.py | 8 +++----- ..._domains_internal_user_database_enabled.py | 8 +++----- ...domains_node_to_node_encryption_enabled.py | 8 +++----- ...service_domains_not_publicly_accessible.py | 8 +++----- ..._to_the_latest_service_software_version.py | 8 +++----- ...s_use_cognito_authentication_for_kibana.py | 8 +++----- ...nizations_account_part_of_organizations.py | 7 ++++--- .../organizations_delegated_administrators.py | 7 ++++--- ...rganizations_opt_out_ai_services_policy.py | 7 ++++--- .../organizations_scp_check_deny_regions.py | 7 ++++--- ...ions_tags_policies_enabled_and_attached.py | 7 ++++--- ...luster_encryption_at_rest_uses_cmk_test.py | 2 ++ ...luster_enhanced_monitoring_enabled_test.py | 2 ++ ...ster_in_transit_encryption_enabled_test.py | 3 +++ .../kafka_cluster_is_public_test.py | 2 ++ ..._mutual_tls_authentication_enabled_test.py | 2 ++ ...uster_unrestricted_access_disabled_test.py | 2 ++ .../kafka_cluster_uses_latest_version_test.py | 2 ++ .../aws/services/kafka/kafka_service_test.py | 1 + .../lightsail_database_public_test.py | 2 ++ ...tsail_instance_automated_snapshots_test.py | 2 ++ .../lightsail_instance_public_test.py | 2 ++ .../lightsail/lightsail_service_test.py | 12 ++++++++++++ .../lightsail_static_ip_unused_test.py | 2 ++ 147 files changed, 467 insertions(+), 543 deletions(-) diff --git a/prowler/providers/aws/services/firehose/firehose_stream_encrypted_at_rest/firehose_stream_encrypted_at_rest.py b/prowler/providers/aws/services/firehose/firehose_stream_encrypted_at_rest/firehose_stream_encrypted_at_rest.py index 0430b3d184..4fb4306d5e 100644 --- a/prowler/providers/aws/services/firehose/firehose_stream_encrypted_at_rest/firehose_stream_encrypted_at_rest.py +++ b/prowler/providers/aws/services/firehose/firehose_stream_encrypted_at_rest/firehose_stream_encrypted_at_rest.py @@ -21,11 +21,9 @@ class firehose_stream_encrypted_at_rest(Check): """ findings = [] for stream in firehose_client.delivery_streams.values(): - report = Check_Report_AWS(self.metadata()) - report.region = stream.region - report.resource_id = stream.name - report.resource_arn = stream.arn - report.resource_tags = stream.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stream + ) report.status = "PASS" report.status_extended = ( f"Firehose Stream {stream.name} does have at rest encryption enabled." diff --git a/prowler/providers/aws/services/fms/fms_policy_compliant/fms_policy_compliant.py b/prowler/providers/aws/services/fms/fms_policy_compliant/fms_policy_compliant.py index 9c94974c0d..9bc8959b92 100644 --- a/prowler/providers/aws/services/fms/fms_policy_compliant/fms_policy_compliant.py +++ b/prowler/providers/aws/services/fms/fms_policy_compliant/fms_policy_compliant.py @@ -6,10 +6,12 @@ class fms_policy_compliant(Check): def execute(self): findings = [] if fms_client.fms_admin_account: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=fms_client.fms_policies + ) + report.region = fms_client.region report.resource_arn = fms_client.policy_arn_template report.resource_id = fms_client.audited_account - report.region = fms_client.region report.status = "PASS" report.status_extended = "FMS enabled with all compliant accounts." non_compliant_policy = False @@ -20,10 +22,12 @@ class fms_policy_compliant(Check): policy_to_account.status == "NON_COMPLIANT" or not policy_to_account.status ): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.status = "FAIL" report.status_extended = f"FMS with non-compliant policy {policy.name} for account {policy_to_account.account_id}." - report.resource_id = policy.id - report.resource_arn = policy.arn + report.region = fms_client.region non_compliant_policy = True break if non_compliant_policy: diff --git a/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_backups_enabled/fsx_file_system_copy_tags_to_backups_enabled.py b/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_backups_enabled/fsx_file_system_copy_tags_to_backups_enabled.py index a4892c5fa3..a80d91ac4e 100644 --- a/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_backups_enabled/fsx_file_system_copy_tags_to_backups_enabled.py +++ b/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_backups_enabled/fsx_file_system_copy_tags_to_backups_enabled.py @@ -7,11 +7,9 @@ class fsx_file_system_copy_tags_to_backups_enabled(Check): findings = [] for file_system in fsx_client.file_systems.values(): if file_system.copy_tags_to_backups is not None: - report = Check_Report_AWS(self.metadata()) - report.region = file_system.region - report.resource_id = file_system.id - report.resource_arn = file_system.arn - report.resource_tags = file_system.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=file_system + ) report.status = "PASS" report.status_extended = f"FSx file system {file_system.id} has copy tags to backups enabled." diff --git a/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_volumes_enabled/fsx_file_system_copy_tags_to_volumes_enabled.py b/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_volumes_enabled/fsx_file_system_copy_tags_to_volumes_enabled.py index 0f3b7a03d8..dbb88c4839 100644 --- a/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_volumes_enabled/fsx_file_system_copy_tags_to_volumes_enabled.py +++ b/prowler/providers/aws/services/fsx/fsx_file_system_copy_tags_to_volumes_enabled/fsx_file_system_copy_tags_to_volumes_enabled.py @@ -7,11 +7,9 @@ class fsx_file_system_copy_tags_to_volumes_enabled(Check): findings = [] for file_system in fsx_client.file_systems.values(): if file_system.copy_tags_to_volumes is not None: - report = Check_Report_AWS(self.metadata()) - report.region = file_system.region - report.resource_id = file_system.id - report.resource_arn = file_system.arn - report.resource_tags = file_system.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=file_system + ) report.status = "PASS" report.status_extended = f"FSx file system {file_system.id} has copy tags to volumes enabled." diff --git a/prowler/providers/aws/services/fsx/fsx_windows_file_system_multi_az_enabled/fsx_windows_file_system_multi_az_enabled.py b/prowler/providers/aws/services/fsx/fsx_windows_file_system_multi_az_enabled/fsx_windows_file_system_multi_az_enabled.py index f0c6c3990f..a1fb9ad1f1 100644 --- a/prowler/providers/aws/services/fsx/fsx_windows_file_system_multi_az_enabled/fsx_windows_file_system_multi_az_enabled.py +++ b/prowler/providers/aws/services/fsx/fsx_windows_file_system_multi_az_enabled/fsx_windows_file_system_multi_az_enabled.py @@ -7,11 +7,9 @@ class fsx_windows_file_system_multi_az_enabled(Check): findings = [] for file_system in fsx_client.file_systems.values(): if file_system.type == "WINDOWS": - report = Check_Report_AWS(self.metadata()) - report.region = file_system.region - report.resource_id = file_system.id - report.resource_arn = file_system.arn - report.resource_tags = file_system.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=file_system + ) if len(file_system.subnet_ids) > 1: report.status = "PASS" report.status_extended = f"FSx Windows file system {file_system.id} is configured for Multi-AZ deployment." diff --git a/prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access.py b/prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access.py index 6d2fb89131..66fccd1783 100644 --- a/prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access.py +++ b/prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access.py @@ -6,11 +6,7 @@ class glacier_vaults_policy_public_access(Check): def execute(self): findings = [] for vault in glacier_client.vaults.values(): - report = Check_Report_AWS(self.metadata()) - report.region = vault.region - report.resource_id = vault.name - report.resource_arn = vault.arn - report.resource_tags = vault.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=vault) report.status = "PASS" report.status_extended = f"Vault {vault.name} has policy which does not allow access to everyone." diff --git a/prowler/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled.py index f369894a6e..46a1e57b49 100644 --- a/prowler/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_data_catalogs_connection_passwords_encryption_enabled/glue_data_catalogs_connection_passwords_encryption_enabled.py @@ -8,12 +8,13 @@ class glue_data_catalogs_connection_passwords_encryption_enabled(Check): for data_catalog in glue_client.data_catalogs.values(): # Check only if there are Glue Tables if data_catalog.tables or glue_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=data_catalog + ) report.resource_id = glue_client.audited_account report.resource_arn = glue_client._get_data_catalog_arn_template( data_catalog.region ) - report.region = data_catalog.region report.status = "FAIL" report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled.py index e1cacafd6c..bbf1ec9e00 100644 --- a/prowler/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_data_catalogs_metadata_encryption_enabled/glue_data_catalogs_metadata_encryption_enabled.py @@ -8,12 +8,13 @@ class glue_data_catalogs_metadata_encryption_enabled(Check): for data_catalog in glue_client.data_catalogs.values(): # Check only if there are Glue Tables if data_catalog.tables or glue_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=data_catalog + ) report.resource_id = glue_client.audited_account report.resource_arn = glue_client._get_data_catalog_arn_template( data_catalog.region ) - report.region = data_catalog.region report.status = "FAIL" report.status_extended = ( "Glue data catalog settings have metadata encryption disabled." diff --git a/prowler/providers/aws/services/glue/glue_data_catalogs_not_publicly_accessible/glue_data_catalogs_not_publicly_accessible.py b/prowler/providers/aws/services/glue/glue_data_catalogs_not_publicly_accessible/glue_data_catalogs_not_publicly_accessible.py index 9f74923b35..b005d9a642 100644 --- a/prowler/providers/aws/services/glue/glue_data_catalogs_not_publicly_accessible/glue_data_catalogs_not_publicly_accessible.py +++ b/prowler/providers/aws/services/glue/glue_data_catalogs_not_publicly_accessible/glue_data_catalogs_not_publicly_accessible.py @@ -7,8 +7,9 @@ class glue_data_catalogs_not_publicly_accessible(Check): def execute(self): findings = [] for data_catalog in glue_client.data_catalogs.values(): - report = Check_Report_AWS(self.metadata()) - report.region = data_catalog.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=data_catalog + ) report.resource_id = glue_client.audited_account report.resource_arn = glue_client._get_data_catalog_arn_template( data_catalog.region diff --git a/prowler/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled.py b/prowler/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled.py index f2ccf2feed..b5395d0b8e 100644 --- a/prowler/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled.py +++ b/prowler/providers/aws/services/glue/glue_database_connections_ssl_enabled/glue_database_connections_ssl_enabled.py @@ -6,11 +6,7 @@ class glue_database_connections_ssl_enabled(Check): def execute(self): findings = [] for conn in glue_client.connections: - report = Check_Report_AWS(self.metadata()) - report.resource_id = conn.name - report.resource_arn = conn.arn - report.region = conn.region - report.resource_tags = conn.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=conn) report.status = "FAIL" report.status_extended = ( f"Glue connection {conn.name} has SSL connection disabled." diff --git a/prowler/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled.py index 01f022a605..767ead6016 100644 --- a/prowler/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_development_endpoints_cloudwatch_logs_encryption_enabled/glue_development_endpoints_cloudwatch_logs_encryption_enabled.py @@ -7,11 +7,9 @@ class glue_development_endpoints_cloudwatch_logs_encryption_enabled(Check): findings = [] for endpoint in glue_client.dev_endpoints: no_sec_configs = True - report = Check_Report_AWS(self.metadata()) - report.resource_id = endpoint.name - report.resource_arn = endpoint.arn - report.region = endpoint.region - report.resource_tags = endpoint.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) for sec_config in glue_client.security_configs: if sec_config.name == endpoint.security: no_sec_configs = False diff --git a/prowler/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled.py index c1011d4c74..91e751c874 100644 --- a/prowler/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_development_endpoints_job_bookmark_encryption_enabled/glue_development_endpoints_job_bookmark_encryption_enabled.py @@ -7,11 +7,9 @@ class glue_development_endpoints_job_bookmark_encryption_enabled(Check): findings = [] for endpoint in glue_client.dev_endpoints: no_sec_configs = True - report = Check_Report_AWS(self.metadata()) - report.resource_id = endpoint.name - report.resource_arn = endpoint.arn - report.region = endpoint.region - report.resource_tags = endpoint.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) for sec_config in glue_client.security_configs: if sec_config.name == endpoint.security: no_sec_configs = False diff --git a/prowler/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled.py index 5e929ee7de..fb4ba04ffa 100644 --- a/prowler/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_development_endpoints_s3_encryption_enabled/glue_development_endpoints_s3_encryption_enabled.py @@ -7,11 +7,9 @@ class glue_development_endpoints_s3_encryption_enabled(Check): findings = [] for endpoint in glue_client.dev_endpoints: no_sec_configs = True - report = Check_Report_AWS(self.metadata()) - report.resource_id = endpoint.name - report.resource_arn = endpoint.arn - report.region = endpoint.region - report.resource_tags = endpoint.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) for sec_config in glue_client.security_configs: if sec_config.name == endpoint.security: no_sec_configs = False diff --git a/prowler/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled.py index b76fa9f49f..9199a2def9 100644 --- a/prowler/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_etl_jobs_amazon_s3_encryption_enabled/glue_etl_jobs_amazon_s3_encryption_enabled.py @@ -7,11 +7,7 @@ class glue_etl_jobs_amazon_s3_encryption_enabled(Check): findings = [] for job in glue_client.jobs: no_sec_configs = True - report = Check_Report_AWS(self.metadata()) - report.resource_id = job.name - report.resource_arn = job.arn - report.region = job.region - report.resource_tags = job.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job) for sec_config in glue_client.security_configs: if sec_config.name == job.security: no_sec_configs = False diff --git a/prowler/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled.py index 90eb6a5c08..ab40558a50 100644 --- a/prowler/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_etl_jobs_cloudwatch_logs_encryption_enabled/glue_etl_jobs_cloudwatch_logs_encryption_enabled.py @@ -7,11 +7,7 @@ class glue_etl_jobs_cloudwatch_logs_encryption_enabled(Check): findings = [] for job in glue_client.jobs: no_sec_configs = True - report = Check_Report_AWS(self.metadata()) - report.resource_id = job.name - report.resource_arn = job.arn - report.region = job.region - report.resource_tags = job.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job) for sec_config in glue_client.security_configs: if sec_config.name == job.security: no_sec_configs = False diff --git a/prowler/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled.py b/prowler/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled.py index 3c3f1b1c58..cf29b7106e 100644 --- a/prowler/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled.py +++ b/prowler/providers/aws/services/glue/glue_etl_jobs_job_bookmark_encryption_enabled/glue_etl_jobs_job_bookmark_encryption_enabled.py @@ -7,11 +7,7 @@ class glue_etl_jobs_job_bookmark_encryption_enabled(Check): findings = [] for job in glue_client.jobs: no_sec_configs = True - report = Check_Report_AWS(self.metadata()) - report.resource_id = job.name - report.resource_arn = job.arn - report.region = job.region - report.resource_tags = job.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job) for sec_config in glue_client.security_configs: if sec_config.name == job.security: no_sec_configs = False diff --git a/prowler/providers/aws/services/glue/glue_etl_jobs_logging_enabled/glue_etl_jobs_logging_enabled.py b/prowler/providers/aws/services/glue/glue_etl_jobs_logging_enabled/glue_etl_jobs_logging_enabled.py index d2a6596897..9a446a8c40 100644 --- a/prowler/providers/aws/services/glue/glue_etl_jobs_logging_enabled/glue_etl_jobs_logging_enabled.py +++ b/prowler/providers/aws/services/glue/glue_etl_jobs_logging_enabled/glue_etl_jobs_logging_enabled.py @@ -20,11 +20,7 @@ class glue_etl_jobs_logging_enabled(Check): """ findings = [] for job in glue_client.jobs: - report = Check_Report_AWS(self.metadata()) - report.resource_id = job.name - report.resource_arn = job.arn - report.region = job.region - report.resource_tags = job.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=job) report.status = "FAIL" report.status_extended = ( f"Glue job {job.name} does not have logging enabled." diff --git a/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py b/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py index fe56aa6113..5ab1576e5c 100644 --- a/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py +++ b/prowler/providers/aws/services/glue/glue_ml_transform_encrypted_at_rest/glue_ml_transform_encrypted_at_rest.py @@ -6,12 +6,10 @@ class glue_ml_transform_encrypted_at_rest(Check): def execute(self): findings = [] - for ml_transform_arn, ml_transform in glue_client.ml_transforms.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = ml_transform.id - report.resource_arn = ml_transform_arn - report.region = ml_transform.region - report.resource_tags = ml_transform.tags + for ml_transform in glue_client.ml_transforms.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=ml_transform + ) report.status = "PASS" report.status_extended = ( f"Glue ML Transform {ml_transform.name} is encrypted at rest." diff --git a/prowler/providers/aws/services/guardduty/guardduty_centrally_managed/guardduty_centrally_managed.py b/prowler/providers/aws/services/guardduty/guardduty_centrally_managed/guardduty_centrally_managed.py index fb6aa64c26..84b72f6164 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_centrally_managed/guardduty_centrally_managed.py +++ b/prowler/providers/aws/services/guardduty/guardduty_centrally_managed/guardduty_centrally_managed.py @@ -7,11 +7,9 @@ class guardduty_centrally_managed(Check): findings = [] for detector in guardduty_client.detectors: if detector.id and detector.enabled_in_account: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "FAIL" report.status_extended = ( f"GuardDuty detector {detector.id} is not centrally managed." diff --git a/prowler/providers/aws/services/guardduty/guardduty_ec2_malware_protection_enabled/guardduty_ec2_malware_protection_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_ec2_malware_protection_enabled/guardduty_ec2_malware_protection_enabled.py index aacf2c08f1..82122bad1a 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_ec2_malware_protection_enabled/guardduty_ec2_malware_protection_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_ec2_malware_protection_enabled/guardduty_ec2_malware_protection_enabled.py @@ -7,11 +7,9 @@ class guardduty_ec2_malware_protection_enabled(Check): findings = [] for detector in guardduty_client.detectors: if detector.status: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "FAIL" report.status_extended = f"GuardDuty detector {detector.id} does not have Malware Protection for EC2 enabled." if detector.ec2_malware_protection: diff --git a/prowler/providers/aws/services/guardduty/guardduty_eks_audit_log_enabled/guardduty_eks_audit_log_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_eks_audit_log_enabled/guardduty_eks_audit_log_enabled.py index 2cbba4148a..6a513fc57e 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_eks_audit_log_enabled/guardduty_eks_audit_log_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_eks_audit_log_enabled/guardduty_eks_audit_log_enabled.py @@ -7,11 +7,9 @@ class guardduty_eks_audit_log_enabled(Check): findings = [] for detector in guardduty_client.detectors: if detector.status: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "FAIL" report.status_extended = f"GuardDuty detector {detector.id} does not have EKS Audit Log Monitoring enabled." if detector.eks_audit_log_protection: diff --git a/prowler/providers/aws/services/guardduty/guardduty_eks_runtime_monitoring_enabled/guardduty_eks_runtime_monitoring_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_eks_runtime_monitoring_enabled/guardduty_eks_runtime_monitoring_enabled.py index 2abad2e01f..0dde63c3dc 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_eks_runtime_monitoring_enabled/guardduty_eks_runtime_monitoring_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_eks_runtime_monitoring_enabled/guardduty_eks_runtime_monitoring_enabled.py @@ -7,11 +7,9 @@ class guardduty_eks_runtime_monitoring_enabled(Check): findings = [] for detector in guardduty_client.detectors: if detector.status: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "FAIL" report.status_extended = f"GuardDuty detector {detector.id} does not have EKS Runtime Monitoring enabled." if detector.eks_runtime_monitoring: diff --git a/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py index 610eb4a0ce..733175da51 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py @@ -6,11 +6,9 @@ class guardduty_is_enabled(Check): def execute(self): findings = [] for detector in guardduty_client.detectors: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "PASS" report.status_extended = f"GuardDuty detector {detector.id} enabled." diff --git a/prowler/providers/aws/services/guardduty/guardduty_lambda_protection_enabled/guardduty_lambda_protection_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_lambda_protection_enabled/guardduty_lambda_protection_enabled.py index b304f8f788..1b4d08972e 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_lambda_protection_enabled/guardduty_lambda_protection_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_lambda_protection_enabled/guardduty_lambda_protection_enabled.py @@ -7,11 +7,9 @@ class guardduty_lambda_protection_enabled(Check): findings = [] for detector in guardduty_client.detectors: if detector.status: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "FAIL" report.status_extended = f"GuardDuty detector {detector.id} does not have Lambda Protection enabled." if detector.lambda_protection: diff --git a/prowler/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings.py b/prowler/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings.py index ad38fd96e6..5406b3d54d 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings.py +++ b/prowler/providers/aws/services/guardduty/guardduty_no_high_severity_findings/guardduty_no_high_severity_findings.py @@ -7,11 +7,9 @@ class guardduty_no_high_severity_findings(Check): findings = [] for detector in guardduty_client.detectors: if detector.id and detector.enabled_in_account: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "PASS" report.status_extended = f"GuardDuty detector {detector.id} does not have high severity findings." if len(detector.findings) > 0: diff --git a/prowler/providers/aws/services/guardduty/guardduty_rds_protection_enabled/guardduty_rds_protection_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_rds_protection_enabled/guardduty_rds_protection_enabled.py index d765c86848..7633f50ad0 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_rds_protection_enabled/guardduty_rds_protection_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_rds_protection_enabled/guardduty_rds_protection_enabled.py @@ -7,11 +7,9 @@ class guardduty_rds_protection_enabled(Check): findings = [] for detector in guardduty_client.detectors: if detector.status: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "FAIL" report.status_extended = ( "GuardDuty detector does not have RDS Protection enabled." diff --git a/prowler/providers/aws/services/guardduty/guardduty_s3_protection_enabled/guardduty_s3_protection_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_s3_protection_enabled/guardduty_s3_protection_enabled.py index 5aaf134b37..21b00e45d4 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_s3_protection_enabled/guardduty_s3_protection_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_s3_protection_enabled/guardduty_s3_protection_enabled.py @@ -7,11 +7,9 @@ class guardduty_s3_protection_enabled(Check): findings = [] for detector in guardduty_client.detectors: if detector.status: - report = Check_Report_AWS(self.metadata()) - report.region = detector.region - report.resource_id = detector.id - report.resource_arn = detector.arn - report.resource_tags = detector.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=detector + ) report.status = "FAIL" report.status_extended = ( "GuardDuty detector does not have S3 Protection enabled." diff --git a/prowler/providers/aws/services/iam/iam_administrator_access_with_mfa/iam_administrator_access_with_mfa.py b/prowler/providers/aws/services/iam/iam_administrator_access_with_mfa/iam_administrator_access_with_mfa.py index 1853de9531..fe876b51fe 100644 --- a/prowler/providers/aws/services/iam/iam_administrator_access_with_mfa/iam_administrator_access_with_mfa.py +++ b/prowler/providers/aws/services/iam/iam_administrator_access_with_mfa/iam_administrator_access_with_mfa.py @@ -8,9 +8,7 @@ class iam_administrator_access_with_mfa(Check): response = iam_client.groups for group in response: - report = Check_Report_AWS(self.metadata()) - report.resource_id = group.name - report.resource_arn = group.arn + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=group) report.region = iam_client.region report.status = "PASS" report.status_extended = f"Group {group.name} has no policies." diff --git a/prowler/providers/aws/services/iam/iam_avoid_root_usage/iam_avoid_root_usage.py b/prowler/providers/aws/services/iam/iam_avoid_root_usage/iam_avoid_root_usage.py index 00f9bdcf12..7bf9ca42db 100644 --- a/prowler/providers/aws/services/iam/iam_avoid_root_usage/iam_avoid_root_usage.py +++ b/prowler/providers/aws/services/iam/iam_avoid_root_usage/iam_avoid_root_usage.py @@ -16,7 +16,9 @@ class iam_avoid_root_usage(Check): for user in response: if user["user"] == "": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] diff --git a/prowler/providers/aws/services/iam/iam_aws_attached_policy_no_administrative_privileges/iam_aws_attached_policy_no_administrative_privileges.py b/prowler/providers/aws/services/iam/iam_aws_attached_policy_no_administrative_privileges/iam_aws_attached_policy_no_administrative_privileges.py index 97ab98c810..518daf4ab5 100644 --- a/prowler/providers/aws/services/iam/iam_aws_attached_policy_no_administrative_privileges/iam_aws_attached_policy_no_administrative_privileges.py +++ b/prowler/providers/aws/services/iam/iam_aws_attached_policy_no_administrative_privileges/iam_aws_attached_policy_no_administrative_privileges.py @@ -9,11 +9,10 @@ class iam_aws_attached_policy_no_administrative_privileges(Check): for policy in iam_client.policies: # Check only for attached AWS policies if policy.attached and policy.type == "AWS": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn - report.resource_id = policy.name - report.resource_tags = policy.tags report.status = "PASS" report.status_extended = f"{policy.type} policy {policy.name} is attached but does not allow '*:*' administrative privileges." if policy.document: diff --git a/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py b/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py index ea5c74fe78..fbe1bd168f 100644 --- a/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py +++ b/prowler/providers/aws/services/iam/iam_check_saml_providers_sts/iam_check_saml_providers_sts.py @@ -6,7 +6,9 @@ class iam_check_saml_providers_sts(Check): def execute(self) -> Check_Report_AWS: findings = [] if not iam_client.saml_providers and iam_client.saml_providers is not None: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.saml_providers + ) report.resource_id = iam_client.audited_account report.resource_arn = iam_client.audited_account_arn report.region = iam_client.region @@ -14,11 +16,10 @@ class iam_check_saml_providers_sts(Check): report.status_extended = "No SAML Providers found." findings.append(report) - for provider_arn, provider in iam_client.saml_providers.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = provider.name - report.resource_arn = provider_arn - report.resource_tags = provider.tags + for provider in iam_client.saml_providers.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=provider + ) report.region = iam_client.region report.status = "PASS" report.status_extended = f"SAML Provider {provider.name} has been found." diff --git a/prowler/providers/aws/services/iam/iam_customer_attached_policy_no_administrative_privileges/iam_customer_attached_policy_no_administrative_privileges.py b/prowler/providers/aws/services/iam/iam_customer_attached_policy_no_administrative_privileges/iam_customer_attached_policy_no_administrative_privileges.py index c2e83c92da..7d5d6013df 100644 --- a/prowler/providers/aws/services/iam/iam_customer_attached_policy_no_administrative_privileges/iam_customer_attached_policy_no_administrative_privileges.py +++ b/prowler/providers/aws/services/iam/iam_customer_attached_policy_no_administrative_privileges/iam_customer_attached_policy_no_administrative_privileges.py @@ -9,11 +9,10 @@ class iam_customer_attached_policy_no_administrative_privileges(Check): for policy in iam_client.policies: # Check only for attached custom policies if policy.attached and policy.type == "Custom": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn - report.resource_id = policy.name - report.resource_tags = policy.tags report.status = "PASS" report.status_extended = f"{policy.type} policy {policy.name} is attached but does not allow '*:*' administrative privileges." if policy.document: diff --git a/prowler/providers/aws/services/iam/iam_customer_unattached_policy_no_administrative_privileges/iam_customer_unattached_policy_no_administrative_privileges.py b/prowler/providers/aws/services/iam/iam_customer_unattached_policy_no_administrative_privileges/iam_customer_unattached_policy_no_administrative_privileges.py index cecfbd36e7..39422f064c 100644 --- a/prowler/providers/aws/services/iam/iam_customer_unattached_policy_no_administrative_privileges/iam_customer_unattached_policy_no_administrative_privileges.py +++ b/prowler/providers/aws/services/iam/iam_customer_unattached_policy_no_administrative_privileges/iam_customer_unattached_policy_no_administrative_privileges.py @@ -9,11 +9,10 @@ class iam_customer_unattached_policy_no_administrative_privileges(Check): for policy in iam_client.policies: # Check only for cutomer unattached policies if not policy.attached and policy.type == "Custom": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn - report.resource_id = policy.name - report.resource_tags = policy.tags report.status = "PASS" report.status_extended = f"{policy.type} policy {policy.name} is unattached and does not allow '*:*' administrative privileges." if policy.document: diff --git a/prowler/providers/aws/services/iam/iam_group_administrator_access_policy/iam_group_administrator_access_policy.py b/prowler/providers/aws/services/iam/iam_group_administrator_access_policy/iam_group_administrator_access_policy.py index 0bf208feeb..c46db4e790 100644 --- a/prowler/providers/aws/services/iam/iam_group_administrator_access_policy/iam_group_administrator_access_policy.py +++ b/prowler/providers/aws/services/iam/iam_group_administrator_access_policy/iam_group_administrator_access_policy.py @@ -8,10 +8,8 @@ class iam_group_administrator_access_policy(Check): def execute(self) -> List[Check_Report_AWS]: findings = [] for group in iam_client.groups: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=group) report.region = iam_client.region - report.resource_arn = group.arn - report.resource_id = group.name report.status = "PASS" report.status_extended = ( f"IAM Group {group.name} does not have AdministratorAccess policy." diff --git a/prowler/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation.py b/prowler/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation.py index 2042b8343a..c560b6c829 100644 --- a/prowler/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation.py +++ b/prowler/providers/aws/services/iam/iam_inline_policy_allows_privilege_escalation/iam_inline_policy_allows_privilege_escalation.py @@ -11,11 +11,11 @@ class iam_inline_policy_allows_privilege_escalation(Check): for policy in iam_client.policies: if policy.type == "Inline": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.resource_id = f"{policy.entity}/{policy.name}" - report.resource_arn = policy.arn report.region = iam_client.region - report.resource_tags = policy.tags report.status = "PASS" resource_type_str = report.resource_arn.split(":")[-1].split("/")[0] diff --git a/prowler/providers/aws/services/iam/iam_inline_policy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges.py b/prowler/providers/aws/services/iam/iam_inline_policy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges.py index daab80b03d..c74ff202bb 100644 --- a/prowler/providers/aws/services/iam/iam_inline_policy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges.py +++ b/prowler/providers/aws/services/iam/iam_inline_policy_no_administrative_privileges/iam_inline_policy_no_administrative_privileges.py @@ -8,11 +8,11 @@ class iam_inline_policy_no_administrative_privileges(Check): findings = [] for policy in iam_client.policies: if policy.type == "Inline": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn report.resource_id = f"{policy.entity}/{policy.name}" - report.resource_tags = policy.tags report.status = "PASS" resource_type_str = report.resource_arn.split(":")[-1].split("/")[0] diff --git a/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_cloudtrail/iam_inline_policy_no_full_access_to_cloudtrail.py b/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_cloudtrail/iam_inline_policy_no_full_access_to_cloudtrail.py index 06df9a3b6f..866ac2eb80 100644 --- a/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_cloudtrail/iam_inline_policy_no_full_access_to_cloudtrail.py +++ b/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_cloudtrail/iam_inline_policy_no_full_access_to_cloudtrail.py @@ -12,11 +12,11 @@ class iam_inline_policy_no_full_access_to_cloudtrail(Check): for policy in iam_client.policies: # Check only inline policies if policy.type == "Inline": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn report.resource_id = f"{policy.entity}/{policy.name}" - report.resource_tags = policy.tags report.status = "PASS" resource_type_str = report.resource_arn.split(":")[-1].split("/")[0] diff --git a/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_kms/iam_inline_policy_no_full_access_to_kms.py b/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_kms/iam_inline_policy_no_full_access_to_kms.py index b938a72654..fd1cacb61e 100644 --- a/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_kms/iam_inline_policy_no_full_access_to_kms.py +++ b/prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_kms/iam_inline_policy_no_full_access_to_kms.py @@ -11,11 +11,11 @@ class iam_inline_policy_no_full_access_to_kms(Check): for policy in iam_client.policies: if policy.type == "Inline": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn report.resource_id = f"{policy.entity}/{policy.name}" - report.resource_tags = policy.tags report.status = "PASS" resource_type_str = report.resource_arn.split(":")[-1].split("/")[0] diff --git a/prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py b/prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py index 5da2e67291..0cfc7e9e6f 100644 --- a/prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py +++ b/prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py @@ -8,11 +8,10 @@ class iam_no_custom_policy_permissive_role_assumption(Check): for policy in iam_client.policies: # Check only custom policies if policy.type == "Custom": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn - report.resource_id = policy.name - report.resource_tags = policy.tags report.status = "PASS" report.status_extended = f"Custom Policy {policy.name} does not allow permissive STS Role assumption." if policy.document: diff --git a/prowler/providers/aws/services/iam/iam_no_expired_server_certificates_stored/iam_no_expired_server_certificates_stored.py b/prowler/providers/aws/services/iam/iam_no_expired_server_certificates_stored/iam_no_expired_server_certificates_stored.py index 00a952f82a..e7af7ac4bc 100644 --- a/prowler/providers/aws/services/iam/iam_no_expired_server_certificates_stored/iam_no_expired_server_certificates_stored.py +++ b/prowler/providers/aws/services/iam/iam_no_expired_server_certificates_stored/iam_no_expired_server_certificates_stored.py @@ -9,11 +9,10 @@ class iam_no_expired_server_certificates_stored(Check): findings = [] for certificate in iam_client.server_certificates: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=certificate + ) report.region = iam_client.region - report.resource_id = certificate.id - report.resource_arn = certificate.arn - report.resource_tags = certificate.tags expiration_days = (datetime.now(timezone.utc) - certificate.expiration).days if expiration_days >= 0: report.status = "FAIL" diff --git a/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py b/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py index 12666439b2..8d484179c2 100644 --- a/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py +++ b/prowler/providers/aws/services/iam/iam_no_root_access_key/iam_no_root_access_key.py @@ -12,7 +12,9 @@ class iam_no_root_access_key(Check): ): for user in iam_client.credential_report: if user["user"] == "": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] diff --git a/prowler/providers/aws/services/iam/iam_password_policy_expires_passwords_within_90_days_or_less/iam_password_policy_expires_passwords_within_90_days_or_less.py b/prowler/providers/aws/services/iam/iam_password_policy_expires_passwords_within_90_days_or_less/iam_password_policy_expires_passwords_within_90_days_or_less.py index 4ae79d62ce..61a46d9299 100644 --- a/prowler/providers/aws/services/iam/iam_password_policy_expires_passwords_within_90_days_or_less/iam_password_policy_expires_passwords_within_90_days_or_less.py +++ b/prowler/providers/aws/services/iam/iam_password_policy_expires_passwords_within_90_days_or_less/iam_password_policy_expires_passwords_within_90_days_or_less.py @@ -6,7 +6,9 @@ class iam_password_policy_expires_passwords_within_90_days_or_less(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.password_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.password_policy + ) report.region = iam_client.region report.resource_arn = iam_client.password_policy_arn_template report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_password_policy_lowercase/iam_password_policy_lowercase.py b/prowler/providers/aws/services/iam/iam_password_policy_lowercase/iam_password_policy_lowercase.py index 052db73bf5..e215f0bc3a 100644 --- a/prowler/providers/aws/services/iam/iam_password_policy_lowercase/iam_password_policy_lowercase.py +++ b/prowler/providers/aws/services/iam/iam_password_policy_lowercase/iam_password_policy_lowercase.py @@ -6,7 +6,9 @@ class iam_password_policy_lowercase(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.password_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.password_policy + ) report.region = iam_client.region report.resource_arn = iam_client.password_policy_arn_template report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_password_policy_minimum_length_14/iam_password_policy_minimum_length_14.py b/prowler/providers/aws/services/iam/iam_password_policy_minimum_length_14/iam_password_policy_minimum_length_14.py index 452dee6e3a..a5b06a7323 100644 --- a/prowler/providers/aws/services/iam/iam_password_policy_minimum_length_14/iam_password_policy_minimum_length_14.py +++ b/prowler/providers/aws/services/iam/iam_password_policy_minimum_length_14/iam_password_policy_minimum_length_14.py @@ -6,7 +6,9 @@ class iam_password_policy_minimum_length_14(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.password_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.password_policy + ) report.region = iam_client.region report.resource_arn = iam_client.password_policy_arn_template report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_password_policy_number/iam_password_policy_number.py b/prowler/providers/aws/services/iam/iam_password_policy_number/iam_password_policy_number.py index aaa2956efc..9c1e5f5342 100644 --- a/prowler/providers/aws/services/iam/iam_password_policy_number/iam_password_policy_number.py +++ b/prowler/providers/aws/services/iam/iam_password_policy_number/iam_password_policy_number.py @@ -6,7 +6,9 @@ class iam_password_policy_number(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.password_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.password_policy + ) report.region = iam_client.region report.resource_arn = iam_client.password_policy_arn_template report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_password_policy_reuse_24/iam_password_policy_reuse_24.py b/prowler/providers/aws/services/iam/iam_password_policy_reuse_24/iam_password_policy_reuse_24.py index 8ee47908bd..6ddeed6ed5 100644 --- a/prowler/providers/aws/services/iam/iam_password_policy_reuse_24/iam_password_policy_reuse_24.py +++ b/prowler/providers/aws/services/iam/iam_password_policy_reuse_24/iam_password_policy_reuse_24.py @@ -6,7 +6,9 @@ class iam_password_policy_reuse_24(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.password_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.password_policy + ) report.region = iam_client.region report.resource_arn = iam_client.password_policy_arn_template report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_password_policy_symbol/iam_password_policy_symbol.py b/prowler/providers/aws/services/iam/iam_password_policy_symbol/iam_password_policy_symbol.py index 2074e8e67a..68a0f85c82 100644 --- a/prowler/providers/aws/services/iam/iam_password_policy_symbol/iam_password_policy_symbol.py +++ b/prowler/providers/aws/services/iam/iam_password_policy_symbol/iam_password_policy_symbol.py @@ -6,7 +6,9 @@ class iam_password_policy_symbol(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.password_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.password_policy + ) report.region = iam_client.region report.resource_arn = iam_client.password_policy_arn_template report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_password_policy_uppercase/iam_password_policy_uppercase.py b/prowler/providers/aws/services/iam/iam_password_policy_uppercase/iam_password_policy_uppercase.py index e7afbddace..783fa035c2 100644 --- a/prowler/providers/aws/services/iam/iam_password_policy_uppercase/iam_password_policy_uppercase.py +++ b/prowler/providers/aws/services/iam/iam_password_policy_uppercase/iam_password_policy_uppercase.py @@ -6,7 +6,9 @@ class iam_password_policy_uppercase(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.password_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=iam_client.password_policy + ) report.region = iam_client.region report.resource_arn = iam_client.password_policy_arn_template report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py b/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py index 6ec759e60d..d71f555c8b 100644 --- a/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py +++ b/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.py @@ -11,11 +11,10 @@ class iam_policy_allows_privilege_escalation(Check): for policy in iam_client.policies: if policy.type == "Custom": - report = Check_Report_AWS(self.metadata()) - report.resource_id = policy.name - report.resource_arn = policy.arn + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_tags = policy.tags report.status = "PASS" report.status_extended = f"Custom Policy {report.resource_arn} does not allow privilege escalation." diff --git a/prowler/providers/aws/services/iam/iam_policy_attached_only_to_group_or_roles/iam_policy_attached_only_to_group_or_roles.py b/prowler/providers/aws/services/iam/iam_policy_attached_only_to_group_or_roles/iam_policy_attached_only_to_group_or_roles.py index 512faca0b0..e04f8a5bc7 100644 --- a/prowler/providers/aws/services/iam/iam_policy_attached_only_to_group_or_roles/iam_policy_attached_only_to_group_or_roles.py +++ b/prowler/providers/aws/services/iam/iam_policy_attached_only_to_group_or_roles/iam_policy_attached_only_to_group_or_roles.py @@ -10,31 +10,30 @@ class iam_policy_attached_only_to_group_or_roles(Check): if user.attached_policies or user.inline_policies: if user.attached_policies: for policy in user.attached_policies: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.status = "FAIL" report.status_extended = f"User {user.name} has the policy {policy['PolicyName']} attached." report.resource_id = f"{user.name}/{policy['PolicyName']}" - report.resource_arn = user.arn - report.resource_tags = user.tags findings.append(report) if user.inline_policies: for policy in user.inline_policies: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.status = "FAIL" report.status_extended = f"User {user.name} has the inline policy {policy} attached." report.resource_id = f"{user.name}/{policy}" - report.resource_arn = user.arn - report.resource_tags = user.tags findings.append(report) else: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region - report.resource_id = user.name - report.resource_arn = user.arn - report.resource_tags = user.tags report.status = "PASS" report.status_extended = ( f"User {user.name} has no inline or attached policies." diff --git a/prowler/providers/aws/services/iam/iam_policy_cloudshell_admin_not_attached/iam_policy_cloudshell_admin_not_attached.py b/prowler/providers/aws/services/iam/iam_policy_cloudshell_admin_not_attached/iam_policy_cloudshell_admin_not_attached.py index bb40835acf..019a325d02 100644 --- a/prowler/providers/aws/services/iam/iam_policy_cloudshell_admin_not_attached/iam_policy_cloudshell_admin_not_attached.py +++ b/prowler/providers/aws/services/iam/iam_policy_cloudshell_admin_not_attached/iam_policy_cloudshell_admin_not_attached.py @@ -6,7 +6,10 @@ class iam_policy_cloudshell_admin_not_attached(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.entities_attached_to_cloudshell_policy: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=iam_client.entities_attached_to_cloudshell_policy, + ) report.region = iam_client.region report.resource_id = iam_client.audited_account report.resource_arn = f"arn:{iam_client.audited_partition}:iam::aws:policy/AWSCloudShellFullAccess" diff --git a/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_cloudtrail/iam_policy_no_full_access_to_cloudtrail.py b/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_cloudtrail/iam_policy_no_full_access_to_cloudtrail.py index a53bef880a..48e0715b36 100644 --- a/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_cloudtrail/iam_policy_no_full_access_to_cloudtrail.py +++ b/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_cloudtrail/iam_policy_no_full_access_to_cloudtrail.py @@ -11,11 +11,10 @@ class iam_policy_no_full_access_to_cloudtrail(Check): for policy in iam_client.policies: # Check only custom policies if policy.type == "Custom": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn - report.resource_id = policy.name - report.resource_tags = policy.tags report.status = "PASS" report.status_extended = f"Custom Policy {policy.name} does not allow '{critical_service}:*' privileges." diff --git a/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_kms/iam_policy_no_full_access_to_kms.py b/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_kms/iam_policy_no_full_access_to_kms.py index b85a1912ad..1c48f54794 100644 --- a/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_kms/iam_policy_no_full_access_to_kms.py +++ b/prowler/providers/aws/services/iam/iam_policy_no_full_access_to_kms/iam_policy_no_full_access_to_kms.py @@ -11,11 +11,10 @@ class iam_policy_no_full_access_to_kms(Check): for policy in iam_client.policies: # Check only custom policies if policy.type == "Custom": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=policy + ) report.region = iam_client.region - report.resource_arn = policy.arn - report.resource_id = policy.name - report.resource_tags = policy.tags report.status = "PASS" report.status_extended = f"Custom Policy {policy.name} does not allow '{critical_service}:*' privileges." diff --git a/prowler/providers/aws/services/iam/iam_role_administratoraccess_policy/iam_role_administratoraccess_policy.py b/prowler/providers/aws/services/iam/iam_role_administratoraccess_policy/iam_role_administratoraccess_policy.py index 2889f291fa..0cfcf52d0a 100644 --- a/prowler/providers/aws/services/iam/iam_role_administratoraccess_policy/iam_role_administratoraccess_policy.py +++ b/prowler/providers/aws/services/iam/iam_role_administratoraccess_policy/iam_role_administratoraccess_policy.py @@ -10,11 +10,10 @@ class iam_role_administratoraccess_policy(Check): if ( not role.is_service_role ): # Avoid service roles since they cannot be modified by the user - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=role + ) report.region = iam_client.region - report.resource_arn = role.arn - report.resource_id = role.name - report.resource_tags = role.tags report.status = "PASS" report.status_extended = f"IAM Role {role.name} does not have AdministratorAccess policy." for policy in role.attached_policies: diff --git a/prowler/providers/aws/services/iam/iam_role_cross_account_readonlyaccess_policy/iam_role_cross_account_readonlyaccess_policy.py b/prowler/providers/aws/services/iam/iam_role_cross_account_readonlyaccess_policy/iam_role_cross_account_readonlyaccess_policy.py index 4f71f0a4e5..8eae0940b3 100644 --- a/prowler/providers/aws/services/iam/iam_role_cross_account_readonlyaccess_policy/iam_role_cross_account_readonlyaccess_policy.py +++ b/prowler/providers/aws/services/iam/iam_role_cross_account_readonlyaccess_policy/iam_role_cross_account_readonlyaccess_policy.py @@ -10,11 +10,10 @@ class iam_role_cross_account_readonlyaccess_policy(Check): if ( not role.is_service_role ): # Avoid service roles since they cannot be modified by the user - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=role + ) report.region = iam_client.region - report.resource_arn = role.arn - report.resource_id = role.name - report.resource_tags = role.tags report.status = "PASS" report.status_extended = ( f"IAM Role {role.name} does not have ReadOnlyAccess policy." diff --git a/prowler/providers/aws/services/iam/iam_role_cross_service_confused_deputy_prevention/iam_role_cross_service_confused_deputy_prevention.py b/prowler/providers/aws/services/iam/iam_role_cross_service_confused_deputy_prevention/iam_role_cross_service_confused_deputy_prevention.py index 4c6cff4656..5141460a9d 100644 --- a/prowler/providers/aws/services/iam/iam_role_cross_service_confused_deputy_prevention/iam_role_cross_service_confused_deputy_prevention.py +++ b/prowler/providers/aws/services/iam/iam_role_cross_service_confused_deputy_prevention/iam_role_cross_service_confused_deputy_prevention.py @@ -10,11 +10,10 @@ class iam_role_cross_service_confused_deputy_prevention(Check): for role in iam_client.roles: # This check should only be performed against service roles (avoid Service Linked Roles since the trust relationship cannot be changed) if role.is_service_role and "aws-service-role" not in role.arn: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=role + ) report.region = iam_client.region - report.resource_arn = role.arn - report.resource_id = role.name - report.resource_tags = role.tags report.status = "FAIL" report.status_extended = f"IAM Service Role {role.name} does not prevent against a cross-service confused deputy attack." if not is_policy_public( diff --git a/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py b/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py index c5fcc0896e..16fbd6e655 100644 --- a/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py +++ b/prowler/providers/aws/services/iam/iam_root_credentials_management_enabled/iam_root_credentials_management_enabled.py @@ -13,7 +13,10 @@ class iam_root_credentials_management_enabled(Check): and organizations_client.organization.status == "ACTIVE" and iam_client.organization_features is not None ): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=iam_client.organization_features, + ) report.region = iam_client.region report.resource_arn = iam_client.audited_account_arn report.resource_id = iam_client.audited_account diff --git a/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py b/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py index 03d14d15cf..7b11522b00 100644 --- a/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py +++ b/prowler/providers/aws/services/iam/iam_root_hardware_mfa_enabled/iam_root_hardware_mfa_enabled.py @@ -14,7 +14,10 @@ class iam_root_hardware_mfa_enabled(Check): ): if iam_client.account_summary: virtual_mfa = False - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=iam_client.account_summary, + ) report.region = iam_client.region report.resource_id = "" report.resource_arn = iam_client.mfa_arn_template diff --git a/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py b/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py index 4710d47689..52579c6042 100644 --- a/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py +++ b/prowler/providers/aws/services/iam/iam_root_mfa_enabled/iam_root_mfa_enabled.py @@ -13,7 +13,9 @@ class iam_root_mfa_enabled(Check): if iam_client.credential_report: for user in iam_client.credential_report: if user["user"] == "": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] diff --git a/prowler/providers/aws/services/iam/iam_rotate_access_key_90_days/iam_rotate_access_key_90_days.py b/prowler/providers/aws/services/iam/iam_rotate_access_key_90_days/iam_rotate_access_key_90_days.py index 225b92381d..d42109e6be 100644 --- a/prowler/providers/aws/services/iam/iam_rotate_access_key_90_days/iam_rotate_access_key_90_days.py +++ b/prowler/providers/aws/services/iam/iam_rotate_access_key_90_days/iam_rotate_access_key_90_days.py @@ -25,7 +25,9 @@ class iam_rotate_access_key_90_days(Check): user["access_key_1_last_rotated"] == "N/A" and user["access_key_2_last_rotated"] == "N/A" ): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] @@ -47,7 +49,9 @@ class iam_rotate_access_key_90_days(Check): ) - parser.parse(user["access_key_1_last_rotated"]) if access_key_1_last_rotated.days > maximum_expiration_days: old_access_keys = True - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = f"{user['user']}-access-key-1" report.resource_arn = user["arn"] @@ -64,7 +68,9 @@ class iam_rotate_access_key_90_days(Check): ) - parser.parse(user["access_key_2_last_rotated"]) if access_key_2_last_rotated.days > maximum_expiration_days: old_access_keys = True - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = f"{user['user']}-access-key-2" report.resource_arn = user["arn"] @@ -74,7 +80,9 @@ class iam_rotate_access_key_90_days(Check): findings.append(report) if not old_access_keys: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] diff --git a/prowler/providers/aws/services/iam/iam_securityaudit_role_created/iam_securityaudit_role_created.py b/prowler/providers/aws/services/iam/iam_securityaudit_role_created/iam_securityaudit_role_created.py index 863b363dfe..00efd3379d 100644 --- a/prowler/providers/aws/services/iam/iam_securityaudit_role_created/iam_securityaudit_role_created.py +++ b/prowler/providers/aws/services/iam/iam_securityaudit_role_created/iam_securityaudit_role_created.py @@ -6,7 +6,10 @@ class iam_securityaudit_role_created(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.entities_role_attached_to_securityaudit_policy is not None: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=iam_client.entities_role_attached_to_securityaudit_policy, + ) report.region = iam_client.region report.resource_id = "SecurityAudit" report.resource_arn = ( diff --git a/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py b/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py index 7354135207..782380e9e5 100644 --- a/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py +++ b/prowler/providers/aws/services/iam/iam_support_role_created/iam_support_role_created.py @@ -6,7 +6,10 @@ class iam_support_role_created(Check): def execute(self) -> Check_Report_AWS: findings = [] if iam_client.entities_role_attached_to_support_policy is not None: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=iam_client.entities_role_attached_to_support_policy, + ) report.region = iam_client.region report.resource_id = iam_client.audited_account report.resource_arn = ( diff --git a/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py b/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py index 6267192d97..e8326ec88a 100644 --- a/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py +++ b/prowler/providers/aws/services/iam/iam_user_accesskey_unused/iam_user_accesskey_unused.py @@ -25,7 +25,9 @@ class iam_user_accesskey_unused(Check): user["access_key_1_active"] != "true" and user["access_key_2_active"] != "true" ): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] diff --git a/prowler/providers/aws/services/iam/iam_user_administrator_access_policy/iam_user_administrator_access_policy.py b/prowler/providers/aws/services/iam/iam_user_administrator_access_policy/iam_user_administrator_access_policy.py index 2547a485c5..7d2ff0e8cf 100644 --- a/prowler/providers/aws/services/iam/iam_user_administrator_access_policy/iam_user_administrator_access_policy.py +++ b/prowler/providers/aws/services/iam/iam_user_administrator_access_policy/iam_user_administrator_access_policy.py @@ -8,11 +8,8 @@ class iam_user_administrator_access_policy(Check): def execute(self) -> List[Check_Report_AWS]: findings = [] for user in iam_client.users: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user) report.region = iam_client.region - report.resource_arn = user.arn - report.resource_id = user.name - report.resource_tags = user.tags report.status = "PASS" report.status_extended = ( f"IAM User {user.name} does not have AdministratorAccess policy." diff --git a/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py b/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py index 06ba44a107..c05b0d3c0d 100644 --- a/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py +++ b/prowler/providers/aws/services/iam/iam_user_console_access_unused/iam_user_console_access_unused.py @@ -11,10 +11,7 @@ class iam_user_console_access_unused(Check): ) findings = [] for user in iam_client.users: - report = Check_Report_AWS(self.metadata()) - report.resource_id = user.name - report.resource_arn = user.arn - report.resource_tags = user.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user) report.region = iam_client.region if user.console_access and user.password_last_used: time_since_insertion = ( diff --git a/prowler/providers/aws/services/iam/iam_user_hardware_mfa_enabled/iam_user_hardware_mfa_enabled.py b/prowler/providers/aws/services/iam/iam_user_hardware_mfa_enabled/iam_user_hardware_mfa_enabled.py index 2507bc290d..987194242a 100644 --- a/prowler/providers/aws/services/iam/iam_user_hardware_mfa_enabled/iam_user_hardware_mfa_enabled.py +++ b/prowler/providers/aws/services/iam/iam_user_hardware_mfa_enabled/iam_user_hardware_mfa_enabled.py @@ -8,10 +8,7 @@ class iam_user_hardware_mfa_enabled(Check): response = iam_client.users for user in response: - report = Check_Report_AWS(self.metadata()) - report.resource_id = user.name - report.resource_arn = user.arn - report.resource_tags = user.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user) report.region = iam_client.region if user.mfa_devices: report.status = "PASS" diff --git a/prowler/providers/aws/services/iam/iam_user_mfa_enabled_console_access/iam_user_mfa_enabled_console_access.py b/prowler/providers/aws/services/iam/iam_user_mfa_enabled_console_access/iam_user_mfa_enabled_console_access.py index a3695ec86a..3d1f399cf4 100644 --- a/prowler/providers/aws/services/iam/iam_user_mfa_enabled_console_access/iam_user_mfa_enabled_console_access.py +++ b/prowler/providers/aws/services/iam/iam_user_mfa_enabled_console_access/iam_user_mfa_enabled_console_access.py @@ -9,7 +9,9 @@ class iam_user_mfa_enabled_console_access(Check): for user in response: # all the users but root (which by default does not support console password) if user["user"] != "": - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.resource_id = user["user"] report.resource_arn = user["arn"] report.region = iam_client.region diff --git a/prowler/providers/aws/services/iam/iam_user_no_setup_initial_access_key/iam_user_no_setup_initial_access_key.py b/prowler/providers/aws/services/iam/iam_user_no_setup_initial_access_key/iam_user_no_setup_initial_access_key.py index 2c3aaa30ea..a91f5cae6d 100644 --- a/prowler/providers/aws/services/iam/iam_user_no_setup_initial_access_key/iam_user_no_setup_initial_access_key.py +++ b/prowler/providers/aws/services/iam/iam_user_no_setup_initial_access_key/iam_user_no_setup_initial_access_key.py @@ -48,7 +48,7 @@ class iam_user_no_setup_initial_access_key(Check): return findings def add_finding(self, user, status, status_extended, findings): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=user) report.region = iam_client.region report.resource_id = user["user"] report.resource_arn = user["arn"] diff --git a/prowler/providers/aws/services/iam/iam_user_two_active_access_key/iam_user_two_active_access_key.py b/prowler/providers/aws/services/iam/iam_user_two_active_access_key/iam_user_two_active_access_key.py index 94b40985b9..921e459c38 100644 --- a/prowler/providers/aws/services/iam/iam_user_two_active_access_key/iam_user_two_active_access_key.py +++ b/prowler/providers/aws/services/iam/iam_user_two_active_access_key/iam_user_two_active_access_key.py @@ -9,7 +9,9 @@ class iam_user_two_active_access_key(Check): findings = [] response = iam_client.credential_report for user in response: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=user + ) report.resource_id = user["user"] report.resource_arn = user["arn"] report.region = iam_client.region diff --git a/prowler/providers/aws/services/iam/iam_user_with_temporary_credentials/iam_user_with_temporary_credentials.py b/prowler/providers/aws/services/iam/iam_user_with_temporary_credentials/iam_user_with_temporary_credentials.py index b352188cc0..23aa433926 100644 --- a/prowler/providers/aws/services/iam/iam_user_with_temporary_credentials/iam_user_with_temporary_credentials.py +++ b/prowler/providers/aws/services/iam/iam_user_with_temporary_credentials/iam_user_with_temporary_credentials.py @@ -13,7 +13,10 @@ class iam_user_with_temporary_credentials(Check): user_name = user_data[0] user_arn = user_data[1] - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=iam_client.user_temporary_credentials_usage, + ) report.resource_id = user_name report.resource_arn = user_arn report.region = iam_client.region diff --git a/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py b/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py index 5a4b524188..f1c94dc399 100644 --- a/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py +++ b/prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.py @@ -9,10 +9,9 @@ class inspector2_active_findings_exist(Check): findings = [] for inspector in inspector2_client.inspectors: if inspector.status == "ENABLED": - report = Check_Report_AWS(self.metadata()) - report.resource_id = inspector.id - report.resource_arn = inspector.arn - report.region = inspector.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=inspector + ) report.status = "PASS" report.status_extended = ( "Inspector2 is enabled with no active findings." diff --git a/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py b/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py index e735f42661..664e361db8 100644 --- a/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py +++ b/prowler/providers/aws/services/inspector2/inspector2_is_enabled/inspector2_is_enabled.py @@ -11,10 +11,9 @@ class inspector2_is_enabled(Check): def execute(self): findings = [] for inspector in inspector2_client.inspectors: - report = Check_Report_AWS(self.metadata()) - report.resource_id = inspector.id - report.resource_arn = inspector.arn - report.region = inspector.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=inspector + ) if inspector.status == "ENABLED": report.status = "PASS" report.status_extended = "Inspector2 is enabled for EC2 instances, ECR container images, Lambda functions and code." diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk.py b/prowler/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk.py index a56e5dffc6..ec37ba0c75 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk.py @@ -7,12 +7,10 @@ class kafka_cluster_encryption_at_rest_uses_cmk(Check): def execute(self): findings = [] - for arn_cluster, cluster in kafka_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = arn_cluster - report.resource_tags = cluster.tags + for cluster in kafka_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"Kafka cluster '{cluster.name}' does not have encryption at rest enabled with a CMK." diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled.py b/prowler/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled.py index 7a9b05c490..c5cb0aadb8 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled.py @@ -6,12 +6,10 @@ class kafka_cluster_enhanced_monitoring_enabled(Check): def execute(self): findings = [] - for arn_cluster, cluster in kafka_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = arn_cluster - report.resource_tags = cluster.tags + for cluster in kafka_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "PASS" report.status_extended = ( f"Kafka cluster '{cluster.name}' has enhanced monitoring enabled." diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled.py b/prowler/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled.py index 13c111458e..ba2fdb6ebd 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled.py @@ -6,12 +6,10 @@ class kafka_cluster_in_transit_encryption_enabled(Check): def execute(self): findings = [] - for arn_cluster, cluster in kafka_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = arn_cluster - report.resource_tags = cluster.tags + for cluster in kafka_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"Kafka cluster '{cluster.name}' does not have encryption in transit enabled." diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py b/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py index 2090640cb2..58173ab9b6 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public.py @@ -6,12 +6,10 @@ class kafka_cluster_is_public(Check): def execute(self): findings = [] - for arn_cluster, cluster in kafka_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = arn_cluster - report.resource_tags = cluster.tags + for cluster in kafka_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = ( f"Kafka cluster '{cluster.name}' is publicly accessible." diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled.py b/prowler/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled.py index 4c84aacf9d..dd7e614884 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled.py @@ -6,12 +6,10 @@ class kafka_cluster_mutual_tls_authentication_enabled(Check): def execute(self): findings = [] - for arn_cluster, cluster in kafka_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = arn_cluster - report.resource_tags = cluster.tags + for cluster in kafka_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"Kafka cluster '{cluster.name}' does not have mutual TLS authentication enabled." diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled.py b/prowler/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled.py index 80a8b378ed..c7ba718984 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled.py @@ -6,12 +6,10 @@ class kafka_cluster_unrestricted_access_disabled(Check): def execute(self): findings = [] - for arn_cluster, cluster in kafka_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = arn_cluster - report.resource_tags = cluster.tags + for cluster in kafka_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = ( f"Kafka cluster '{cluster.name}' has unrestricted access enabled." diff --git a/prowler/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version.py b/prowler/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version.py index 10de7bf597..0a7adae1f8 100644 --- a/prowler/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version.py +++ b/prowler/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version.py @@ -6,12 +6,10 @@ class kafka_cluster_uses_latest_version(Check): def execute(self): findings = [] - for arn_cluster, cluster in kafka_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = arn_cluster - report.resource_tags = cluster.tags + for cluster in kafka_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "PASS" report.status_extended = ( f"Kafka cluster '{cluster.name}' is using the latest version." diff --git a/prowler/providers/aws/services/kafka/kafka_connector_in_transit_encryption_enabled/kafka_connector_in_transit_encryption_enabled.py b/prowler/providers/aws/services/kafka/kafka_connector_in_transit_encryption_enabled/kafka_connector_in_transit_encryption_enabled.py index fd058bffce..3b0a70bb4a 100644 --- a/prowler/providers/aws/services/kafka/kafka_connector_in_transit_encryption_enabled/kafka_connector_in_transit_encryption_enabled.py +++ b/prowler/providers/aws/services/kafka/kafka_connector_in_transit_encryption_enabled/kafka_connector_in_transit_encryption_enabled.py @@ -6,11 +6,10 @@ class kafka_connector_in_transit_encryption_enabled(Check): def execute(self): findings = [] - for arn_connector, connector in kafkaconnect_client.connectors.items(): - report = Check_Report_AWS(self.metadata()) - report.region = connector.region - report.resource_id = connector.name - report.resource_arn = arn_connector + for connector in kafkaconnect_client.connectors.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=connector + ) report.status = "FAIL" report.status_extended = f"Kafka connector {connector.name} does not have encryption in transit enabled." diff --git a/prowler/providers/aws/services/kafka/kafka_service.py b/prowler/providers/aws/services/kafka/kafka_service.py index a30e8ccafc..96a1418490 100644 --- a/prowler/providers/aws/services/kafka/kafka_service.py +++ b/prowler/providers/aws/services/kafka/kafka_service.py @@ -31,6 +31,7 @@ class Kafka(AWSService): self.clusters[cluster.get("ClusterArn", "")] = Cluster( id=arn.split(":")[-1].split("/")[-1], name=cluster.get("ClusterName", ""), + arn=arn, region=regional_client.region, tags=list(cluster.get("Tags", {})), state=cluster.get("State", ""), @@ -98,6 +99,7 @@ class EncryptionInTransit(BaseModel): class Cluster(BaseModel): id: str name: str + arn: str region: str tags: list kafka_version: str diff --git a/prowler/providers/aws/services/kinesis/kinesis_stream_data_retention_period/kinesis_stream_data_retention_period.py b/prowler/providers/aws/services/kinesis/kinesis_stream_data_retention_period/kinesis_stream_data_retention_period.py index b86e1dccab..61b18f6ac5 100644 --- a/prowler/providers/aws/services/kinesis/kinesis_stream_data_retention_period/kinesis_stream_data_retention_period.py +++ b/prowler/providers/aws/services/kinesis/kinesis_stream_data_retention_period/kinesis_stream_data_retention_period.py @@ -18,11 +18,9 @@ class kinesis_stream_data_retention_period(Check): """ findings = [] for stream in kinesis_client.streams.values(): - report = Check_Report_AWS(self.metadata()) - report.region = stream.region - report.resource_id = stream.name - report.resource_arn = stream.arn - report.resource_tags = stream.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stream + ) report.status = "FAIL" report.status_extended = f"Kinesis Stream {stream.name} does not have an adequate data retention period ({stream.retention_period}hrs)." diff --git a/prowler/providers/aws/services/kinesis/kinesis_stream_encrypted_at_rest/kinesis_stream_encrypted_at_rest.py b/prowler/providers/aws/services/kinesis/kinesis_stream_encrypted_at_rest/kinesis_stream_encrypted_at_rest.py index af46a212c4..0c88388f8c 100644 --- a/prowler/providers/aws/services/kinesis/kinesis_stream_encrypted_at_rest/kinesis_stream_encrypted_at_rest.py +++ b/prowler/providers/aws/services/kinesis/kinesis_stream_encrypted_at_rest/kinesis_stream_encrypted_at_rest.py @@ -7,11 +7,9 @@ class kinesis_stream_encrypted_at_rest(Check): def execute(self): findings = [] for stream in kinesis_client.streams.values(): - report = Check_Report_AWS(self.metadata()) - report.region = stream.region - report.resource_id = stream.name - report.resource_arn = stream.arn - report.resource_tags = stream.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=stream + ) report.status = "FAIL" report.status_extended = ( f"Kinesis Stream {stream.name} is not encrypted at rest." diff --git a/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.py b/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.py index 20653cb533..d4bb01a397 100644 --- a/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.py +++ b/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.py @@ -8,11 +8,9 @@ class kms_cmk_are_used(Check): for key in kms_client.keys: # Only check CMKs keys if key.manager == "CUSTOMER": - report = Check_Report_AWS(self.metadata()) - report.region = key.region - report.resource_id = key.id - report.resource_arn = key.arn - report.resource_tags = key.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=key + ) if key.state != "Enabled": if key.state == "PendingDeletion": report.status = "PASS" diff --git a/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.py b/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.py index 8f7d3ebd3e..d66a89421d 100644 --- a/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.py +++ b/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.py @@ -8,15 +8,13 @@ class kms_cmk_not_deleted_unintentionally(Check): for key in kms_client.keys: if key.manager == "CUSTOMER": if key.state != "Disabled" or kms_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata()) - report.region = key.region - report.resource_tags = key.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=key + ) report.status = "PASS" report.status_extended = ( f"KMS CMK {key.id} is not scheduled for deletion." ) - report.resource_id = key.id - report.resource_arn = key.arn if key.state == "PendingDeletion": report.status = "FAIL" report.status_extended = f"KMS CMK {key.id} is scheduled for deletion, revert it if it was unintentionally." diff --git a/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.py b/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.py index 0a002231cc..c3adc865d6 100644 --- a/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.py +++ b/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.py @@ -6,9 +6,7 @@ class kms_cmk_rotation_enabled(Check): def execute(self): findings = [] for key in kms_client.keys: - report = Check_Report_AWS(self.metadata()) - report.region = key.region - report.resource_tags = key.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=key) # Only check enabled CMKs keys if ( key.manager == "CUSTOMER" @@ -20,14 +18,10 @@ class kms_cmk_rotation_enabled(Check): report.status_extended = ( f"KMS CMK {key.id} has automatic rotation enabled." ) - report.resource_id = key.id - report.resource_arn = key.arn else: report.status = "FAIL" report.status_extended = ( f"KMS CMK {key.id} has automatic rotation disabled." ) - report.resource_id = key.id - report.resource_arn = key.arn findings.append(report) return findings diff --git a/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.py b/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.py index 0ac6f1f0e7..5378786224 100644 --- a/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.py +++ b/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.py @@ -10,13 +10,11 @@ class kms_key_not_publicly_accessible(Check): if ( key.manager == "CUSTOMER" and key.state == "Enabled" ): # only customer KMS have policies - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=key + ) report.status = "PASS" report.status_extended = f"KMS key {key.id} is not exposed to Public." - report.resource_id = key.id - report.resource_arn = key.arn - report.resource_tags = key.tags - report.region = key.region # If the "Principal" element value is set to { "AWS": "*" } and the policy statement is not using any Condition clauses to filter the access, the selected AWS KMS master key is publicly accessible. if is_policy_public( key.policy, diff --git a/prowler/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public.py b/prowler/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public.py index 313fa1e2c8..565a6e3f67 100644 --- a/prowler/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public.py +++ b/prowler/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public.py @@ -6,12 +6,10 @@ class lightsail_database_public(Check): def execute(self): findings = [] - for arn_database, database in lightsail_client.databases.items(): - report = Check_Report_AWS(self.metadata()) - report.region = database.region - report.resource_id = database.id - report.resource_arn = arn_database - report.resource_tags = database.tags + for database in lightsail_client.databases.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=database + ) report.status = "FAIL" report.status_extended = f"Database '{database.name}' is public." diff --git a/prowler/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots.py b/prowler/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots.py index 82cae775e9..712e92d93d 100644 --- a/prowler/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots.py +++ b/prowler/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots.py @@ -5,12 +5,10 @@ from prowler.providers.aws.services.lightsail.lightsail_client import lightsail_ class lightsail_instance_automated_snapshots(Check): def execute(self): findings = [] - for arn_instance, instance in lightsail_client.instances.items(): - report = Check_Report_AWS(self.metadata()) - report.region = instance.region - report.resource_id = instance.id - report.resource_arn = arn_instance - report.resource_tags = instance.tags + for instance in lightsail_client.instances.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "FAIL" report.status_extended = ( f"Instance '{instance.name}' does not have automated snapshots enabled." diff --git a/prowler/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public.py b/prowler/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public.py index 21f9abc1fe..8ca62eb73e 100644 --- a/prowler/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public.py +++ b/prowler/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public.py @@ -6,12 +6,10 @@ class lightsail_instance_public(Check): def execute(self) -> Check_Report_AWS: findings = [] - for arn_instance, instance in lightsail_client.instances.items(): - report = Check_Report_AWS(self.metadata()) - report.region = instance.region - report.resource_id = instance.id - report.resource_arn = arn_instance - report.resource_tags = instance.tags + for instance in lightsail_client.instances.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = ( f"Instance '{instance.name}' is not publicly exposed." diff --git a/prowler/providers/aws/services/lightsail/lightsail_service.py b/prowler/providers/aws/services/lightsail/lightsail_service.py index e6f0d5f903..56c137e21f 100644 --- a/prowler/providers/aws/services/lightsail/lightsail_service.py +++ b/prowler/providers/aws/services/lightsail/lightsail_service.py @@ -66,6 +66,7 @@ class Lightsail(AWSService): self.instances[arn] = Instance( name=instance.get("name", ""), id=instance.get("supportCode", ""), + arn=arn, tags=instance.get("tags", []), region=instance.get( "location", {"regionName": regional_client.region} @@ -106,6 +107,7 @@ class Lightsail(AWSService): self.databases[arn] = Database( name=database.get("name", ""), id=database.get("supportCode", ""), + arn=arn, tags=database.get("tags", []), region=database.get( "location", {"regionName": regional_client.region} @@ -142,6 +144,7 @@ class Lightsail(AWSService): self.static_ips[arn] = StaticIP( name=static_ip.get("name", ""), id=static_ip.get("supportCode", ""), + arn=arn, region=static_ip.get( "location", {"regionName": regional_client.region} ).get("regionName", ""), @@ -169,6 +172,7 @@ class PortRange(BaseModel): class Instance(BaseModel): name: str id: str + arn: str tags: List[Dict[str, str]] region: str availability_zone: str @@ -184,6 +188,7 @@ class Instance(BaseModel): class Database(BaseModel): name: str id: str + arn: str tags: List[Dict[str, str]] region: str availability_zone: str @@ -197,6 +202,7 @@ class Database(BaseModel): class StaticIP(BaseModel): name: str id: str + arn: str region: str availability_zone: str ip_address: str diff --git a/prowler/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused.py b/prowler/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused.py index aa093190f4..94dc986acf 100644 --- a/prowler/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused.py +++ b/prowler/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused.py @@ -6,12 +6,10 @@ class lightsail_static_ip_unused(Check): def execute(self) -> Check_Report_AWS: findings = [] - for arn_static_ip, static_ip in lightsail_client.static_ips.items(): - report = Check_Report_AWS(self.metadata()) - report.region = static_ip.region - report.resource_id = static_ip.id - report.resource_arn = arn_static_ip - report.resource_tags = [] + for static_ip in lightsail_client.static_ips.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=static_ip + ) report.status = "FAIL" report.status_extended = ( f"Static IP '{static_ip.name}' is not associated with any instance." diff --git a/prowler/providers/aws/services/macie/macie_automated_sensitive_data_discovery_enabled/macie_automated_sensitive_data_discovery_enabled.py b/prowler/providers/aws/services/macie/macie_automated_sensitive_data_discovery_enabled/macie_automated_sensitive_data_discovery_enabled.py index 19abe9104b..c8552d4e74 100644 --- a/prowler/providers/aws/services/macie/macie_automated_sensitive_data_discovery_enabled/macie_automated_sensitive_data_discovery_enabled.py +++ b/prowler/providers/aws/services/macie/macie_automated_sensitive_data_discovery_enabled/macie_automated_sensitive_data_discovery_enabled.py @@ -7,8 +7,9 @@ class macie_automated_sensitive_data_discovery_enabled(Check): findings = [] for session in macie_client.sessions: if session.status == "ENABLED": - report = Check_Report_AWS(self.metadata()) - report.region = session.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=session + ) report.resource_arn = macie_client._get_session_arn_template( session.region ) diff --git a/prowler/providers/aws/services/macie/macie_is_enabled/macie_is_enabled.py b/prowler/providers/aws/services/macie/macie_is_enabled/macie_is_enabled.py index 79820b3c1e..567715de9c 100644 --- a/prowler/providers/aws/services/macie/macie_is_enabled/macie_is_enabled.py +++ b/prowler/providers/aws/services/macie/macie_is_enabled/macie_is_enabled.py @@ -7,8 +7,9 @@ class macie_is_enabled(Check): def execute(self): findings = [] for session in macie_client.sessions: - report = Check_Report_AWS(self.metadata()) - report.region = session.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=session + ) report.resource_arn = macie_client._get_session_arn_template(session.region) report.resource_id = macie_client.audited_account if session.status == "ENABLED": diff --git a/prowler/providers/aws/services/memorydb/memorydb_cluster_auto_minor_version_upgrades/memorydb_cluster_auto_minor_version_upgrades.py b/prowler/providers/aws/services/memorydb/memorydb_cluster_auto_minor_version_upgrades/memorydb_cluster_auto_minor_version_upgrades.py index 195185fff7..9ed1fcf0ac 100644 --- a/prowler/providers/aws/services/memorydb/memorydb_cluster_auto_minor_version_upgrades/memorydb_cluster_auto_minor_version_upgrades.py +++ b/prowler/providers/aws/services/memorydb/memorydb_cluster_auto_minor_version_upgrades/memorydb_cluster_auto_minor_version_upgrades.py @@ -6,10 +6,9 @@ class memorydb_cluster_auto_minor_version_upgrades(Check): def execute(self): findings = [] for cluster in memorydb_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) if cluster.auto_minor_version_upgrade: report.status = "PASS" report.status_extended = f"Memory DB Cluster {cluster.name} has minor version upgrade enabled." diff --git a/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py b/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py index 4beb81eba0..5c36d14c7e 100644 --- a/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py +++ b/prowler/providers/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py @@ -8,11 +8,9 @@ class mq_broker_active_deployment_mode(Check): findings = [] for broker in mq_client.brokers.values(): if broker.engine_type == EngineType.ACTIVEMQ: - report = Check_Report_AWS(self.metadata()) - report.region = broker.region - report.resource_id = broker.id - report.resource_arn = broker.arn - report.resource_tags = broker.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=broker + ) report.status = "FAIL" report.status_extended = f"MQ Apache ActiveMQ Broker {broker.name} does not have an active/standby deployment mode." if broker.deployment_mode == DeploymentMode.ACTIVE_STANDBY_MULTI_AZ: diff --git a/prowler/providers/aws/services/mq/mq_broker_auto_minor_version_upgrades/mq_broker_auto_minor_version_upgrades.py b/prowler/providers/aws/services/mq/mq_broker_auto_minor_version_upgrades/mq_broker_auto_minor_version_upgrades.py index c1cccd8e69..fa86105639 100644 --- a/prowler/providers/aws/services/mq/mq_broker_auto_minor_version_upgrades/mq_broker_auto_minor_version_upgrades.py +++ b/prowler/providers/aws/services/mq/mq_broker_auto_minor_version_upgrades/mq_broker_auto_minor_version_upgrades.py @@ -6,11 +6,9 @@ class mq_broker_auto_minor_version_upgrades(Check): def execute(self): findings = [] for broker in mq_client.brokers.values(): - report = Check_Report_AWS(self.metadata()) - report.region = broker.region - report.resource_id = broker.id - report.resource_arn = broker.arn - report.resource_tags = broker.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=broker + ) report.status = "PASS" report.status_extended = f"MQ Broker {broker.name} does have automated minor version upgrades enabled." diff --git a/prowler/providers/aws/services/mq/mq_broker_cluster_deployment_mode/mq_broker_cluster_deployment_mode.py b/prowler/providers/aws/services/mq/mq_broker_cluster_deployment_mode/mq_broker_cluster_deployment_mode.py index 920fc98db0..13e7ea3bde 100644 --- a/prowler/providers/aws/services/mq/mq_broker_cluster_deployment_mode/mq_broker_cluster_deployment_mode.py +++ b/prowler/providers/aws/services/mq/mq_broker_cluster_deployment_mode/mq_broker_cluster_deployment_mode.py @@ -20,11 +20,9 @@ class mq_broker_cluster_deployment_mode(Check): findings = [] for broker in mq_client.brokers.values(): if broker.engine_type == EngineType.RABBITMQ: - report = Check_Report_AWS(self.metadata()) - report.region = broker.region - report.resource_id = broker.id - report.resource_arn = broker.arn - report.resource_tags = broker.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=broker + ) report.status = "FAIL" report.status_extended = f"MQ RabbitMQ Broker {broker.name} does not have a cluster deployment mode." if broker.deployment_mode == DeploymentMode.CLUSTER_MULTI_AZ: diff --git a/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py b/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py index 9d978b999c..6904bb2561 100644 --- a/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py +++ b/prowler/providers/aws/services/mq/mq_broker_logging_enabled/mq_broker_logging_enabled.py @@ -16,11 +16,9 @@ class mq_broker_logging_enabled(Check): """ findings = [] for broker in mq_client.brokers.values(): - report = Check_Report_AWS(self.metadata()) - report.region = broker.region - report.resource_id = broker.id - report.resource_arn = broker.arn - report.resource_tags = broker.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=broker + ) report.status = "FAIL" report.status_extended = ( f"MQ Broker {broker.name} does not have logging enabled." diff --git a/prowler/providers/aws/services/mq/mq_broker_not_publicly_accessible/mq_broker_not_publicly_accessible.py b/prowler/providers/aws/services/mq/mq_broker_not_publicly_accessible/mq_broker_not_publicly_accessible.py index 92284b2ea3..a1de642582 100644 --- a/prowler/providers/aws/services/mq/mq_broker_not_publicly_accessible/mq_broker_not_publicly_accessible.py +++ b/prowler/providers/aws/services/mq/mq_broker_not_publicly_accessible/mq_broker_not_publicly_accessible.py @@ -6,11 +6,9 @@ class mq_broker_not_publicly_accessible(Check): def execute(self): findings = [] for broker in mq_client.brokers.values(): - report = Check_Report_AWS(self.metadata()) - report.region = broker.region - report.resource_id = broker.id - report.resource_arn = broker.arn - report.resource_tags = broker.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=broker + ) report.status = "FAIL" report.status_extended = f"MQ Broker {broker.name} is publicly accessible." diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.py b/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.py index 0296fe08fe..1573147feb 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.py @@ -6,11 +6,10 @@ class neptune_cluster_backup_enabled(Check): def execute(self): findings = [] for cluster in neptune_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags report.status = "FAIL" report.status_extended = ( f"Neptune Cluster {cluster.name} does not have backup enabled." diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.py b/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.py index e9982b663b..c144ede995 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.py @@ -5,12 +5,10 @@ from prowler.providers.aws.services.neptune.neptune_client import neptune_client class neptune_cluster_copy_tags_to_snapshots(Check): def execute(self): findings = [] - for cluster_arn, cluster in neptune_client.clusters.items(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + for cluster in neptune_client.clusters.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"Neptune DB Cluster {cluster.id} is not configured to copy tags to snapshots." if cluster.copy_tags_to_snapshot: diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.py b/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.py index 38d38b499b..887cd5756d 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.py @@ -6,11 +6,10 @@ class neptune_cluster_deletion_protection(Check): def execute(self): findings = [] for cluster in neptune_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags report.status = "FAIL" report.status_extended = f"Neptune Cluster {cluster.name} does not have deletion protection enabled." if cluster.deletion_protection: diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.py b/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.py index 69f30f3830..d7a8d391ce 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.py @@ -6,11 +6,10 @@ class neptune_cluster_iam_authentication_enabled(Check): def execute(self): findings = [] for cluster in neptune_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags report.status = "FAIL" report.status_extended = f"Neptune Cluster {cluster.name} does not have IAM authentication enabled." if cluster.iam_auth: diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.py b/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.py index 90d6fbbb33..187577e3cf 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.py @@ -6,11 +6,10 @@ class neptune_cluster_integration_cloudwatch_logs(Check): def execute(self): findings = [] for cluster in neptune_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags report.status = "FAIL" report.status_extended = f"Neptune Cluster {cluster.name} does not have cloudwatch audit logs enabled." if "audit" in cluster.cloudwatch_logs: diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.py b/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.py index a31dac2d4f..aa5158741c 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.py @@ -6,11 +6,10 @@ class neptune_cluster_multi_az(Check): def execute(self): findings = [] for cluster in neptune_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags report.status = "FAIL" report.status_extended = ( f"Neptune Cluster {cluster.name} does not have Multi-AZ enabled." diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.py b/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.py index 5b6563b19e..ae34d20fdb 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.py @@ -6,11 +6,9 @@ class neptune_cluster_public_snapshot(Check): def execute(self): findings = [] for db_snap in neptune_client.db_cluster_snapshots: - report = Check_Report_AWS(self.metadata()) - report.region = db_snap.region - report.resource_id = db_snap.id - report.resource_arn = db_snap.arn - report.resource_tags = db_snap.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=db_snap + ) if db_snap.public: report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.py b/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.py index 20d6dde603..e9d11b54aa 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.py @@ -6,11 +6,9 @@ class neptune_cluster_snapshot_encrypted(Check): def execute(self): findings = [] for snapshot in neptune_client.db_cluster_snapshots: - report = Check_Report_AWS(self.metadata()) - report.region = snapshot.region - report.resource_id = snapshot.id - report.resource_arn = snapshot.arn - report.resource_tags = snapshot.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=snapshot + ) report.status = "FAIL" report.status_extended = ( f"Neptune Cluster Snapshot {snapshot.id} is not encrypted at rest." diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.py b/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.py index d21401c0d3..80333135a1 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.py @@ -6,11 +6,10 @@ class neptune_cluster_storage_encrypted(Check): def execute(self): findings = [] for cluster in neptune_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags report.status = "FAIL" report.status_extended = ( f"Neptune Cluster {cluster.name} is not encrypted at rest." diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.py b/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.py index f154511680..1f5f8e8b7d 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.py +++ b/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.py @@ -7,11 +7,9 @@ class neptune_cluster_uses_public_subnet(Check): def execute(self): findings = [] for cluster in neptune_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "PASS" report.status_extended = ( f"Cluster {cluster.id} is not using public subnets." diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py index bf3cfa808d..89e7951b36 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_deletion_protection/networkfirewall_deletion_protection.py @@ -7,12 +7,10 @@ from prowler.providers.aws.services.networkfirewall.networkfirewall_client impor class networkfirewall_deletion_protection(Check): def execute(self): findings = [] - for arn, firewall in networkfirewall_client.network_firewalls.items(): - report = Check_Report_AWS(self.metadata()) - report.region = firewall.region - report.resource_id = firewall.name - report.resource_arn = arn - report.resource_tags = firewall.tags + for firewall in networkfirewall_client.network_firewalls.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=firewall + ) report.status = "FAIL" report.status_extended = f"Network Firewall {firewall.name} does not have deletion protection enabled." if firewall.deletion_protection: diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py index 94b9eac18f..97dc2a52f7 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc.py @@ -10,11 +10,9 @@ class networkfirewall_in_all_vpc(Check): findings = [] for vpc in vpc_client.vpcs.values(): if vpc_client.provider.scan_unused_services or vpc.in_use: - report = Check_Report_AWS(self.metadata()) - report.region = vpc.region - report.resource_id = vpc.id - report.resource_arn = vpc.arn - report.resource_tags = vpc.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=vpc + ) report.status = "FAIL" report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} does not have Network Firewall enabled." for firewall in networkfirewall_client.network_firewalls.values(): diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_logging_enabled/networkfirewall_logging_enabled.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_logging_enabled/networkfirewall_logging_enabled.py index 24f59a4e05..7219fac5c7 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_logging_enabled/networkfirewall_logging_enabled.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_logging_enabled/networkfirewall_logging_enabled.py @@ -7,12 +7,10 @@ from prowler.providers.aws.services.networkfirewall.networkfirewall_client impor class networkfirewall_logging_enabled(Check): def execute(self): findings = [] - for arn, firewall in networkfirewall_client.network_firewalls.items(): - report = Check_Report_AWS(self.metadata()) - report.region = firewall.region - report.resource_id = firewall.name - report.resource_arn = arn - report.resource_tags = firewall.tags + for firewall in networkfirewall_client.network_firewalls.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=firewall + ) report.status = "FAIL" report.status_extended = ( f"Network Firewall {firewall.name} does not have logging enabled." diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_multi_az/networkfirewall_multi_az.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_multi_az/networkfirewall_multi_az.py index da31c55b35..4fd4316066 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_multi_az/networkfirewall_multi_az.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_multi_az/networkfirewall_multi_az.py @@ -8,11 +8,9 @@ class networkfirewall_multi_az(Check): def execute(self): findings = [] for firewall in networkfirewall_client.network_firewalls.values(): - report = Check_Report_AWS(self.metadata()) - report.region = firewall.region - report.resource_id = firewall.name - report.resource_arn = firewall.arn - report.resource_tags = firewall.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=firewall + ) report.status = "FAIL" report.status_extended = ( f"Network Firewall {firewall.name} is not deployed across multiple AZ." diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_fragmented_packets/networkfirewall_policy_default_action_fragmented_packets.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_fragmented_packets/networkfirewall_policy_default_action_fragmented_packets.py index 5b7884a969..9ba80bc73a 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_fragmented_packets/networkfirewall_policy_default_action_fragmented_packets.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_fragmented_packets/networkfirewall_policy_default_action_fragmented_packets.py @@ -7,12 +7,10 @@ from prowler.providers.aws.services.networkfirewall.networkfirewall_client impor class networkfirewall_policy_default_action_fragmented_packets(Check): def execute(self): findings = [] - for arn, firewall in networkfirewall_client.network_firewalls.items(): - report = Check_Report_AWS(self.metadata()) - report.region = firewall.region - report.resource_id = firewall.name - report.resource_arn = arn - report.resource_tags = firewall.tags + for firewall in networkfirewall_client.network_firewalls.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=firewall + ) report.status = "FAIL" report.status_extended = f"Network Firewall {firewall.name} policy does not drop or forward fragmented packets by default." diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_full_packets/networkfirewall_policy_default_action_full_packets.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_full_packets/networkfirewall_policy_default_action_full_packets.py index 3611ee8991..afa4dc71d4 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_full_packets/networkfirewall_policy_default_action_full_packets.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_full_packets/networkfirewall_policy_default_action_full_packets.py @@ -7,12 +7,10 @@ from prowler.providers.aws.services.networkfirewall.networkfirewall_client impor class networkfirewall_policy_default_action_full_packets(Check): def execute(self): findings = [] - for arn, firewall in networkfirewall_client.network_firewalls.items(): - report = Check_Report_AWS(self.metadata()) - report.region = firewall.region - report.resource_id = firewall.name - report.resource_arn = arn - report.resource_tags = firewall.tags + for firewall in networkfirewall_client.network_firewalls.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=firewall + ) report.status = "FAIL" report.status_extended = f"Network Firewall {firewall.name} policy does not drop or forward full packets by default." diff --git a/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_rule_group_associated/networkfirewall_policy_rule_group_associated.py b/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_rule_group_associated/networkfirewall_policy_rule_group_associated.py index 1efb722c41..09d2090216 100644 --- a/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_rule_group_associated/networkfirewall_policy_rule_group_associated.py +++ b/prowler/providers/aws/services/networkfirewall/networkfirewall_policy_rule_group_associated/networkfirewall_policy_rule_group_associated.py @@ -8,11 +8,9 @@ class networkfirewall_policy_rule_group_associated(Check): def execute(self): findings = [] for firewall in networkfirewall_client.network_firewalls.values(): - report = Check_Report_AWS(self.metadata()) - report.region = firewall.region - report.resource_id = firewall.name - report.resource_arn = firewall.arn - report.resource_tags = firewall.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=firewall + ) report.status = "PASS" report.status_extended = f"Network Firewall {firewall.name} policy has at least one rule group associated." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_access_control_enabled/opensearch_service_domains_access_control_enabled.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_access_control_enabled/opensearch_service_domains_access_control_enabled.py index 98b9d37e0e..b33cb3e9fc 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_access_control_enabled/opensearch_service_domains_access_control_enabled.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_access_control_enabled/opensearch_service_domains_access_control_enabled.py @@ -8,11 +8,9 @@ class opensearch_service_domains_access_control_enabled(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "FAIL" report.status_extended = f"Opensearch domain {domain.name} does not have fine grained access control enabled." if domain.advanced_settings_enabled: diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled.py index 397e110c3a..b4c17c0f1c 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_audit_logging_enabled/opensearch_service_domains_audit_logging_enabled.py @@ -8,11 +8,9 @@ class opensearch_service_domains_audit_logging_enabled(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "FAIL" report.status_extended = ( f"Opensearch domain {domain.name} AUDIT_LOGS disabled." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled.py index 2a6439ab08..0cda99fc41 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_cloudwatch_logging_enabled/opensearch_service_domains_cloudwatch_logging_enabled.py @@ -8,11 +8,9 @@ class opensearch_service_domains_cloudwatch_logging_enabled(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "FAIL" report.status_extended = f"Opensearch domain {domain.name} SEARCH_SLOW_LOGS and INDEX_SLOW_LOGS disabled." has_SEARCH_SLOW_LOGS = False diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled.py index d4e429875e..981bf111db 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_encryption_at_rest_enabled/opensearch_service_domains_encryption_at_rest_enabled.py @@ -8,11 +8,9 @@ class opensearch_service_domains_encryption_at_rest_enabled(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = ( f"Opensearch domain {domain.name} has encryption at-rest enabled." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_data_nodes/opensearch_service_domains_fault_tolerant_data_nodes.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_data_nodes/opensearch_service_domains_fault_tolerant_data_nodes.py index 0c8a2552ed..1db1154fe8 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_data_nodes/opensearch_service_domains_fault_tolerant_data_nodes.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_data_nodes/opensearch_service_domains_fault_tolerant_data_nodes.py @@ -9,11 +9,9 @@ class opensearch_service_domains_fault_tolerant_data_nodes(Check): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "FAIL" report.status_extended = f"Opensearch domain {domain.name} is not fault tolerant as it has less than 3 data nodes and cross-zone replication (Zone Awareness) is not enabled." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_master_nodes/opensearch_service_domains_fault_tolerant_master_nodes.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_master_nodes/opensearch_service_domains_fault_tolerant_master_nodes.py index ca98c0e376..bbce07a90a 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_master_nodes/opensearch_service_domains_fault_tolerant_master_nodes.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_fault_tolerant_master_nodes/opensearch_service_domains_fault_tolerant_master_nodes.py @@ -8,11 +8,9 @@ class opensearch_service_domains_fault_tolerant_master_nodes(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = domain.name - report.resource_arn = domain.arn - report.region = domain.region - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = f"Opensearch domain {domain.name} has {domain.dedicated_master_count} dedicated master nodes, which guarantees fault tolerance on the master nodes." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced.py index c352101712..e7329c6a77 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_https_communications_enforced/opensearch_service_domains_https_communications_enforced.py @@ -8,11 +8,9 @@ class opensearch_service_domains_https_communications_enforced(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = ( f"Opensearch domain {domain.name} has enforce HTTPS enabled." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled.py index 9d750c2380..0fa93d5f3f 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_internal_user_database_enabled/opensearch_service_domains_internal_user_database_enabled.py @@ -8,11 +8,9 @@ class opensearch_service_domains_internal_user_database_enabled(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = f"Opensearch domain {domain.name} does not have internal user database enabled." if domain.internal_user_database: diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled.py index 49efd92ba0..6b11b89054 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_node_to_node_encryption_enabled/opensearch_service_domains_node_to_node_encryption_enabled.py @@ -8,11 +8,9 @@ class opensearch_service_domains_node_to_node_encryption_enabled(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = ( f"Opensearch domain {domain.name} has node-to-node encryption enabled." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py index a367423731..dcdcaad19a 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_not_publicly_accessible/opensearch_service_domains_not_publicly_accessible.py @@ -9,11 +9,9 @@ class opensearch_service_domains_not_publicly_accessible(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = ( f"Opensearch domain {domain.name} is not publicly accessible." diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version.py index 7c17c9f5b5..8db628e50a 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_updated_to_the_latest_service_software_version/opensearch_service_domains_updated_to_the_latest_service_software_version.py @@ -8,11 +8,9 @@ class opensearch_service_domains_updated_to_the_latest_service_software_version( def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = f"Opensearch domain {domain.name} with version {domain.version} does not have internal updates available." if domain.update_available: diff --git a/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py b/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py index b3b775685b..cd839533ba 100644 --- a/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py +++ b/prowler/providers/aws/services/opensearch/opensearch_service_domains_use_cognito_authentication_for_kibana/opensearch_service_domains_use_cognito_authentication_for_kibana.py @@ -8,11 +8,9 @@ class opensearch_service_domains_use_cognito_authentication_for_kibana(Check): def execute(self): findings = [] for domain in opensearch_client.opensearch_domains.values(): - report = Check_Report_AWS(self.metadata()) - report.region = domain.region - report.resource_id = domain.name - report.resource_arn = domain.arn - report.resource_tags = domain.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=domain + ) report.status = "PASS" report.status_extended = f"Opensearch domain {domain.name} has either Amazon Cognito or SAML authentication for Kibana enabled." if not domain.cognito_options and not domain.saml_enabled: diff --git a/prowler/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations.py b/prowler/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations.py index f3ff390429..da090d2358 100644 --- a/prowler/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations.py +++ b/prowler/providers/aws/services/organizations/organizations_account_part_of_organizations/organizations_account_part_of_organizations.py @@ -8,7 +8,10 @@ class organizations_account_part_of_organizations(Check): def execute(self): findings = [] if organizations_client.organization: - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=organizations_client.organization, + ) if organizations_client.organization.status == "ACTIVE": report.status = "PASS" report.status_extended = f"AWS Organization {organizations_client.organization.id} contains this AWS account." @@ -18,8 +21,6 @@ class organizations_account_part_of_organizations(Check): "AWS Organizations is not in-use for this AWS Account." ) report.region = organizations_client.region - report.resource_id = organizations_client.organization.id - report.resource_arn = organizations_client.organization.arn findings.append(report) return findings diff --git a/prowler/providers/aws/services/organizations/organizations_delegated_administrators/organizations_delegated_administrators.py b/prowler/providers/aws/services/organizations/organizations_delegated_administrators/organizations_delegated_administrators.py index 043a087e3c..1aa00fa346 100644 --- a/prowler/providers/aws/services/organizations/organizations_delegated_administrators/organizations_delegated_administrators.py +++ b/prowler/providers/aws/services/organizations/organizations_delegated_administrators/organizations_delegated_administrators.py @@ -18,9 +18,10 @@ class organizations_delegated_administrators(Check): organizations_client.organization and organizations_client.organization.status == "ACTIVE" ): - report = Check_Report_AWS(self.metadata()) - report.resource_id = organizations_client.organization.id - report.resource_arn = organizations_client.organization.arn + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=organizations_client.organization, + ) report.region = organizations_client.region if ( organizations_client.organization.delegated_administrators is not None diff --git a/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py b/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py index d7aa4db3f7..f849ac6ced 100644 --- a/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py +++ b/prowler/providers/aws/services/organizations/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py @@ -12,9 +12,10 @@ class organizations_opt_out_ai_services_policy(Check): if ( organizations_client.organization.policies is not None ): # Access Denied to list_policies - report = Check_Report_AWS(self.metadata()) - report.resource_id = organizations_client.organization.id - report.resource_arn = organizations_client.organization.arn + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=organizations_client.organization, + ) report.region = organizations_client.region report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py b/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py index c251019833..d20996af92 100644 --- a/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py +++ b/prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py @@ -15,9 +15,10 @@ class organizations_scp_check_deny_regions(Check): if ( organizations_client.organization.policies is not None ): # Access denied to list policies - report = Check_Report_AWS(self.metadata()) - report.resource_id = organizations_client.organization.id - report.resource_arn = organizations_client.organization.arn + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=organizations_client.organization, + ) report.region = organizations_client.region report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py b/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py index ce06740214..bedc1f0501 100644 --- a/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py +++ b/prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py @@ -12,9 +12,10 @@ class organizations_tags_policies_enabled_and_attached(Check): if ( organizations_client.organization.policies is not None ): # Access Denied to list_policies - report = Check_Report_AWS(self.metadata()) - report.resource_id = organizations_client.organization.id - report.resource_arn = organizations_client.organization.arn + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=organizations_client.organization, + ) report.region = organizations_client.region report.status = "FAIL" report.status_extended = ( diff --git a/tests/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk_test.py b/tests/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk_test.py index 5b579d5734..91e8ca5357 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk_test.py @@ -34,6 +34,7 @@ class Test_kafka_cluster_encryption_at_rest_uses_cmk: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -95,6 +96,7 @@ class Test_kafka_cluster_encryption_at_rest_uses_cmk: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", diff --git a/tests/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled_test.py b/tests/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled_test.py index f0d6e32dc0..e12757c7c2 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_enhanced_monitoring_enabled/kafka_cluster_enhanced_monitoring_enabled_test.py @@ -34,6 +34,7 @@ class Test_kafka_cluster_enhanced_monitoring_enabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -84,6 +85,7 @@ class Test_kafka_cluster_enhanced_monitoring_enabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", diff --git a/tests/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled_test.py b/tests/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled_test.py index 3a3cbc4240..0f186a8e74 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_in_transit_encryption_enabled/kafka_cluster_in_transit_encryption_enabled_test.py @@ -34,6 +34,7 @@ class Test_kafka_cluster_in_transit_encryption_enabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -84,6 +85,7 @@ class Test_kafka_cluster_in_transit_encryption_enabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -134,6 +136,7 @@ class Test_kafka_cluster_in_transit_encryption_enabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", diff --git a/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py b/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py index 944b66f043..44eb233ec3 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_is_public/kafka_cluster_is_public_test.py @@ -34,6 +34,7 @@ class Test_kafka_cluster_is_public: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -84,6 +85,7 @@ class Test_kafka_cluster_is_public: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", diff --git a/tests/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled_test.py b/tests/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled_test.py index 4378ee44fa..8aac138544 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_mutual_tls_authentication_enabled/kafka_cluster_mutual_tls_authentication_enabled_test.py @@ -34,6 +34,7 @@ class Test_kafka_cluster_mutual_tls_authentication_enabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -84,6 +85,7 @@ class Test_kafka_cluster_mutual_tls_authentication_enabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", diff --git a/tests/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled_test.py b/tests/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled_test.py index 622e837850..f3c69cfa22 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_unrestricted_access_disabled/kafka_cluster_unrestricted_access_disabled_test.py @@ -34,6 +34,7 @@ class Test_kafka_cluster_unrestricted_access_disabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -84,6 +85,7 @@ class Test_kafka_cluster_unrestricted_access_disabled: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", diff --git a/tests/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version_test.py b/tests/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version_test.py index 803685ee29..ef4a7cf2eb 100644 --- a/tests/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version_test.py +++ b/tests/providers/aws/services/kafka/kafka_cluster_uses_latest_version/kafka_cluster_uses_latest_version_test.py @@ -35,6 +35,7 @@ class Test_kafka_cluster_latest_version: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", @@ -90,6 +91,7 @@ class Test_kafka_cluster_latest_version: "arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5": Cluster( id="6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", name="demo-cluster-1", + arn="arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5", region=AWS_REGION_US_EAST_1, tags=[], state="ACTIVE", diff --git a/tests/providers/aws/services/kafka/kafka_service_test.py b/tests/providers/aws/services/kafka/kafka_service_test.py index 83e79d6d28..a7767a0201 100644 --- a/tests/providers/aws/services/kafka/kafka_service_test.py +++ b/tests/providers/aws/services/kafka/kafka_service_test.py @@ -93,6 +93,7 @@ class TestKafkaService: assert ( kafka.clusters[cluster_arn].id == "6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5" ) + assert kafka.clusters[cluster_arn].arn == cluster_arn assert kafka.clusters[cluster_arn].name == "demo-cluster-1" assert kafka.clusters[cluster_arn].region == AWS_REGION_US_EAST_1 assert kafka.clusters[cluster_arn].tags == [] diff --git a/tests/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public_test.py b/tests/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public_test.py index e25122339b..35b6e01972 100644 --- a/tests/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public_test.py +++ b/tests/providers/aws/services/lightsail/lightsail_database_public/lightsail_database_public_test.py @@ -36,6 +36,7 @@ class Test_lightsail_database_public: f"{BASE_LIGHTSAIL_ARN}:Database/test-database": Database( name="test-database", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:Database/test-database", tags=[], region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, @@ -78,6 +79,7 @@ class Test_lightsail_database_public: f"{BASE_LIGHTSAIL_ARN}:Database/test-database": Database( name="test-database", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:Database/test-database", tags=[], region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, diff --git a/tests/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots_test.py b/tests/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots_test.py index 1f98732a86..f1d67b7996 100644 --- a/tests/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots_test.py +++ b/tests/providers/aws/services/lightsail/lightsail_instance_automated_snapshots/lightsail_instance_automated_snapshots_test.py @@ -39,6 +39,7 @@ class Test_lightsail_instance_automated_snapshots: f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance": Instance( name="test-instance", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance", tags=[], region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, @@ -98,6 +99,7 @@ class Test_lightsail_instance_automated_snapshots: f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance": Instance( name="test-instance", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance", tags=[], region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, diff --git a/tests/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public_test.py b/tests/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public_test.py index adb01a5892..596ddd34c9 100644 --- a/tests/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public_test.py +++ b/tests/providers/aws/services/lightsail/lightsail_instance_public/lightsail_instance_public_test.py @@ -39,6 +39,7 @@ class Test_lightsail_instance_public: f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance": Instance( name="test-instance", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance", tags=[], region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, @@ -98,6 +99,7 @@ class Test_lightsail_instance_public: f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance": Instance( name="test-instance", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:Instance/test-instance", tags=[], region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, diff --git a/tests/providers/aws/services/lightsail/lightsail_service_test.py b/tests/providers/aws/services/lightsail/lightsail_service_test.py index ddbdeaa874..29aad1cb3e 100644 --- a/tests/providers/aws/services/lightsail/lightsail_service_test.py +++ b/tests/providers/aws/services/lightsail/lightsail_service_test.py @@ -197,6 +197,10 @@ class TestLightsailService: lightsail.instances[f"{BASE_LIGHTSAIL_ARN}:Instance/test-id"].name == "WordPress-1" ) + assert ( + lightsail.instances[f"{BASE_LIGHTSAIL_ARN}:Instance/test-id"].arn + == f"{BASE_LIGHTSAIL_ARN}:Instance/test-id" + ) assert lightsail.instances[f"{BASE_LIGHTSAIL_ARN}:Instance/test-id"].tags == [] assert ( lightsail.instances[f"{BASE_LIGHTSAIL_ARN}:Instance/test-id"].region @@ -308,6 +312,10 @@ class TestLightsailService: lightsail.databases[f"{BASE_LIGHTSAIL_ARN}:Database/test-id"].name == "test-db" ) + assert ( + lightsail.databases[f"{BASE_LIGHTSAIL_ARN}:Database/test-id"].arn + == f"{BASE_LIGHTSAIL_ARN}:Database/test-id" + ) assert lightsail.databases[f"{BASE_LIGHTSAIL_ARN}:Database/test-id"].tags == [] assert ( lightsail.databases[f"{BASE_LIGHTSAIL_ARN}:Database/test-id"].region @@ -350,6 +358,10 @@ class TestLightsailService: lightsail.static_ips[f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-id"].id == "578520385941/ip-0a0f5d4e2b3a4e4f" ) + assert ( + lightsail.static_ips[f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-id"].arn + == f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-id" + ) assert ( lightsail.static_ips[f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-id"].region == AWS_REGION_US_EAST_1 diff --git a/tests/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused_test.py b/tests/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused_test.py index b64b920910..ad07d6d2b8 100644 --- a/tests/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused_test.py +++ b/tests/providers/aws/services/lightsail/lightsail_static_ip_unused/lightsail_static_ip_unused_test.py @@ -36,6 +36,7 @@ class Test_lightsail_static_ip_unused: f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-static-ip": StaticIP( name="test-static-ip", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-static-ip", region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, ip_address="1.2.3.4", @@ -78,6 +79,7 @@ class Test_lightsail_static_ip_unused: f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-static-ip": StaticIP( name="test-static-ip", id="1234/5678", + arn=f"{BASE_LIGHTSAIL_ARN}:StaticIp/test-static-ip", region=AWS_REGION_US_EAST_1, availability_zone=AWS_REGION_US_EAST_1_AZA, ip_address="1.2.3.4",