From ee87f2676d18b285c74f55e8a4c7b9daf3c46c66 Mon Sep 17 00:00:00 2001 From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> Date: Wed, 15 Jan 2025 16:05:04 +0100 Subject: [PATCH] feat(aws): include resource metadata in services from `d*` to `e*` (#6532) Co-authored-by: Sergio Garcia --- .../datasync_task_logging_enabled.py | 2 +- .../directconnect_connection_redundancy.py | 4 +++- ...rectconnect_virtual_interface_redundancy.py | 5 +---- ...service_directory_log_forwarding_enabled.py | 8 +++----- ...yservice_directory_monitor_notifications.py | 8 +++----- ...rectoryservice_directory_snapshots_limit.py | 8 +++----- ...ctoryservice_ldap_certificate_expiration.py | 7 +++---- ...yservice_radius_server_security_protocol.py | 8 +++----- ...toryservice_supported_mfa_radius_enabled.py | 8 +++----- ...dlm_ebs_snapshot_lifecycle_policy_exists.py | 5 ++++- ..._endpoint_mongodb_authentication_enabled.py | 10 ++++------ ...dpoint_neptune_iam_authorization_enabled.py | 10 ++++------ ...oint_redis_in_transit_encryption_enabled.py | 10 ++++------ .../dms_endpoint_ssl_enabled.py | 10 ++++------ ...s_instance_minor_version_upgrade_enabled.py | 8 +++----- .../dms_instance_multi_az_enabled.py | 8 +++----- .../dms_instance_no_public_access.py | 8 +++----- ..._replication_task_source_logging_enabled.py | 7 +++---- ..._replication_task_target_logging_enabled.py | 7 +++---- .../documentdb_cluster_backup_enabled.py | 8 +++----- ...documentdb_cluster_cloudwatch_log_export.py | 8 +++----- .../documentdb_cluster_deletion_protection.py | 8 +++----- .../documentdb_cluster_multi_az_enabled.py | 8 +++----- .../documentdb_cluster_public_snapshot.py | 8 +++----- .../documentdb_cluster_storage_encrypted.py | 8 +++----- .../drs/drs_job_exist/drs_job_exist.py | 9 ++++----- ...b_accelerator_cluster_encryption_enabled.py | 8 +++----- ...or_cluster_in_transit_encryption_enabled.py | 8 +++----- .../dynamodb_accelerator_cluster_multi_az.py | 8 +++----- .../aws/services/dynamodb/dynamodb_service.py | 2 ++ .../dynamodb_table_autoscaling_enabled.py | 8 ++------ .../dynamodb_table_cross_account_access.py | 8 ++------ ...namodb_table_deletion_protection_enabled.py | 8 ++------ .../dynamodb_table_protected_by_backup_plan.py | 10 +++------- ...namodb_tables_kms_cmk_encryption_enabled.py | 8 ++------ .../dynamodb_tables_pitr_enabled.py | 8 ++------ .../ec2/ec2_ami_public/ec2_ami_public.py | 2 +- ..._vpn_endpoint_connection_logging_enabled.py | 4 +++- .../ec2_ebs_default_encryption.py | 4 +++- .../ec2_ebs_public_snapshot.py | 4 +++- ...ebs_snapshot_account_block_public_access.py | 5 ++++- .../ec2_ebs_snapshots_encrypted.py | 4 +++- .../ec2_ebs_volume_encryption.py | 4 +++- .../ec2_ebs_volume_protected_by_backup_plan.py | 4 +++- .../ec2_ebs_volume_snapshots_exists.py | 4 +++- .../ec2_elastic_ip_shodan.py | 4 +++- .../ec2_elastic_ip_unassigned.py | 2 +- .../ec2_instance_account_imdsv2_enabled.py | 5 ++++- ...ec2_instance_detailed_monitoring_enabled.py | 4 +++- .../ec2_instance_imdsv2_enabled.py | 4 +++- ...ce_internet_facing_with_instance_profile.py | 4 +++- .../ec2_instance_managed_by_ssm.py | 4 +++- .../ec2_instance_older_than_specific_days.py | 4 +++- .../ec2_instance_paravirtual_type.py | 4 +++- ...tance_port_cassandra_exposed_to_internet.py | 4 +++- ...2_instance_port_cifs_exposed_to_internet.py | 4 +++- ...elasticsearch_kibana_exposed_to_internet.py | 4 +++- ...c2_instance_port_ftp_exposed_to_internet.py | 4 +++- ..._instance_port_kafka_exposed_to_internet.py | 4 +++- ...stance_port_kerberos_exposed_to_internet.py | 4 +++- ...2_instance_port_ldap_exposed_to_internet.py | 4 +++- ...tance_port_memcached_exposed_to_internet.py | 4 +++- ...nstance_port_mongodb_exposed_to_internet.py | 4 +++- ..._instance_port_mysql_exposed_to_internet.py | 4 +++- ...instance_port_oracle_exposed_to_internet.py | 4 +++- ...ance_port_postgresql_exposed_to_internet.py | 4 +++- ...c2_instance_port_rdp_exposed_to_internet.py | 4 +++- ..._instance_port_redis_exposed_to_internet.py | 4 +++- ...tance_port_sqlserver_exposed_to_internet.py | 4 +++- ...c2_instance_port_ssh_exposed_to_internet.py | 4 +++- ...instance_port_telnet_exposed_to_internet.py | 4 +++- .../ec2_instance_profile_attached.py | 4 +++- .../ec2_instance_public_ip.py | 4 +++- .../ec2_instance_secrets_user_data.py | 4 +++- .../ec2_instance_uses_single_eni.py | 4 +++- .../ec2_launch_template_imdsv2_required.py | 4 +++- .../ec2_launch_template_no_public_ip.py | 4 +++- .../ec2_launch_template_no_secrets.py | 4 +++- .../ec2_networkacl_allow_ingress_any_port.py | 4 +++- ...ec2_networkacl_allow_ingress_tcp_port_22.py | 4 +++- ...2_networkacl_allow_ingress_tcp_port_3389.py | 4 +++- .../ec2_networkacl_unused.py | 4 +++- ...allow_ingress_from_internet_to_all_ports.py | 4 +++- ..._allow_ingress_from_internet_to_any_port.py | 4 +++- ...ess_from_internet_to_high_risk_tcp_ports.py | 4 +++- ...rom_internet_to_port_mongodb_27017_27018.py | 4 +++- ...ress_from_internet_to_tcp_ftp_port_20_21.py | 4 +++- ...low_ingress_from_internet_to_tcp_port_22.py | 4 +++- ...w_ingress_from_internet_to_tcp_port_3389.py | 4 +++- ...net_to_tcp_port_cassandra_7199_9160_8888.py | 4 +++- ...port_elasticsearch_kibana_9200_9300_5601.py | 4 +++- ...ess_from_internet_to_tcp_port_kafka_9092.py | 4 +++- ...rom_internet_to_tcp_port_memcached_11211.py | 4 +++- ...ess_from_internet_to_tcp_port_mysql_3306.py | 4 +++- ...om_internet_to_tcp_port_oracle_1521_2483.py | 4 +++- ..._from_internet_to_tcp_port_postgres_5432.py | 4 +++- ...ess_from_internet_to_tcp_port_redis_6379.py | 4 +++- ...nternet_to_tcp_port_sql_server_1433_1434.py | 4 +++- ...ress_from_internet_to_tcp_port_telnet_23.py | 4 +++- ...ecuritygroup_allow_wide_open_public_ipv4.py | 4 +++- ...2_securitygroup_default_restrict_traffic.py | 4 +++- .../ec2_securitygroup_from_launch_wizard.py | 4 +++- .../ec2_securitygroup_not_used.py | 4 +++- ...ritygroup_with_many_ingress_egress_rules.py | 4 +++- ...ansitgateway_auto_accept_vpc_attachments.py | 2 +- ...ecr_registry_scan_images_on_push_enabled.py | 7 +++---- ...cr_repositories_lifecycle_policy_enabled.py | 8 +++----- ...ecr_repositories_not_publicly_accessible.py | 8 +++----- ...repositories_scan_images_on_push_enabled.py | 8 +++----- ...ies_scan_vulnerabilities_in_latest_image.py | 8 +++----- .../ecr_repositories_tag_immutability.py | 8 +++----- .../ecs_cluster_container_insights_enabled.py | 8 +++----- ..._service_fargate_latest_platform_version.py | 8 +++----- .../ecs_service_no_assign_public_ip.py | 8 +++----- ...k_definitions_containers_readonly_access.py | 7 +++---- ...sk_definitions_host_namespace_not_shared.py | 7 +++---- ...k_definitions_host_networking_mode_users.py | 7 +++---- .../ecs_task_definitions_logging_block_mode.py | 9 ++++----- .../ecs_task_definitions_logging_enabled.py | 7 +++---- ..._task_definitions_no_environment_secrets.py | 7 +++---- ...ask_definitions_no_privileged_containers.py | 7 +++---- .../ecs_task_set_no_assign_public_ip.py | 8 +++----- .../efs_access_point_enforce_root_directory.py | 8 +++----- .../efs_access_point_enforce_user_identity.py | 8 +++----- .../efs_encryption_at_rest_enabled.py | 6 +----- .../efs_have_backup_enabled.py | 6 +----- .../efs_multi_az_enabled.py | 6 +----- .../efs_not_publicly_accessible.py | 6 +----- ...er_kms_cmk_encryption_in_secrets_enabled.py | 8 +++----- .../eks_cluster_network_policy_enabled.py | 8 +++----- .../eks_cluster_not_publicly_accessible.py | 8 +++----- .../eks_cluster_private_nodes_enabled.py | 8 +++----- .../eks_cluster_uses_a_supported_version.py | 8 +++----- ..._control_plane_logging_all_types_enabled.py | 8 +++----- .../elasticache_cluster_uses_public_subnet.py | 8 +++----- ...edis_cluster_auto_minor_version_upgrades.py | 8 +++----- ...redis_cluster_automatic_failover_enabled.py | 8 +++----- ...elasticache_redis_cluster_backup_enabled.py | 8 +++----- ...is_cluster_in_transit_encryption_enabled.py | 8 +++----- ...asticache_redis_cluster_multi_az_enabled.py | 8 +++----- ...he_redis_cluster_rest_encryption_enabled.py | 8 +++----- ...che_redis_replication_group_auth_enabled.py | 8 +++----- ...k_environment_cloudwatch_logging_enabled.py | 8 +++----- ...lk_environment_enhanced_health_reporting.py | 8 +++----- ...talk_environment_managed_updates_enabled.py | 8 +++----- .../elb_connection_draining_enabled.py | 18 +++++++----------- .../elb_cross_zone_load_balancing_enabled.py | 16 +++++++--------- .../elb_desync_mitigation_mode.py | 8 ++------ .../elb_insecure_ssl_ciphers.py | 8 ++------ .../elb_internet_facing/elb_internet_facing.py | 8 ++------ .../elb_is_in_multiple_az.py | 14 +++++--------- .../elb_logging_enabled/elb_logging_enabled.py | 8 ++------ .../providers/aws/services/elb/elb_service.py | 2 ++ .../elb/elb_ssl_listeners/elb_ssl_listeners.py | 8 ++------ .../elb_ssl_listeners_use_acm_certificate.py | 8 ++------ .../elbv2_cross_zone_load_balancing_enabled.py | 10 ++++------ .../elbv2_deletion_protection.py | 8 ++------ .../elbv2_desync_mitigation_mode.py | 10 ++++------ .../elbv2_internet_facing.py | 8 ++------ .../elbv2_is_in_multiple_az.py | 14 +++++--------- .../elbv2_listeners_underneath.py | 8 ++------ .../elbv2_logging_enabled.py | 8 ++------ .../elbv2_nlb_tls_termination_enabled.py | 10 ++++------ .../aws/services/elbv2/elbv2_service.py | 2 ++ .../elbv2_ssl_listeners/elbv2_ssl_listeners.py | 10 ++++------ .../elbv2_waf_acl_attached.py | 14 ++++++-------- .../emr_cluster_master_nodes_no_public_ip.py | 8 +++----- .../emr_cluster_publicly_accesible.py | 8 +++----- .../providers/aws/services/emr/emr_service.py | 1 - .../eventbridge_bus_exposed.py | 6 +----- ...lobal_endpoint_event_replication_enabled.py | 8 +++----- ...dge_schema_registry_cross_account_access.py | 8 +++----- ...bs_snapshot_lifecycle_policy_exists_test.py | 2 +- .../services/dynamodb/dynamodb_service_test.py | 10 ++++++---- ...modb_table_protected_by_backup_plan_test.py | 3 +++ .../aws/services/elb/elb_service_test.py | 3 +++ .../aws/services/elbv2/elbv2_service_test.py | 1 + 177 files changed, 517 insertions(+), 593 deletions(-) diff --git a/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.py b/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.py index 0a55a1c5a2..65661b1c74 100644 --- a/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.py +++ b/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.py @@ -22,7 +22,7 @@ class datasync_task_logging_enabled(Check): """ findings = [] for task in datasync_client.tasks.values(): - report = Check_Report_AWS(self.metadata(), task) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=task) report.status = "PASS" report.status_extended = f"DataSync task {task.name} has logging enabled." diff --git a/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py b/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py index 7621411eb9..f25e12b19a 100644 --- a/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py +++ b/prowler/providers/aws/services/directconnect/directconnect_connection_redundancy/directconnect_connection_redundancy.py @@ -18,7 +18,9 @@ class directconnect_connection_redundancy(Check): regions[conn.region]["Locations"].add(conn.location) for region, connections in regions.items(): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=connections + ) report.region = region report.resource_arn = directconnect_client._get_connection_arn_template( region diff --git a/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py b/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py index 5ffd55a19d..1d658f6626 100644 --- a/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py +++ b/prowler/providers/aws/services/directconnect/directconnect_virtual_interface_redundancy/directconnect_virtual_interface_redundancy.py @@ -27,10 +27,7 @@ class directconnect_virtual_interface_redundancy(Check): findings.append(report) for dxgw in directconnect_client.dxgws.values(): - report = Check_Report_AWS(self.metadata()) - report.region = dxgw.region - report.resource_arn = dxgw.arn - report.resource_id = dxgw.id + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=dxgw) if len(dxgw.vifs) < 2: report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.py b/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.py index de01b5c1e1..8ed8051106 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.py +++ b/prowler/providers/aws/services/directoryservice/directoryservice_directory_log_forwarding_enabled/directoryservice_directory_log_forwarding_enabled.py @@ -8,11 +8,9 @@ class directoryservice_directory_log_forwarding_enabled(Check): def execute(self): findings = [] for directory in directoryservice_client.directories.values(): - report = Check_Report_AWS(self.metadata()) - report.region = directory.region - report.resource_id = directory.id - report.resource_arn = directory.arn - report.resource_tags = directory.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=directory + ) if directory.log_subscriptions: report.status = "PASS" report.status_extended = f"Directory Service {directory.id} have log forwarding to CloudWatch enabled." diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.py b/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.py index 704a55f5c6..40df7034cf 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.py +++ b/prowler/providers/aws/services/directoryservice/directoryservice_directory_monitor_notifications/directoryservice_directory_monitor_notifications.py @@ -8,11 +8,9 @@ class directoryservice_directory_monitor_notifications(Check): def execute(self): findings = [] for directory in directoryservice_client.directories.values(): - report = Check_Report_AWS(self.metadata()) - report.region = directory.region - report.resource_id = directory.id - report.resource_arn = directory.arn - report.resource_tags = directory.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=directory + ) if directory.event_topics: report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.py b/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.py index ba579809d1..0f18693545 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.py +++ b/prowler/providers/aws/services/directoryservice/directoryservice_directory_snapshots_limit/directoryservice_directory_snapshots_limit.py @@ -11,11 +11,9 @@ class directoryservice_directory_snapshots_limit(Check): def execute(self): findings = [] for directory in directoryservice_client.directories.values(): - report = Check_Report_AWS(self.metadata()) - report.region = directory.region - report.resource_id = directory.id - report.resource_arn = directory.arn - report.resource_tags = directory.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=directory + ) if directory.snapshots_limits: if directory.snapshots_limits.manual_snapshots_limit_reached: report.status = "FAIL" diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.py b/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.py index 3590afd483..bae1e8d1b5 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.py +++ b/prowler/providers/aws/services/directoryservice/directoryservice_ldap_certificate_expiration/directoryservice_ldap_certificate_expiration.py @@ -14,11 +14,10 @@ class directoryservice_ldap_certificate_expiration(Check): findings = [] for directory in directoryservice_client.directories.values(): for certificate in directory.certificates: - report = Check_Report_AWS(self.metadata()) - report.region = directory.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=directory + ) report.resource_id = certificate.id - report.resource_arn = directory.arn - report.resource_tags = directory.tags remaining_days_to_expire = ( certificate.expiry_date_time diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.py b/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.py index caaa8ee07d..4d72ff0fb7 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.py +++ b/prowler/providers/aws/services/directoryservice/directoryservice_radius_server_security_protocol/directoryservice_radius_server_security_protocol.py @@ -12,11 +12,9 @@ class directoryservice_radius_server_security_protocol(Check): findings = [] for directory in directoryservice_client.directories.values(): if directory.radius_settings: - report = Check_Report_AWS(self.metadata()) - report.region = directory.region - report.resource_id = directory.id - report.resource_arn = directory.arn - report.resource_tags = directory.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=directory + ) if ( directory.radius_settings.authentication_protocol == AuthenticationProtocol.MS_CHAPv2 diff --git a/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.py b/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.py index e5fe559b7e..028eb3e72a 100644 --- a/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.py +++ b/prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.py @@ -12,11 +12,9 @@ class directoryservice_supported_mfa_radius_enabled(Check): findings = [] for directory in directoryservice_client.directories.values(): if directory.radius_settings: - report = Check_Report_AWS(self.metadata()) - report.region = directory.region - report.resource_id = directory.id - report.resource_arn = directory.arn - report.resource_tags = directory.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=directory + ) if directory.radius_settings.status == RadiusStatus.Completed: report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py b/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py index 146df4b374..506f690507 100644 --- a/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py +++ b/prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py @@ -11,7 +11,10 @@ class dlm_ebs_snapshot_lifecycle_policy_exists(Check): region in ec2_client.regions_with_snapshots and ec2_client.regions_with_snapshots[region] ): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=dlm_client.lifecycle_policies, + ) report.status = "FAIL" report.status_extended = "No EBS Snapshot lifecycle policies found." report.region = region diff --git a/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.py b/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.py index b19d8f1eeb..9052802285 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.py +++ b/prowler/providers/aws/services/dms/dms_endpoint_mongodb_authentication_enabled/dms_endpoint_mongodb_authentication_enabled.py @@ -24,13 +24,11 @@ class dms_endpoint_mongodb_authentication_enabled(Check): List[Check_Report_AWS]: A list of report objects with the results of the check. """ findings = [] - for endpoint_arn, endpoint in dms_client.endpoints.items(): + for endpoint in dms_client.endpoints.values(): if endpoint.engine_name == "mongodb": - report = Check_Report_AWS(self.metadata()) - report.resource_id = endpoint.id - report.resource_arn = endpoint_arn - report.region = endpoint.region - report.resource_tags = endpoint.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) report.status = "FAIL" report.status_extended = f"DMS Endpoint '{endpoint.id}' for MongoDB does not have an authentication mechanism enabled." if endpoint.mongodb_auth_type != "no": diff --git a/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.py b/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.py index e66e033284..1eebf10c12 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.py +++ b/prowler/providers/aws/services/dms/dms_endpoint_neptune_iam_authorization_enabled/dms_endpoint_neptune_iam_authorization_enabled.py @@ -23,13 +23,11 @@ class dms_endpoint_neptune_iam_authorization_enabled(Check): List[Check_Report_AWS]: A list of report objects with the results of the check. """ findings = [] - for endpoint_arn, endpoint in dms_client.endpoints.items(): + for endpoint in dms_client.endpoints.values(): if endpoint.engine_name == "neptune": - report = Check_Report_AWS(self.metadata()) - report.resource_id = endpoint.id - report.resource_arn = endpoint_arn - report.region = endpoint.region - report.resource_tags = endpoint.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) report.status = "FAIL" report.status_extended = f"DMS Endpoint {endpoint.id} for Neptune databases does not have IAM authorization enabled." if endpoint.neptune_iam_auth_enabled: diff --git a/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.py b/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.py index 84ef3a888f..6d5dba2bba 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.py +++ b/prowler/providers/aws/services/dms/dms_endpoint_redis_in_transit_encryption_enabled/dms_endpoint_redis_in_transit_encryption_enabled.py @@ -24,13 +24,11 @@ class dms_endpoint_redis_in_transit_encryption_enabled(Check): List[Check_Report_AWS]: A list of report objects with the results of the check. """ findings = [] - for endpoint_arn, endpoint in dms_client.endpoints.items(): + for endpoint in dms_client.endpoints.values(): if endpoint.engine_name == "redis": - report = Check_Report_AWS(self.metadata()) - report.resource_id = endpoint.id - report.resource_arn = endpoint_arn - report.region = endpoint.region - report.resource_tags = endpoint.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) report.status = "FAIL" report.status_extended = f"DMS Endpoint {endpoint.id} for Redis OSS is not encrypted in transit." if endpoint.redis_ssl_protocol == "ssl-encryption": diff --git a/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.py b/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.py index 465923b60c..b30e584f6f 100644 --- a/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.py +++ b/prowler/providers/aws/services/dms/dms_endpoint_ssl_enabled/dms_endpoint_ssl_enabled.py @@ -5,12 +5,10 @@ from prowler.providers.aws.services.dms.dms_client import dms_client class dms_endpoint_ssl_enabled(Check): def execute(self): findings = [] - for endpoint_arn, endpoint in dms_client.endpoints.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = endpoint.id - report.resource_arn = endpoint_arn - report.region = endpoint.region - report.resource_tags = endpoint.tags + for endpoint in dms_client.endpoints.values(): + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) if endpoint.ssl_mode == "none": report.status = "FAIL" diff --git a/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.py b/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.py index b89e72ec89..43ab957f65 100644 --- a/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.py +++ b/prowler/providers/aws/services/dms/dms_instance_minor_version_upgrade_enabled/dms_instance_minor_version_upgrade_enabled.py @@ -6,11 +6,9 @@ class dms_instance_minor_version_upgrade_enabled(Check): def execute(self): findings = [] for instance in dms_client.instances: - report = Check_Report_AWS(self.metadata()) - report.region = instance.region - report.resource_id = instance.id - report.resource_arn = instance.arn - report.resource_tags = instance.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "FAIL" report.status_extended = f"DMS Replication Instance {instance.id} does not have auto minor version upgrade enabled." if instance.auto_minor_version_upgrade: diff --git a/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.py b/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.py index d632ff225b..17030e4520 100644 --- a/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.py +++ b/prowler/providers/aws/services/dms/dms_instance_multi_az_enabled/dms_instance_multi_az_enabled.py @@ -6,11 +6,9 @@ class dms_instance_multi_az_enabled(Check): def execute(self): findings = [] for instance in dms_client.instances: - report = Check_Report_AWS(self.metadata()) - report.region = instance.region - report.resource_id = instance.id - report.resource_arn = instance.arn - report.resource_tags = instance.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "FAIL" report.status_extended = f"DMS Replication Instance {instance.id} does not have multi az enabled." if instance.multi_az: diff --git a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py index de383196a7..9c61bf143f 100644 --- a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py +++ b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py @@ -8,11 +8,9 @@ class dms_instance_no_public_access(Check): def execute(self): findings = [] for instance in dms_client.instances: - report = Check_Report_AWS(self.metadata()) - report.region = instance.region - report.resource_id = instance.id - report.resource_arn = instance.arn - report.resource_tags = instance.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = ( f"DMS Replication Instance {instance.id} is not publicly accessible." diff --git a/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.py b/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.py index d2e2a1c316..43ecd30406 100644 --- a/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.py +++ b/prowler/providers/aws/services/dms/dms_replication_task_source_logging_enabled/dms_replication_task_source_logging_enabled.py @@ -36,11 +36,10 @@ class dms_replication_task_source_logging_enabled(Check): replication_task_arn, replication_task, ) in dms_client.replication_tasks.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = replication_task.id + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=replication_task + ) report.resource_arn = replication_task_arn - report.region = replication_task.region - report.resource_tags = replication_task.tags if not replication_task.logging_enabled: report.status = "FAIL" diff --git a/prowler/providers/aws/services/dms/dms_replication_task_target_logging_enabled/dms_replication_task_target_logging_enabled.py b/prowler/providers/aws/services/dms/dms_replication_task_target_logging_enabled/dms_replication_task_target_logging_enabled.py index 464657c81c..7b7bf41805 100644 --- a/prowler/providers/aws/services/dms/dms_replication_task_target_logging_enabled/dms_replication_task_target_logging_enabled.py +++ b/prowler/providers/aws/services/dms/dms_replication_task_target_logging_enabled/dms_replication_task_target_logging_enabled.py @@ -36,11 +36,10 @@ class dms_replication_task_target_logging_enabled(Check): replication_task_arn, replication_task, ) in dms_client.replication_tasks.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = replication_task.id + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=replication_task + ) report.resource_arn = replication_task_arn - report.region = replication_task.region - report.resource_tags = replication_task.tags if not replication_task.logging_enabled: report.status = "FAIL" diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.py b/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.py index 67dcc6a03e..58c48d2cba 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.py +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.py @@ -8,11 +8,9 @@ class documentdb_cluster_backup_enabled(Check): def execute(self): findings = [] for cluster in documentdb_client.db_clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = ( f"DocumentDB Cluster {cluster.id} does not have backup enabled." diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.py b/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.py index dbedc2169f..cb1fc7c79e 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.py +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.py @@ -8,11 +8,9 @@ class documentdb_cluster_cloudwatch_log_export(Check): def execute(self): findings = [] for cluster in documentdb_client.db_clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"DocumentDB Cluster {cluster.id} does not have cloudwatch log export enabled." if cluster.cloudwatch_logs: diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.py b/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.py index 67f40512d3..5a253a34b9 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.py +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.py @@ -8,11 +8,9 @@ class documentdb_cluster_deletion_protection(Check): def execute(self): findings = [] for cluster in documentdb_client.db_clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"DocumentDB Cluster {cluster.id} does not have deletion protection enabled." if cluster.deletion_protection: diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.py b/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.py index 3b57ef9b00..8ad48aa384 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.py +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.py @@ -8,11 +8,9 @@ class documentdb_cluster_multi_az_enabled(Check): def execute(self): findings = [] for db_cluster in documentdb_client.db_clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = db_cluster.region - report.resource_id = db_cluster.id - report.resource_arn = db_cluster.arn - report.resource_tags = db_cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=db_cluster + ) report.status = "FAIL" report.status_extended = ( f"DocumentDB Cluster {db_cluster.id} does not have Multi-AZ enabled." diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.py b/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.py index 89a8429bd1..30e5d60208 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.py +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.py @@ -8,11 +8,9 @@ class documentdb_cluster_public_snapshot(Check): def execute(self): findings = [] for db_snap in documentdb_client.db_cluster_snapshots: - report = Check_Report_AWS(self.metadata()) - report.region = db_snap.region - report.resource_id = db_snap.id - report.resource_arn = db_snap.arn - report.resource_tags = db_snap.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=db_snap + ) if db_snap.public: report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.py b/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.py index aa9ce6609f..8ecc81799c 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.py +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.py @@ -8,11 +8,9 @@ class documentdb_cluster_storage_encrypted(Check): def execute(self): findings = [] for db_cluster in documentdb_client.db_clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = db_cluster.region - report.resource_id = db_cluster.id - report.resource_arn = db_cluster.arn - report.resource_tags = db_cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=db_cluster + ) if db_cluster.encrypted: report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py b/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py index 8bcf58e796..5409040de0 100644 --- a/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py +++ b/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py @@ -6,13 +6,12 @@ class drs_job_exist(Check): def execute(self): findings = [] for drs in drs_client.drs_services: - report = Check_Report_AWS(self.metadata()) - report.status = "FAIL" - report.status_extended = "DRS is not enabled for this region." - report.region = drs.region - report.resource_tags = [] + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=drs) report.resource_arn = drs_client._get_recovery_job_arn_template(drs.region) report.resource_id = drs_client.audited_account + report.status = "FAIL" + report.status_extended = "DRS is not enabled for this region." + if drs.status == "ENABLED": report.status_extended = "DRS is enabled for this region without jobs." if drs.jobs: diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.py b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.py index 9fda39d391..2ba8df978b 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_encryption_enabled/dynamodb_accelerator_cluster_encryption_enabled.py @@ -6,11 +6,9 @@ class dynamodb_accelerator_cluster_encryption_enabled(Check): def execute(self): findings = [] for cluster in dax_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.region = cluster.region - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = ( f"DAX cluster {cluster.name} does not have encryption at rest enabled." diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.py b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.py index c509f3645d..76c7604470 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_in_transit_encryption_enabled/dynamodb_accelerator_cluster_in_transit_encryption_enabled.py @@ -6,11 +6,9 @@ class dynamodb_accelerator_cluster_in_transit_encryption_enabled(Check): def execute(self): findings = [] for cluster in dax_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.region = cluster.region - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"DAX cluster {cluster.name} does not have encryption in transit enabled." if cluster.tls_encryption: diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.py b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.py index 02db43eff7..6cb3018f2b 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_accelerator_cluster_multi_az/dynamodb_accelerator_cluster_multi_az.py @@ -6,11 +6,9 @@ class dynamodb_accelerator_cluster_multi_az(Check): def execute(self): findings = [] for cluster in dax_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.region = cluster.region - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"DAX cluster {cluster.name} does not have nodes in multiple availability zones." if len(cluster.node_azs) > 1: diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_service.py b/prowler/providers/aws/services/dynamodb/dynamodb_service.py index ef31276196..ad6c959955 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_service.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_service.py @@ -30,6 +30,7 @@ class DynamoDB(AWSService): is_resource_filtered(arn, self.audit_resources) ): self.tables[arn] = Table( + arn=arn, name=table, encryption_type=None, kms_arn=None, @@ -221,6 +222,7 @@ class DAX(AWSService): class Table(BaseModel): + arn: str name: str billing_mode: str = "PROVISIONED" encryption_type: Optional[str] diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.py b/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.py index 606a674354..60722e6669 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_autoscaling_enabled/dynamodb_table_autoscaling_enabled.py @@ -22,12 +22,8 @@ class dynamodb_table_autoscaling_enabled(Check): autoscaling_mapping[table_name] = {} autoscaling_mapping[table_name][target.scalable_dimension] = target - for table_arn, table in dynamodb_client.tables.items(): - report = Check_Report_AWS(self.metadata()) - report.region = table.region - report.resource_id = table.name - report.resource_arn = table_arn - report.resource_tags = table.tags + for table in dynamodb_client.tables.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=table) report.status = "PASS" report.status_extended = ( f"DynamoDB table {table.name} automatically scales capacity on demand." diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.py b/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.py index 9cd049898f..b1f6e26020 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.py @@ -6,12 +6,8 @@ from prowler.providers.aws.services.iam.lib.policy import is_policy_public class dynamodb_table_cross_account_access(Check): def execute(self): findings = [] - for table_arn, table in dynamodb_client.tables.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = table.name - report.resource_arn = table_arn - report.resource_tags = table.tags - report.region = table.region + for table in dynamodb_client.tables.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=table) report.status = "PASS" report.status_extended = ( f"DynamoDB table {table.name} does not have a resource-based policy." diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.py b/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.py index e1e79caba8..2d288eec2d 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_deletion_protection_enabled/dynamodb_table_deletion_protection_enabled.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.dynamodb.dynamodb_client import dynamodb_cli class dynamodb_table_deletion_protection_enabled(Check): def execute(self): findings = [] - for table_arn, table in dynamodb_client.tables.items(): - report = Check_Report_AWS(self.metadata()) - report.region = table.region - report.resource_id = table.name - report.resource_arn = table_arn - report.resource_tags = table.tags + for table in dynamodb_client.tables.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=table) report.status = "FAIL" report.status_extended = f"DynamoDB table {table.name} does not have deletion protection enabled." diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.py b/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.py index 127304c912..c1fe7d9639 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan.py @@ -6,19 +6,15 @@ from prowler.providers.aws.services.dynamodb.dynamodb_client import dynamodb_cli class dynamodb_table_protected_by_backup_plan(Check): def execute(self): findings = [] - for table_arn, table in dynamodb_client.tables.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = table.name - report.resource_arn = table_arn - report.resource_tags = table.tags - report.region = table.region + for table in dynamodb_client.tables.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=table) report.status = "FAIL" report.status_extended = ( f"DynamoDB table {table.name} is not protected by a backup plan." ) if ( - table_arn in backup_client.protected_resources + table.arn in backup_client.protected_resources or f"arn:{dynamodb_client.audited_partition}:dynamodb:*:*:table/*" in backup_client.protected_resources or "*" in backup_client.protected_resources diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.py b/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.py index a805204d64..0acbbfe817 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_tables_kms_cmk_encryption_enabled/dynamodb_tables_kms_cmk_encryption_enabled.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.dynamodb.dynamodb_client import dynamodb_cli class dynamodb_tables_kms_cmk_encryption_enabled(Check): def execute(self): findings = [] - for table_arn, table in dynamodb_client.tables.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = table.name - report.resource_arn = table_arn - report.resource_tags = table.tags - report.region = table.region + for table in dynamodb_client.tables.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=table) report.status = "FAIL" report.status_extended = ( f"DynamoDB table {table.name} is using DEFAULT encryption." diff --git a/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.py b/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.py index 285f4e49ca..a787c3c459 100644 --- a/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.py +++ b/prowler/providers/aws/services/dynamodb/dynamodb_tables_pitr_enabled/dynamodb_tables_pitr_enabled.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.dynamodb.dynamodb_client import dynamodb_cli class dynamodb_tables_pitr_enabled(Check): def execute(self): findings = [] - for table_arn, table in dynamodb_client.tables.items(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = table.name - report.resource_arn = table_arn - report.resource_tags = table.tags - report.region = table.region + for table in dynamodb_client.tables.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=table) report.status = "FAIL" report.status_extended = f"DynamoDB table {table.name} does not have point-in-time recovery enabled." if table.pitr: diff --git a/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py b/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py index ebe84bf867..3649cffe73 100644 --- a/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py +++ b/prowler/providers/aws/services/ec2/ec2_ami_public/ec2_ami_public.py @@ -6,7 +6,7 @@ class ec2_ami_public(Check): def execute(self): findings = [] for image in ec2_client.images: - report = Check_Report_AWS(self.metadata(), image) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=image) report.status = "PASS" report.status_extended = ( f"EC2 AMI {image.name if image.name else image.id} is not public." diff --git a/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.py b/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.py index 409f911961..aabe6ee8b9 100644 --- a/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.py +++ b/prowler/providers/aws/services/ec2/ec2_client_vpn_endpoint_connection_logging_enabled/ec2_client_vpn_endpoint_connection_logging_enabled.py @@ -6,7 +6,9 @@ class ec2_client_vpn_endpoint_connection_logging_enabled(Check): def execute(self): findings = [] for vpn_arn, vpn_endpoint in ec2_client.vpn_endpoints.items(): - report = Check_Report_AWS(self.metadata(), vpn_endpoint) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=vpn_endpoint + ) if vpn_endpoint.connection_logging: report.status = "PASS" diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py b/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py index e11c1a5578..a68d54ceda 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_default_encryption/ec2_ebs_default_encryption.py @@ -7,7 +7,9 @@ class ec2_ebs_default_encryption(Check): findings = [] for ebs_encryption in ec2_client.ebs_encryption_by_default: if ebs_encryption.volumes or ec2_client.provider.scan_unused_services: - report = Check_Report_AWS(self.metadata(), ebs_encryption) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=ebs_encryption + ) report.resource_arn = ec2_client._get_volume_arn_template( ebs_encryption.region ) diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.py b/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.py index 39c9a2d990..2e1ab6c9a4 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_public_snapshot/ec2_ebs_public_snapshot.py @@ -6,7 +6,9 @@ class ec2_ebs_public_snapshot(Check): def execute(self): findings = [] for snapshot in ec2_client.snapshots: - report = Check_Report_AWS(self.metadata(), snapshot) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=snapshot + ) report.status = "PASS" report.status_extended = f"EBS Snapshot {snapshot.id} is not Public." if snapshot.public: diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.py b/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.py index 0c9074aa00..1cf6db6906 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_snapshot_account_block_public_access/ec2_ebs_snapshot_account_block_public_access.py @@ -12,7 +12,10 @@ class ec2_ebs_snapshot_account_block_public_access(Check): ebs_snapshot_block_status.snapshots or ec2_client.provider.scan_unused_services ): - report = Check_Report_AWS(self.metadata(), ebs_snapshot_block_status) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=ebs_snapshot_block_status, + ) report.resource_arn = ec2_client.account_arn_template report.resource_id = ec2_client.audited_account if ebs_snapshot_block_status.status == "block-all-sharing": diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.py b/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.py index 91028473c9..fcf0015055 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_snapshots_encrypted/ec2_ebs_snapshots_encrypted.py @@ -6,7 +6,9 @@ class ec2_ebs_snapshots_encrypted(Check): def execute(self): findings = [] for snapshot in ec2_client.snapshots: - report = Check_Report_AWS(self.metadata(), snapshot) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=snapshot + ) report.status = "PASS" report.status_extended = f"EBS Snapshot {snapshot.id} is encrypted." if not snapshot.encrypted: diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.py b/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.py index ec13228ecf..a31e5a181a 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_volume_encryption/ec2_ebs_volume_encryption.py @@ -6,7 +6,9 @@ class ec2_ebs_volume_encryption(Check): def execute(self): findings = [] for volume in ec2_client.volumes: - report = Check_Report_AWS(self.metadata(), volume) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=volume + ) report.status = "PASS" report.status_extended = f"EBS Snapshot {volume.id} is encrypted." if not volume.encrypted: diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.py b/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.py index 3d3aaa3053..9fb73dc028 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_volume_protected_by_backup_plan/ec2_ebs_volume_protected_by_backup_plan.py @@ -7,7 +7,9 @@ class ec2_ebs_volume_protected_by_backup_plan(Check): def execute(self): findings = [] for volume in ec2_client.volumes: - report = Check_Report_AWS(self.metadata(), volume) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=volume + ) report.status = "FAIL" report.status_extended = ( f"EBS Volume {volume.id} is not protected by a backup plan." diff --git a/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.py b/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.py index ff67be889b..66f1177018 100644 --- a/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.py +++ b/prowler/providers/aws/services/ec2/ec2_ebs_volume_snapshots_exists/ec2_ebs_volume_snapshots_exists.py @@ -6,7 +6,9 @@ class ec2_ebs_volume_snapshots_exists(Check): def execute(self): findings = [] for volume in ec2_client.volumes: - report = Check_Report_AWS(self.metadata(), volume) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=volume + ) report.status = "FAIL" report.status_extended = ( f"Snapshots not found for the EBS volume {volume.id}." diff --git a/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.py b/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.py index 55af643c4d..309a45ab5b 100644 --- a/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.py +++ b/prowler/providers/aws/services/ec2/ec2_elastic_ip_shodan/ec2_elastic_ip_shodan.py @@ -12,7 +12,9 @@ class ec2_elastic_ip_shodan(Check): if shodan_api_key: api = shodan.Shodan(shodan_api_key) for eip in ec2_client.elastic_ips: - report = Check_Report_AWS(self.metadata(), eip) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=eip + ) if eip.public_ip: try: shodan_info = api.host(eip.public_ip) diff --git a/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.py b/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.py index f25f1b12b7..10ac60becd 100644 --- a/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.py +++ b/prowler/providers/aws/services/ec2/ec2_elastic_ip_unassigned/ec2_elastic_ip_unassigned.py @@ -6,7 +6,7 @@ class ec2_elastic_ip_unassigned(Check): def execute(self): findings = [] for eip in ec2_client.elastic_ips: - report = Check_Report_AWS(self.metadata(), eip) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=eip) if eip.public_ip: report.resource_id = eip.public_ip report.status = "FAIL" diff --git a/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py b/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py index 8353603466..69e166ef5d 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_account_imdsv2_enabled/ec2_instance_account_imdsv2_enabled.py @@ -10,7 +10,10 @@ class ec2_instance_account_imdsv2_enabled(Check): instance_metadata_default.instances or ec2_client.provider.scan_unused_services ): - report = Check_Report_AWS(self.metadata(), instance_metadata_default) + report = Check_Report_AWS( + metadata=self.metadata(), + resource_metadata=instance_metadata_default, + ) report.resource_arn = ec2_client.account_arn_template report.resource_id = ec2_client.audited_account if instance_metadata_default.http_tokens == "required": diff --git a/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.py b/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.py index 4d899378c1..de38aa0d19 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_detailed_monitoring_enabled/ec2_instance_detailed_monitoring_enabled.py @@ -6,7 +6,9 @@ class ec2_instance_detailed_monitoring_enabled(Check): def execute(self): findings = [] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.resource_id = instance.id report.resource_arn = instance.arn report.resource_tags = instance.tags diff --git a/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.py b/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.py index adf82838ee..67b6c405ae 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_imdsv2_enabled/ec2_instance_imdsv2_enabled.py @@ -7,7 +7,9 @@ class ec2_instance_imdsv2_enabled(Check): findings = [] for instance in ec2_client.instances: if instance.state != "terminated": - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "FAIL" report.status_extended = ( f"EC2 Instance {instance.id} has IMDSv2 disabled or not required." diff --git a/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.py b/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.py index 11093f587c..5178fbd18e 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_internet_facing_with_instance_profile/ec2_instance_internet_facing_with_instance_profile.py @@ -7,7 +7,9 @@ class ec2_instance_internet_facing_with_instance_profile(Check): findings = [] for instance in ec2_client.instances: if instance.state != "terminated": - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"EC2 Instance {instance.id} is not internet facing with an instance profile." if instance.public_ip and instance.instance_profile: diff --git a/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.py b/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.py index 96e7cc0e94..d37af7ab7b 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_managed_by_ssm/ec2_instance_managed_by_ssm.py @@ -7,7 +7,9 @@ class ec2_instance_managed_by_ssm(Check): def execute(self): findings = [] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.resource_arn = instance.arn report.resource_tags = instance.tags report.status = "PASS" diff --git a/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.py b/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.py index 61b7658a00..adda705918 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_older_than_specific_days/ec2_instance_older_than_specific_days.py @@ -13,7 +13,9 @@ class ec2_instance_older_than_specific_days(Check): "max_ec2_instance_age_in_days", 180 ) for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.resource_id = instance.id report.resource_arn = instance.arn report.resource_tags = instance.tags diff --git a/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.py b/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.py index ab0e3eec13..71780cab17 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_paravirtual_type/ec2_instance_paravirtual_type.py @@ -7,7 +7,9 @@ class ec2_instance_paravirtual_type(Check): findings = [] for instance in ec2_client.instances: if instance.state != "terminated": - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = ( f"EC2 Instance {instance.id} virtualization type is set to HVM." diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py index d78e405523..eec808322f 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_cassandra_exposed_to_internet(Check): findings = [] check_ports = [7000, 7001, 7199, 9042, 9160] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Cassandra ports open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py index bb9fecead7..947a669575 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_cifs_exposed_to_internet(Check): findings = [] check_ports = [139, 445] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = ( f"Instance {instance.id} does not have CIFS ports open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py index 5ef9fb33cb..6de98f45a7 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_elasticsearch_kibana_exposed_to_internet(Check): findings = [] check_ports = [9200, 9300, 5601] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Elasticsearch/Kibana ports open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py index b0349a3bc7..ea35738eaf 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_ftp_exposed_to_internet(Check): findings = [] check_ports = [20, 21] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = ( f"Instance {instance.id} does not have FTP ports open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py index 5dd6d2dca6..ee4414c845 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_kafka_exposed_to_internet(Check): findings = [] check_ports = [9092] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Kafka port 9092 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py index 4ceef6ad0d..05844a3b49 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_kerberos_exposed_to_internet(Check): findings = [] check_ports = [88, 464, 749, 750] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Kerberos ports open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py index 3503c68254..31b6091641 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_ldap_exposed_to_internet(Check): findings = [] check_ports = [389, 636] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = ( f"Instance {instance.id} does not have LDAP ports open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py index 19b0147f46..33648cb3db 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_memcached_exposed_to_internet(Check): findings = [] check_ports = [11211] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Memcached port 11211 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py index 71794d9bd2..96182ae77a 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_mongodb_exposed_to_internet(Check): findings = [] check_ports = [27017, 27018] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have MongoDB ports open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py index ae368ed789..3ab88f8d73 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_mysql_exposed_to_internet(Check): findings = [] check_ports = [3306] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have MySQL port 3306 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py index 1f94575eac..002a3cfeaa 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_oracle_exposed_to_internet(Check): findings = [] check_ports = [1521, 2483, 2484] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Oracle ports open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py index f0195274c2..056810f73f 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_postgresql_exposed_to_internet(Check): findings = [] check_ports = [5432] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have PostgreSQL port 5432 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py index 5fb9faf6de..a64172ef04 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_rdp_exposed_to_internet(Check): findings = [] check_ports = [3389] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have RDP port 3389 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py index c591fbb448..b7bbdbdcbe 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_redis_exposed_to_internet(Check): findings = [] check_ports = [6379] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Redis port 6379 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py index a4020a3acb..7acb26035a 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_sqlserver_exposed_to_internet(Check): findings = [] check_ports = [1433, 1434] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have SQL Server ports open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py index f43ec7302c..ccda3c828b 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_ssh_exposed_to_internet(Check): findings = [] check_ports = [22] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have SSH port 22 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py index 332b059f30..80281df874 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py @@ -11,7 +11,9 @@ class ec2_instance_port_telnet_exposed_to_internet(Check): findings = [] check_ports = [23] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = f"Instance {instance.id} does not have Telnet port 23 open to the Internet." is_open_port = False diff --git a/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.py b/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.py index ebf601a13a..7dadd307c1 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_profile_attached/ec2_instance_profile_attached.py @@ -7,7 +7,9 @@ class ec2_instance_profile_attached(Check): findings = [] for instance in ec2_client.instances: if instance.state != "terminated": - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "FAIL" report.status_extended = f"EC2 Instance {instance.id} not associated with an Instance Profile Role." if instance.instance_profile: diff --git a/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.py b/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.py index ce4a0f45e6..2043a59f0c 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_public_ip/ec2_instance_public_ip.py @@ -7,7 +7,9 @@ class ec2_instance_public_ip(Check): findings = [] for instance in ec2_client.instances: if instance.state != "terminated": - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) report.status = "PASS" report.status_extended = ( f"EC2 Instance {instance.id} does not have a Public IP." diff --git a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py index 0bb21a93f6..dc6e376f38 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py @@ -16,7 +16,9 @@ class ec2_instance_secrets_user_data(Check): ) for instance in ec2_client.instances: if instance.state != "terminated": - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) if instance.user_data: user_data = b64decode(instance.user_data) try: diff --git a/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.py b/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.py index 2d3390c311..5354257f91 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_uses_single_eni/ec2_instance_uses_single_eni.py @@ -6,7 +6,9 @@ class ec2_instance_uses_single_eni(Check): def execute(self): findings = [] for instance in ec2_client.instances: - report = Check_Report_AWS(self.metadata(), instance) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=instance + ) eni_types = {"efa": [], "interface": [], "trunk": []} if not instance.network_interfaces: report.status = "PASS" diff --git a/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.py b/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.py index 51c8c5a5a8..91617fc322 100644 --- a/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.py +++ b/prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.py @@ -6,7 +6,9 @@ class ec2_launch_template_imdsv2_required(Check): def execute(self): findings = [] for template in ec2_client.launch_templates: - report = Check_Report_AWS(self.metadata(), template) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=template + ) versions_with_imdsv2_required = [] versions_with_metadata_disabled = [] diff --git a/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.py b/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.py index 460bf9c213..47bc591567 100644 --- a/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.py +++ b/prowler/providers/aws/services/ec2/ec2_launch_template_no_public_ip/ec2_launch_template_no_public_ip.py @@ -6,7 +6,9 @@ class ec2_launch_template_no_public_ip(Check): def execute(self): findings = [] for template in ec2_client.launch_templates: - report = Check_Report_AWS(self.metadata(), template) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=template + ) versions_with_autoassign_public_ip = [] versions_with_network_interfaces_public_ip = [] diff --git a/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py b/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py index a4f413a143..3184023f6c 100644 --- a/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py +++ b/prowler/providers/aws/services/ec2/ec2_launch_template_no_secrets/ec2_launch_template_no_secrets.py @@ -15,7 +15,9 @@ class ec2_launch_template_no_secrets(Check): "secrets_ignore_patterns", [] ) for template in ec2_client.launch_templates: - report = Check_Report_AWS(self.metadata(), template) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=template + ) versions_with_secrets = [] diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.py b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.py index 1e8c766881..08adf13e53 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.py +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_any_port/ec2_networkacl_allow_ingress_any_port.py @@ -13,7 +13,9 @@ class ec2_networkacl_allow_ingress_any_port(Check): ec2_client.provider.scan_unused_services or network_acl.region in ec2_client.regions_with_sgs ): - report = Check_Report_AWS(self.metadata(), network_acl) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=network_acl + ) # If some entry allows it, that ACL is not securely configured if check_network_acl(network_acl.entries, tcp_protocol, check_port): report.status = "FAIL" diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.py b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.py index 0eba9cb4af..f5cd60bf7a 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.py +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_22/ec2_networkacl_allow_ingress_tcp_port_22.py @@ -13,7 +13,9 @@ class ec2_networkacl_allow_ingress_tcp_port_22(Check): ec2_client.provider.scan_unused_services or network_acl.region in ec2_client.regions_with_sgs ): - report = Check_Report_AWS(self.metadata(), network_acl) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=network_acl + ) # If some entry allows it, that ACL is not securely configured if check_network_acl(network_acl.entries, tcp_protocol, check_port): report.status = "FAIL" diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.py b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.py index 2213efd216..5c538d5d95 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.py +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_allow_ingress_tcp_port_3389/ec2_networkacl_allow_ingress_tcp_port_3389.py @@ -13,7 +13,9 @@ class ec2_networkacl_allow_ingress_tcp_port_3389(Check): ec2_client.provider.scan_unused_services or network_acl.region in ec2_client.regions_with_sgs ): - report = Check_Report_AWS(self.metadata(), network_acl) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=network_acl + ) # If some entry allows it, that ACL is not securely configured if check_network_acl(network_acl.entries, tcp_protocol, check_port): report.status = "FAIL" diff --git a/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.py b/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.py index b2606efd79..c15cebb782 100644 --- a/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.py +++ b/prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.py @@ -7,7 +7,9 @@ class ec2_networkacl_unused(Check): findings = [] for arn, network_acl in ec2_client.network_acls.items(): if not network_acl.default: - report = Check_Report_AWS(self.metadata(), network_acl) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=network_acl + ) if not network_acl.in_use: report.status = "FAIL" diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py index bffd917079..7bbb90f121 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py @@ -14,7 +14,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_all_ports(Check): and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have all ports open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py index 0437e14dc8..669aa2378f 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py @@ -23,7 +23,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_any_port(Check): and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have any port open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.py index 5f58a447f4..a43ae14407 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports/ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports.py @@ -17,7 +17,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports(Check and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have any high-risk port open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py index ae554b6440..c1cb8ccdce 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018( and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have MongoDB ports 27017 and 27018 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py index 854d0ec7eb..ba4a2b0ac9 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21(Check) and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have FTP ports 20 and 21 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py index fb028fd41b..ef1b8e3de1 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22(Check): and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have SSH port 22 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py index fade2ee651..169c56319d 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389(Check): and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Microsoft RDP port 3389 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py index 087aec26cf..024a83ad2e 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888.py @@ -20,7 +20,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9 and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Casandra ports 7199, 8888 and 9160 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py index 462ddb230c..ee57f80efd 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601.py @@ -20,7 +20,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_ki and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Elasticsearch/Kibana ports 9200, 9300 and 5601 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py index 11dbe73c4e..0fca4d9dd8 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092(Check and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Kafka port 9092 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py index b9932469f0..28671a813e 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211( and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Memcached port 11211 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py index dc7487d922..133927727d 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306(Check and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have MySQL port 3306 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py index f425632708..95bc56742b 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483 and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Oracle ports 1521 and 2483 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py index 2e148cc9df..76ff6f51bc 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432(Ch and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Postgres port 5432 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py index 39783655d5..db942730f8 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379(Check and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Redis port 6379 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py index 18b9ad0ad5..9fc0ad2560 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434.py @@ -20,7 +20,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_ and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Microsoft SQL Server ports 1433 and 1434 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py index f29403c772..3b12b61114 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23.py @@ -18,7 +18,9 @@ class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23(Check) and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have Telnet port 23 open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py index 9dc55f2fda..db0a01715a 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_wide_open_public_ipv4/ec2_securitygroup_allow_wide_open_public_ipv4.py @@ -16,7 +16,9 @@ class ec2_securitygroup_allow_wide_open_public_ipv4(Check): and vpc_client.vpcs[security_group.vpc_id].in_use and len(security_group.network_interfaces) > 0 ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) has no potential wide-open non-RFC1918 address." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py index 6ab633ec48..87bf5b6c0d 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_default_restrict_traffic/ec2_securitygroup_default_restrict_traffic.py @@ -16,7 +16,9 @@ class ec2_securitygroup_default_restrict_traffic(Check): and len(security_group.network_interfaces) > 0 ) ): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py index f3f522160e..2294608984 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_from_launch_wizard/ec2_securitygroup_from_launch_wizard.py @@ -6,7 +6,9 @@ class ec2_securitygroup_from_launch_wizard(Check): def execute(self): findings = [] for security_group in ec2_client.security_groups.values(): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) was not created using the EC2 Launch Wizard." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py index 799fef9756..c90709209d 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used.py @@ -9,7 +9,9 @@ class ec2_securitygroup_not_used(Check): for security_group_arn, security_group in ec2_client.security_groups.items(): # Default security groups can not be deleted, so ignore them if security_group.name != "default": - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) it is being used." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py index ff354e2730..b3c7d62b98 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_with_many_ingress_egress_rules/ec2_securitygroup_with_many_ingress_egress_rules.py @@ -11,7 +11,9 @@ class ec2_securitygroup_with_many_ingress_egress_rules(Check): "max_security_group_rules", 50 ) for security_group_arn, security_group in ec2_client.security_groups.items(): - report = Check_Report_AWS(self.metadata(), security_group) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=security_group + ) report.resource_details = security_group.name report.status = "PASS" report.status_extended = f"Security group {security_group.name} ({security_group.id}) has {len(security_group.ingress_rules)} inbound rules and {len(security_group.egress_rules)} outbound rules." diff --git a/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.py b/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.py index a1796b86b4..94266c3a6a 100644 --- a/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.py +++ b/prowler/providers/aws/services/ec2/ec2_transitgateway_auto_accept_vpc_attachments/ec2_transitgateway_auto_accept_vpc_attachments.py @@ -6,7 +6,7 @@ class ec2_transitgateway_auto_accept_vpc_attachments(Check): def execute(self): findings = [] for tgw in ec2_client.transit_gateways.values(): - report = Check_Report_AWS(self.metadata(), tgw) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=tgw) if tgw.auto_accept_shared_attachments: report.status = "FAIL" diff --git a/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.py b/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.py index db34c41ea5..3c77250d9b 100644 --- a/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.py +++ b/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.py @@ -8,10 +8,9 @@ class ecr_registry_scan_images_on_push_enabled(Check): for registry in ecr_client.registries.values(): # We want to check the registry if it is in use, hence there are repositories if len(registry.repositories) != 0: - report = Check_Report_AWS(self.metadata()) - report.region = registry.region - report.resource_id = registry.id - report.resource_arn = registry.arn + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=registry + ) report.status = "FAIL" report.status_extended = f"ECR registry {registry.id} has {registry.scan_type} scanning without scan on push enabled." if registry.rules: diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.py b/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.py index dbba260dd9..b8b183e455 100644 --- a/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.py +++ b/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.py @@ -7,11 +7,9 @@ class ecr_repositories_lifecycle_policy_enabled(Check): findings = [] for registry in ecr_client.registries.values(): for repository in registry.repositories: - report = Check_Report_AWS(self.metadata()) - report.region = repository.region - report.resource_id = repository.name - report.resource_arn = repository.arn - report.resource_tags = repository.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repository + ) report.status = "FAIL" report.status_extended = f"Repository {repository.name} does not have a lifecycle policy configured." if repository.lifecycle_policy: diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_not_publicly_accessible/ecr_repositories_not_publicly_accessible.py b/prowler/providers/aws/services/ecr/ecr_repositories_not_publicly_accessible/ecr_repositories_not_publicly_accessible.py index 146c1cfcd2..7f88bc28b3 100644 --- a/prowler/providers/aws/services/ecr/ecr_repositories_not_publicly_accessible/ecr_repositories_not_publicly_accessible.py +++ b/prowler/providers/aws/services/ecr/ecr_repositories_not_publicly_accessible/ecr_repositories_not_publicly_accessible.py @@ -8,11 +8,9 @@ class ecr_repositories_not_publicly_accessible(Check): findings = [] for registry in ecr_client.registries.values(): for repository in registry.repositories: - report = Check_Report_AWS(self.metadata()) - report.region = repository.region - report.resource_id = repository.name - report.resource_arn = repository.arn - report.resource_tags = repository.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repository + ) report.status = "PASS" report.status_extended = ( f"Repository {repository.name} is not publicly accessible." diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.py b/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.py index 4712f0b5dd..7d757ff7eb 100644 --- a/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.py +++ b/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.py @@ -7,11 +7,9 @@ class ecr_repositories_scan_images_on_push_enabled(Check): findings = [] for registry in ecr_client.registries.values(): for repository in registry.repositories: - report = Check_Report_AWS(self.metadata()) - report.region = repository.region - report.resource_id = repository.name - report.resource_arn = repository.arn - report.resource_tags = repository.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repository + ) report.status = "PASS" report.status_extended = ( f"ECR repository {repository.name} has scan on push enabled." diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.py b/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.py index 068203e0b7..2e6d53df35 100644 --- a/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.py +++ b/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.py @@ -17,11 +17,9 @@ class ecr_repositories_scan_vulnerabilities_in_latest_image(Check): if len(repository.images_details) > 0: # We only want to check the latest image pushed that is scannable image = repository.images_details[-1] - report = Check_Report_AWS(self.metadata()) - report.region = repository.region - report.resource_id = repository.name - report.resource_arn = repository.arn - report.resource_tags = repository.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repository + ) report.status = "PASS" status_extended_prefix = f"ECR repository '{repository.name}' has scanned the {image.type} container image with digest '{image.latest_digest}' and tag '{image.latest_tag}' " report.status_extended = ( diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.py b/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.py index c721c2c504..d8feb9ee97 100644 --- a/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.py +++ b/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.py @@ -7,11 +7,9 @@ class ecr_repositories_tag_immutability(Check): findings = [] for registry in ecr_client.registries.values(): for repository in registry.repositories: - report = Check_Report_AWS(self.metadata()) - report.region = repository.region - report.resource_id = repository.name - report.resource_arn = repository.arn - report.resource_tags = repository.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repository + ) report.status = "PASS" report.status_extended = ( diff --git a/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.py b/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.py index 3c3ce272ef..31f51e0979 100644 --- a/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.py +++ b/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.py @@ -6,11 +6,9 @@ class ecs_cluster_container_insights_enabled(Check): def execute(self): findings = [] for cluster in ecs_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = ( f"ECS cluster {cluster.name} does not have container insights enabled." diff --git a/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.py b/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.py index e6a20e6b4c..a38dc42d42 100644 --- a/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.py +++ b/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.py @@ -7,11 +7,9 @@ class ecs_service_fargate_latest_platform_version(Check): findings = [] for service in ecs_client.services.values(): if service.launch_type == "FARGATE": - report = Check_Report_AWS(self.metadata()) - report.region = service.region - report.resource_id = service.name - report.resource_arn = service.arn - report.resource_tags = service.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=service + ) fargate_latest_linux_version = ecs_client.audit_config.get( "fargate_linux_latest_version", "1.4.0" ) diff --git a/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.py b/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.py index 89eacae7cb..5e51b9d55c 100644 --- a/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.py +++ b/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.py @@ -6,11 +6,9 @@ class ecs_service_no_assign_public_ip(Check): def execute(self): findings = [] for service in ecs_client.services.values(): - report = Check_Report_AWS(self.metadata()) - report.region = service.region - report.resource_id = service.name - report.resource_arn = service.arn - report.resource_tags = service.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=service + ) report.status = "PASS" report.status_extended = f"ECS Service {service.name} does not have automatic public IP assignment." diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py index cf423f8b13..6aae60bcc4 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py @@ -6,11 +6,10 @@ class ecs_task_definitions_containers_readonly_access(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = task_definition.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_definition + ) report.resource_id = f"{task_definition.name}:{task_definition.revision}" - report.resource_arn = task_definition.arn - report.resource_tags = task_definition.tags report.status = "PASS" report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not have containers with write access to the root filesystems." diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py index e85c9d1c17..9ca7354c42 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py @@ -6,11 +6,10 @@ class ecs_task_definitions_host_namespace_not_shared(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = task_definition.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_definition + ) report.resource_id = f"{task_definition.name}:{task_definition.revision}" - report.resource_arn = task_definition.arn - report.resource_tags = task_definition.tags report.status = "PASS" report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not share a host's process namespace with its containers." if task_definition.pid_mode == "host": diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py index 5b4ed9b153..e47d24c5d2 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py @@ -6,11 +6,10 @@ class ecs_task_definitions_host_networking_mode_users(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = task_definition.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_definition + ) report.resource_id = f"{task_definition.name}:{task_definition.revision}" - report.resource_arn = task_definition.arn - report.resource_tags = task_definition.tags report.status = "PASS" report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not have host network mode." failed_containers = [] diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py index 2d9e91c7b8..99ef33337d 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py @@ -6,12 +6,11 @@ class ecs_task_definitions_logging_block_mode(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): - report = Check_Report_AWS(self.metadata()) - containers = 0 - report.region = task_definition.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_definition + ) report.resource_id = f"{task_definition.name}:{task_definition.revision}" - report.resource_arn = task_definition.arn - report.resource_tags = task_definition.tags + containers = 0 report.status = "PASS" report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} containers has logging configured with non blocking mode." failed_containers = [] diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py index 8180c3a83e..8b90587f0a 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py @@ -6,11 +6,10 @@ class ecs_task_definitions_logging_enabled(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = task_definition.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_definition + ) report.resource_id = f"{task_definition.name}:{task_definition.revision}" - report.resource_arn = task_definition.arn - report.resource_tags = task_definition.tags report.status = "PASS" report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} containers have logging configured." failed_containers = [] diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py index 53fe501f9c..dc4735068d 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py @@ -12,11 +12,10 @@ class ecs_task_definitions_no_environment_secrets(Check): "secrets_ignore_patterns", [] ) for task_definition in ecs_client.task_definitions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = task_definition.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_definition + ) report.resource_id = f"{task_definition.name}:{task_definition.revision}" - report.resource_arn = task_definition.arn - report.resource_tags = task_definition.tags report.status = "PASS" extended_status_parts = [] diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py index 3618889c39..846472fdf3 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py @@ -6,11 +6,10 @@ class ecs_task_definitions_no_privileged_containers(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): - report = Check_Report_AWS(self.metadata()) - report.region = task_definition.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_definition + ) report.resource_id = f"{task_definition.name}:{task_definition.revision}" - report.resource_arn = task_definition.arn - report.resource_tags = task_definition.tags report.status = "PASS" report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not have privileged containers." failed_containers = [] diff --git a/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.py b/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.py index 561dd223e4..93b921918c 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.py +++ b/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.py @@ -6,11 +6,9 @@ class ecs_task_set_no_assign_public_ip(Check): def execute(self): findings = [] for task_set in ecs_client.task_sets.values(): - report = Check_Report_AWS(self.metadata()) - report.region = task_set.region - report.resource_id = task_set.id - report.resource_arn = task_set.arn - report.resource_tags = task_set.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=task_set + ) report.status = "PASS" report.status_extended = f"ECS Task Set {task_set.id} does not have automatic public IP assignment." diff --git a/prowler/providers/aws/services/efs/efs_access_point_enforce_root_directory/efs_access_point_enforce_root_directory.py b/prowler/providers/aws/services/efs/efs_access_point_enforce_root_directory/efs_access_point_enforce_root_directory.py index 8e7641cc9e..4e62efc70b 100644 --- a/prowler/providers/aws/services/efs/efs_access_point_enforce_root_directory/efs_access_point_enforce_root_directory.py +++ b/prowler/providers/aws/services/efs/efs_access_point_enforce_root_directory/efs_access_point_enforce_root_directory.py @@ -7,11 +7,9 @@ class efs_access_point_enforce_root_directory(Check): findings = [] for fs in efs_client.filesystems.values(): if fs.access_points: - report = Check_Report_AWS(self.metadata()) - report.region = fs.region - report.resource_id = fs.id - report.resource_arn = fs.arn - report.resource_tags = fs.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=fs + ) report.status = "PASS" report.status_extended = f"EFS {fs.id} does not have any access point allowing access to the root directory." access_points = [] diff --git a/prowler/providers/aws/services/efs/efs_access_point_enforce_user_identity/efs_access_point_enforce_user_identity.py b/prowler/providers/aws/services/efs/efs_access_point_enforce_user_identity/efs_access_point_enforce_user_identity.py index 33b8bcace3..00de1fb648 100644 --- a/prowler/providers/aws/services/efs/efs_access_point_enforce_user_identity/efs_access_point_enforce_user_identity.py +++ b/prowler/providers/aws/services/efs/efs_access_point_enforce_user_identity/efs_access_point_enforce_user_identity.py @@ -7,11 +7,9 @@ class efs_access_point_enforce_user_identity(Check): findings = [] for fs in efs_client.filesystems.values(): if fs.access_points: - report = Check_Report_AWS(self.metadata()) - report.region = fs.region - report.resource_id = fs.id - report.resource_arn = fs.arn - report.resource_tags = fs.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=fs + ) report.status = "PASS" report.status_extended = ( f"EFS {fs.id} has all access points with defined POSIX user." diff --git a/prowler/providers/aws/services/efs/efs_encryption_at_rest_enabled/efs_encryption_at_rest_enabled.py b/prowler/providers/aws/services/efs/efs_encryption_at_rest_enabled/efs_encryption_at_rest_enabled.py index ceecaf9216..52edd7848f 100644 --- a/prowler/providers/aws/services/efs/efs_encryption_at_rest_enabled/efs_encryption_at_rest_enabled.py +++ b/prowler/providers/aws/services/efs/efs_encryption_at_rest_enabled/efs_encryption_at_rest_enabled.py @@ -6,11 +6,7 @@ class efs_encryption_at_rest_enabled(Check): def execute(self): findings = [] for fs in efs_client.filesystems.values(): - report = Check_Report_AWS(self.metadata()) - report.region = fs.region - report.resource_id = fs.id - report.resource_arn = fs.arn - report.resource_tags = fs.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fs) report.status = "FAIL" report.status_extended = ( f"EFS {fs.id} does not have encryption at rest enabled." diff --git a/prowler/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled.py b/prowler/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled.py index 65ab9d0dd4..26884d60e7 100644 --- a/prowler/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled.py +++ b/prowler/providers/aws/services/efs/efs_have_backup_enabled/efs_have_backup_enabled.py @@ -6,11 +6,7 @@ class efs_have_backup_enabled(Check): def execute(self): findings = [] for fs in efs_client.filesystems.values(): - report = Check_Report_AWS(self.metadata()) - report.region = fs.region - report.resource_id = fs.id - report.resource_arn = fs.arn - report.resource_tags = fs.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fs) report.status = "PASS" report.status_extended = f"EFS {fs.id} has backup enabled." if fs.backup_policy == "DISABLED" or fs.backup_policy == "DISABLING": diff --git a/prowler/providers/aws/services/efs/efs_multi_az_enabled/efs_multi_az_enabled.py b/prowler/providers/aws/services/efs/efs_multi_az_enabled/efs_multi_az_enabled.py index 24944f859e..8c52558e12 100644 --- a/prowler/providers/aws/services/efs/efs_multi_az_enabled/efs_multi_az_enabled.py +++ b/prowler/providers/aws/services/efs/efs_multi_az_enabled/efs_multi_az_enabled.py @@ -6,11 +6,7 @@ class efs_multi_az_enabled(Check): def execute(self): findings = [] for fs in efs_client.filesystems.values(): - report = Check_Report_AWS(self.metadata()) - report.region = fs.region - report.resource_id = fs.id - report.resource_arn = fs.arn - report.resource_tags = fs.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fs) if fs.availability_zone_id: report.status = "FAIL" report.status_extended = f"EFS {fs.id} is a Single-AZ file system." diff --git a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py index a6a6f6abec..f7ce674f02 100644 --- a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py +++ b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py @@ -7,11 +7,7 @@ class efs_not_publicly_accessible(Check): def execute(self): findings = [] for fs in efs_client.filesystems.values(): - report = Check_Report_AWS(self.metadata()) - report.region = fs.region - report.resource_id = fs.id - report.resource_arn = fs.arn - report.resource_tags = fs.tags + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=fs) report.status = "PASS" report.status_extended = f"EFS {fs.id} has a policy which does not allow access to any client within the VPC." if not fs.policy: diff --git a/prowler/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled.py b/prowler/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled.py index d187d8a34b..818f09c807 100644 --- a/prowler/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled.py +++ b/prowler/providers/aws/services/eks/eks_cluster_kms_cmk_encryption_in_secrets_enabled/eks_cluster_kms_cmk_encryption_in_secrets_enabled.py @@ -6,11 +6,9 @@ class eks_cluster_kms_cmk_encryption_in_secrets_enabled(Check): def execute(self): findings = [] for cluster in eks_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"EKS cluster {cluster.name} does not have encryption for Kubernetes secrets." if cluster.encryptionConfig: diff --git a/prowler/providers/aws/services/eks/eks_cluster_network_policy_enabled/eks_cluster_network_policy_enabled.py b/prowler/providers/aws/services/eks/eks_cluster_network_policy_enabled/eks_cluster_network_policy_enabled.py index 56e5800852..8cbdfe613d 100644 --- a/prowler/providers/aws/services/eks/eks_cluster_network_policy_enabled/eks_cluster_network_policy_enabled.py +++ b/prowler/providers/aws/services/eks/eks_cluster_network_policy_enabled/eks_cluster_network_policy_enabled.py @@ -6,11 +6,9 @@ class eks_cluster_network_policy_enabled(Check): def execute(self): findings = [] for cluster in eks_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"EKS cluster {cluster.name} does not have a Network Policy. Cluster security group ID is not set." if cluster.security_group_id: diff --git a/prowler/providers/aws/services/eks/eks_cluster_not_publicly_accessible/eks_cluster_not_publicly_accessible.py b/prowler/providers/aws/services/eks/eks_cluster_not_publicly_accessible/eks_cluster_not_publicly_accessible.py index 38406f46c4..f30927e175 100644 --- a/prowler/providers/aws/services/eks/eks_cluster_not_publicly_accessible/eks_cluster_not_publicly_accessible.py +++ b/prowler/providers/aws/services/eks/eks_cluster_not_publicly_accessible/eks_cluster_not_publicly_accessible.py @@ -6,11 +6,9 @@ class eks_cluster_not_publicly_accessible(Check): def execute(self): findings = [] for cluster in eks_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "PASS" report.status_extended = ( f"EKS cluster {cluster.name} is not publicly accessible." diff --git a/prowler/providers/aws/services/eks/eks_cluster_private_nodes_enabled/eks_cluster_private_nodes_enabled.py b/prowler/providers/aws/services/eks/eks_cluster_private_nodes_enabled/eks_cluster_private_nodes_enabled.py index d8ddcabafe..7e7a85f804 100644 --- a/prowler/providers/aws/services/eks/eks_cluster_private_nodes_enabled/eks_cluster_private_nodes_enabled.py +++ b/prowler/providers/aws/services/eks/eks_cluster_private_nodes_enabled/eks_cluster_private_nodes_enabled.py @@ -6,11 +6,9 @@ class eks_cluster_private_nodes_enabled(Check): def execute(self): findings = [] for cluster in eks_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "PASS" report.status_extended = ( f"EKS cluster {cluster.name} is created with private nodes." diff --git a/prowler/providers/aws/services/eks/eks_cluster_uses_a_supported_version/eks_cluster_uses_a_supported_version.py b/prowler/providers/aws/services/eks/eks_cluster_uses_a_supported_version/eks_cluster_uses_a_supported_version.py index 499ff85549..18c4618443 100644 --- a/prowler/providers/aws/services/eks/eks_cluster_uses_a_supported_version/eks_cluster_uses_a_supported_version.py +++ b/prowler/providers/aws/services/eks/eks_cluster_uses_a_supported_version/eks_cluster_uses_a_supported_version.py @@ -14,11 +14,9 @@ class eks_cluster_uses_a_supported_version(Check): ) for cluster in eks_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) cluster_version_major, cluster_version_minor = map( int, cluster.version.split(".") diff --git a/prowler/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled.py b/prowler/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled.py index f2f465db1d..7a7ebc0ca8 100644 --- a/prowler/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled.py +++ b/prowler/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled.py @@ -19,11 +19,9 @@ class eks_control_plane_logging_all_types_enabled(Check): required_log_types_str = ", ".join(required_log_types) for cluster in eks_client.clusters: - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.name - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "FAIL" report.status_extended = f"Control plane logging is not enabled for EKS cluster {cluster.name}. Required log types: {required_log_types_str}." if cluster.logging and cluster.logging.enabled: diff --git a/prowler/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet.py b/prowler/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet.py index 3a8c554fa4..2b1d2d1aff 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet.py +++ b/prowler/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet.py @@ -9,11 +9,9 @@ class elasticache_cluster_uses_public_subnet(Check): def execute(self): findings = [] for cluster in elasticache_client.clusters.values(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags - report.region = cluster.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "PASS" if cluster.engine == "redis": diff --git a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_auto_minor_version_upgrades/elasticache_redis_cluster_auto_minor_version_upgrades.py b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_auto_minor_version_upgrades/elasticache_redis_cluster_auto_minor_version_upgrades.py index f28fd62462..5188c19416 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_auto_minor_version_upgrades/elasticache_redis_cluster_auto_minor_version_upgrades.py +++ b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_auto_minor_version_upgrades/elasticache_redis_cluster_auto_minor_version_upgrades.py @@ -8,11 +8,9 @@ class elasticache_redis_cluster_auto_minor_version_upgrades(Check): def execute(self): findings = [] for repl_group in elasticache_client.replication_groups.values(): - report = Check_Report_AWS(self.metadata()) - report.region = repl_group.region - report.resource_id = repl_group.id - report.resource_arn = repl_group.arn - report.resource_tags = repl_group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repl_group + ) report.status = "PASS" report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does have automated minor version upgrades enabled." diff --git a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_automatic_failover_enabled/elasticache_redis_cluster_automatic_failover_enabled.py b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_automatic_failover_enabled/elasticache_redis_cluster_automatic_failover_enabled.py index e3dd36fc33..ae96231c9f 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_automatic_failover_enabled/elasticache_redis_cluster_automatic_failover_enabled.py +++ b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_automatic_failover_enabled/elasticache_redis_cluster_automatic_failover_enabled.py @@ -8,11 +8,9 @@ class elasticache_redis_cluster_automatic_failover_enabled(Check): def execute(self): findings = [] for repl_group in elasticache_client.replication_groups.values(): - report = Check_Report_AWS(self.metadata()) - report.region = repl_group.region - report.resource_id = repl_group.id - report.resource_arn = repl_group.arn - report.resource_tags = repl_group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repl_group + ) report.status = "FAIL" report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have automatic failover enabled." diff --git a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_backup_enabled/elasticache_redis_cluster_backup_enabled.py b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_backup_enabled/elasticache_redis_cluster_backup_enabled.py index ce4cdc88cf..e327112928 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_backup_enabled/elasticache_redis_cluster_backup_enabled.py +++ b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_backup_enabled/elasticache_redis_cluster_backup_enabled.py @@ -8,11 +8,9 @@ class elasticache_redis_cluster_backup_enabled(Check): def execute(self): findings = [] for repl_group in elasticache_client.replication_groups.values(): - report = Check_Report_AWS(self.metadata()) - report.region = repl_group.region - report.resource_id = repl_group.id - report.resource_arn = repl_group.arn - report.resource_tags = repl_group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repl_group + ) report.status = "FAIL" report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have automated snapshot backups enabled." if repl_group.snapshot_retention > elasticache_client.audit_config.get( diff --git a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_in_transit_encryption_enabled/elasticache_redis_cluster_in_transit_encryption_enabled.py b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_in_transit_encryption_enabled/elasticache_redis_cluster_in_transit_encryption_enabled.py index bed12a7214..146ce73984 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_in_transit_encryption_enabled/elasticache_redis_cluster_in_transit_encryption_enabled.py +++ b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_in_transit_encryption_enabled/elasticache_redis_cluster_in_transit_encryption_enabled.py @@ -8,11 +8,9 @@ class elasticache_redis_cluster_in_transit_encryption_enabled(Check): def execute(self): findings = [] for repl_group in elasticache_client.replication_groups.values(): - report = Check_Report_AWS(self.metadata()) - report.region = repl_group.region - report.resource_id = repl_group.id - report.resource_arn = repl_group.arn - report.resource_tags = repl_group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repl_group + ) report.status = "FAIL" report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have in transit encryption enabled." if repl_group.transit_encryption: diff --git a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_multi_az_enabled/elasticache_redis_cluster_multi_az_enabled.py b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_multi_az_enabled/elasticache_redis_cluster_multi_az_enabled.py index 18b3aaa068..40782472ad 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_multi_az_enabled/elasticache_redis_cluster_multi_az_enabled.py +++ b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_multi_az_enabled/elasticache_redis_cluster_multi_az_enabled.py @@ -8,11 +8,9 @@ class elasticache_redis_cluster_multi_az_enabled(Check): def execute(self): findings = [] for repl_group in elasticache_client.replication_groups.values(): - report = Check_Report_AWS(self.metadata()) - report.region = repl_group.region - report.resource_id = repl_group.id - report.resource_arn = repl_group.arn - report.resource_tags = repl_group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repl_group + ) report.status = "FAIL" report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have Multi-AZ enabled." if repl_group.multi_az == "enabled": diff --git a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_rest_encryption_enabled/elasticache_redis_cluster_rest_encryption_enabled.py b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_rest_encryption_enabled/elasticache_redis_cluster_rest_encryption_enabled.py index 5a2a990db5..647a232a77 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_rest_encryption_enabled/elasticache_redis_cluster_rest_encryption_enabled.py +++ b/prowler/providers/aws/services/elasticache/elasticache_redis_cluster_rest_encryption_enabled/elasticache_redis_cluster_rest_encryption_enabled.py @@ -8,11 +8,9 @@ class elasticache_redis_cluster_rest_encryption_enabled(Check): def execute(self): findings = [] for repl_group in elasticache_client.replication_groups.values(): - report = Check_Report_AWS(self.metadata()) - report.region = repl_group.region - report.resource_id = repl_group.id - report.resource_arn = repl_group.arn - report.resource_tags = repl_group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repl_group + ) report.status = "FAIL" report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have at rest encryption enabled." if repl_group.encrypted: diff --git a/prowler/providers/aws/services/elasticache/elasticache_redis_replication_group_auth_enabled/elasticache_redis_replication_group_auth_enabled.py b/prowler/providers/aws/services/elasticache/elasticache_redis_replication_group_auth_enabled/elasticache_redis_replication_group_auth_enabled.py index 6bdaa1170b..612492868c 100644 --- a/prowler/providers/aws/services/elasticache/elasticache_redis_replication_group_auth_enabled/elasticache_redis_replication_group_auth_enabled.py +++ b/prowler/providers/aws/services/elasticache/elasticache_redis_replication_group_auth_enabled/elasticache_redis_replication_group_auth_enabled.py @@ -10,11 +10,9 @@ class elasticache_redis_replication_group_auth_enabled(Check): def execute(self): findings = [] for repl_group in elasticache_client.replication_groups.values(): - report = Check_Report_AWS(self.metadata()) - report.region = repl_group.region - report.resource_id = repl_group.id - report.resource_arn = repl_group.arn - report.resource_tags = repl_group.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=repl_group + ) if version.parse(repl_group.engine_version) < version.parse("6.0"): if not repl_group.auth_token_enabled: diff --git a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_cloudwatch_logging_enabled/elasticbeanstalk_environment_cloudwatch_logging_enabled.py b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_cloudwatch_logging_enabled/elasticbeanstalk_environment_cloudwatch_logging_enabled.py index ce9b8711e6..070d2af1ff 100644 --- a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_cloudwatch_logging_enabled/elasticbeanstalk_environment_cloudwatch_logging_enabled.py +++ b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_cloudwatch_logging_enabled/elasticbeanstalk_environment_cloudwatch_logging_enabled.py @@ -8,11 +8,9 @@ class elasticbeanstalk_environment_cloudwatch_logging_enabled(Check): def execute(self): findings = [] for environment in elasticbeanstalk_client.environments.values(): - report = Check_Report_AWS(self.metadata()) - report.region = environment.region - report.resource_id = environment.name - report.resource_arn = environment.arn - report.resource_tags = environment.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=environment + ) report.status = "PASS" report.status_extended = f"Elastic Beanstalk environment {environment.name} is sending logs to CloudWatch Logs." diff --git a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_enhanced_health_reporting/elasticbeanstalk_environment_enhanced_health_reporting.py b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_enhanced_health_reporting/elasticbeanstalk_environment_enhanced_health_reporting.py index 0e6b0f570c..0fefce64ff 100644 --- a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_enhanced_health_reporting/elasticbeanstalk_environment_enhanced_health_reporting.py +++ b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_enhanced_health_reporting/elasticbeanstalk_environment_enhanced_health_reporting.py @@ -8,11 +8,9 @@ class elasticbeanstalk_environment_enhanced_health_reporting(Check): def execute(self): findings = [] for environment in elasticbeanstalk_client.environments.values(): - report = Check_Report_AWS(self.metadata()) - report.region = environment.region - report.resource_id = environment.name - report.resource_arn = environment.arn - report.resource_tags = environment.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=environment + ) report.status = "PASS" report.status_extended = f"Elastic Beanstalk environment {environment.name} has enhanced health reporting enabled." diff --git a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.py b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.py index 2b592b8348..0e07d30d0b 100644 --- a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.py +++ b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.py @@ -8,11 +8,9 @@ class elasticbeanstalk_environment_managed_updates_enabled(Check): def execute(self): findings = [] for environment in elasticbeanstalk_client.environments.values(): - report = Check_Report_AWS(self.metadata()) - report.region = environment.region - report.resource_id = environment.name - report.resource_arn = environment.arn - report.resource_tags = environment.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=environment + ) report.status = "PASS" report.status_extended = f"Elastic Beanstalk environment {environment.name} has managed platform updates enabled." diff --git a/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.py b/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.py index 0c146fb516..cb1ccbc55b 100644 --- a/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.py +++ b/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.py @@ -5,20 +5,16 @@ from prowler.providers.aws.services.elb.elb_client import elb_client class elb_connection_draining_enabled(Check): def execute(self) -> list[Check_Report_AWS]: findings = [] - for loadbalancer_arn, load_balancer in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = load_balancer.region - report.resource_id = load_balancer.name - report.resource_arn = loadbalancer_arn - report.resource_tags = load_balancer.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" - report.status_extended = ( - f"ELB {load_balancer.name} has connection draining enabled." - ) + report.status_extended = f"ELB {lb.name} has connection draining enabled." - if not load_balancer.connection_draining: + if not lb.connection_draining: report.status = "FAIL" - report.status_extended = f"ELB {load_balancer.name} does not have connection draining enabled." + report.status_extended = ( + f"ELB {lb.name} does not have connection draining enabled." + ) findings.append(report) diff --git a/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.py b/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.py index f9dbbff636..4bf7090d26 100644 --- a/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.py +++ b/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.py @@ -7,19 +7,17 @@ from prowler.providers.aws.services.elb.elb_client import elb_client class elb_cross_zone_load_balancing_enabled(Check): def execute(self) -> List[Check_Report_AWS]: findings = [] - for load_balancer_arn, load_balancer in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = load_balancer.region - report.resource_id = load_balancer.name - report.resource_arn = load_balancer_arn - report.resource_tags = load_balancer.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "FAIL" - report.status_extended = f"ELB {load_balancer.name} does not have cross-zone load balancing enabled." + report.status_extended = ( + f"ELB {lb.name} does not have cross-zone load balancing enabled." + ) - if load_balancer.cross_zone_load_balancing: + if lb.cross_zone_load_balancing: report.status = "PASS" report.status_extended = ( - f"ELB {load_balancer.name} has cross-zone load balancing enabled." + f"ELB {lb.name} has cross-zone load balancing enabled." ) findings.append(report) diff --git a/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.py b/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.py index 4897a73cda..cc03593c92 100644 --- a/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.py +++ b/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.elb.elb_client import elb_client class elb_desync_mitigation_mode(Check): def execute(self): findings = [] - for lb_arn, lb in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) if ( lb.desync_mitigation_mode == "defensive" or lb.desync_mitigation_mode == "strictest" diff --git a/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.py b/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.py index 1e83d432a2..d31429e504 100644 --- a/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.py +++ b/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.py @@ -8,12 +8,8 @@ class elb_insecure_ssl_ciphers(Check): secure_ssl_policies = [ "ELBSecurityPolicy-TLS-1-2-2017-01", ] - for lb_arn, lb in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" report.status_extended = ( f"ELB {lb.name} does not have insecure SSL protocols or ciphers." diff --git a/prowler/providers/aws/services/elb/elb_internet_facing/elb_internet_facing.py b/prowler/providers/aws/services/elb/elb_internet_facing/elb_internet_facing.py index 5688d0b3c9..4699530877 100644 --- a/prowler/providers/aws/services/elb/elb_internet_facing/elb_internet_facing.py +++ b/prowler/providers/aws/services/elb/elb_internet_facing/elb_internet_facing.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.elb.elb_client import elb_client class elb_internet_facing(Check): def execute(self): findings = [] - for lb_arn, lb in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" report.status_extended = f"ELB {lb.name} is not internet facing." if lb.scheme == "internet-facing": diff --git a/prowler/providers/aws/services/elb/elb_is_in_multiple_az/elb_is_in_multiple_az.py b/prowler/providers/aws/services/elb/elb_is_in_multiple_az/elb_is_in_multiple_az.py index d8404382ca..22e6bf67a9 100644 --- a/prowler/providers/aws/services/elb/elb_is_in_multiple_az/elb_is_in_multiple_az.py +++ b/prowler/providers/aws/services/elb/elb_is_in_multiple_az/elb_is_in_multiple_az.py @@ -8,18 +8,14 @@ class elb_is_in_multiple_az(Check): def execute(self) -> List[Check_Report_AWS]: findings = [] ELB_MIN_AZS = elb_client.audit_config.get("elb_min_azs", 2) - for loadbalancer_arn, load_balancer in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = load_balancer.region - report.resource_id = load_balancer.name - report.resource_arn = loadbalancer_arn - report.resource_tags = load_balancer.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "FAIL" - report.status_extended = f"Classic Load Balancer {load_balancer.name} is not in at least {ELB_MIN_AZS} availability zones, it is only in {', '.join(load_balancer.availability_zones)}." + report.status_extended = f"Classic Load Balancer {lb.name} is not in at least {ELB_MIN_AZS} availability zones, it is only in {', '.join(lb.availability_zones)}." - if len(load_balancer.availability_zones) >= ELB_MIN_AZS: + if len(lb.availability_zones) >= ELB_MIN_AZS: report.status = "PASS" - report.status_extended = f"Classic Load Balancer {load_balancer.name} is in {len(load_balancer.availability_zones)} availability zones: {', '.join(load_balancer.availability_zones)}." + report.status_extended = f"Classic Load Balancer {lb.name} is in {len(lb.availability_zones)} availability zones: {', '.join(lb.availability_zones)}." findings.append(report) diff --git a/prowler/providers/aws/services/elb/elb_logging_enabled/elb_logging_enabled.py b/prowler/providers/aws/services/elb/elb_logging_enabled/elb_logging_enabled.py index a9cfec587d..b2fd56f079 100644 --- a/prowler/providers/aws/services/elb/elb_logging_enabled/elb_logging_enabled.py +++ b/prowler/providers/aws/services/elb/elb_logging_enabled/elb_logging_enabled.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.elb.elb_client import elb_client class elb_logging_enabled(Check): def execute(self): findings = [] - for lb_arn, lb in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "FAIL" report.status_extended = ( f"ELB {lb.name} does not have access logs configured." diff --git a/prowler/providers/aws/services/elb/elb_service.py b/prowler/providers/aws/services/elb/elb_service.py index 5ab828a348..85d56d4946 100644 --- a/prowler/providers/aws/services/elb/elb_service.py +++ b/prowler/providers/aws/services/elb/elb_service.py @@ -43,6 +43,7 @@ class ELB(AWSService): ) self.loadbalancers[arn] = LoadBalancer( + arn=arn, name=elb["LoadBalancerName"], dns=elb["DNSName"], region=regional_client.region, @@ -104,6 +105,7 @@ class Listener(BaseModel): class LoadBalancer(BaseModel): + arn: str name: str dns: str region: str diff --git a/prowler/providers/aws/services/elb/elb_ssl_listeners/elb_ssl_listeners.py b/prowler/providers/aws/services/elb/elb_ssl_listeners/elb_ssl_listeners.py index 4839ad36c6..cacfa4124b 100644 --- a/prowler/providers/aws/services/elb/elb_ssl_listeners/elb_ssl_listeners.py +++ b/prowler/providers/aws/services/elb/elb_ssl_listeners/elb_ssl_listeners.py @@ -6,12 +6,8 @@ class elb_ssl_listeners(Check): def execute(self): findings = [] secure_protocols = ["SSL", "HTTPS"] - for lb_arn, lb in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" report.status_extended = f"ELB {lb.name} has HTTPS listeners only." for listener in lb.listeners: diff --git a/prowler/providers/aws/services/elb/elb_ssl_listeners_use_acm_certificate/elb_ssl_listeners_use_acm_certificate.py b/prowler/providers/aws/services/elb/elb_ssl_listeners_use_acm_certificate/elb_ssl_listeners_use_acm_certificate.py index 5c2acfffee..bf83b870a4 100644 --- a/prowler/providers/aws/services/elb/elb_ssl_listeners_use_acm_certificate/elb_ssl_listeners_use_acm_certificate.py +++ b/prowler/providers/aws/services/elb/elb_ssl_listeners_use_acm_certificate/elb_ssl_listeners_use_acm_certificate.py @@ -7,12 +7,8 @@ class elb_ssl_listeners_use_acm_certificate(Check): def execute(self): findings = [] secure_protocols = ["SSL", "HTTPS"] - for lb_arn, lb in elb_client.loadbalancers.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elb_client.loadbalancers.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" report.status_extended = f"ELB {lb.name} HTTPS/SSL listeners are using certificates managed by ACM." for listener in lb.listeners: diff --git a/prowler/providers/aws/services/elbv2/elbv2_cross_zone_load_balancing_enabled/elbv2_cross_zone_load_balancing_enabled.py b/prowler/providers/aws/services/elbv2/elbv2_cross_zone_load_balancing_enabled/elbv2_cross_zone_load_balancing_enabled.py index f7340f5797..1e1a323c64 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_cross_zone_load_balancing_enabled/elbv2_cross_zone_load_balancing_enabled.py +++ b/prowler/providers/aws/services/elbv2/elbv2_cross_zone_load_balancing_enabled/elbv2_cross_zone_load_balancing_enabled.py @@ -7,13 +7,11 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_cross_zone_load_balancing_enabled(Check): def execute(self) -> List[Check_Report_AWS]: findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): + for lb in elbv2_client.loadbalancersv2.values(): if lb.type != "application": - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=lb + ) report.status = "FAIL" report.status_extended = ( f"ELBv2 {lb.name} does not have cross-zone load balancing enabled." diff --git a/prowler/providers/aws/services/elbv2/elbv2_deletion_protection/elbv2_deletion_protection.py b/prowler/providers/aws/services/elbv2/elbv2_deletion_protection/elbv2_deletion_protection.py index 7084068fff..9e0fd02fe0 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_deletion_protection/elbv2_deletion_protection.py +++ b/prowler/providers/aws/services/elbv2/elbv2_deletion_protection/elbv2_deletion_protection.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_deletion_protection(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elbv2_client.loadbalancersv2.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "FAIL" report.status_extended = ( f"ELBv2 {lb.name} does not have deletion protection enabled." diff --git a/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py b/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py index a9ee709a8f..626ee17ec2 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py +++ b/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py @@ -5,13 +5,11 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_desync_mitigation_mode(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): + for lb in elbv2_client.loadbalancersv2.values(): if lb.type == "application": - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=lb + ) report.status = "PASS" report.status_extended = f"ELBv2 ALB {lb.name} is configured with correct desync mitigation mode." if ( diff --git a/prowler/providers/aws/services/elbv2/elbv2_internet_facing/elbv2_internet_facing.py b/prowler/providers/aws/services/elbv2/elbv2_internet_facing/elbv2_internet_facing.py index 4ff093d5d0..3464fc2090 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_internet_facing/elbv2_internet_facing.py +++ b/prowler/providers/aws/services/elbv2/elbv2_internet_facing/elbv2_internet_facing.py @@ -7,12 +7,8 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_internet_facing(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elbv2_client.loadbalancersv2.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" report.status_extended = f"ELBv2 ALB {lb.name} is not internet facing." if lb.scheme == "internet-facing": diff --git a/prowler/providers/aws/services/elbv2/elbv2_is_in_multiple_az/elbv2_is_in_multiple_az.py b/prowler/providers/aws/services/elbv2/elbv2_is_in_multiple_az/elbv2_is_in_multiple_az.py index 46dd5e6250..a8166dfe7d 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_is_in_multiple_az/elbv2_is_in_multiple_az.py +++ b/prowler/providers/aws/services/elbv2/elbv2_is_in_multiple_az/elbv2_is_in_multiple_az.py @@ -8,18 +8,14 @@ class elbv2_is_in_multiple_az(Check): def execute(self) -> List[Check_Report_AWS]: findings = [] elbv2_min_azs = elbv2_client.audit_config.get("elbv2_min_azs", 2) - for load_balancer_arn, load_balancer in elbv2_client.loadbalancersv2.items(): - report = Check_Report_AWS(self.metadata()) - report.region = load_balancer.region - report.resource_id = load_balancer.name - report.resource_arn = load_balancer_arn - report.resource_tags = load_balancer.tags + for lb in elbv2_client.loadbalancersv2.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "FAIL" - report.status_extended = f"ELBv2 {load_balancer.name} is not in at least {elbv2_min_azs} AZs. Is only in {', '.join(load_balancer.availability_zones.keys())}." + report.status_extended = f"ELBv2 {lb.name} is not in at least {elbv2_min_azs} AZs. Is only in {', '.join(lb.availability_zones.keys())}." - if len(load_balancer.availability_zones) >= elbv2_min_azs: + if len(lb.availability_zones) >= elbv2_min_azs: report.status = "PASS" - report.status_extended = f"ELBv2 {load_balancer.name} is at least in {elbv2_min_azs} AZs: {', '.join(load_balancer.availability_zones.keys())}." + report.status_extended = f"ELBv2 {lb.name} is at least in {elbv2_min_azs} AZs: {', '.join(lb.availability_zones.keys())}." findings.append(report) diff --git a/prowler/providers/aws/services/elbv2/elbv2_listeners_underneath/elbv2_listeners_underneath.py b/prowler/providers/aws/services/elbv2/elbv2_listeners_underneath/elbv2_listeners_underneath.py index c79c36b4fb..2904831f7b 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_listeners_underneath/elbv2_listeners_underneath.py +++ b/prowler/providers/aws/services/elbv2/elbv2_listeners_underneath/elbv2_listeners_underneath.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_listeners_underneath(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elbv2_client.loadbalancersv2.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "PASS" report.status_extended = f"ELBv2 {lb.name} has listeners underneath." if len(lb.listeners) == 0: diff --git a/prowler/providers/aws/services/elbv2/elbv2_logging_enabled/elbv2_logging_enabled.py b/prowler/providers/aws/services/elbv2/elbv2_logging_enabled/elbv2_logging_enabled.py index 18eecfb152..d554f33a69 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_logging_enabled/elbv2_logging_enabled.py +++ b/prowler/providers/aws/services/elbv2/elbv2_logging_enabled/elbv2_logging_enabled.py @@ -5,12 +5,8 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_logging_enabled(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + for lb in elbv2_client.loadbalancersv2.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=lb) report.status = "FAIL" report.status_extended = ( f"ELBv2 ALB {lb.name} does not have access logs configured." diff --git a/prowler/providers/aws/services/elbv2/elbv2_nlb_tls_termination_enabled/elbv2_nlb_tls_termination_enabled.py b/prowler/providers/aws/services/elbv2/elbv2_nlb_tls_termination_enabled/elbv2_nlb_tls_termination_enabled.py index 9d00ad7a54..3d522de680 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_nlb_tls_termination_enabled/elbv2_nlb_tls_termination_enabled.py +++ b/prowler/providers/aws/services/elbv2/elbv2_nlb_tls_termination_enabled/elbv2_nlb_tls_termination_enabled.py @@ -5,13 +5,11 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_nlb_tls_termination_enabled(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): + for lb in elbv2_client.loadbalancersv2.values(): if lb.type == "network": - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=lb + ) report.status = "FAIL" report.status_extended = f"ELBv2 NLB {lb.name} is not configured to terminate TLS connections." for listener in lb.listeners.values(): diff --git a/prowler/providers/aws/services/elbv2/elbv2_service.py b/prowler/providers/aws/services/elbv2/elbv2_service.py index 3955dfcb8f..96889b54e4 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_service.py +++ b/prowler/providers/aws/services/elbv2/elbv2_service.py @@ -42,6 +42,7 @@ class ELBv2(AWSService): ) ): self.loadbalancersv2[elbv2["LoadBalancerArn"]] = LoadBalancerv2( + arn=elbv2["LoadBalancerArn"], name=elbv2["LoadBalancerName"], region=regional_client.region, type=elbv2["Type"], @@ -197,6 +198,7 @@ class Listenerv2(BaseModel): class LoadBalancerv2(BaseModel): + arn: str name: str region: str type: str diff --git a/prowler/providers/aws/services/elbv2/elbv2_ssl_listeners/elbv2_ssl_listeners.py b/prowler/providers/aws/services/elbv2/elbv2_ssl_listeners/elbv2_ssl_listeners.py index 46ea77df6c..09b34ee3c8 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_ssl_listeners/elbv2_ssl_listeners.py +++ b/prowler/providers/aws/services/elbv2/elbv2_ssl_listeners/elbv2_ssl_listeners.py @@ -5,13 +5,11 @@ from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client class elbv2_ssl_listeners(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): + for lb in elbv2_client.loadbalancersv2.values(): if lb.type == "application": - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=lb + ) report.status = "PASS" report.status_extended = ( f"ELBv2 ALB {lb.name} has HTTPS listeners only." diff --git a/prowler/providers/aws/services/elbv2/elbv2_waf_acl_attached/elbv2_waf_acl_attached.py b/prowler/providers/aws/services/elbv2/elbv2_waf_acl_attached/elbv2_waf_acl_attached.py index 95ab649568..4b72865d44 100644 --- a/prowler/providers/aws/services/elbv2/elbv2_waf_acl_attached/elbv2_waf_acl_attached.py +++ b/prowler/providers/aws/services/elbv2/elbv2_waf_acl_attached/elbv2_waf_acl_attached.py @@ -7,23 +7,21 @@ from prowler.providers.aws.services.wafv2.wafv2_client import wafv2_client class elbv2_waf_acl_attached(Check): def execute(self): findings = [] - for lb_arn, lb in elbv2_client.loadbalancersv2.items(): + for lb in elbv2_client.loadbalancersv2.values(): if lb.type == "application": - report = Check_Report_AWS(self.metadata()) - report.region = lb.region - report.resource_id = lb.name - report.resource_arn = lb_arn - report.resource_tags = lb.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=lb + ) report.status = "FAIL" report.status_extended = ( f"ELBv2 ALB {lb.name} is not protected by WAF Web ACL." ) for acl in wafv2_client.web_acls.values(): - if lb_arn in acl.albs: + if lb.arn in acl.albs: report.status = "PASS" report.status_extended = f"ELBv2 ALB {lb.name} is protected by WAFv2 Web ACL {acl.name}." for acl in wafregional_client.web_acls.values(): - if lb_arn in acl.albs: + if lb.arn in acl.albs: report.status = "PASS" report.status_extended = f"ELBv2 ALB {lb.name} is protected by WAFv1 Web ACL {acl.name}." diff --git a/prowler/providers/aws/services/emr/emr_cluster_master_nodes_no_public_ip/emr_cluster_master_nodes_no_public_ip.py b/prowler/providers/aws/services/emr/emr_cluster_master_nodes_no_public_ip/emr_cluster_master_nodes_no_public_ip.py index 2836390c38..fc2009efa0 100644 --- a/prowler/providers/aws/services/emr/emr_cluster_master_nodes_no_public_ip/emr_cluster_master_nodes_no_public_ip.py +++ b/prowler/providers/aws/services/emr/emr_cluster_master_nodes_no_public_ip/emr_cluster_master_nodes_no_public_ip.py @@ -11,11 +11,9 @@ class emr_cluster_master_nodes_no_public_ip(Check): ClusterStatus.TERMINATED, ClusterStatus.TERMINATED_WITH_ERRORS, ): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) if cluster.public: report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py b/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py index 61ee169396..443e8c99d7 100644 --- a/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py +++ b/prowler/providers/aws/services/emr/emr_cluster_publicly_accesible/emr_cluster_publicly_accesible.py @@ -15,11 +15,9 @@ class emr_cluster_publicly_accesible(Check): ClusterStatus.TERMINATED, ClusterStatus.TERMINATED_WITH_ERRORS, ): - report = Check_Report_AWS(self.metadata()) - report.region = cluster.region - report.resource_id = cluster.id - report.resource_arn = cluster.arn - report.resource_tags = cluster.tags + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=cluster + ) report.status = "PASS" report.status_extended = ( f"EMR Cluster {cluster.id} is not publicly accessible." diff --git a/prowler/providers/aws/services/emr/emr_service.py b/prowler/providers/aws/services/emr/emr_service.py index 0e90099624..e1fb7c15da 100644 --- a/prowler/providers/aws/services/emr/emr_service.py +++ b/prowler/providers/aws/services/emr/emr_service.py @@ -9,7 +9,6 @@ from prowler.lib.scan_filters.scan_filters import is_resource_filtered from prowler.providers.aws.lib.service.service import AWSService -################## EMR class EMR(AWSService): def __init__(self, provider): # Call AWSService's __init__ diff --git a/prowler/providers/aws/services/eventbridge/eventbridge_bus_exposed/eventbridge_bus_exposed.py b/prowler/providers/aws/services/eventbridge/eventbridge_bus_exposed/eventbridge_bus_exposed.py index 5da8c67b33..c2861a02c4 100644 --- a/prowler/providers/aws/services/eventbridge/eventbridge_bus_exposed/eventbridge_bus_exposed.py +++ b/prowler/providers/aws/services/eventbridge/eventbridge_bus_exposed/eventbridge_bus_exposed.py @@ -9,15 +9,11 @@ class eventbridge_bus_exposed(Check): def execute(self): findings = [] for bus in eventbridge_client.buses.values(): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS(metadata=self.metadata(), resource_metadata=bus) report.status = "PASS" report.status_extended = ( f"EventBridge event bus {bus.name} is not exposed to everyone." ) - report.resource_id = bus.name - report.resource_arn = bus.arn - report.resource_tags = bus.tags - report.region = bus.region if is_policy_public(bus.policy, eventbridge_client.audited_account): report.status = "FAIL" report.status_extended = ( diff --git a/prowler/providers/aws/services/eventbridge/eventbridge_global_endpoint_event_replication_enabled/eventbridge_global_endpoint_event_replication_enabled.py b/prowler/providers/aws/services/eventbridge/eventbridge_global_endpoint_event_replication_enabled/eventbridge_global_endpoint_event_replication_enabled.py index fa8befd592..ba3848736a 100644 --- a/prowler/providers/aws/services/eventbridge/eventbridge_global_endpoint_event_replication_enabled/eventbridge_global_endpoint_event_replication_enabled.py +++ b/prowler/providers/aws/services/eventbridge/eventbridge_global_endpoint_event_replication_enabled/eventbridge_global_endpoint_event_replication_enabled.py @@ -8,13 +8,11 @@ class eventbridge_global_endpoint_event_replication_enabled(Check): def execute(self): findings = [] for endpoint in eventbridge_client.endpoints.values(): - report = Check_Report_AWS(self.metadata()) + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=endpoint + ) report.status = "PASS" report.status_extended = f"EventBridge global endpoint {endpoint.name} has event replication enabled." - report.resource_id = endpoint.name - report.resource_arn = endpoint.arn - report.resource_tags = endpoint.tags - report.region = endpoint.region if endpoint.replication_state == "DISABLED": report.status = "FAIL" report.status_extended = f"EventBridge global endpoint {endpoint.name} does not have event replication enabled." diff --git a/prowler/providers/aws/services/eventbridge/eventbridge_schema_registry_cross_account_access/eventbridge_schema_registry_cross_account_access.py b/prowler/providers/aws/services/eventbridge/eventbridge_schema_registry_cross_account_access/eventbridge_schema_registry_cross_account_access.py index 85a2a7e01c..2475b4858d 100644 --- a/prowler/providers/aws/services/eventbridge/eventbridge_schema_registry_cross_account_access/eventbridge_schema_registry_cross_account_access.py +++ b/prowler/providers/aws/services/eventbridge/eventbridge_schema_registry_cross_account_access/eventbridge_schema_registry_cross_account_access.py @@ -7,11 +7,9 @@ class eventbridge_schema_registry_cross_account_access(Check): def execute(self): findings = [] for registry in schema_client.registries.values(): - report = Check_Report_AWS(self.metadata()) - report.resource_id = registry.name - report.resource_arn = registry.arn - report.resource_tags = registry.tags - report.region = registry.region + report = Check_Report_AWS( + metadata=self.metadata(), resource_metadata=registry + ) report.status = "PASS" report.status_extended = f"EventBridge schema registry {registry.name} does not allow cross-account access." if is_policy_public( diff --git a/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py b/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py index aaf9d88785..a39e51b80e 100644 --- a/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py +++ b/tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py @@ -72,7 +72,7 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists: )["SnapshotId"] # DLM Mock Client - dlm_client = mock.MagicMock + dlm_client = mock.MagicMock() dlm_client.audited_account = AWS_ACCOUNT_NUMBER dlm_client.audited_account_arn = AWS_ACCOUNT_ARN dlm_client.region = AWS_REGION_US_EAST_1 diff --git a/tests/providers/aws/services/dynamodb/dynamodb_service_test.py b/tests/providers/aws/services/dynamodb/dynamodb_service_test.py index bef0aee35f..66025c0f5b 100644 --- a/tests/providers/aws/services/dynamodb/dynamodb_service_test.py +++ b/tests/providers/aws/services/dynamodb/dynamodb_service_test.py @@ -49,7 +49,7 @@ class Test_DynamoDB_Service: # Generate DynamoDB Client dynamodb_client = client("dynamodb", region_name=AWS_REGION_US_EAST_1) # Create DynamoDB Tables - dynamodb_client.create_table( + table1_arn = dynamodb_client.create_table( TableName="test1", AttributeDefinitions=[ {"AttributeName": "client", "AttributeType": "S"}, @@ -60,8 +60,8 @@ class Test_DynamoDB_Service: {"AttributeName": "app", "KeyType": "RANGE"}, ], BillingMode="PAY_PER_REQUEST", - ) - dynamodb_client.create_table( + )["TableDescription"]["TableArn"] + table2_arn = dynamodb_client.create_table( TableName="test2", AttributeDefinitions=[ {"AttributeName": "client", "AttributeType": "S"}, @@ -73,7 +73,7 @@ class Test_DynamoDB_Service: ], BillingMode="PROVISIONED", ProvisionedThroughput={"ReadCapacityUnits": 5, "WriteCapacityUnits": 5}, - ) + )["TableDescription"]["TableArn"] # DynamoDB client for this test class aws_provider = set_mocked_aws_provider() dynamo = DynamoDB(aws_provider) @@ -81,6 +81,8 @@ class Test_DynamoDB_Service: table_names = [table.name for table in dynamo.tables.values()] assert "test1" in table_names assert "test2" in table_names + assert table1_arn == list(dynamo.tables.keys())[0] + assert table2_arn == list(dynamo.tables.keys())[1] for table in dynamo.tables.values(): assert table.region == AWS_REGION_US_EAST_1 table_billing = [table.billing_mode for table in dynamo.tables.values()] diff --git a/tests/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan_test.py b/tests/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan_test.py index e6586f1a9c..870c0f81a1 100644 --- a/tests/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan_test.py +++ b/tests/providers/aws/services/dynamodb/dynamodb_table_protected_by_backup_plan/dynamodb_table_protected_by_backup_plan_test.py @@ -167,6 +167,7 @@ class Test_dynamodb_table_protected_by_backup_plan: dynamodb_client.tables = { f"arn:aws:dynamodb:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:table/test1": Table( + arn=f"arn:aws:dynamodb:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:table/test1", name="test1", region=AWS_REGION_US_EAST_1, ) @@ -225,6 +226,7 @@ class Test_dynamodb_table_protected_by_backup_plan: dynamodb_client.audited_partition = "aws" dynamodb_client.tables = { f"arn:aws:dynamodb:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:table/test1": Table( + arn=f"arn:aws:dynamodb:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:table/test1", name="test1", region=AWS_REGION_US_EAST_1, ) @@ -280,6 +282,7 @@ class Test_dynamodb_table_protected_by_backup_plan: dynamodb_client.tables = { f"arn:aws:dynamodb:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:table/test1": Table( + arn=f"arn:aws:dynamodb:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:table/test1", name="test1", region=AWS_REGION_US_EAST_1, ) diff --git a/tests/providers/aws/services/elb/elb_service_test.py b/tests/providers/aws/services/elb/elb_service_test.py index d855281d99..53b4c9c6d3 100644 --- a/tests/providers/aws/services/elb/elb_service_test.py +++ b/tests/providers/aws/services/elb/elb_service_test.py @@ -72,6 +72,7 @@ class Test_ELB_Service: aws_provider = set_mocked_aws_provider() elb = ELB(aws_provider) assert len(elb.loadbalancers) == 1 + assert elb.loadbalancers[elb_arn].arn == elb_arn assert elb.loadbalancers[elb_arn].name == "my-lb" assert elb.loadbalancers[elb_arn].region == AWS_REGION_US_EAST_1 assert elb.loadbalancers[elb_arn].scheme == "internal" @@ -130,6 +131,7 @@ class Test_ELB_Service: # ELB client for this test class aws_provider = set_mocked_aws_provider() elb = ELB(aws_provider) + assert elb.loadbalancers[elb_arn].arn == elb_arn assert elb.loadbalancers[elb_arn].name == "my-lb" assert elb.loadbalancers[elb_arn].region == AWS_REGION_US_EAST_1 assert elb.loadbalancers[elb_arn].scheme == "internal" @@ -170,6 +172,7 @@ class Test_ELB_Service: # ELB client for this test class aws_provider = set_mocked_aws_provider() elb = ELB(aws_provider) + assert elb.loadbalancers[elb_arn].arn == elb_arn assert elb.loadbalancers[elb_arn].name == "my-lb" assert elb.loadbalancers[elb_arn].region == AWS_REGION_US_EAST_1 assert elb.loadbalancers[elb_arn].scheme == "internal" diff --git a/tests/providers/aws/services/elbv2/elbv2_service_test.py b/tests/providers/aws/services/elbv2/elbv2_service_test.py index d9e4c729cb..a985402475 100644 --- a/tests/providers/aws/services/elbv2/elbv2_service_test.py +++ b/tests/providers/aws/services/elbv2/elbv2_service_test.py @@ -224,6 +224,7 @@ class Test_ELBv2_Service: ) elbv2 = ELBv2(aws_provider) assert len(elbv2.loadbalancersv2) == 1 + assert elbv2.loadbalancersv2[lb["LoadBalancerArn"]].arn == lb["LoadBalancerArn"] assert ( elbv2.loadbalancersv2[lb["LoadBalancerArn"]].desync_mitigation_mode == "defensive"