From f26f5d3c725b508dd88f376f9cace70072c1b477 Mon Sep 17 00:00:00 2001 From: Sergio Garcia <38561120+sergargar@users.noreply.github.com> Date: Mon, 6 May 2024 10:25:01 +0200 Subject: [PATCH] fix(efs): change public EFS check metadata (#3917) --- .../efs_not_publicly_accessible.metadata.json | 8 ++++---- .../efs_not_publicly_accessible.py | 10 +++------- .../efs_not_publicly_accessible_test.py | 10 +++++----- 3 files changed, 12 insertions(+), 16 deletions(-) diff --git a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json index 021d8ba585..a20ee155cb 100644 --- a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json +++ b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.metadata.json @@ -1,7 +1,7 @@ { "Provider": "aws", "CheckID": "efs_not_publicly_accessible", - "CheckTitle": "Check if EFS have policies which allow access to everyone", + "CheckTitle": "Check if EFS have policies which allow access to any client within the VPC", "CheckType": [ "Protect", "Data protection" @@ -9,10 +9,10 @@ "ServiceName": "efs", "SubServiceName": "", "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", - "Severity": "critical", + "Severity": "medium", "ResourceType": "AwsEFSFileSystem", - "Description": "Check if EFS have policies which allow access to everyone", - "Risk": "EFS accessible to everyone could expose sensitive data to bad actors", + "Description": "Check if EFS have policies which allow access to any client within the VPC", + "Risk": "Restricting access to EFS file systems is a security best practice. Allowing access to any client within the VPC can lead to unauthorized access to the file system.", "RelatedUrl": "", "Remediation": { "Code": { diff --git a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py index cf8229c2d2..98c348e139 100644 --- a/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py +++ b/prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py @@ -13,21 +13,17 @@ class efs_not_publicly_accessible(Check): report.resource_arn = fs.arn report.resource_tags = fs.tags report.status = "PASS" - report.status_extended = ( - f"EFS {fs.id} has a policy which does not allow access to everyone." - ) + report.status_extended = f"EFS {fs.id} has a policy which does not allow access to any client within the VPC." if not fs.policy: report.status = "FAIL" - report.status_extended = f"EFS {fs.id} doesn't have any policy which means it grants full access to any client." + report.status_extended = f"EFS {fs.id} doesn't have any policy which means it grants full access to any client within the VPC." else: for statement in fs.policy.get("Statement", []): if statement.get("Effect") == "Allow" and is_public_access_allowed( statement ): report.status = "FAIL" - report.status_extended = ( - f"EFS {fs.id} has a policy which allows access to everyone." - ) + report.status_extended = f"EFS {fs.id} has a policy which allows access to any client within the VPC." break findings.append(report) return findings diff --git a/tests/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible_test.py b/tests/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible_test.py index 25891fe123..2ea9111cde 100644 --- a/tests/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible_test.py +++ b/tests/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible_test.py @@ -102,7 +102,7 @@ class Test_efs_not_publicly_accessible: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"EFS {file_system_id} has a policy which does not allow access to everyone." + == f"EFS {file_system_id} has a policy which does not allow access to any client within the VPC." ) assert result[0].resource_id == file_system_id assert result[0].resource_arn == efs_arn @@ -136,7 +136,7 @@ class Test_efs_not_publicly_accessible: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"EFS {file_system_id} has a policy which does not allow access to everyone." + == f"EFS {file_system_id} has a policy which does not allow access to any client within the VPC." ) assert result[0].resource_id == file_system_id assert result[0].resource_arn == efs_arn @@ -170,7 +170,7 @@ class Test_efs_not_publicly_accessible: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"EFS {file_system_id} has a policy which does not allow access to everyone." + == f"EFS {file_system_id} has a policy which does not allow access to any client within the VPC." ) assert result[0].resource_id == file_system_id assert result[0].resource_arn == efs_arn @@ -205,7 +205,7 @@ class Test_efs_not_publicly_accessible: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"EFS {file_system_id} has a policy which allows access to everyone." + == f"EFS {file_system_id} has a policy which allows access to any client within the VPC." ) assert result[0].resource_id == file_system_id assert result[0].resource_arn == efs_arn @@ -239,7 +239,7 @@ class Test_efs_not_publicly_accessible: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"EFS {file_system_id} doesn't have any policy which means it grants full access to any client." + == f"EFS {file_system_id} doesn't have any policy which means it grants full access to any client within the VPC." ) assert result[0].resource_id == file_system_id assert result[0].resource_arn == efs_arn