mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-20 11:01:52 +00:00
feat(aws): add new check organizations_opt_out_ai_services_policy (#5152)
This commit is contained in:
Sergio Garcia
+30
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "organizations_opt_out_ai_services_policy",
|
||||
"CheckTitle": "Ensure that AWS Organizations opt-out of AI services policy is enabled.",
|
||||
"CheckType": [],
|
||||
"ServiceName": "organizations",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service::account-id:organization/organization-id",
|
||||
"Severity": "low",
|
||||
"ResourceType": "Other",
|
||||
"Description": "This control checks whether the AWS Organizations opt-out of AI services policy is enabled. The control fails if the policy is not enabled.",
|
||||
"Risk": "By default, AWS may be using your data to train its AI models. This may include data from your AWS CloudTrail logs, AWS Config rules, and AWS GuardDuty findings. If you opt out of AI services, AWS will not use your data to train its AI models.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out_all.html",
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws organizations enable-policy-type --root-id <root-id> --policy-type AI_SERVICES_OPT_OUT {'services': {'default': {'opt_out_policy': {'@@assign': 'optOut'}}}}",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Artificial Intelligence (AI) services opt-out policies enable you to control whether AWS AI services can store and use your content. Enable the AWS Organizations opt-out of AI services policy.",
|
||||
"Url": "https://docs.aws.amazon.com/organizations/latest/userguide/disable-policy-type.html"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
}
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
from prowler.lib.check.models import Check, Check_Report_AWS
|
||||
from prowler.providers.aws.services.organizations.organizations_client import (
|
||||
organizations_client,
|
||||
)
|
||||
|
||||
|
||||
class organizations_opt_out_ai_services_policy(Check):
|
||||
def execute(self):
|
||||
findings = []
|
||||
|
||||
for org in organizations_client.organizations:
|
||||
report = Check_Report_AWS(self.metadata())
|
||||
report.resource_id = org.id
|
||||
report.resource_arn = org.arn
|
||||
report.region = organizations_client.region
|
||||
report.status = "FAIL"
|
||||
report.status_extended = (
|
||||
"AWS Organizations is not in-use for this AWS Account."
|
||||
)
|
||||
if org.status == "ACTIVE":
|
||||
report.status_extended = f"AWS Organization {org.id} has not opted out of all AI services, granting consent for AWS to access its data."
|
||||
if org.policies is not None: # Access Denied to list_policies
|
||||
for policy in org.policies.get("AISERVICES_OPT_OUT_POLICY", []):
|
||||
if (
|
||||
policy.content.get("services", {})
|
||||
.get("default", {})
|
||||
.get("opt_out_policy", {})
|
||||
.get("@@assign")
|
||||
== "optOut"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"AWS Organization {org.id} has opted out of all AI services, not granting consent for AWS to access its data."
|
||||
break
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
+216
@@ -0,0 +1,216 @@
|
||||
from unittest import mock
|
||||
|
||||
from prowler.providers.aws.services.organizations.organizations_service import (
|
||||
Organization,
|
||||
Policy,
|
||||
)
|
||||
from tests.providers.aws.utils import (
|
||||
AWS_ACCOUNT_ARN,
|
||||
AWS_REGION_EU_WEST_1,
|
||||
set_mocked_aws_provider,
|
||||
)
|
||||
|
||||
|
||||
class Test_organizations_tags_policies_enabled_and_attached:
|
||||
def test_organization_no_organization(self):
|
||||
organizations_client = mock.MagicMock
|
||||
organizations_client.region = AWS_REGION_EU_WEST_1
|
||||
organizations_client.organizations = [
|
||||
Organization(
|
||||
arn=AWS_ACCOUNT_ARN,
|
||||
id="AWS Organization",
|
||||
status="NOT_AVAILABLE",
|
||||
master_id="",
|
||||
)
|
||||
]
|
||||
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
return_value=aws_provider,
|
||||
):
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
|
||||
new=organizations_client,
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
|
||||
organizations_opt_out_ai_services_policy,
|
||||
)
|
||||
|
||||
check = organizations_opt_out_ai_services_policy()
|
||||
result = check.execute()
|
||||
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "AWS Organizations is not in-use for this AWS Account."
|
||||
)
|
||||
assert result[0].resource_id == "AWS Organization"
|
||||
assert result[0].resource_arn == AWS_ACCOUNT_ARN
|
||||
assert result[0].region == AWS_REGION_EU_WEST_1
|
||||
|
||||
def test_organization_with_AI_optout_no_policies(self):
|
||||
organizations_client = mock.MagicMock
|
||||
organizations_client.region = AWS_REGION_EU_WEST_1
|
||||
organizations_client.organizations = [
|
||||
Organization(
|
||||
id="o-1234567890",
|
||||
arn="arn:aws:organizations::1234567890:organization/o-1234567890",
|
||||
status="ACTIVE",
|
||||
master_id="1234567890",
|
||||
policies={"AISERVICES_OPT_OUT_POLICY": []},
|
||||
delegated_administrators=None,
|
||||
)
|
||||
]
|
||||
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
return_value=aws_provider,
|
||||
):
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
|
||||
new=organizations_client,
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
|
||||
organizations_opt_out_ai_services_policy,
|
||||
)
|
||||
|
||||
check = organizations_opt_out_ai_services_policy()
|
||||
result = check.execute()
|
||||
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "AWS Organization o-1234567890 has not opted out of all AI services, granting consent for AWS to access its data."
|
||||
)
|
||||
assert result[0].resource_id == "o-1234567890"
|
||||
assert (
|
||||
result[0].resource_arn
|
||||
== "arn:aws:organizations::1234567890:organization/o-1234567890"
|
||||
)
|
||||
assert result[0].region == AWS_REGION_EU_WEST_1
|
||||
|
||||
def test_organization_with_AI_optout_policy(self):
|
||||
organizations_client = mock.MagicMock
|
||||
organizations_client.region = AWS_REGION_EU_WEST_1
|
||||
organizations_client.organizations = [
|
||||
Organization(
|
||||
id="o-1234567890",
|
||||
arn="arn:aws:organizations::1234567890:organization/o-1234567890",
|
||||
status="ACTIVE",
|
||||
master_id="1234567890",
|
||||
policies={
|
||||
"AISERVICES_OPT_OUT_POLICY": [
|
||||
Policy(
|
||||
id="p-1234567890",
|
||||
arn="arn:aws:organizations::1234567890:policy/o-1234567890/p-1234567890",
|
||||
type="AISERVICES_OPT_OUT_POLICY",
|
||||
aws_managed=False,
|
||||
content={
|
||||
"services": {
|
||||
"default": {
|
||||
"opt_out_policy": {"@@assign": "optOut"}
|
||||
}
|
||||
}
|
||||
},
|
||||
targets=[],
|
||||
)
|
||||
]
|
||||
},
|
||||
delegated_administrators=None,
|
||||
)
|
||||
]
|
||||
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
return_value=aws_provider,
|
||||
):
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
|
||||
new=organizations_client,
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
|
||||
organizations_opt_out_ai_services_policy,
|
||||
)
|
||||
|
||||
check = organizations_opt_out_ai_services_policy()
|
||||
result = check.execute()
|
||||
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "AWS Organization o-1234567890 has opted out of all AI services, not granting consent for AWS to access its data."
|
||||
)
|
||||
assert result[0].resource_id == "o-1234567890"
|
||||
assert (
|
||||
result[0].resource_arn
|
||||
== "arn:aws:organizations::1234567890:organization/o-1234567890"
|
||||
)
|
||||
assert result[0].region == AWS_REGION_EU_WEST_1
|
||||
|
||||
def test_organization_with_AI_optout_policy_no_content(self):
|
||||
organizations_client = mock.MagicMock
|
||||
organizations_client.region = AWS_REGION_EU_WEST_1
|
||||
organizations_client.organizations = [
|
||||
Organization(
|
||||
id="o-1234567890",
|
||||
arn="arn:aws:organizations::1234567890:organization/o-1234567890",
|
||||
status="ACTIVE",
|
||||
master_id="1234567890",
|
||||
policies={
|
||||
"AISERVICES_OPT_OUT_POLICY": [
|
||||
Policy(
|
||||
id="p-1234567890",
|
||||
arn="arn:aws:organizations::1234567890:policy/o-1234567890/p-1234567890",
|
||||
type="AISERVICES_OPT_OUT_POLICY",
|
||||
aws_managed=False,
|
||||
content={},
|
||||
targets=[],
|
||||
)
|
||||
]
|
||||
},
|
||||
delegated_administrators=None,
|
||||
)
|
||||
]
|
||||
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
return_value=aws_provider,
|
||||
):
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
|
||||
new=organizations_client,
|
||||
):
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
|
||||
organizations_opt_out_ai_services_policy,
|
||||
)
|
||||
|
||||
check = organizations_opt_out_ai_services_policy()
|
||||
result = check.execute()
|
||||
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "AWS Organization o-1234567890 has not opted out of all AI services, granting consent for AWS to access its data."
|
||||
)
|
||||
assert result[0].resource_id == "o-1234567890"
|
||||
assert (
|
||||
result[0].resource_arn
|
||||
== "arn:aws:organizations::1234567890:organization/o-1234567890"
|
||||
)
|
||||
assert result[0].region == AWS_REGION_EU_WEST_1
|
||||
Reference in New Issue
Block a user