feat(aws): add new check organizations_opt_out_ai_services_policy (#5152)

2026-07-24 21:11:53 +00:00 · 2024-09-24 11:37:03 -04:00
parent b26dc899be
commit f4d89066d9
4 changed files with 283 additions and 0 deletions
@@ -0,0 +1,216 @@
+from unittest import mock
+
+from prowler.providers.aws.services.organizations.organizations_service import (
+    Organization,
+    Policy,
+)
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_ARN,
+    AWS_REGION_EU_WEST_1,
+    set_mocked_aws_provider,
+)
+
+
+class Test_organizations_tags_policies_enabled_and_attached:
+    def test_organization_no_organization(self):
+        organizations_client = mock.MagicMock
+        organizations_client.region = AWS_REGION_EU_WEST_1
+        organizations_client.organizations = [
+            Organization(
+                arn=AWS_ACCOUNT_ARN,
+                id="AWS Organization",
+                status="NOT_AVAILABLE",
+                master_id="",
+            )
+        ]
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
+                new=organizations_client,
+            ):
+                # Test Check
+                from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
+                    organizations_opt_out_ai_services_policy,
+                )
+
+                check = organizations_opt_out_ai_services_policy()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert (
+                    result[0].status_extended
+                    == "AWS Organizations is not in-use for this AWS Account."
+                )
+                assert result[0].resource_id == "AWS Organization"
+                assert result[0].resource_arn == AWS_ACCOUNT_ARN
+                assert result[0].region == AWS_REGION_EU_WEST_1
+
+    def test_organization_with_AI_optout_no_policies(self):
+        organizations_client = mock.MagicMock
+        organizations_client.region = AWS_REGION_EU_WEST_1
+        organizations_client.organizations = [
+            Organization(
+                id="o-1234567890",
+                arn="arn:aws:organizations::1234567890:organization/o-1234567890",
+                status="ACTIVE",
+                master_id="1234567890",
+                policies={"AISERVICES_OPT_OUT_POLICY": []},
+                delegated_administrators=None,
+            )
+        ]
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
+                new=organizations_client,
+            ):
+                # Test Check
+                from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
+                    organizations_opt_out_ai_services_policy,
+                )
+
+                check = organizations_opt_out_ai_services_policy()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert (
+                    result[0].status_extended
+                    == "AWS Organization o-1234567890 has not opted out of all AI services, granting consent for AWS to access its data."
+                )
+                assert result[0].resource_id == "o-1234567890"
+                assert (
+                    result[0].resource_arn
+                    == "arn:aws:organizations::1234567890:organization/o-1234567890"
+                )
+                assert result[0].region == AWS_REGION_EU_WEST_1
+
+    def test_organization_with_AI_optout_policy(self):
+        organizations_client = mock.MagicMock
+        organizations_client.region = AWS_REGION_EU_WEST_1
+        organizations_client.organizations = [
+            Organization(
+                id="o-1234567890",
+                arn="arn:aws:organizations::1234567890:organization/o-1234567890",
+                status="ACTIVE",
+                master_id="1234567890",
+                policies={
+                    "AISERVICES_OPT_OUT_POLICY": [
+                        Policy(
+                            id="p-1234567890",
+                            arn="arn:aws:organizations::1234567890:policy/o-1234567890/p-1234567890",
+                            type="AISERVICES_OPT_OUT_POLICY",
+                            aws_managed=False,
+                            content={
+                                "services": {
+                                    "default": {
+                                        "opt_out_policy": {"@@assign": "optOut"}
+                                    }
+                                }
+                            },
+                            targets=[],
+                        )
+                    ]
+                },
+                delegated_administrators=None,
+            )
+        ]
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
+                new=organizations_client,
+            ):
+                # Test Check
+                from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
+                    organizations_opt_out_ai_services_policy,
+                )
+
+                check = organizations_opt_out_ai_services_policy()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert (
+                    result[0].status_extended
+                    == "AWS Organization o-1234567890 has opted out of all AI services, not granting consent for AWS to access its data."
+                )
+                assert result[0].resource_id == "o-1234567890"
+                assert (
+                    result[0].resource_arn
+                    == "arn:aws:organizations::1234567890:organization/o-1234567890"
+                )
+                assert result[0].region == AWS_REGION_EU_WEST_1
+
+    def test_organization_with_AI_optout_policy_no_content(self):
+        organizations_client = mock.MagicMock
+        organizations_client.region = AWS_REGION_EU_WEST_1
+        organizations_client.organizations = [
+            Organization(
+                id="o-1234567890",
+                arn="arn:aws:organizations::1234567890:organization/o-1234567890",
+                status="ACTIVE",
+                master_id="1234567890",
+                policies={
+                    "AISERVICES_OPT_OUT_POLICY": [
+                        Policy(
+                            id="p-1234567890",
+                            arn="arn:aws:organizations::1234567890:policy/o-1234567890/p-1234567890",
+                            type="AISERVICES_OPT_OUT_POLICY",
+                            aws_managed=False,
+                            content={},
+                            targets=[],
+                        )
+                    ]
+                },
+                delegated_administrators=None,
+            )
+        ]
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy.organizations_client",
+                new=organizations_client,
+            ):
+                # Test Check
+                from prowler.providers.aws.services.organizations.organizations_opt_out_ai_services_policy.organizations_opt_out_ai_services_policy import (
+                    organizations_opt_out_ai_services_policy,
+                )
+
+                check = organizations_opt_out_ai_services_policy()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert (
+                    result[0].status_extended
+                    == "AWS Organization o-1234567890 has not opted out of all AI services, granting consent for AWS to access its data."
+                )
+                assert result[0].resource_id == "o-1234567890"
+                assert (
+                    result[0].resource_arn
+                    == "arn:aws:organizations::1234567890:organization/o-1234567890"
+                )
+                assert result[0].region == AWS_REGION_EU_WEST_1