feat(elasticbeanstalk): add new check elasticbeanstalk_managed_platform_updates_enabled (#5324)

Co-authored-by: Sergio <sergio@prowler.com>
2026-07-23 20:42:02 +00:00 · 2024-10-10 21:31:11 +02:00
parent d9c2933dc5
commit f8a8266c9d
5 changed files with 209 additions and 1 deletions
@@ -0,0 +1,34 @@
+{
+  "Provider": "aws",
+  "CheckID": "elasticbeanstalk_environment_managed_updates_enabled",
+  "CheckTitle": "Elastic Beanstalk managed platform updates should be enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "elasticbeanstalk",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "arn:aws:elasticbeanstalk:{region}:{account-id}:environment/{environment-id}",
+  "Severity": "high",
+  "ResourceType": "AwsElasticBeanstalkEnvironment",
+  "Description": "This control checks whether managed platform updates are enabled for an Elastic Beanstalk environment. The control fails if no managed platform updates are enabled.",
+  "Risk": "If managed platform updates are not enabled, the environment might miss critical security patches and updates, which can expose it to vulnerabilities.",
+  "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/elastic-beanstalk-managed-updates-enabled.html",
+  "Remediation": {
+    "Code": {
+      "CLI": "aws elasticbeanstalk update-environment --environment-id <environment-id> --option-settings Namespace=aws:elasticbeanstalk:environment:ManagedActions,OptionName=ManagedActionsEnabled,Value=true",
+      "NativeIaC": "",
+      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/elasticbeanstalk-controls.html#elasticbeanstalk-2",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable managed platform updates for your Elastic Beanstalk environment to ensure the latest security patches and updates are applied.",
+      "Url": "https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environment-platform-update-managed.html"
+    }
+  },
+  "Categories": [
+    "vulnerabilities"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
@@ -0,0 +1,25 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_client import (
+    elasticbeanstalk_client,
+)
+
+
+class elasticbeanstalk_environment_managed_updates_enabled(Check):
+    def execute(self):
+        findings = []
+        for environment in elasticbeanstalk_client.environments.values():
+            report = Check_Report_AWS(self.metadata())
+            report.region = environment.region
+            report.resource_id = environment.name
+            report.resource_arn = environment.arn
+            report.resource_tags = environment.tags
+            report.status = "PASS"
+            report.status_extended = f"Elastic Beanstalk environment {environment.name} has managed platform updates enabled."
+
+            if environment.managed_platform_updates != "true":
+                report.status = "FAIL"
+                report.status_extended = f"Elastic Beanstalk environment {environment.name} does not have managed platform updates enabled."
+
+            findings.append(report)
+
+        return findings
@@ -0,0 +1,150 @@
+from unittest import mock
+
+import botocore
+from boto3 import client
+from moto import mock_aws
+
+from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_service import (
+    ElasticBeanstalk,
+)
+from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider
+
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+    if operation_name == "DescribeConfigurationSettings":
+        return {
+            "ConfigurationSettings": [
+                {
+                    "OptionSettings": [
+                        {
+                            "Namespace": "aws:elasticbeanstalk:managedactions",
+                            "OptionName": "ManagedActionsEnabled",
+                            "Value": "true",
+                        },
+                    ],
+                }
+            ]
+        }
+
+    return make_api_call(self, operation_name, kwarg)
+
+
+def mock_make_api_call_v2(self, operation_name, kwarg):
+    if operation_name == "DescribeConfigurationSettings":
+        return {
+            "ConfigurationSettings": [
+                {
+                    "OptionSettings": [
+                        {
+                            "Namespace": "aws:elasticbeanstalk:managedactions",
+                            "OptionName": "ManagedActionsEnabled",
+                            "Value": "false",
+                        },
+                    ],
+                }
+            ]
+        }
+
+    return make_api_call(self, operation_name, kwarg)
+
+
+class Test_elasticbeanstalk_environment_managed_updates_enabled:
+    @mock_aws
+    def test_elasticbeanstalk_no_environments(self):
+        elasticbeanstalk_client = client(
+            "elasticbeanstalk", region_name=AWS_REGION_EU_WEST_1
+        )
+        elasticbeanstalk_client.create_application(ApplicationName="test-app")
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_client",
+            new=ElasticBeanstalk(aws_provider),
+        ):
+            from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled import (
+                elasticbeanstalk_environment_managed_updates_enabled,
+            )
+
+            check = elasticbeanstalk_environment_managed_updates_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    @mock_aws
+    @mock.patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+    def test_elasticbeanstalk_environments_enabled_autoupdate(self):
+        elasticbeanstalk_client = client(
+            "elasticbeanstalk", region_name=AWS_REGION_EU_WEST_1
+        )
+        elasticbeanstalk_client.create_application(ApplicationName="test-app")
+        environment = elasticbeanstalk_client.create_environment(
+            ApplicationName="test-app",
+            EnvironmentName="test-env",
+        )
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_client",
+            new=ElasticBeanstalk(aws_provider),
+        ):
+            from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled import (
+                elasticbeanstalk_environment_managed_updates_enabled,
+            )
+
+            check = elasticbeanstalk_environment_managed_updates_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Elastic Beanstalk environment test-env has managed platform updates enabled."
+            )
+            assert result[0].resource_id == environment["EnvironmentName"]
+            assert result[0].resource_arn == environment["EnvironmentArn"]
+            assert result[0].region == AWS_REGION_EU_WEST_1
+
+    @mock_aws
+    @mock.patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call_v2)
+    def test_elasticbeanstalk_environments_not_enabled_autoupdate(self):
+        elasticbeanstalk_client = client(
+            "elasticbeanstalk", region_name=AWS_REGION_EU_WEST_1
+        )
+        elasticbeanstalk_client.create_application(ApplicationName="test-app")
+        environment = elasticbeanstalk_client.create_environment(
+            ApplicationName="test-app",
+            EnvironmentName="test-env",
+        )
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_client",
+            new=ElasticBeanstalk(aws_provider),
+        ):
+            from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled import (
+                elasticbeanstalk_environment_managed_updates_enabled,
+            )
+
+            check = elasticbeanstalk_environment_managed_updates_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Elastic Beanstalk environment test-env does not have managed platform updates enabled."
+            )
+            assert result[0].resource_id == environment["EnvironmentName"]
+            assert result[0].resource_arn == environment["EnvironmentArn"]
+            assert result[0].region == AWS_REGION_EU_WEST_1
@@ -9,7 +9,6 @@ from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_service im
 )
 from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider

-# Mocking Access Analyzer Calls
 make_api_call = botocore.client.BaseClient._make_api_call