diff --git a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/__init__.py b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.metadata.json b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.metadata.json new file mode 100644 index 0000000000..e2eeeb3e52 --- /dev/null +++ b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.metadata.json @@ -0,0 +1,34 @@ +{ + "Provider": "aws", + "CheckID": "elasticbeanstalk_environment_managed_updates_enabled", + "CheckTitle": "Elastic Beanstalk managed platform updates should be enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], + "ServiceName": "elasticbeanstalk", + "SubServiceName": "", + "ResourceIdTemplate": "arn:aws:elasticbeanstalk:{region}:{account-id}:environment/{environment-id}", + "Severity": "high", + "ResourceType": "AwsElasticBeanstalkEnvironment", + "Description": "This control checks whether managed platform updates are enabled for an Elastic Beanstalk environment. The control fails if no managed platform updates are enabled.", + "Risk": "If managed platform updates are not enabled, the environment might miss critical security patches and updates, which can expose it to vulnerabilities.", + "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/elastic-beanstalk-managed-updates-enabled.html", + "Remediation": { + "Code": { + "CLI": "aws elasticbeanstalk update-environment --environment-id --option-settings Namespace=aws:elasticbeanstalk:environment:ManagedActions,OptionName=ManagedActionsEnabled,Value=true", + "NativeIaC": "", + "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/elasticbeanstalk-controls.html#elasticbeanstalk-2", + "Terraform": "" + }, + "Recommendation": { + "Text": "Enable managed platform updates for your Elastic Beanstalk environment to ensure the latest security patches and updates are applied.", + "Url": "https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environment-platform-update-managed.html" + } + }, + "Categories": [ + "vulnerabilities" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.py b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.py new file mode 100644 index 0000000000..2b592b8348 --- /dev/null +++ b/prowler/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled.py @@ -0,0 +1,25 @@ +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_client import ( + elasticbeanstalk_client, +) + + +class elasticbeanstalk_environment_managed_updates_enabled(Check): + def execute(self): + findings = [] + for environment in elasticbeanstalk_client.environments.values(): + report = Check_Report_AWS(self.metadata()) + report.region = environment.region + report.resource_id = environment.name + report.resource_arn = environment.arn + report.resource_tags = environment.tags + report.status = "PASS" + report.status_extended = f"Elastic Beanstalk environment {environment.name} has managed platform updates enabled." + + if environment.managed_platform_updates != "true": + report.status = "FAIL" + report.status_extended = f"Elastic Beanstalk environment {environment.name} does not have managed platform updates enabled." + + findings.append(report) + + return findings diff --git a/tests/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled_test.py b/tests/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled_test.py new file mode 100644 index 0000000000..01b19a9a8d --- /dev/null +++ b/tests/providers/aws/services/elasticbeanstalk/elasticbeanstalk_environment_managed_updates_enabled/elasticbeanstalk_environment_managed_updates_enabled_test.py @@ -0,0 +1,150 @@ +from unittest import mock + +import botocore +from boto3 import client +from moto import mock_aws + +from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_service import ( + ElasticBeanstalk, +) +from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider + +make_api_call = botocore.client.BaseClient._make_api_call + + +def mock_make_api_call(self, operation_name, kwarg): + if operation_name == "DescribeConfigurationSettings": + return { + "ConfigurationSettings": [ + { + "OptionSettings": [ + { + "Namespace": "aws:elasticbeanstalk:managedactions", + "OptionName": "ManagedActionsEnabled", + "Value": "true", + }, + ], + } + ] + } + + return make_api_call(self, operation_name, kwarg) + + +def mock_make_api_call_v2(self, operation_name, kwarg): + if operation_name == "DescribeConfigurationSettings": + return { + "ConfigurationSettings": [ + { + "OptionSettings": [ + { + "Namespace": "aws:elasticbeanstalk:managedactions", + "OptionName": "ManagedActionsEnabled", + "Value": "false", + }, + ], + } + ] + } + + return make_api_call(self, operation_name, kwarg) + + +class Test_elasticbeanstalk_environment_managed_updates_enabled: + @mock_aws + def test_elasticbeanstalk_no_environments(self): + elasticbeanstalk_client = client( + "elasticbeanstalk", region_name=AWS_REGION_EU_WEST_1 + ) + elasticbeanstalk_client.create_application(ApplicationName="test-app") + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_client", + new=ElasticBeanstalk(aws_provider), + ): + from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled import ( + elasticbeanstalk_environment_managed_updates_enabled, + ) + + check = elasticbeanstalk_environment_managed_updates_enabled() + result = check.execute() + assert len(result) == 0 + + @mock_aws + @mock.patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call) + def test_elasticbeanstalk_environments_enabled_autoupdate(self): + elasticbeanstalk_client = client( + "elasticbeanstalk", region_name=AWS_REGION_EU_WEST_1 + ) + elasticbeanstalk_client.create_application(ApplicationName="test-app") + environment = elasticbeanstalk_client.create_environment( + ApplicationName="test-app", + EnvironmentName="test-env", + ) + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_client", + new=ElasticBeanstalk(aws_provider), + ): + from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled import ( + elasticbeanstalk_environment_managed_updates_enabled, + ) + + check = elasticbeanstalk_environment_managed_updates_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "Elastic Beanstalk environment test-env has managed platform updates enabled." + ) + assert result[0].resource_id == environment["EnvironmentName"] + assert result[0].resource_arn == environment["EnvironmentArn"] + assert result[0].region == AWS_REGION_EU_WEST_1 + + @mock_aws + @mock.patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call_v2) + def test_elasticbeanstalk_environments_not_enabled_autoupdate(self): + elasticbeanstalk_client = client( + "elasticbeanstalk", region_name=AWS_REGION_EU_WEST_1 + ) + elasticbeanstalk_client.create_application(ApplicationName="test-app") + environment = elasticbeanstalk_client.create_environment( + ApplicationName="test-app", + EnvironmentName="test-env", + ) + + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), mock.patch( + "prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_client", + new=ElasticBeanstalk(aws_provider), + ): + from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_environment_managed_updates_enabled.elasticbeanstalk_environment_managed_updates_enabled import ( + elasticbeanstalk_environment_managed_updates_enabled, + ) + + check = elasticbeanstalk_environment_managed_updates_enabled() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "Elastic Beanstalk environment test-env does not have managed platform updates enabled." + ) + assert result[0].resource_id == environment["EnvironmentName"] + assert result[0].resource_arn == environment["EnvironmentArn"] + assert result[0].region == AWS_REGION_EU_WEST_1 diff --git a/tests/providers/aws/services/elasticbeanstalk/elasticbeanstalk_service_test.py b/tests/providers/aws/services/elasticbeanstalk/elasticbeanstalk_service_test.py index e435bfec49..3c77a13d7e 100644 --- a/tests/providers/aws/services/elasticbeanstalk/elasticbeanstalk_service_test.py +++ b/tests/providers/aws/services/elasticbeanstalk/elasticbeanstalk_service_test.py @@ -9,7 +9,6 @@ from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_service im ) from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider -# Mocking Access Analyzer Calls make_api_call = botocore.client.BaseClient._make_api_call