ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-04 02:04:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(aws): support the ISO partitions for region resolution and scanning (#12759)

Browse Source 
Co-authored-by: pedrooot <pedromarting3@gmail.com>
This commit is contained in:
StylusFrost
2026-09-10 17:15:13 +02:00
committed by GitHub
co-authored by pedrooot
parent 865eebe7fb
commit f9c02da90a
10 changed files with 3045 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/providers/aws/aws_provider_test.py
+116 -3
View File
@@ -59,6 +59,7 @@ from tests.providers.aws.utils import (
AWS_EUSC_PARTITION,
AWS_GOV_CLOUD_ACCOUNT_ARN,
AWS_GOV_CLOUD_PARTITION,
AWS_ISO_B_PARTITION,
AWS_ISO_PARTITION,
AWS_REGION_CN_NORTH_1,
AWS_REGION_CN_NORTHWEST_1,
@@ -67,7 +68,9 @@ from tests.providers.aws.utils import (
AWS_REGION_EUSC_DE_EAST_1,
AWS_REGION_GOV_CLOUD_US_EAST_1,
AWS_REGION_GOV_CLOUD_US_WEST_1,
AWS_REGION_ISO_GLOBAL,
AWS_REGION_ISO_B_EAST_1,
AWS_REGION_ISO_EAST_1,
AWS_REGION_ISO_WEST_1,
AWS_REGION_US_EAST_1,
AWS_REGION_US_EAST_2,
EXAMPLE_AMI_ID,
@@ -1192,6 +1195,13 @@ aws:
== AWS_REGION_EU_WEST_1
)
@mock_aws
def test_aws_get_global_region(self):
aws_provider = AwsProvider()
aws_provider._identity.partition = AWS_COMMERCIAL_PARTITION
assert aws_provider.get_global_region() == AWS_REGION_US_EAST_1
@mock_aws
def test_aws_gov_get_global_region(self):
aws_provider = AwsProvider()
@@ -1211,7 +1221,21 @@ aws:
aws_provider = AwsProvider()
aws_provider._identity.partition = AWS_ISO_PARTITION
assert aws_provider.get_global_region() == AWS_REGION_ISO_GLOBAL
assert aws_provider.get_global_region() == AWS_REGION_ISO_EAST_1
@mock_aws
def test_aws_iso_b_get_global_region(self):
aws_provider = AwsProvider()
aws_provider._identity.partition = AWS_ISO_B_PARTITION
assert aws_provider.get_global_region() == AWS_REGION_ISO_B_EAST_1
@mock_aws
def test_get_global_region_for_an_unknown_partition(self):
aws_provider = AwsProvider()
aws_provider._identity.partition = "aws-unknown"
assert aws_provider.get_global_region() == AWS_REGION_US_EAST_1
@mock_aws
def test_aws_eusc_get_global_region(self):
@@ -1299,6 +1323,88 @@ aws:
len(aws_provider.get_available_aws_service_regions("ec2", "aws")) == 17
)
@mock_aws
def test_get_available_aws_service_regions_commercial_and_gov_cloud(self):
aws_provider = AwsProvider()
assert AWS_REGION_US_EAST_1 in aws_provider.get_available_aws_service_regions(
"ec2", AWS_COMMERCIAL_PARTITION
)
assert (
AWS_REGION_GOV_CLOUD_US_EAST_1
in aws_provider.get_available_aws_service_regions(
"ec2", AWS_GOV_CLOUD_PARTITION
)
)
# A service recorded as unavailable in the partition yields an empty set
assert (
aws_provider.get_available_aws_service_regions(
"bedrock-agent", AWS_CHINA_PARTITION
)
== set()
)
@mock_aws
def test_get_available_aws_service_regions_iso_partitions(self):
aws_provider = AwsProvider()
assert aws_provider.get_available_aws_service_regions(
"ec2", AWS_ISO_PARTITION
) == {
AWS_REGION_ISO_EAST_1,
AWS_REGION_ISO_WEST_1,
}
assert aws_provider.get_available_aws_service_regions(
"guardduty", AWS_ISO_B_PARTITION
) == {AWS_REGION_ISO_B_EAST_1}
# Every service carries every ISO partition, empty when not available
assert (
aws_provider.get_available_aws_service_regions(
"bedrock", AWS_ISO_B_PARTITION
)
== set()
)
@mock_aws
def test_get_available_aws_service_regions_unknown_partition(self):
aws_provider = AwsProvider()
assert (
aws_provider.get_available_aws_service_regions("ec2", "aws-unknown")
== set()
)
@mock_aws
def test_get_available_aws_service_regions_unknown_service(self):
aws_provider = AwsProvider()
assert (
aws_provider.get_available_aws_service_regions(
"unknown-service", AWS_COMMERCIAL_PARTITION
)
== set()
)
@mock_aws
def test_generate_regional_clients_service_not_in_partition(self):
aws_provider = AwsProvider()
aws_provider._identity.partition = AWS_ISO_PARTITION
response = aws_provider.generate_regional_clients("bedrock")
assert response == {}
@mock_aws
def test_generate_regional_clients_returns_empty_dict_on_error(self):
aws_provider = AwsProvider()
with patch.object(
AwsProvider,
"get_available_aws_service_regions",
side_effect=Exception("boom"),
):
assert aws_provider.generate_regional_clients("ec2") == {}
@mock_aws
def test_get_tagged_resources(self):
ec2_client = client("ec2", region_name=AWS_REGION_EU_CENTRAL_1)
@@ -2065,7 +2171,8 @@ aws:
assert not recovered_regions
def test_get_regions_all_count(self):
assert len(AwsProvider.get_regions(partition=None)) == 39
# 34 aws + 2 aws-cn + 2 aws-us-gov + 1 aws-eusc + 7 ISO regions
assert len(AwsProvider.get_regions(partition=None)) == 46
def test_get_regions_cn_count(self):
assert len(AwsProvider.get_regions("aws-cn")) == 2
@@ -2073,6 +2180,12 @@ aws:
def test_get_regions_aws_count(self):
assert len(AwsProvider.get_regions(partition="aws")) == 34
def test_get_regions_iso_count(self):
assert AwsProvider.get_regions(AWS_ISO_PARTITION) == {
AWS_REGION_ISO_EAST_1,
AWS_REGION_ISO_WEST_1,
}
def test_get_all_regions(self):
with patch(
"prowler.providers.aws.aws_provider.read_aws_regions_file",
tests/providers/aws/utils.py
+4 -1
View File
@@ -21,6 +21,7 @@ AWS_GOV_CLOUD_PARTITION = "aws-us-gov"
AWS_CHINA_PARTITION = "aws-cn"
AWS_EUSC_PARTITION = "aws-eusc"
AWS_ISO_PARTITION = "aws-iso"
AWS_ISO_B_PARTITION = "aws-iso-b"
# Root AWS Account
AWS_ACCOUNT_NUMBER = "123456789012"
@@ -54,7 +55,9 @@ AWS_REGION_GOV_CLOUD_US_EAST_1 = "us-gov-east-1"
AWS_REGION_GOV_CLOUD_US_WEST_1 = "us-gov-west-1"
# Iso Regions
AWS_REGION_ISO_GLOBAL = "aws-iso-global"
AWS_REGION_ISO_EAST_1 = "us-iso-east-1"
AWS_REGION_ISO_WEST_1 = "us-iso-west-1"
AWS_REGION_ISO_B_EAST_1 = "us-isob-east-1"
# European Sovereign Cloud Regions
AWS_REGION_EUSC_DE_EAST_1 = "eusc-de-east-1"