feat(ec2): Client VPN Endpoints Should Have Client Connection Logging Enabled (#4804)

Co-authored-by: Sergio <sergio@prowler.com>
2026-10-09 21:14:22 +00:00 · 2024-08-22 09:57:33 -04:00
parent ff244138d9
commit fc03188bfb
6 changed files with 260 additions and 1 deletions
@@ -0,0 +1,135 @@
+from unittest import mock
+
+from moto import mock_aws
+
+from prowler.providers.aws.services.ec2.ec2_service import VpnEndpoint
+from tests.providers.aws.utils import (
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+
+class Test_ec2_client_vpn_endpoint_connection_logging_enabled:
+    @mock_aws
+    def test_ec2_no_vpn_endpoints(self):
+        from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.ec2.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client",
+            new=EC2(aws_provider),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.ec2.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client_vpn_endpoint_connection_logging_enabled import (
+                ec2_client_vpn_endpoint_connection_logging_enabled,
+            )
+
+            check = ec2_client_vpn_endpoint_connection_logging_enabled()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    @mock_aws
+    def test_ec2_vpn_endpoint_without_connection_logging(self):
+        # Create EC2 Mocked Resources
+        from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        ec2 = EC2(aws_provider)
+
+        # Assuming that you mock the creation of a VPN endpoint without connection logging
+        ec2.vpn_endpoints = {
+            "arn:aws:ec2:us-east-1:123456789012:client-vpn-endpoint/cvpn-endpoint-1234567890abcdef0": VpnEndpoint(
+                id="cvpn-endpoint-1234567890abcdef0",
+                connection_logging=False,
+                region=AWS_REGION_US_EAST_1,
+                tags=None,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.ec2.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client",
+            new=ec2,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.ec2.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client_vpn_endpoint_connection_logging_enabled import (
+                ec2_client_vpn_endpoint_connection_logging_enabled,
+            )
+
+            check = ec2_client_vpn_endpoint_connection_logging_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].resource_tags is None
+            assert (
+                result[0].status_extended
+                == f"Client VPN endpoint cvpn-endpoint-1234567890abcdef0 in region {AWS_REGION_US_EAST_1} does not have client connection logging enabled."
+            )
+            assert (
+                result[0].resource_arn
+                == "arn:aws:ec2:us-east-1:123456789012:client-vpn-endpoint/cvpn-endpoint-1234567890abcdef0"
+            )
+
+    @mock_aws
+    def test_ec2_vpn_endpoint_with_connection_logging(self):
+        # Create EC2 Mocked Resources
+        from prowler.providers.aws.services.ec2.ec2_service import EC2
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        ec2 = EC2(aws_provider)
+
+        # Assuming that you mock the creation of a VPN endpoint with connection logging
+        ec2.vpn_endpoints = {
+            "arn:aws:ec2:us-east-1:123456789012:client-vpn-endpoint/cvpn-endpoint-1234567890abcdef0": VpnEndpoint(
+                id="cvpn-endpoint-1234567890abcdef0",
+                connection_logging=True,
+                region=AWS_REGION_US_EAST_1,
+                tags=None,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ), mock.patch(
+            "prowler.providers.aws.services.ec2.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client",
+            new=ec2,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.ec2.ec2_client_vpn_endpoint_connection_logging_enabled.ec2_client_vpn_endpoint_connection_logging_enabled import (
+                ec2_client_vpn_endpoint_connection_logging_enabled,
+            )
+
+            check = ec2_client_vpn_endpoint_connection_logging_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].region == AWS_REGION_US_EAST_1
+            assert result[0].resource_tags is None
+            assert (
+                result[0].status_extended
+                == f"Client VPN endpoint cvpn-endpoint-1234567890abcdef0 in region {AWS_REGION_US_EAST_1} has client connection logging enabled."
+            )
+            assert (
+                result[0].resource_arn
+                == "arn:aws:ec2:us-east-1:123456789012:client-vpn-endpoint/cvpn-endpoint-1234567890abcdef0"
+            )
@@ -22,7 +22,26 @@ from tests.providers.aws.utils import (
 EXAMPLE_AMI_ID = "ami-12c6146b"
 MOCK_DATETIME = datetime(2023, 1, 4, 7, 27, 30, tzinfo=tzutc())

-orig = botocore.client.BaseClient._make_api_call
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+    if operation_name == "DescribeClientVpnEndpoints":
+        return {
+            "ClientVpnEndpoints": [
+                {
+                    "ClientVpnEndpointId": "cvpn-endpoint-1234567890abcdef0",
+                    "ConnectionLogOptions": {
+                        "Enabled": True,
+                        "CloudwatchLogGroup": "string",
+                        "CloudwatchLogStream": "string",
+                    },
+                    "Tags": [{"Key": "vpnendpoint", "Value": "test"}],
+                }
+            ]
+        }
+    # Si no es la operación que queremos interceptar, llamamos al método original
+    return make_api_call(self, operation_name, kwarg)


 class Test_EC2_Service:
@@ -708,6 +727,21 @@ class Test_EC2_Service:
            == KNOWN_SECRET_USER_DATA
        )

+    # Test EC2 Describe VPN Endpoints
+    @mock.patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+    def test_describe_vpn_endpoints(self):
+        # EC2 client for this test class
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        ec2 = EC2(aws_provider)
+
+        assert len(ec2.vpn_endpoints) == 1
+        vpn_arn = f"arn:aws:ec2:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:client-vpn-endpoint/cvpn-endpoint-1234567890abcdef0"
+        assert vpn_arn in ec2.vpn_endpoints
+        vpn_endpoint = ec2.vpn_endpoints[vpn_arn]
+        assert vpn_endpoint.id == "cvpn-endpoint-1234567890abcdef0"
+        assert vpn_endpoint.connection_logging
+        assert vpn_endpoint.region == AWS_REGION_US_EAST_1
+
    # Test EC2 Describe Launch Templates
    @mock_aws
    def test_describe_transit_gateways(self):