From fd610d44c0c3a6905d7f58efbb52f02686c8e4ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Tue, 17 Dec 2024 00:21:42 +0100 Subject: [PATCH] refactor(gcp): use always .region for checks (#6206) --- ...tance_block_project_wide_ssh_keys_disabled.py | 2 +- ...te_instance_confidential_computing_enabled.py | 2 +- ...te_instance_default_service_account_in_use.py | 2 +- ...ervice_account_in_use_with_full_api_access.py | 2 +- ...pute_instance_encryption_with_csek_enabled.py | 2 +- .../compute_instance_ip_forwarding_is_enabled.py | 2 +- .../compute_instance_public_ip.py | 2 +- .../compute_instance_serial_ports_in_use.py | 2 +- .../compute_instance_shielded_vm_enabled.py | 2 +- .../compute_network_default_in_use.py | 2 +- .../compute_project_os_login_enabled.py | 2 +- .../gcp/services/compute/compute_service.py | 2 ++ .../dataproc_encrypted_with_cmks_disabled.py | 1 + .../dns_dnssec_disabled/dns_dnssec_disabled.py | 1 + .../dns_rsasha1_in_use_to_key_sign_in_dnssec.py | 1 + .../dns_rsasha1_in_use_to_zone_sign_in_dnssec.py | 1 + .../gke_cluster_no_default_service_account.py | 2 +- .../providers/gcp/services/gke/gke_service.py | 2 ++ ..._block_project_wide_ssh_keys_disabled_test.py | 6 ++++++ ...stance_confidential_computing_enabled_test.py | 6 ++++-- ...stance_default_service_account_in_use_test.py | 6 ++++++ ...e_account_in_use_with_full_api_access_test.py | 6 ++++++ ...instance_encryption_with_csek_enabled_test.py | 7 +++++++ ...ute_instance_ip_forwarding_is_enabled_test.py | 6 ++++++ .../compute_instance_public_ip_test.py | 6 ++++-- .../compute_network_default_in_use_test.py | 3 +++ .../compute_project_os_login_enabled_test.py | 2 ++ .../compute_serial_ports_in_use_test.py | 10 ++++++++++ .../gcp/services/compute/compute_service_test.py | 2 ++ .../compute_shielded_vm_enabled_test.py | 6 ++++++ ...dataproc_encrypted_with_cmks_disabled_test.py | 4 ++++ ...ke_cluster_no_default_service_account_test.py | 16 ++++++++-------- 32 files changed, 94 insertions(+), 24 deletions(-) diff --git a/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py b/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py index 3e093fcb0f..50942a1648 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py +++ b/prowler/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled.py @@ -10,7 +10,7 @@ class compute_instance_block_project_wide_ssh_keys_disabled(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "FAIL" report.status_extended = f"The VM Instance {instance.name} is making use of common/shared project-wide SSH key(s)." if instance.metadata.get("items"): diff --git a/prowler/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled.py b/prowler/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled.py index 1cbb7420c4..d65ea26c25 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled.py +++ b/prowler/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled.py @@ -10,7 +10,7 @@ class compute_instance_confidential_computing_enabled(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "PASS" report.status_extended = ( f"VM Instance {instance.name} has Confidential Computing enabled." diff --git a/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use.py b/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use.py index 49a5f7af2f..60895befe3 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use.py +++ b/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use.py @@ -10,7 +10,7 @@ class compute_instance_default_service_account_in_use(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "PASS" report.status_extended = f"The default service account is not configured to be used with VM Instance {instance.name}." if ( diff --git a/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access.py b/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access.py index 3953bbd53a..785877bc96 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access.py +++ b/prowler/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access.py @@ -10,7 +10,7 @@ class compute_instance_default_service_account_in_use_with_full_api_access(Check report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "PASS" report.status_extended = f"The VM Instance {instance.name} is not configured to use the default service account with full access to all cloud APIs." for service_account in instance.service_accounts: diff --git a/prowler/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled.py b/prowler/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled.py index edd4875487..e94c560bc9 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled.py +++ b/prowler/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled.py @@ -10,7 +10,7 @@ class compute_instance_encryption_with_csek_enabled(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "FAIL" report.status_extended = f"The VM Instance {instance.name} has the following unencrypted disks: '{', '.join([i[0] for i in instance.disks_encryption if not i[1]])}'." if all([i[1] for i in instance.disks_encryption]): diff --git a/prowler/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled.py b/prowler/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled.py index 40cccd9014..371d912d56 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled.py +++ b/prowler/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled.py @@ -10,7 +10,7 @@ class compute_instance_ip_forwarding_is_enabled(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "PASS" report.status_extended = ( f"The IP Forwarding of VM Instance {instance.name} is not enabled." diff --git a/prowler/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip.py b/prowler/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip.py index 429b4d99ed..f67059e618 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip.py +++ b/prowler/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip.py @@ -10,7 +10,7 @@ class compute_instance_public_ip(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "PASS" report.status_extended = ( f"VM Instance {instance.name} does not have a public IP." diff --git a/prowler/providers/gcp/services/compute/compute_instance_serial_ports_in_use/compute_instance_serial_ports_in_use.py b/prowler/providers/gcp/services/compute/compute_instance_serial_ports_in_use/compute_instance_serial_ports_in_use.py index c73fdf546d..399ef32b94 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_serial_ports_in_use/compute_instance_serial_ports_in_use.py +++ b/prowler/providers/gcp/services/compute/compute_instance_serial_ports_in_use/compute_instance_serial_ports_in_use.py @@ -10,7 +10,7 @@ class compute_instance_serial_ports_in_use(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "PASS" report.status_extended = f"VM Instance {instance.name} has Enable Connecting to Serial Ports off." if instance.metadata.get("items"): diff --git a/prowler/providers/gcp/services/compute/compute_instance_shielded_vm_enabled/compute_instance_shielded_vm_enabled.py b/prowler/providers/gcp/services/compute/compute_instance_shielded_vm_enabled/compute_instance_shielded_vm_enabled.py index e691d459c0..80b210006c 100644 --- a/prowler/providers/gcp/services/compute/compute_instance_shielded_vm_enabled/compute_instance_shielded_vm_enabled.py +++ b/prowler/providers/gcp/services/compute/compute_instance_shielded_vm_enabled/compute_instance_shielded_vm_enabled.py @@ -10,7 +10,7 @@ class compute_instance_shielded_vm_enabled(Check): report.project_id = instance.project_id report.resource_id = instance.id report.resource_name = instance.name - report.location = instance.zone + report.location = instance.region report.status = "PASS" report.status_extended = f"VM Instance {instance.name} has vTPM or Integrity Monitoring set to on." if ( diff --git a/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py b/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py index 7c0dab3935..e8199d3b1a 100644 --- a/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py +++ b/prowler/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use.py @@ -18,7 +18,7 @@ class compute_network_default_in_use(Check): report.project_id = project report.resource_id = "default" report.resource_name = "default" - report.location = "global" + report.location = compute_client.region if project in projects_with_default_network: report.status = "FAIL" diff --git a/prowler/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled.py b/prowler/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled.py index c728e3d8e9..0239a11295 100644 --- a/prowler/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled.py +++ b/prowler/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled.py @@ -9,7 +9,7 @@ class compute_project_os_login_enabled(Check): report = Check_Report_GCP(self.metadata()) report.project_id = project.id report.resource_id = project.id - report.location = "global" + report.location = compute_client.region report.status = "PASS" report.status_extended = f"Project {project.id} has OS Login enabled." if not project.enable_oslogin: diff --git a/prowler/providers/gcp/services/compute/compute_service.py b/prowler/providers/gcp/services/compute/compute_service.py index 7691933e90..3ce461e0a0 100644 --- a/prowler/providers/gcp/services/compute/compute_service.py +++ b/prowler/providers/gcp/services/compute/compute_service.py @@ -101,6 +101,7 @@ class Compute(GCPService): name=instance["name"], id=instance["id"], zone=zone, + region=zone.rsplit("-", 1)[0], public_ip=public_ip, metadata=instance.get("metadata", {}), shielded_enabled_vtpm=instance.get( @@ -306,6 +307,7 @@ class Instance(BaseModel): name: str id: str zone: str + region: str public_ip: bool project_id: str metadata: dict diff --git a/prowler/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled.py b/prowler/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled.py index 24c5bcf154..e1c5b8fc05 100644 --- a/prowler/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled.py +++ b/prowler/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled.py @@ -10,6 +10,7 @@ class dataproc_encrypted_with_cmks_disabled(Check): report.project_id = cluster.project_id report.resource_id = cluster.id report.resource_name = cluster.name + report.location = dataproc_client.region report.status = "PASS" report.status_extended = f"Dataproc cluster {cluster.name} is encrypted with customer managed encryption keys." if cluster.encryption_config.get("gcePdKmsKeyName") is None: diff --git a/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.py b/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.py index 5595f0269a..79d3fa145c 100644 --- a/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.py +++ b/prowler/providers/gcp/services/dns/dns_dnssec_disabled/dns_dnssec_disabled.py @@ -10,6 +10,7 @@ class dns_dnssec_disabled(Check): report.project_id = managed_zone.project_id report.resource_id = managed_zone.id report.resource_name = managed_zone.name + report.location = dns_client.region report.status = "PASS" report.status_extended = ( f"Cloud DNS {managed_zone.name} has DNSSEC enabled." diff --git a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.py b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.py index ef6e1fa985..ada5e4a516 100644 --- a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.py +++ b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_key_sign_in_dnssec/dns_rsasha1_in_use_to_key_sign_in_dnssec.py @@ -10,6 +10,7 @@ class dns_rsasha1_in_use_to_key_sign_in_dnssec(Check): report.project_id = managed_zone.project_id report.resource_id = managed_zone.id report.resource_name = managed_zone.name + report.location = dns_client.region report.status = "PASS" report.status_extended = f"Cloud DNS {managed_zone.name} is not using RSASHA1 algorithm as key signing." if any( diff --git a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.py b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.py index 50dbd05adb..fcb123ae7a 100644 --- a/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.py +++ b/prowler/providers/gcp/services/dns/dns_rsasha1_in_use_to_zone_sign_in_dnssec/dns_rsasha1_in_use_to_zone_sign_in_dnssec.py @@ -10,6 +10,7 @@ class dns_rsasha1_in_use_to_zone_sign_in_dnssec(Check): report.project_id = managed_zone.project_id report.resource_id = managed_zone.id report.resource_name = managed_zone.name + report.location = dns_client.region report.status = "PASS" report.status_extended = f"Cloud DNS {managed_zone.name} is not using RSASHA1 algorithm as zone signing." if any( diff --git a/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.py b/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.py index e412d18129..7acc81d559 100644 --- a/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.py +++ b/prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.py @@ -10,7 +10,7 @@ class gke_cluster_no_default_service_account(Check): report.project_id = cluster.project_id report.resource_id = cluster.id report.resource_name = cluster.name - report.location = cluster.location + report.location = cluster.region report.status = "PASS" report.status_extended = f"GKE cluster {cluster.name} is not using the Compute Engine default service account." if not cluster.node_pools and cluster.service_account == "default": diff --git a/prowler/providers/gcp/services/gke/gke_service.py b/prowler/providers/gcp/services/gke/gke_service.py index 840478b891..ecd351c93f 100644 --- a/prowler/providers/gcp/services/gke/gke_service.py +++ b/prowler/providers/gcp/services/gke/gke_service.py @@ -60,6 +60,7 @@ class GKE(GCPService): name=cluster["name"], id=cluster["id"], location=cluster["location"], + region=cluster["location"].rsplit("-", 1)[0], service_account=cluster["nodeConfig"]["serviceAccount"], node_pools=node_pools, project_id=location.project_id, @@ -85,6 +86,7 @@ class NodePool(BaseModel): class Cluster(BaseModel): name: str id: str + region: str location: str service_account: str node_pools: list[NodePool] diff --git a/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py b/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py index 0a42aaeb1d..0141a49a46 100644 --- a/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_block_project_wide_ssh_keys_disabled/compute_instance_block_project_wide_ssh_keys_disabled_test.py @@ -32,6 +32,7 @@ class Test_compute_instance_block_project_wide_ssh_keys_disabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "block-project-ssh-keys", "value": "true"}]}, shielded_enabled_vtpm=True, @@ -68,6 +69,7 @@ class Test_compute_instance_block_project_wide_ssh_keys_disabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_without_metadata(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -76,6 +78,7 @@ class Test_compute_instance_block_project_wide_ssh_keys_disabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -112,6 +115,7 @@ class Test_compute_instance_block_project_wide_ssh_keys_disabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_with_block_project_ssh_keys_false(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -120,6 +124,7 @@ class Test_compute_instance_block_project_wide_ssh_keys_disabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "block-project-ssh-keys", "value": "false"}]}, shielded_enabled_vtpm=True, @@ -156,3 +161,4 @@ class Test_compute_instance_block_project_wide_ssh_keys_disabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled_test.py b/tests/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled_test.py index ea9d2a72a5..9b6367c1d2 100644 --- a/tests/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_confidential_computing_enabled/compute_instance_confidential_computing_enabled_test.py @@ -32,6 +32,7 @@ class Test_compute_instance_confidential_computing_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -69,7 +70,7 @@ class Test_compute_instance_confidential_computing_enabled: ) assert result[0].resource_id == instance.id assert result[0].resource_name == instance.name - assert result[0].location == instance.zone + assert result[0].location == "us-central1" assert result[0].project_id == GCP_PROJECT_ID def test_one_instance_with_shielded_vtpm_disabled(self): @@ -79,6 +80,7 @@ class Test_compute_instance_confidential_computing_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=False, @@ -116,5 +118,5 @@ class Test_compute_instance_confidential_computing_enabled: ) assert result[0].resource_id == instance.id assert result[0].resource_name == instance.name - assert result[0].location == instance.zone + assert result[0].location == "us-central1" assert result[0].project_id == GCP_PROJECT_ID diff --git a/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use_test.py b/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use_test.py index 834b60788d..b30726c015 100644 --- a/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use/compute_instance_default_service_account_in_use_test.py @@ -30,6 +30,7 @@ class Test_compute_instance_default_service_account_in_use: instance = Instance( name="test", id="1234567890", + region="us-central1", zone="us-central1-a", public_ip=True, metadata={}, @@ -67,6 +68,7 @@ class Test_compute_instance_default_service_account_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_compliant_instance_gke(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -75,6 +77,7 @@ class Test_compute_instance_default_service_account_in_use: name="gke-test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -113,6 +116,7 @@ class Test_compute_instance_default_service_account_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_instance_with_default_service_account(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -121,6 +125,7 @@ class Test_compute_instance_default_service_account_in_use: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -159,3 +164,4 @@ class Test_compute_instance_default_service_account_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access_test.py b/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access_test.py index beaff82f16..3ec9dc6d24 100644 --- a/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_default_service_account_in_use_with_full_api_access/compute_instance_default_service_account_in_use_with_full_api_access_test.py @@ -32,6 +32,7 @@ class Test_compute_instance_default_service_account_in_use_with_full_api_access: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -72,6 +73,7 @@ class Test_compute_instance_default_service_account_in_use_with_full_api_access: == f"The VM Instance {instance.name} is not configured to use the default service account with full access to all cloud APIs." ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_compliant_instance_gke(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -80,6 +82,7 @@ class Test_compute_instance_default_service_account_in_use_with_full_api_access: name="gke-test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -123,6 +126,7 @@ class Test_compute_instance_default_service_account_in_use_with_full_api_access: == f"The VM Instance {instance.name} is not configured to use the default service account with full access to all cloud APIs." ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_instance_with_default_service_account(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -131,6 +135,7 @@ class Test_compute_instance_default_service_account_in_use_with_full_api_access: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -174,3 +179,4 @@ class Test_compute_instance_default_service_account_in_use_with_full_api_access: == f"The VM Instance {instance.name} is configured to use the default service account with full access to all cloud APIs." ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled_test.py b/tests/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled_test.py index bcfc4bfd62..96a6538bd7 100644 --- a/tests/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_encryption_with_csek_enabled/compute_instance_encryption_with_csek_enabled_test.py @@ -32,6 +32,7 @@ class Test_compute_instance_encryption_with_csek_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "block-project-ssh-keys", "value": "true"}]}, shielded_enabled_vtpm=True, @@ -46,6 +47,7 @@ class Test_compute_instance_encryption_with_csek_enabled: compute_client = mock.MagicMock compute_client.project_ids = [GCP_PROJECT_ID] compute_client.instances = [instance] + compute_client.region = "us-central1" with mock.patch( "prowler.providers.common.provider.Provider.get_global_provider", @@ -68,6 +70,7 @@ class Test_compute_instance_encryption_with_csek_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_with_one_unecrypted_disk(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -76,6 +79,7 @@ class Test_compute_instance_encryption_with_csek_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -112,6 +116,7 @@ class Test_compute_instance_encryption_with_csek_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_with_all_unencrypted_disks(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -120,6 +125,7 @@ class Test_compute_instance_encryption_with_csek_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "block-project-ssh-keys", "value": "false"}]}, shielded_enabled_vtpm=True, @@ -156,3 +162,4 @@ class Test_compute_instance_encryption_with_csek_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled_test.py b/tests/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled_test.py index 5c6ce5b8c8..2cf21d791b 100644 --- a/tests/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_ip_forwarding_is_enabled/compute_instance_ip_forwarding_is_enabled_test.py @@ -31,6 +31,7 @@ class Test_compute_instance_ip_forwarding_is_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -67,6 +68,7 @@ class Test_compute_instance_ip_forwarding_is_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_compliant_instance_gke(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -75,6 +77,7 @@ class Test_compute_instance_ip_forwarding_is_enabled: name="gke-test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -113,6 +116,7 @@ class Test_compute_instance_ip_forwarding_is_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_instance_with_ip_forwarding_enabled(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -121,6 +125,7 @@ class Test_compute_instance_ip_forwarding_is_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -159,3 +164,4 @@ class Test_compute_instance_ip_forwarding_is_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip_test.py b/tests/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip_test.py index 9c3b20020a..a4ccd3cd4e 100644 --- a/tests/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip_test.py +++ b/tests/providers/gcp/services/compute/compute_instance_public_ip/compute_instance_public_ip_test.py @@ -42,6 +42,7 @@ class Test_compute_instance_public_ip: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=False, metadata={}, shielded_enabled_vtpm=True, @@ -70,7 +71,7 @@ class Test_compute_instance_public_ip: assert result[0].resource_id == "1234567890" assert result[0].project_id == GCP_PROJECT_ID assert result[0].resource_name == "test" - assert result[0].location == "us-central1-a" + assert result[0].location == "us-central1" def test_public_ip_instance(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -79,6 +80,7 @@ class Test_compute_instance_public_ip: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -116,4 +118,4 @@ class Test_compute_instance_public_ip: assert result[0].resource_id == "1234567890" assert result[0].project_id == GCP_PROJECT_ID assert result[0].resource_name == "test" - assert result[0].location == "us-central1-a" + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use_test.py b/tests/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use_test.py index c8360a1c32..d9d684be7e 100644 --- a/tests/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use_test.py +++ b/tests/providers/gcp/services/compute/compute_network_default_in_use/compute_network_default_in_use_test.py @@ -41,6 +41,7 @@ class Test_compute_network_default_in_use: compute_client.project_ids = [GCP_PROJECT_ID] compute_client.networks = [] + compute_client.region = "global" check = compute_network_default_in_use() result = check.execute() @@ -79,6 +80,7 @@ class Test_compute_network_default_in_use: project_id=GCP_PROJECT_ID, ) ] + compute_client.region = "global" check = compute_network_default_in_use() result = check.execute() @@ -117,6 +119,7 @@ class Test_compute_network_default_in_use: project_id=GCP_PROJECT_ID, ) ] + compute_client.region = "global" check = compute_network_default_in_use() result = check.execute() diff --git a/tests/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled_test.py b/tests/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled_test.py index 42e98049fe..df71caf421 100644 --- a/tests/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled_test.py +++ b/tests/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled_test.py @@ -36,6 +36,7 @@ class Test_compute_project_os_login_enabled: compute_client = mock.MagicMock compute_client.project_ids = [GCP_PROJECT_ID] compute_client.projects = [project] + compute_client.region = "global" with mock.patch( "prowler.providers.common.provider.Provider.get_global_provider", @@ -72,6 +73,7 @@ class Test_compute_project_os_login_enabled: compute_client = mock.MagicMock compute_client.project_ids = [GCP_PROJECT_ID] compute_client.projects = [project] + compute_client.region = "global" with mock.patch( "prowler.providers.common.provider.Provider.get_global_provider", diff --git a/tests/providers/gcp/services/compute/compute_serial_ports_in_use/compute_serial_ports_in_use_test.py b/tests/providers/gcp/services/compute/compute_serial_ports_in_use/compute_serial_ports_in_use_test.py index 64869f4be2..f9bdb787c7 100644 --- a/tests/providers/gcp/services/compute/compute_serial_ports_in_use/compute_serial_ports_in_use_test.py +++ b/tests/providers/gcp/services/compute/compute_serial_ports_in_use/compute_serial_ports_in_use_test.py @@ -32,6 +32,7 @@ class Test_compute_instance_serial_ports_in_use: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -68,6 +69,7 @@ class Test_compute_instance_serial_ports_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_compliant_instance_with_0(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -76,6 +78,7 @@ class Test_compute_instance_serial_ports_in_use: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "serial-port-enabled", "value": "0"}]}, shielded_enabled_vtpm=True, @@ -112,6 +115,7 @@ class Test_compute_instance_serial_ports_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_compliant_instance_with_false(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -120,6 +124,7 @@ class Test_compute_instance_serial_ports_in_use: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "serial-port-enabled", "value": "false"}]}, shielded_enabled_vtpm=True, @@ -156,6 +161,7 @@ class Test_compute_instance_serial_ports_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_with_serial_ports_enable_1(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -164,6 +170,7 @@ class Test_compute_instance_serial_ports_in_use: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "serial-port-enable", "value": "1"}]}, shielded_enabled_vtpm=True, @@ -200,6 +207,7 @@ class Test_compute_instance_serial_ports_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_with_serial_ports_enable_true(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -208,6 +216,7 @@ class Test_compute_instance_serial_ports_in_use: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={"items": [{"key": "serial-port-enable", "value": "true"}]}, shielded_enabled_vtpm=True, @@ -244,3 +253,4 @@ class Test_compute_instance_serial_ports_in_use: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/compute/compute_service_test.py b/tests/providers/gcp/services/compute/compute_service_test.py index 3e6f47a3d3..8a62c379e9 100644 --- a/tests/providers/gcp/services/compute/compute_service_test.py +++ b/tests/providers/gcp/services/compute/compute_service_test.py @@ -36,6 +36,7 @@ class TestComputeService: assert compute_client.instances[0].name == "instance1" assert compute_client.instances[0].id.__class__.__name__ == "str" assert compute_client.instances[0].zone == "zone1" + assert compute_client.instances[0].region == "zone1" assert compute_client.instances[0].public_ip assert compute_client.instances[0].project_id == GCP_PROJECT_ID assert compute_client.instances[0].metadata == {} @@ -57,6 +58,7 @@ class TestComputeService: assert compute_client.instances[1].name == "instance2" assert compute_client.instances[1].id.__class__.__name__ == "str" assert compute_client.instances[1].zone == "zone1" + assert compute_client.instances[1].region == "zone1" assert not compute_client.instances[1].public_ip assert compute_client.instances[1].project_id == GCP_PROJECT_ID assert compute_client.instances[1].metadata == {} diff --git a/tests/providers/gcp/services/compute/compute_shielded_vm_enabled/compute_shielded_vm_enabled_test.py b/tests/providers/gcp/services/compute/compute_shielded_vm_enabled/compute_shielded_vm_enabled_test.py index ba2af23afd..0af10dfd81 100644 --- a/tests/providers/gcp/services/compute/compute_shielded_vm_enabled/compute_shielded_vm_enabled_test.py +++ b/tests/providers/gcp/services/compute/compute_shielded_vm_enabled/compute_shielded_vm_enabled_test.py @@ -32,6 +32,7 @@ class Test_compute_instance_shielded_vm_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -68,6 +69,7 @@ class Test_compute_instance_shielded_vm_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_with_shielded_vtpm_disabled(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -76,6 +78,7 @@ class Test_compute_instance_shielded_vm_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=False, @@ -112,6 +115,7 @@ class Test_compute_instance_shielded_vm_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" def test_one_instance_with_shielded_integrity_monitoring_disabled(self): from prowler.providers.gcp.services.compute.compute_service import Instance @@ -120,6 +124,7 @@ class Test_compute_instance_shielded_vm_enabled: name="test", id="1234567890", zone="us-central1-a", + region="us-central1", public_ip=True, metadata={}, shielded_enabled_vtpm=True, @@ -156,3 +161,4 @@ class Test_compute_instance_shielded_vm_enabled: result[0].status_extended, ) assert result[0].resource_id == instance.id + assert result[0].location == "us-central1" diff --git a/tests/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled_test.py b/tests/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled_test.py index f29f9c02f6..f187bfd1a8 100644 --- a/tests/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled_test.py +++ b/tests/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled_test.py @@ -44,6 +44,7 @@ class Test_dataproc_encrypted_with_cmks_disabled: project_id=GCP_PROJECT_ID, ) dataproc_client.clusters = [cluster] + dataproc_client.region = "global" from prowler.providers.gcp.services.dataproc.dataproc_encrypted_with_cmks_disabled.dataproc_encrypted_with_cmks_disabled import ( dataproc_encrypted_with_cmks_disabled, @@ -59,6 +60,7 @@ class Test_dataproc_encrypted_with_cmks_disabled: result[0].status_extended, ) assert result[0].resource_id == cluster.id + assert result[0].location == "global" def test_cluster_without_encryption(self): dataproc_client = mock.MagicMock @@ -81,6 +83,7 @@ class Test_dataproc_encrypted_with_cmks_disabled: project_id=GCP_PROJECT_ID, ) dataproc_client.clusters = [cluster] + dataproc_client.region = "global" from prowler.providers.gcp.services.dataproc.dataproc_encrypted_with_cmks_disabled.dataproc_encrypted_with_cmks_disabled import ( dataproc_encrypted_with_cmks_disabled, @@ -96,3 +99,4 @@ class Test_dataproc_encrypted_with_cmks_disabled: result[0].status_extended, ) assert result[0].resource_id == cluster.id + assert result[0].location == "global" diff --git a/tests/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account_test.py b/tests/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account_test.py index 319861e1a6..aa9c672374 100644 --- a/tests/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account_test.py +++ b/tests/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account_test.py @@ -31,6 +31,7 @@ class Test_gke_cluster_no_default_service_account: name="test", id="123", location="eu-west-1", + region="eu-west-1", service_account="default", node_pools=[], project_id=GCP_PROJECT_ID, @@ -40,7 +41,6 @@ class Test_gke_cluster_no_default_service_account: gke_client = mock.MagicMock gke_client.project_ids = [GCP_PROJECT_ID] gke_client.clusters = clusters - gke_client.region = "global" with mock.patch( "prowler.providers.common.provider.Provider.get_global_provider", @@ -65,7 +65,7 @@ class Test_gke_cluster_no_default_service_account: assert result[0].project_id == clusters["123"].project_id assert result[0].resource_id == clusters["123"].id assert result[0].resource_name == clusters["123"].name - assert result[0].location == clusters["123"].location + assert result[0].location == "eu-west-1" def test_one_cluster_without_node_pool_without_default_sa(self): @@ -74,6 +74,7 @@ class Test_gke_cluster_no_default_service_account: name="test", id="123", location="eu-west-1", + region="eu-west-1", service_account="1231231231", node_pools=[], project_id=GCP_PROJECT_ID, @@ -83,7 +84,6 @@ class Test_gke_cluster_no_default_service_account: gke_client = mock.MagicMock gke_client.project_ids = [GCP_PROJECT_ID] gke_client.clusters = clusters - gke_client.region = "global" with mock.patch( "prowler.providers.common.provider.Provider.get_global_provider", @@ -108,7 +108,7 @@ class Test_gke_cluster_no_default_service_account: assert result[0].project_id == clusters["123"].project_id assert result[0].resource_id == clusters["123"].id assert result[0].resource_name == clusters["123"].name - assert result[0].location == clusters["123"].location + assert result[0].location == "eu-west-1" def test_one_cluster_with_node_pool_with_default_sa(self): @@ -117,6 +117,7 @@ class Test_gke_cluster_no_default_service_account: name="test", id="123", location="eu-west-1", + region="eu-west-1", service_account="default", node_pools=[ NodePool( @@ -133,7 +134,6 @@ class Test_gke_cluster_no_default_service_account: gke_client = mock.MagicMock gke_client.project_ids = [GCP_PROJECT_ID] gke_client.clusters = clusters - gke_client.region = "global" with mock.patch( "prowler.providers.common.provider.Provider.get_global_provider", @@ -158,7 +158,7 @@ class Test_gke_cluster_no_default_service_account: assert result[0].project_id == clusters["123"].project_id assert result[0].resource_id == clusters["123"].id assert result[0].resource_name == clusters["123"].name - assert result[0].location == clusters["123"].location + assert result[0].location == "eu-west-1" def test_one_cluster_with_node_pool_with_non_default_sa(self): @@ -167,6 +167,7 @@ class Test_gke_cluster_no_default_service_account: name="test", id="123", location="eu-west-1", + region="eu-west-1", service_account="default", node_pools=[ NodePool( @@ -183,7 +184,6 @@ class Test_gke_cluster_no_default_service_account: gke_client = mock.MagicMock gke_client.project_ids = [GCP_PROJECT_ID] gke_client.clusters = clusters - gke_client.region = "global" with mock.patch( "prowler.providers.common.provider.Provider.get_global_provider", @@ -208,4 +208,4 @@ class Test_gke_cluster_no_default_service_account: assert result[0].project_id == clusters["123"].project_id assert result[0].resource_id == clusters["123"].id assert result[0].resource_name == clusters["123"].name - assert result[0].location == clusters["123"].location + assert result[0].location == "eu-west-1"