ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(vpc): improve public subnet logic (#3814)

Browse Source
This commit is contained in:
Sergio Garcia
2024-04-18 13:58:42 +02:00
committed by GitHub
parent a138d2964e
commit fff06f971e
3 changed files with 58 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/vpc/vpc_service.py
+6 -1
View File
@@ -342,7 +342,12 @@ class VPC(AWSService):
for route in route_tables_for_subnet.get("RouteTables")[
0
].get("Routes"):
if "GatewayId" in route and "igw" in route["GatewayId"]:
if (
"GatewayId" in route
and "igw" in route["GatewayId"]
and route["DestinationCidrBlock"] == "0.0.0.0/0"
):
# If the route table has a default route to an internet gateway, the subnet is public
public = True
if "NatGatewayId" in route:
nat_gateway = True
tests/providers/aws/services/vpc/vpc_subnet_separate_private_public/vpc_subnet_separate_private_public_test.py
+35 -49
View File
@@ -1,6 +1,6 @@
from unittest import mock
from boto3 import client
from boto3 import client, resource
from moto import mock_aws
from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider
@@ -78,28 +78,21 @@ class Test_vpc_subnet_separate_private_public:
@mock_aws
def test_vpc_subnet_only_public(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1)
vpc = ec2_client.create_vpc(
CidrBlock="172.28.7.0/24", InstanceTenancy="default"
)
# VPC Public
subnet_public = ec2_client.create_subnet(
VpcId=vpc["Vpc"]["VpcId"],
CidrBlock="172.28.7.192/26",
AvailabilityZone=f"{AWS_REGION_US_EAST_1}a",
)
route_table_public = ec2_client.create_route_table(
VpcId=vpc["Vpc"]["VpcId"],
)
igw = ec2_client.create_internet_gateway()
# Create IGW and attach to VPC
igw = ec2.create_internet_gateway()
vpc.attach_internet_gateway(InternetGatewayId=igw.id)
# Set IGW as default route for public subnet
route_table = ec2.create_route_table(VpcId=vpc.id)
route_table.associate_with_subnet(SubnetId=subnet.id)
ec2_client.create_route(
DestinationCidrBlock="0.0.0.0",
RouteTableId=route_table_public["RouteTable"]["RouteTableId"],
GatewayId=igw["InternetGateway"]["InternetGatewayId"],
)
ec2_client.associate_route_table(
RouteTableId=route_table_public["RouteTable"]["RouteTableId"],
SubnetId=subnet_public["Subnet"]["SubnetId"],
RouteTableId=route_table.id,
DestinationCidrBlock="0.0.0.0/0",
GatewayId=igw.id,
)
from prowler.providers.aws.services.vpc.vpc_service import VPC
@@ -123,14 +116,14 @@ class Test_vpc_subnet_separate_private_public:
found = False
for result in results:
if result.resource_id == vpc["Vpc"]["VpcId"]:
if result.resource_id == vpc.id:
found = True
assert result.status == "FAIL"
assert (
result.status_extended
== f"VPC {vpc['Vpc']['VpcId']} has only public subnets."
== f"VPC {vpc.id} has only public subnets."
)
assert result.resource_id == vpc["Vpc"]["VpcId"]
assert result.resource_id == vpc.id
assert result.resource_tags == []
assert result.region == AWS_REGION_US_EAST_1
if not found:
@@ -139,17 +132,16 @@ class Test_vpc_subnet_separate_private_public:
@mock_aws
def test_vpc_subnet_private_and_public(self):
ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1)
vpc = ec2_client.create_vpc(
CidrBlock="172.28.7.0/24", InstanceTenancy="default"
)
ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
# VPC Private
subnet_private = ec2_client.create_subnet(
VpcId=vpc["Vpc"]["VpcId"],
CidrBlock="172.28.7.192/26",
VpcId=vpc.id,
CidrBlock="10.0.0.0/17",
AvailabilityZone=f"{AWS_REGION_US_EAST_1}a",
)
route_table_private = ec2_client.create_route_table(
VpcId=vpc["Vpc"]["VpcId"],
VpcId=vpc.id,
)
ec2_client.create_route(
DestinationCidrBlock="10.10.10.0",
@@ -160,23 +152,17 @@ class Test_vpc_subnet_separate_private_public:
SubnetId=subnet_private["Subnet"]["SubnetId"],
)
# VPC Public
subnet_public = ec2_client.create_subnet(
VpcId=vpc["Vpc"]["VpcId"],
CidrBlock="172.28.7.0/26",
AvailabilityZone=f"{AWS_REGION_US_EAST_1}a",
)
route_table_public = ec2_client.create_route_table(
VpcId=vpc["Vpc"]["VpcId"],
)
igw = ec2_client.create_internet_gateway()
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.128.0/17")
# Create IGW and attach to VPC
igw = ec2.create_internet_gateway()
vpc.attach_internet_gateway(InternetGatewayId=igw.id)
# Set IGW as default route for public subnet
route_table = ec2.create_route_table(VpcId=vpc.id)
route_table.associate_with_subnet(SubnetId=subnet.id)
ec2_client.create_route(
DestinationCidrBlock="0.0.0.0",
RouteTableId=route_table_public["RouteTable"]["RouteTableId"],
GatewayId=igw["InternetGateway"]["InternetGatewayId"],
)
ec2_client.associate_route_table(
RouteTableId=route_table_public["RouteTable"]["RouteTableId"],
SubnetId=subnet_public["Subnet"]["SubnetId"],
RouteTableId=route_table.id,
DestinationCidrBlock="0.0.0.0/0",
GatewayId=igw.id,
)
from prowler.providers.aws.services.vpc.vpc_service import VPC
@@ -200,14 +186,14 @@ class Test_vpc_subnet_separate_private_public:
found = False
for result in results:
if result.resource_id == vpc["Vpc"]["VpcId"]:
if result.resource_id == vpc.id:
found = True
assert result.status == "PASS"
assert (
result.status_extended
== f"VPC {vpc['Vpc']['VpcId']} has private and public subnets."
== f"VPC {vpc.id} has private and public subnets."
)
assert result.resource_id == vpc["Vpc"]["VpcId"]
assert result.resource_id == vpc.id
assert result.resource_tags == []
assert result.region == AWS_REGION_US_EAST_1
if not found:
tests/providers/aws/services/workspaces/workspaces_vpc_2private_1public_subnets_nat/workspaces_vpc_2private_1public_subnets_nat_test.py
+17 -24
View File
@@ -1,7 +1,7 @@
from unittest import mock
from uuid import uuid4
from boto3 import client
from boto3 import client, resource
from moto import mock_aws
from prowler.providers.aws.services.vpc.vpc_service import VPC
@@ -343,17 +343,16 @@ class Test_workspaces_vpc_2private_1public_subnets_nat:
def test_workspaces_vpc_two_private_subnet_one_public_and_nat(self):
# EC2 Client
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2_client.create_vpc(
CidrBlock="172.28.7.0/24", InstanceTenancy="default"
)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="172.28.7.0/24", InstanceTenancy="default")
# VPC Private
subnet_private = ec2_client.create_subnet(
VpcId=vpc["Vpc"]["VpcId"],
VpcId=vpc.id,
CidrBlock="172.28.7.0/26",
AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a",
)
route_table_private = ec2_client.create_route_table(
VpcId=vpc["Vpc"]["VpcId"],
VpcId=vpc.id,
)
ec2_client.create_route(
DestinationCidrBlock="10.10.10.0",
@@ -365,12 +364,12 @@ class Test_workspaces_vpc_2private_1public_subnets_nat:
)
# VPC Private 2
subnet_private_2 = ec2_client.create_subnet(
VpcId=vpc["Vpc"]["VpcId"],
VpcId=vpc.id,
CidrBlock="172.28.7.64/26",
AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a",
)
route_table_private_2 = ec2_client.create_route_table(
VpcId=vpc["Vpc"]["VpcId"],
VpcId=vpc.id,
)
ec2_client.create_route(
DestinationCidrBlock="10.10.10.0",
@@ -389,23 +388,17 @@ class Test_workspaces_vpc_2private_1public_subnets_nat:
RouteTableId=route_table_private_2["RouteTable"]["RouteTableId"],
)
# VPC Public
subnet_public = ec2_client.create_subnet(
VpcId=vpc["Vpc"]["VpcId"],
CidrBlock="172.28.7.192/26",
AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a",
)
route_table_public = ec2_client.create_route_table(
VpcId=vpc["Vpc"]["VpcId"],
)
igw = ec2_client.create_internet_gateway()
subnet_public = ec2.create_subnet(VpcId=vpc.id, CidrBlock="172.28.7.128/25")
# Create IGW and attach to VPC
igw = ec2.create_internet_gateway()
vpc.attach_internet_gateway(InternetGatewayId=igw.id)
# Set IGW as default route for public subnet
route_table = ec2.create_route_table(VpcId=vpc.id)
route_table.associate_with_subnet(SubnetId=subnet_public.id)
ec2_client.create_route(
DestinationCidrBlock="0.0.0.0",
RouteTableId=route_table_public["RouteTable"]["RouteTableId"],
GatewayId=igw["InternetGateway"]["InternetGatewayId"],
)
ec2_client.associate_route_table(
RouteTableId=route_table_public["RouteTable"]["RouteTableId"],
SubnetId=subnet_public["Subnet"]["SubnetId"],
RouteTableId=route_table.id,
DestinationCidrBlock="0.0.0.0/0",
GatewayId=igw.id,
)
# Workspace Mock
workspaces_client = mock.MagicMock