diff --git a/prowler/providers/aws/services/vpc/vpc_service.py b/prowler/providers/aws/services/vpc/vpc_service.py index 2915acc701..1cf7b30eb7 100644 --- a/prowler/providers/aws/services/vpc/vpc_service.py +++ b/prowler/providers/aws/services/vpc/vpc_service.py @@ -342,7 +342,12 @@ class VPC(AWSService): for route in route_tables_for_subnet.get("RouteTables")[ 0 ].get("Routes"): - if "GatewayId" in route and "igw" in route["GatewayId"]: + if ( + "GatewayId" in route + and "igw" in route["GatewayId"] + and route["DestinationCidrBlock"] == "0.0.0.0/0" + ): + # If the route table has a default route to an internet gateway, the subnet is public public = True if "NatGatewayId" in route: nat_gateway = True diff --git a/tests/providers/aws/services/vpc/vpc_subnet_separate_private_public/vpc_subnet_separate_private_public_test.py b/tests/providers/aws/services/vpc/vpc_subnet_separate_private_public/vpc_subnet_separate_private_public_test.py index ac14ebed6e..ecc9c61ee6 100644 --- a/tests/providers/aws/services/vpc/vpc_subnet_separate_private_public/vpc_subnet_separate_private_public_test.py +++ b/tests/providers/aws/services/vpc/vpc_subnet_separate_private_public/vpc_subnet_separate_private_public_test.py @@ -1,6 +1,6 @@ from unittest import mock -from boto3 import client +from boto3 import client, resource from moto import mock_aws from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider @@ -78,28 +78,21 @@ class Test_vpc_subnet_separate_private_public: @mock_aws def test_vpc_subnet_only_public(self): + # Create EC2 Mocked Resources + ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1) + vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16") + subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18") ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1) - vpc = ec2_client.create_vpc( - CidrBlock="172.28.7.0/24", InstanceTenancy="default" - ) - # VPC Public - subnet_public = ec2_client.create_subnet( - VpcId=vpc["Vpc"]["VpcId"], - CidrBlock="172.28.7.192/26", - AvailabilityZone=f"{AWS_REGION_US_EAST_1}a", - ) - route_table_public = ec2_client.create_route_table( - VpcId=vpc["Vpc"]["VpcId"], - ) - igw = ec2_client.create_internet_gateway() + # Create IGW and attach to VPC + igw = ec2.create_internet_gateway() + vpc.attach_internet_gateway(InternetGatewayId=igw.id) + # Set IGW as default route for public subnet + route_table = ec2.create_route_table(VpcId=vpc.id) + route_table.associate_with_subnet(SubnetId=subnet.id) ec2_client.create_route( - DestinationCidrBlock="0.0.0.0", - RouteTableId=route_table_public["RouteTable"]["RouteTableId"], - GatewayId=igw["InternetGateway"]["InternetGatewayId"], - ) - ec2_client.associate_route_table( - RouteTableId=route_table_public["RouteTable"]["RouteTableId"], - SubnetId=subnet_public["Subnet"]["SubnetId"], + RouteTableId=route_table.id, + DestinationCidrBlock="0.0.0.0/0", + GatewayId=igw.id, ) from prowler.providers.aws.services.vpc.vpc_service import VPC @@ -123,14 +116,14 @@ class Test_vpc_subnet_separate_private_public: found = False for result in results: - if result.resource_id == vpc["Vpc"]["VpcId"]: + if result.resource_id == vpc.id: found = True assert result.status == "FAIL" assert ( result.status_extended - == f"VPC {vpc['Vpc']['VpcId']} has only public subnets." + == f"VPC {vpc.id} has only public subnets." ) - assert result.resource_id == vpc["Vpc"]["VpcId"] + assert result.resource_id == vpc.id assert result.resource_tags == [] assert result.region == AWS_REGION_US_EAST_1 if not found: @@ -139,17 +132,16 @@ class Test_vpc_subnet_separate_private_public: @mock_aws def test_vpc_subnet_private_and_public(self): ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1) - vpc = ec2_client.create_vpc( - CidrBlock="172.28.7.0/24", InstanceTenancy="default" - ) + ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1) + vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16") # VPC Private subnet_private = ec2_client.create_subnet( - VpcId=vpc["Vpc"]["VpcId"], - CidrBlock="172.28.7.192/26", + VpcId=vpc.id, + CidrBlock="10.0.0.0/17", AvailabilityZone=f"{AWS_REGION_US_EAST_1}a", ) route_table_private = ec2_client.create_route_table( - VpcId=vpc["Vpc"]["VpcId"], + VpcId=vpc.id, ) ec2_client.create_route( DestinationCidrBlock="10.10.10.0", @@ -160,23 +152,17 @@ class Test_vpc_subnet_separate_private_public: SubnetId=subnet_private["Subnet"]["SubnetId"], ) # VPC Public - subnet_public = ec2_client.create_subnet( - VpcId=vpc["Vpc"]["VpcId"], - CidrBlock="172.28.7.0/26", - AvailabilityZone=f"{AWS_REGION_US_EAST_1}a", - ) - route_table_public = ec2_client.create_route_table( - VpcId=vpc["Vpc"]["VpcId"], - ) - igw = ec2_client.create_internet_gateway() + subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.128.0/17") + # Create IGW and attach to VPC + igw = ec2.create_internet_gateway() + vpc.attach_internet_gateway(InternetGatewayId=igw.id) + # Set IGW as default route for public subnet + route_table = ec2.create_route_table(VpcId=vpc.id) + route_table.associate_with_subnet(SubnetId=subnet.id) ec2_client.create_route( - DestinationCidrBlock="0.0.0.0", - RouteTableId=route_table_public["RouteTable"]["RouteTableId"], - GatewayId=igw["InternetGateway"]["InternetGatewayId"], - ) - ec2_client.associate_route_table( - RouteTableId=route_table_public["RouteTable"]["RouteTableId"], - SubnetId=subnet_public["Subnet"]["SubnetId"], + RouteTableId=route_table.id, + DestinationCidrBlock="0.0.0.0/0", + GatewayId=igw.id, ) from prowler.providers.aws.services.vpc.vpc_service import VPC @@ -200,14 +186,14 @@ class Test_vpc_subnet_separate_private_public: found = False for result in results: - if result.resource_id == vpc["Vpc"]["VpcId"]: + if result.resource_id == vpc.id: found = True assert result.status == "PASS" assert ( result.status_extended - == f"VPC {vpc['Vpc']['VpcId']} has private and public subnets." + == f"VPC {vpc.id} has private and public subnets." ) - assert result.resource_id == vpc["Vpc"]["VpcId"] + assert result.resource_id == vpc.id assert result.resource_tags == [] assert result.region == AWS_REGION_US_EAST_1 if not found: diff --git a/tests/providers/aws/services/workspaces/workspaces_vpc_2private_1public_subnets_nat/workspaces_vpc_2private_1public_subnets_nat_test.py b/tests/providers/aws/services/workspaces/workspaces_vpc_2private_1public_subnets_nat/workspaces_vpc_2private_1public_subnets_nat_test.py index 5e49989fb6..548c35dad9 100644 --- a/tests/providers/aws/services/workspaces/workspaces_vpc_2private_1public_subnets_nat/workspaces_vpc_2private_1public_subnets_nat_test.py +++ b/tests/providers/aws/services/workspaces/workspaces_vpc_2private_1public_subnets_nat/workspaces_vpc_2private_1public_subnets_nat_test.py @@ -1,7 +1,7 @@ from unittest import mock from uuid import uuid4 -from boto3 import client +from boto3 import client, resource from moto import mock_aws from prowler.providers.aws.services.vpc.vpc_service import VPC @@ -343,17 +343,16 @@ class Test_workspaces_vpc_2private_1public_subnets_nat: def test_workspaces_vpc_two_private_subnet_one_public_and_nat(self): # EC2 Client ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1) - vpc = ec2_client.create_vpc( - CidrBlock="172.28.7.0/24", InstanceTenancy="default" - ) + ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1) + vpc = ec2.create_vpc(CidrBlock="172.28.7.0/24", InstanceTenancy="default") # VPC Private subnet_private = ec2_client.create_subnet( - VpcId=vpc["Vpc"]["VpcId"], + VpcId=vpc.id, CidrBlock="172.28.7.0/26", AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a", ) route_table_private = ec2_client.create_route_table( - VpcId=vpc["Vpc"]["VpcId"], + VpcId=vpc.id, ) ec2_client.create_route( DestinationCidrBlock="10.10.10.0", @@ -365,12 +364,12 @@ class Test_workspaces_vpc_2private_1public_subnets_nat: ) # VPC Private 2 subnet_private_2 = ec2_client.create_subnet( - VpcId=vpc["Vpc"]["VpcId"], + VpcId=vpc.id, CidrBlock="172.28.7.64/26", AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a", ) route_table_private_2 = ec2_client.create_route_table( - VpcId=vpc["Vpc"]["VpcId"], + VpcId=vpc.id, ) ec2_client.create_route( DestinationCidrBlock="10.10.10.0", @@ -389,23 +388,17 @@ class Test_workspaces_vpc_2private_1public_subnets_nat: RouteTableId=route_table_private_2["RouteTable"]["RouteTableId"], ) # VPC Public - subnet_public = ec2_client.create_subnet( - VpcId=vpc["Vpc"]["VpcId"], - CidrBlock="172.28.7.192/26", - AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a", - ) - route_table_public = ec2_client.create_route_table( - VpcId=vpc["Vpc"]["VpcId"], - ) - igw = ec2_client.create_internet_gateway() + subnet_public = ec2.create_subnet(VpcId=vpc.id, CidrBlock="172.28.7.128/25") + # Create IGW and attach to VPC + igw = ec2.create_internet_gateway() + vpc.attach_internet_gateway(InternetGatewayId=igw.id) + # Set IGW as default route for public subnet + route_table = ec2.create_route_table(VpcId=vpc.id) + route_table.associate_with_subnet(SubnetId=subnet_public.id) ec2_client.create_route( - DestinationCidrBlock="0.0.0.0", - RouteTableId=route_table_public["RouteTable"]["RouteTableId"], - GatewayId=igw["InternetGateway"]["InternetGatewayId"], - ) - ec2_client.associate_route_table( - RouteTableId=route_table_public["RouteTable"]["RouteTableId"], - SubnetId=subnet_public["Subnet"]["SubnetId"], + RouteTableId=route_table.id, + DestinationCidrBlock="0.0.0.0/0", + GatewayId=igw.id, ) # Workspace Mock workspaces_client = mock.MagicMock