Synchx00
a812249c4c
fix(s3): address review feedback on s3_bucket_object_public
...
Make the check opt-in via three audit_config keys (disabled by default),
lower severity to low, and clarify that this is a spot-check sample.
- prowler/config/config.yaml: add s3_bucket_object_public_enabled
(False), _max_objects (100), _sample_size (3) with guidance pointing
to s3_bucket_acl_prohibited for comprehensive coverage.
- Check early-returns when disabled; otherwise reads max_objects and
sample_size from audit_config. Uses Check_Report_AWS. Compares the
AllUsers group URI exactly instead of substring-matching. PASS
message discloses the sample size and recommends disabling ACLs via
Object Ownership for full assurance.
- metadata.json: Severity -> low; Description, Notes and Recommendation
disclose the sampling limitation and cross-reference
s3_bucket_acl_prohibited; RelatedTo links the two checks.
- Unit tests cover: disabled-by-default (no findings), empty bucket
PASS, private-objects PASS, public-object FAIL, AccessDenied MANUAL,
other ClientError MANUAL.
2026-04-22 15:51:22 +07:00
lydiavilchez
bfce602859
fix(gcp-cloudstorage): handle VPC-blocked API calls as PASS ( #9478 )
2025-12-10 10:40:52 +01:00
dbdce98cf2
feat(alibaba): add Alibaba Cloud provider ( #9329 )
...
Co-authored-by: pedrooot <pedromarting3@gmail.com >
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2025-12-03 11:47:55 -05:00
lydiavilchez
3dadb264cc
feat(gcp): add check for VM instance deletion protection ( #9358 )
2025-12-01 13:20:32 +01:00
lydiavilchez and HugoPBrito
b2abdbeb60
feat(gcp-compute): add check to ensure VMs are not preemptible or spot ( #9342 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2025-11-28 12:49:19 +01:00
lydiavilchez
dc852b4595
feat(gcp-compute): add automatic restart check for VM instances ( #9271 )
2025-11-28 12:21:58 +01:00
Hugo Pereira Brito
1250f582a5
fix(check): custom check folder validation ( #9335 )
2025-11-28 12:19:47 +01:00
mattkeeler and HugoPBrito
dc9e91ac4e
fix(m365): Support multiple Exchange mailbox policies ( #9241 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2025-11-27 14:10:15 +01:00
Shafkat Rahman and Andoni Alonso
59f8dfe5ae
feat(github): add immutable releases check ( #9162 )
...
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2025-11-27 13:40:15 +01:00
lydiavilchez and Daniel Barranquero
9d7b9c3327
feat(gcp): Add VPC Service Controls check for Cloud Storage ( #9256 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-11-26 14:45:27 +01:00
Hugo Pereira Brito
880345bebe
fix(sharepoint): false positives on disabled external sharing ( #9298 )
2025-11-26 12:23:04 +01:00
Andoni Alonso
2198e461c9
feat(iac): use branch as region for IaC findings ( #9295 )
2025-11-24 17:00:06 +01:00
lydiavilchez and Daniel Barranquero
0ba1226d88
feat(gcp): implement Cloud Storage Data Access Audit Logs check ( #9220 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-11-18 12:08:54 +01:00
Marc Espin and Andoni A.
4167de39d2
fix(docs): Fix dead links leading to docs.prowler.cloud ( #9240 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2025-11-17 09:56:51 +01:00
531ba5c31b
feat(azure): new check for Entra ID authentication for Azure PostgreSQL Flexible Server ( #8764 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2025-11-14 13:54:57 +01:00
Hugo Pereira Brito
866edfb167
chore(outputs): raise an error when using -M asff for a provider other than aws ( #9225 )
2025-11-13 16:53:22 +01:00
Daniel Barranquero
d1380fc19d
fix(azure): validation and other errors in cosmosdb, defender, storage and vm ( #8915 )
2025-11-13 09:17:44 -05:00
Lee Trout
c5c7b84afd
chore(ec2): prevent test from calling live AWS endpoint ( #9228 )
2025-11-13 10:12:19 +01:00
Daniel Barranquero
98f8ef1b4b
feat(mongodbatlas): add provider_id verification ( #9211 )
2025-11-12 13:50:00 +01:00
e246c0cfd7
fix(aws): false negative in iam_role_cross_service_confused_deputy_prevention ( #9213 )
...
Co-authored-by: shaun <shaun@snotra.cloud >
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-11-11 17:39:16 -05:00
lydiavilchez
b0ec7daece
feat(gcp): add check cloudstorage_bucket_sufficient_retention_period ( #9149 )
2025-11-11 15:51:57 +01:00
Hugo Pereira Brito
1292abcf91
fix(m365_powershell): restore MSAL.PS ( #9210 )
2025-11-11 15:35:45 +01:00
Hugo Pereira Brito
73a277f27b
chore(m365_powershell): remove unnecessary test_credentials ( #9204 )
2025-11-11 10:16:57 +01:00
Hugo Pereira Brito
ef4e28da03
fix(m365_powershell): teams connection with --sp-env-auth and enhanced timeouts error logging ( #9191 )
2025-11-10 11:23:56 +01:00
Hugo Pereira Brito
fb9eda208e
fix(powershell): depth truncation and parsing error ( #9181 )
2025-11-07 13:19:37 +01:00
0ad5bbf350
feat(github): Add GitHub check ensuring repository creation is limited ( #8844 )
...
Signed-off-by: Mauricio Harley <mauricioharley@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2025-11-06 16:13:10 +01:00
Pedro Martín
edfef51e7a
feat(compliance): add naming and visual improvements ( #9145 )
2025-11-06 13:06:59 +01:00
Sergio Garcia and Andoni Alonso
e038b2fd11
chore(sdk): add validation for invalid checks, services, and categories ( #8971 )
...
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2025-11-06 11:46:21 +01:00
Andoni Alonso and alejandrobailo
b25ed9fd27
feat(github): add external resource link ( #9153 )
...
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com >
2025-11-05 15:57:41 +01:00
Sergio Garcia
f16f94acf3
chore(oci): rename OCI provider to oraclecloud with oci alias ( #9126 )
2025-11-04 11:44:56 -05:00
Andoni Alonso
601495166c
feat(iac): add IaC to Prowler App ( #8751 )
2025-11-04 10:01:58 +01:00
Hugo Pereira Brito
61a66f2bbf
fix(aws): firehose_stream_encrypted_at_rest description and logic ( #9142 )
2025-11-03 11:31:18 -05:00
lydiavilchez and Daniel Barranquero
4a364d91be
feat(gcp): add cloudstorage_bucket_logging_enabled check ( #9091 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-10-31 13:01:55 +01:00
Hugo Pereira Brito and César Arroba
885ee62062
fix(m365): admincenter service unnecessary msgraph calls and repeated resource_id ( #9019 )
...
Co-authored-by: César Arroba <cesar@prowler.com >
2025-10-29 14:50:25 +01:00
lydiavilchez and Daniel Barranquero
aaa5abdead
feat(gcp): add cloudstorage_bucket_soft_delete_enabled check ( #9028 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-10-29 12:02:46 +01:00
Daniel Barranquero
63169289b0
fix(ec2): AttributeError in ec2_instance_with_outdated_ami check ( #9046 )
2025-10-28 09:13:44 -04:00
lydiavilchez and Daniel Barranquero
43d310356d
feat(gcp): add cloudstorage_bucket_versioning_enabled check ( #9014 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-10-28 13:20:59 +01:00
SeongYong Choi and MrCloudSec
efba5d2a8d
feat(codepipeline): add new check codepipeline_project_repo_private ( #5915 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-10-27 18:55:36 -04:00
Pedro Martín
e694b0f634
fix(gcp): set unknown for resource name under metric resources ( #9023 )
2025-10-27 14:19:15 +01:00
ff4a186df6
feat(github): add organization base repository permission strict check (CIS GitHub 1.3.8) ( #8785 )
...
Co-authored-by: akorshak-afg <alex.korshak@afg.org >
Co-authored-by: Sergio Garcia <sergargar1@gmail.com >
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2025-10-27 09:45:50 +01:00
Daniel Barranquero
3d1e7015a6
fix(entra): value errors due tu enums ( #8919 )
2025-10-23 11:36:51 +02:00
lydiavilchez and Daniel Barranquero
f8c8dee2b3
feat(gcp): add cloudstorage_bucket_lifecycle_management_enabled check ( #8936 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-10-22 16:45:26 +02:00
Sergio Garcia and Daniel Barranquero
c424707e32
feat(oci): Add Oracle Cloud Infrastructure provider with CIS 3.0 ( #8893 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-10-15 13:05:51 -04:00
Daniel Barranquero
272e4547b2
fix(gcp): keyerrors in services cloudsql and monitoring ( #8909 )
2025-10-14 09:30:00 -04:00
Hugo Pereira Brito
da6b7b89cb
fix(tests): jira test double lines ( #8886 )
2025-10-09 13:44:01 +02:00
Hugo Pereira Brito
cc9aa7f7ee
feat(jira): support of ADF for MarkDown metadata fields ( #8878 )
2025-10-09 12:31:31 +02:00
Hugo Pereira Brito
ecf749fce8
chore(m365): deprecate user auth ( #8865 )
2025-10-09 12:24:24 +02:00
Hugo Pereira Brito
c7d7ec9a3b
fix: add pagination for m365 and azure users retrieval ( #8858 )
2025-10-08 09:07:18 +02:00
Daniel Barranquero
502525eff1
fix(compliance): generate file extension correctly ( #8791 )
2025-10-06 10:27:16 +02:00
Daniel Barranquero
e279f7fcfd
fix: handle eks cluster version and listener certificate arn not in acm ( #8802 )
2025-10-01 13:55:26 -04:00
Synchx00