Daniel Barranquero
be72a97a88
Merge remote-tracking branch 'origin/master' into feature/issue-3463-s3-objects-public
...
# Conflicts:
# prowler/config/config.yaml
2026-07-01 16:23:34 +02:00
Chirag Trivedi and Daniel Barranquero
3f8c1e822f
feat(apigateway): add check for secrets in REST API stage variables ( #11188 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-01 14:24:18 +02:00
Sergio Garcia
1e1c1c018b
feat(iam): add AWS Bedrock AgentCore privilege escalation paths ( #11726 )
2026-07-01 12:49:34 +02:00
Hugo Pereira Brito and Daniel Barranquero
fd38a0ac03
feat(awslambda): add secrets_ignore_files to skip false-positive files (e.g. *.deps.json) in no-secrets-in-code check ( #11222 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-07-01 09:03:25 +01:00
Hugo Pereira Brito
c46cbaaa4a
feat(sdk): limit selected high-volume AWS resource analysis ( #11228 )
2026-06-30 15:49:12 +01:00
Daniel Barranquero
5dac8a0a53
feat(sdk): replace detect-secrets library with kingfisher ( #11694 )
2026-06-30 15:36:23 +02:00
Siddhant Jadhav and Lydia Vilchez
086805df1d
feat(waf): add check for regional web ACL logging enabled ( #11539 )
...
Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com >
2026-06-26 12:31:44 +02:00
Siddhant Jadhav and Daniel Barranquero
9b8b77cec0
feat(stepfunctions): add check for state machine encryption at rest ( #11538 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-06-25 17:14:50 +02:00
Pedro Martín and Hugo P.Brito
04e6e330a7
feat(aws): add rolesanywhere service and pqc trust anchor check ( #11319 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 18:39:16 +01:00
Pedro Martín and Hugo P.Brito
bdd44a0dce
feat(aws): add acmpca service and pqc key algorithm check ( #11318 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 17:13:17 +01:00
Pedro Martín and Hugo P.Brito
10d9fc35e6
feat(aws): add cloudfront_distributions_pqc_tls_enabled check ( #11317 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 16:44:51 +01:00
Pedro Martín and Hugo P.Brito
ca48fd0719
feat(aws): add apigateway_domain_name_pqc_tls_enabled check ( #11316 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 16:12:01 +01:00
Pedro Martín and Hugo P.Brito
45cfe4e411
feat(aws): add transfer_server_pqc_ssh_kex_enabled check ( #11315 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-22 14:30:15 +01:00
Pepe Fagoaga
810d8d7686
chore(codepipeline): verify if repo is public with TLS ( #11603 )
2026-06-16 09:35:11 +02:00
Branch Vincent and Pepe Fagoaga
dccd674cf9
chore(sdk): support Python 3.13 ( #9293 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-06-15 10:59:51 +02:00
Oleksandr_Sanin and Daniel Barranquero
bba594a1db
feat(aws/sagemaker): add sagemaker_clarify_exists check ( #11211 )
...
Signed-off-by: Oleksandr Sanin <alexaaander.sanin@gmail.com >
Signed-off-by: Oleksandr Yizchak Sanin <alexaaander.sanin@gmail.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-06-11 17:40:41 +02:00
Zeus Almightee and Lydia Vilchez
ce27053c2d
feat(aws): add securityhub + config org-wide delegated admin checks ( #11259 )
...
Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com >
2026-06-11 16:53:28 +02:00
Daniel Barranquero
989c3b174e
fix(bedrock): per-finding severity for long-term API key check ( #11526 )
2026-06-11 08:31:08 +02:00
e085e14247
fix(aws): order-independent CloudWatch metric filter pattern checks ( #11345 )
...
Co-authored-by: Sahil Pugalia <sahil-sols@users.noreply.github.com >
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com >
2026-06-10 18:49:06 +02:00
Aryan Bhaskar and Daniel Barranquero
ec0bb53839
feat(bedrock): add bedrock_agent_role_least_privilege check ( #11335 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-06-10 12:40:54 +02:00
potato-20 and Hugo P.Brito
6f172a5c19
feat(elbv2): add elbv2_alb_drop_invalid_header_fields_enabled check (FSBP ELB.4) ( #11471 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-05 14:26:07 +02:00
d573af911d
feat(aws): add sagemaker_models_monitor_enabled check ( #11278 )
...
Co-authored-by: RishiWig3 <rishi.wig@gmail.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-06-02 16:10:13 +01:00
534dedb608
feat(sagemaker): add sagemaker_models_registry_in_use check ( #11196 )
...
Co-authored-by: cascioli <simdon2015?gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-20 13:59:18 +02:00
cff1704d7b
feat(ses): add check for DKIM signing enabled on SES identities ( #10923 )
...
Co-authored-by: Mohamed Solaiman <mohamedsolaiman@users.noreply.github.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com >
2026-05-20 13:33:03 +02:00
Hugo Pereira Brito
40c1761840
fix(s3): only emit shadow-resource finding when bucket name matches a predictable pattern ( #11220 )
2026-05-19 15:46:05 +01:00
June and Daniel Barranquero
1f39b01fb2
feat(sagemaker): add sagemaker_domain_sso_configured check ( #11094 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-14 11:42:30 +02:00
Hugo Pereira Brito
739be07077
chore(aws): skip unattached IAM policies unless --scan-unused-services ( #11150 )
2026-05-14 08:10:20 +01:00
Daniel Barranquero
759f7b84d6
feat(aws): add cloudtrail_bedrock_logging_enabled security check ( #10858 )
2026-05-11 17:11:49 +02:00
Hugo Pereira Brito and Hugo P.Brito
0b26c1a39c
feat(aws): add iam_user_access_not_stale_to_sagemaker security check ( #11000 )
...
Co-authored-by: Hugo P.Brito <hugopbrito@Mac.home >
2026-05-11 16:34:18 +02:00
Daniel Barranquero
73c0305dc4
feat(aws): add bedrock_prompt_encrypted_with_cmk security check ( #10905 )
2026-05-11 10:32:44 +02:00
Pepe Fagoaga
21d7d08b4b
fix(timeline): Return a compact actor name from CloudTrail events ( #10986 )
2026-05-04 19:39:17 +02:00
Daniel Barranquero
921f49a0de
feat(aws): add bedrock_prompt_management_exists security check ( #10878 )
2026-05-04 12:38:15 +02:00
Danny Lyubenov and Daniel Barranquero
c802dc8a36
feat(codebuild): use batched API calls to prevent throttling and false positives ( #10639 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-04-30 17:19:21 +02:00
Pepe Fagoaga
36b8aa1b79
fix(boto3): pass config to clients ( #10944 )
2026-04-30 14:11:29 +02:00
Josema Camacho
9297453b8a
fix(sdk): add autouse mock_aws fixture and leak detector to prevent AWS test leaks ( #10605 )
2026-04-29 17:49:40 +02:00
Hugo Pereira Brito
380b89cfb6
fix(sdk): cover CNAME → dangling S3 in route53 takeover check ( #10920 )
2026-04-29 11:14:33 +01:00
Daniel Barranquero
8b368e1343
feat(aws): add bedrock_guardrails_configured security check ( #10844 )
2026-04-28 14:16:19 +02:00
Pepe Fagoaga
7df2703db1
fix(aws): get organization's metadata with assumed role ( #10894 )
2026-04-27 22:15:11 +01:00
Kay Agahd
67234210ba
feat(aws): add check secretsmanager_has_restrictive_resource_policy ( #6985 )
2026-04-27 21:49:34 +01:00
Synchx00
a812249c4c
fix(s3): address review feedback on s3_bucket_object_public
...
Make the check opt-in via three audit_config keys (disabled by default),
lower severity to low, and clarify that this is a spot-check sample.
- prowler/config/config.yaml: add s3_bucket_object_public_enabled
(False), _max_objects (100), _sample_size (3) with guidance pointing
to s3_bucket_acl_prohibited for comprehensive coverage.
- Check early-returns when disabled; otherwise reads max_objects and
sample_size from audit_config. Uses Check_Report_AWS. Compares the
AllUsers group URI exactly instead of substring-matching. PASS
message discloses the sample size and recommends disabling ACLs via
Object Ownership for full assurance.
- metadata.json: Severity -> low; Description, Notes and Recommendation
disclose the sampling limitation and cross-reference
s3_bucket_acl_prohibited; RelatedTo links the two checks.
- Unit tests cover: disabled-by-default (no findings), empty bucket
PASS, private-objects PASS, public-object FAIL, AccessDenied MANUAL,
other ClientError MANUAL.
2026-04-22 15:51:22 +07:00
Pepe Fagoaga
f2c5d2ec87
fix(aws): fallback lookup events to resource name ( #10828 )
2026-04-21 18:31:50 +02:00
Daniel Barranquero
43913b1592
feat(aws): support excluding regions from scans via CLI, env var, and config ( #10688 )
2026-04-15 17:59:46 +02:00
Daniel Barranquero
0f4d8ff891
feat(aws): add bedrock_vpc_endpoints_configured security check ( #10591 )
2026-04-14 12:22:22 +02:00
Daniel Barranquero and Hugo P.Brito
d1ab8b8ae5
feat(aws): add iam_policy_no_wildcard_marketplace_subscribe and iam_inline_policy_no_wildcard_marketplace_subscribe checks ( #10525 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-04-14 12:08:40 +02:00
Daniel Barranquero
65e9593b41
feat(aws): add bedrock_access_not_stale security check ( #10536 )
2026-04-14 11:20:40 +02:00
Daniel Barranquero
131112398b
feat(aws): add bedrock_full_access_policy_attached security check ( #10577 )
2026-04-14 11:00:40 +02:00
Avula Jeevan Yadav and Andoni A.
b898f257f1
feat(stepfunctions): add check for secrets in state machine definition ( #10570 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-04-09 15:56:29 +02:00
Kay Agahd and Claude Opus 4.6
89fe867944
fix(aws): recognize service-specific condition keys as restrictive in is_policy_public ( #10600 )
...
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-08 10:55:55 +02:00
Pepe Fagoaga and Andoni Alonso
2be2753c55
fix(codeartifact): only retrieve the latest version from a package ( #10243 )
...
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2026-04-08 09:21:19 +02:00
Josema Camacho
283259f34c
fix(sdk): resolve empty-set bug in _enabled_regions causing 36-region client creation and CI timeouts ( #10598 )
2026-04-08 08:40:58 +02:00
Daniel Barranquero