StylusFrost
5392a87a30
Merge remote-tracking branch 'origin/PROWLER-1444-multi-provider-compliance-entry-points' into PROWLER-1771-public-dynamic-provider-class-resolver
...
# Conflicts:
# prowler/CHANGELOG.md
2026-06-07 14:04:36 +02:00
StylusFrost
40da359804
feat(compliance): discover external universal frameworks via entry points
...
External plug-ins ship multi-provider (universal-schema) frameworks through a
dedicated prowler.compliance.universal entry point group, separate from the
per-provider prowler.compliance group. Both get_bulk_compliance_frameworks_universal
(loading) and get_available_compliance_frameworks (listing / --compliance
choices) scan the new group. Built-ins load first and win on a name collision;
multiple packages under the same provider are merged. load_compliance_framework
gains fatal=False so the legacy external path skips a non-legacy JSON with a
warning instead of aborting the run.
2026-06-07 13:56:59 +02:00
StylusFrost
f729c5a9f0
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-06-05 14:44:50 +02:00
potato-20 and Hugo P.Brito
6f172a5c19
feat(elbv2): add elbv2_alb_drop_invalid_header_fields_enabled check (FSBP ELB.4) ( #11471 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-05 14:26:07 +02:00
StylusFrost
29825f9a2f
fix(provider): move get_output_options default to call site
...
Resolve the provider<->models import cycle CodeQL flagged (py/cyclic-import
#7267 , #7268 ). provider.py no longer imports models: get_output_options
stays override-only and __main__ falls back to a new default_output_options
helper in models.py when a provider does not implement it. models.py keeps
its original module-level Provider import (one-way, no cycle).
2026-06-05 14:21:49 +02:00
StylusFrost
356e6e2bb4
fix(provider): default get_summary_entity instead of raising
...
External providers that do not override get_summary_entity no longer cause
the summary table to be silently dropped. The base contract returns
(self.type, account_id), mirroring the get_output_options default.
2026-06-05 14:05:56 +02:00
StylusFrost
efa3283a25
fix(provider): return generic OutputOptions default instead of raising
...
External providers that do not override get_output_options no longer abort
the run with NotImplementedError. The base contract returns a generic
ProviderOutputOptions, honoring arguments.output_filename and otherwise
falling back to a provider-typed filename. Built-ins are unaffected.
2026-06-05 13:42:29 +02:00
Aline Almeida
a5bc226f11
fix(gcp): pass iam_service_account_unused for disabled service accounts ( #11467 )
2026-06-05 12:07:30 +02:00
Oleksandr_Sanin and Hugo P.Brito
bcd282d3d0
fix(gcp): honour org-level aggregated sinks in logging_sink_created check ( #11355 )
...
Signed-off-by: Oleksandr Sanin <alexaaander.sanin@gmail.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-06-04 12:07:01 +02:00
StylusFrost
c4effd7a60
Merge remote-tracking branch 'origin/PROWLER-1391-provider-contract-dynamic-discovery' into PROWLER-1771-public-dynamic-provider-class-resolver
2026-06-03 13:07:55 +02:00
StylusFrost
38788b7922
Merge remote-tracking branch 'origin/master' into PROWLER-1391-provider-contract-dynamic-discovery
...
# Conflicts:
# prowler/CHANGELOG.md
2026-06-03 12:15:24 +02:00
d573af911d
feat(aws): add sagemaker_models_monitor_enabled check ( #11278 )
...
Co-authored-by: RishiWig3 <rishi.wig@gmail.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-06-02 16:10:13 +01:00
StylusFrost
a111ae763c
chore(sdk): tighten get_class docstring and unknown-provider test
...
- Reword get_class docstring: it may populate the _ep_providers cache,
rather than claiming "no global state"
- Assert ImportError specifically in the unknown-provider test to enforce
the public API contract
- Drop the unused provider_class_name left over after get_class delegation
2026-06-01 20:28:19 +02:00
StylusFrost
ece6af5dd3
Merge remote-tracking branch 'origin/PROWLER-1391-provider-contract-dynamic-discovery' into PROWLER-1771-public-dynamic-provider-class-resolver
...
# Conflicts:
# prowler/providers/common/provider.py
2026-06-01 20:20:50 +02:00
StylusFrost
9c7afd64c5
fix(sdk): match compliance provider segment exactly in get_bulk
...
- Compare the module's last dotted segment instead of substring
- Prevent a provider name from capturing overlapping built-ins
- Add parametrized regression test (cloud, git, work, open cases)
- Update get_bulk test mock to the real dotted module name
2026-06-01 19:51:27 +02:00
StylusFrost
64e82682bd
fix(sdk): detect shadowed provider plug-ins without loading them
...
- Match shadowing entry point by name instead of calling ep.load()
- Prevent plug-in code from executing during a built-in run
- Update regression test to assert ep.load is never called
2026-06-01 19:44:17 +02:00
StylusFrost
fe821a41ea
Merge branch 'PROWLER-1391-provider-contract-dynamic-discovery' into PROWLER-1771-public-dynamic-provider-class-resolver
...
# Conflicts:
# prowler/CHANGELOG.md
2026-05-31 20:05:35 +02:00
StylusFrost
e1ade761b5
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-31 19:30:23 +02:00
StylusFrost
073dbb74f6
feat(sdk): add Provider.get_class dynamic provider resolver
...
- Add public get_class() resolving built-in and entry-point providers
- Refactor init_global_provider to use it; collision warning stays there
- Refactor get_providers_help_text to use it
2026-05-31 18:52:03 +02:00
e3c4368d32
fix(azure): pass authority to credentials for sovereign clouds ( #10284 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-05-29 15:17:41 +02:00
a2824f7166
feat(stackit): add new provider with 4 checks ( #9237 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-05-28 13:16:38 +02:00
lydiavilchez and Daniel Barranquero
c58dad2ca4
feat(googleworkspace): add rules service checks ( #11379 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-28 11:17:33 +02:00
b4befe3a10
feat(googleworkspace): add security service checks ( #11356 )
...
Co-authored-by: pedrooot <pedromarting3@gmail.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-05-28 10:15:10 +02:00
StylusFrost
ca72922dca
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-27 17:12:54 +02:00
Daniel Barranquero
2678c6bc9f
feat(okta): add application service with 6 new checks ( #11358 )
2026-05-27 11:16:18 +02:00
Pedro Martín
723d161c63
fix(az-m365): asyncio.run() in Azure/M365 Celery worker event ( #11360 )
2026-05-26 11:26:39 +02:00
Aline Almeida and Hugo Pereira Brito
d560020592
fix(gcp): match enable-oslogin metadata case-insensitively ( #11341 )
...
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-05-26 10:35:26 +02:00
Hugo Pereira Brito and Daniel Barranquero
4c59af93eb
fix(azure): require all SMB channel encryption algorithms to be secure (storage_smb_channel_encryption_with_secure_algorithm) ( #11327 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-25 18:28:21 +02:00
Hugo Pereira Brito
6ca8e726f7
feat(azure): add storage_account_public_network_access_disabled and fix CIS storage mapping ( #11334 )
2026-05-25 18:17:41 +02:00
Kristofer Jussmann and Hugo P.Brito
6177fc6286
fix(oci): use home region for audit configuration API call ( #10347 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-05-21 16:09:29 +01:00
Sandiyo Christan and Hugo P.Brito
0fd952ae2b
chore(m365): use PowerShell best practices for quoting credential variables ( #9997 )
...
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-05-21 15:17:23 +01:00
lydiavilchez
74622dd576
feat(googleworkspace): add sites, additional_services and marketplace service checks ( #11281 )
2026-05-21 15:52:15 +02:00
Daniel Barranquero
349611d52d
feat(okta): 4 new signon service checks ( #11224 )
2026-05-21 12:48:06 +02:00
534dedb608
feat(sagemaker): add sagemaker_models_registry_in_use check ( #11196 )
...
Co-authored-by: cascioli <simdon2015?gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-20 13:59:18 +02:00
cff1704d7b
feat(ses): add check for DKIM signing enabled on SES identities ( #10923 )
...
Co-authored-by: Mohamed Solaiman <mohamedsolaiman@users.noreply.github.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com >
2026-05-20 13:33:03 +02:00
lydiavilchez
0ca444895f
feat(googleworkspace): add groups service checks ( #11186 )
2026-05-20 12:54:49 +02:00
Daniel Barranquero
6eebfcfe77
feat(api): add okta provider support ( #11184 )
2026-05-20 10:46:29 +02:00
Hugo Pereira Brito
40c1761840
fix(s3): only emit shadow-resource finding when bucket name matches a predictable pattern ( #11220 )
2026-05-19 15:46:05 +01:00
Pedro Martín
0ab0e8671d
fix(azure): skip system 'master' DB in sqlserver_tde_encrypted_with_cmk ( #11233 )
2026-05-19 16:34:33 +02:00
7a7c828fc7
feat(m365/entra): add entra_app_registration_client_secret_unused check (consolidates #11097 and #11212 ) ( #11232 )
...
Co-authored-by: shadyfox <git@twink.energy >
Co-authored-by: Oleksandr Yizchak Sanin <alexaaander.sanin@gmail.com >
2026-05-19 15:14:32 +01:00
s1ns3nz0 and Daniel Barranquero
9dc4deccb6
feat(gcp): add cloudsql_instance_cmek_encryption_enabled check ( #11023 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-19 15:52:16 +02:00
Pedro Martín
bfcbe0a9c4
feat(scaleway): add new provider ( #11166 )
2026-05-18 16:42:10 +02:00
Pedro Martín
5ca6e31f45
fix(vercel): exclude API token from serialization and repr ( #11198 )
2026-05-18 14:30:44 +02:00
lydiavilchez
9894ac7bc3
feat(googleworkspace): implement Chat service with 6 CIS checks ( #11126 )
2026-05-14 17:19:11 +02:00
lydiavilchez
bf4fd8fabd
fix(googleworkspace): use per-service resources for Directory ( #11176 )
2026-05-14 13:07:06 +02:00
lydiavilchez
5f92989492
fix(googleworkspace): use per-service resources for Calendar and Drive ( #11161 )
2026-05-14 12:43:29 +02:00
Hugo Pereira Brito
6befa78978
fix(cloudflare): plan-aware WAF FAIL hints for zones ( #9896 )
2026-05-14 12:27:47 +02:00
lydiavilchez
78af0c24fe
fix(googleworkspace): use per-service resources for Gmail ( #11169 )
2026-05-14 12:01:07 +02:00
June and Daniel Barranquero
1f39b01fb2
feat(sagemaker): add sagemaker_domain_sso_configured check ( #11094 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-14 11:42:30 +02:00
Hugo Pereira Brito
739be07077
chore(aws): skip unattached IAM policies unless --scan-unused-services ( #11150 )
2026-05-14 08:10:20 +01:00
StylusFrost