StylusFrost
e1ade761b5
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-31 19:30:23 +02:00
a2824f7166
feat(stackit): add new provider with 4 checks ( #9237 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-05-28 13:16:38 +02:00
StylusFrost
ca72922dca
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-27 17:12:54 +02:00
Daniel Barranquero
2678c6bc9f
feat(okta): add application service with 6 new checks ( #11358 )
2026-05-27 11:16:18 +02:00
Daniel Barranquero
4dd5baadf6
feat(okta): add provider to the SDK with 1 security check ( #11079 )
2026-05-13 15:57:57 +02:00
Hugo Pereira Brito and Hugo P.Brito
0b26c1a39c
feat(aws): add iam_user_access_not_stale_to_sagemaker security check ( #11000 )
...
Co-authored-by: Hugo P.Brito <hugopbrito@Mac.home >
2026-05-11 16:34:18 +02:00
StylusFrost
e5b9fee942
fix(sdk): dedupe entry-point compliance frameworks against built-ins
...
The entry-point loop in get_available_compliance_frameworks appended
framework names without checking whether the same name was already
provided by a built-in. The loader (Compliance.get_bulk) already
respects "built-in wins" via an explicit guard, but the listing
function did not, causing --list-compliance and
--list-compliance-requirements to print the same name twice on
collision with a built-in.
Adds the same dedup guard already used by the universal frameworks
loop a few lines above, restoring symmetry across the three
compliance discovery layers.
Includes a regression test that registers a fake entry point with
a name colliding with a known built-in (cis_2.0_aws) and asserts
the framework appears exactly once in the resulting list.
2026-05-07 09:32:48 +02:00
StylusFrost
92d7ea2170
Merge remote-tracking branch 'origin/master' into PROWLER-1391-provider-contract-dynamic-discovery
...
# Conflicts:
# prowler/config/config.py
2026-05-03 19:41:25 +02:00
Pedro Martín
578186aa40
feat(sdk): integrate universal compliance into CLI pipeline ( #10301 )
2026-04-30 13:49:00 +02:00
StylusFrost
a31fe9b618
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
...
Conflict in prowler/config/config.py resolved by combining both branches:
- HEAD: external compliance discovery via entry points (PROWLER-1391)
- master: multi-provider framework JSONs scanned at top-level compliance/ (#10300 )
Order: built-in per-provider -> built-in multi-provider -> external entry points.
Built-ins first so they win on name collisions against external registrations.
Supporting external plug-ins to register multi-provider frameworks is tracked
in PROWLER-1444.
2026-04-24 20:54:22 +02:00
StylusFrost
e8487d0686
fix(sdk): unwrap namespaced config for all built-in and external providers
...
load_and_validate_config_file only detected the namespaced format for 5
hardcoded providers (aws, gcp, azure, kubernetes, m365). For every other
built-in (github, nhn, vercel, cloudflare, iac, llm, image, mongodbatlas,
oraclecloud, openstack, alibabacloud, googleworkspace) and for any
external plug-in, the full YAML was returned wrapped instead of the
provider's own block.
Replace the hardcoded list with a dynamic check: if the file has a
top-level key matching the provider and its value is a dict, unwrap it.
Keep the legacy flat format for AWS only (historical, pre-multicloud)
and identify it by the absence of nested-dict top-level values, which
prevents cross-provider config leakage when a namespaced file has no
section for the requested provider.
2026-04-24 18:01:47 +02:00
Pedro Martín and Alan Buscaglia
d4ece2b43e
feat(sdk): add multi-provider compliance framework JSONs ( #10300 )
...
Co-authored-by: Alan Buscaglia <gentlemanprogramming@gmail.com >
2026-04-24 13:27:31 +02:00
Eran Cohen and Daniel Barranquero
0b461233c1
feat(iam): Add trusted IP configurable option to reduce false positives in 'opensearch' check ( #8631 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-03-10 12:12:54 +01:00
mohd4adil and Daniel Barranquero
e97e31c7ca
chore(aws): add support for trusted aws accounts in cross account checks for s3, eventbridge bus, eventbridge schema and dynamodb ( #9692 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-01-29 09:13:34 +01:00
lydiavilchez and Daniel Barranquero
43875b6ae7
feat(gcp): add check to ensure Managed Instance Groups span multiple zones ( #9566 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-12-22 15:12:08 +01:00
Rubén De la Torre Vico and Sergio Garcia
d9a9236ab7
feat(azure/vm): add new check vm_desired_sku_size ( #8191 )
...
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
2025-07-25 17:51:01 +08:00
Rubén De la Torre Vico
1211fe706e
feat(azure/defender): add new check defender_attack_path_notifications_properly_configured ( #8245 )
2025-07-17 12:40:26 +02:00
Daniel Barranquero
e2fd3fe36e
feat(defender): add new check defender_malware_policy_comprehensive_attachments_filter_applied ( #7661 )
2025-05-06 10:29:36 +02:00
Daniel Barranquero and MrCloudSec
6b0d73d7f9
feat(exchange): make exchange_user_mailbox_auditing_enabled check configurable ( #7662 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-05-05 15:16:41 -04:00
Daniel Barranquero and Andoni A.
25b1efe532
feat(exchange): add new check exchange_organization_mailtips_enabled ( #7637 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2025-05-02 08:46:14 +02:00
Felix Dreissig
0b6aa0ddcd
fix(aws): remove SHA-1 from ACM insecure key algorithms ( #7547 )
2025-04-18 16:25:44 -04:00
Hugo Pereira Brito and MrCloudSec
52bd48168f
feat: adapt Microsoft365 provider to use PowerShell ( #7331 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-04-15 13:24:09 -04:00
Bogdan A and MrCloudSec
42f46b0fb1
feat(gcp): add check for unused Service Accounts ( #7419 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-04-14 11:53:54 -04:00
Hugo Pereira Brito
e617ff0460
feat(docs): add microsoft365 configurable checks ( #7200 )
2025-03-12 12:52:35 +01:00
Daniel Barranquero
ba7cd0250a
fix(elasticache): improve logic in elasticache_redis_cluster_backup_enabled ( #7042 )
2025-02-26 10:31:14 +01:00
Pedro Martín
8f3229928e
chore(config): set default values for empty config fields ( #6225 )
2024-12-18 09:48:32 -05:00
johannes-engler-mw and Rubén De la Torre Vico
eded97d735
feat(azure): check for minimal TLS version for Azure SQL server ( #5745 )
...
Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com >
2024-12-11 16:37:53 +01:00
Mario Rodriguez Lopez
9c383baff3
fix(ec2): Change ec2_sg_high_risk_ports configurable parameter name ( #5904 )
2024-11-26 08:24:45 -04:00
Pepe Fagoaga
cb74dae296
refactor(aws): Rename get_regions and validate partition ( #5772 )
2024-11-14 13:02:32 +01:00
Pedro Martín
a419b4b898
feat(aws): get regions by partition ( #5748 )
2024-11-13 18:52:50 +01:00
Sergio Garcia
f1334190d8
fix(aws): remove cloudwatch_log_group_no_critical_pii_in_logs check ( #5736 )
2024-11-12 12:50:47 -05:00
Rubén De la Torre Vico and Sergio
1b50fdba28
feat(secretsmanager): add new check secretsmanager_secret_rotated_periodically ( #5450 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-11-04 16:08:38 -05:00
Sergio Garcia
e3104ae5ee
feat(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs ( #5494 )
2024-11-04 10:20:35 -05:00
Rubén De la Torre Vico
a17cf1bbb6
feat(secretsmanager): add new check secretsmanager_secret_unused ( #5428 )
2024-10-17 10:24:12 -04:00
Sergio Garcia
3c929bd68f
feat(aws): add checks for Bedrock logging configuration and CloudTrail LLM Jacking detection ( #5314 )
2024-10-11 15:01:45 -04:00
Sergio Garcia and Pepe Fagoaga
b703357027
chore(secrets): use master branch of Yelp/detect-secrets ( #5298 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2024-10-08 09:55:46 -04:00
Mario Rodriguez Lopez and Sergio
2ffe7f3ef7
feat(ecs): add new check ecs_service_fargate_latest_platform_version ( #5258 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-10-02 16:50:20 -04:00
Jude Bae(Bae cheongho) and MZC01-JUDE
de5742433b
feat(compliance): add KISA ISMS-P compliance framework ( #5086 )
...
Co-authored-by: MZC01-JUDE <mzc01-jude@MZC01-JUDE-2.local >
2024-09-25 09:06:05 +02:00
Sergio Garcia and pedrooot
9456c6198a
chore(ssm): add trusted accounts variable to ssm check ( #5005 )
...
Co-authored-by: pedrooot <pedromarting3@gmail.com >
2024-09-20 09:12:48 -04:00
Rubén De la Torre Vico and Sergio
320a2a2c77
feat(awslambda): add new check awslambda_function_vpc_multi_az ( #4816 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-09-19 09:30:04 -04:00
Pedro Martín
3933440a08
feat(secrets): improve detect secrets checks and add config ( #4915 )
2024-09-04 16:54:55 +02:00
bcb63d0b2d
feat(elb): add new check elb_is_in_multiple_az ( #4829 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2024-08-26 13:27:08 +02:00
Rubén De la Torre Vico and Sergio Garcia
0b238243b1
feat(elbv2): add new check elbv2_is_in_multiple_az ( #4800 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-22 11:08:49 -04:00
5f075b296d
chore(regions_update): Changes in regions for AWS services. ( #4826 )
...
Co-authored-by: sergargar <38561120+sergargar@users.noreply.github.com >
Co-authored-by: Pedro Martín <pedromarting3@gmail.com >
2024-08-22 13:21:45 +02:00
Sergio Garcia
3f56731e6d
fix(version): update version flag logic ( #4688 )
2024-08-16 11:48:57 -04:00
Mario Rodriguez Lopez
49ff901195
feat(EC2): Add new check for security group port restrictions ( #4594 )
2024-08-16 09:43:00 -04:00
Daniel Barranquero and Sergio
62a1d91869
feat(aws): Add new CodeBuild check to validate environment variables ( #4632 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-08-13 08:15:45 -04:00
Mario Rodriguez Lopez and Sergio Garcia
1b18aef0f0
feat(acm): Add new check for insecure algorithms in certificates ( #4551 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-07 08:00:24 -04:00
Amogh Bantwal and Sergio Garcia
086c203e6b
feat(aws) Add check to make sure EKS clusters have a supported version ( #4604 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-06 13:40:05 -04:00
Kay Agahd
02fc034b1f
feat(aws): make check eks_control_plane_logging_all_types_enabled configurable ( #4553 )
2024-07-26 10:24:01 -04:00
StylusFrost