StylusFrost
e1ade761b5
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-31 19:30:23 +02:00
a2824f7166
feat(stackit): add new provider with 4 checks ( #9237 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-05-28 13:16:38 +02:00
StylusFrost
ca72922dca
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-27 17:12:54 +02:00
Hugo Pereira Brito and Hugo P.Brito
0b26c1a39c
feat(aws): add iam_user_access_not_stale_to_sagemaker security check ( #11000 )
...
Co-authored-by: Hugo P.Brito <hugopbrito@Mac.home >
2026-05-11 16:34:18 +02:00
StylusFrost
e5b9fee942
fix(sdk): dedupe entry-point compliance frameworks against built-ins
...
The entry-point loop in get_available_compliance_frameworks appended
framework names without checking whether the same name was already
provided by a built-in. The loader (Compliance.get_bulk) already
respects "built-in wins" via an explicit guard, but the listing
function did not, causing --list-compliance and
--list-compliance-requirements to print the same name twice on
collision with a built-in.
Adds the same dedup guard already used by the universal frameworks
loop a few lines above, restoring symmetry across the three
compliance discovery layers.
Includes a regression test that registers a fake entry point with
a name colliding with a known built-in (cis_2.0_aws) and asserts
the framework appears exactly once in the resulting list.
2026-05-07 09:32:48 +02:00
StylusFrost
92d7ea2170
Merge remote-tracking branch 'origin/master' into PROWLER-1391-provider-contract-dynamic-discovery
...
# Conflicts:
# prowler/config/config.py
2026-05-03 19:41:25 +02:00
Pedro Martín
578186aa40
feat(sdk): integrate universal compliance into CLI pipeline ( #10301 )
2026-04-30 13:49:00 +02:00
StylusFrost
a31fe9b618
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
...
Conflict in prowler/config/config.py resolved by combining both branches:
- HEAD: external compliance discovery via entry points (PROWLER-1391)
- master: multi-provider framework JSONs scanned at top-level compliance/ (#10300 )
Order: built-in per-provider -> built-in multi-provider -> external entry points.
Built-ins first so they win on name collisions against external registrations.
Supporting external plug-ins to register multi-provider frameworks is tracked
in PROWLER-1444.
2026-04-24 20:54:22 +02:00
StylusFrost
e8487d0686
fix(sdk): unwrap namespaced config for all built-in and external providers
...
load_and_validate_config_file only detected the namespaced format for 5
hardcoded providers (aws, gcp, azure, kubernetes, m365). For every other
built-in (github, nhn, vercel, cloudflare, iac, llm, image, mongodbatlas,
oraclecloud, openstack, alibabacloud, googleworkspace) and for any
external plug-in, the full YAML was returned wrapped instead of the
provider's own block.
Replace the hardcoded list with a dynamic check: if the file has a
top-level key matching the provider and its value is a dict, unwrap it.
Keep the legacy flat format for AWS only (historical, pre-multicloud)
and identify it by the absence of nested-dict top-level values, which
prevents cross-provider config leakage when a namespaced file has no
section for the requested provider.
2026-04-24 18:01:47 +02:00
Pedro Martín and Alan Buscaglia
d4ece2b43e
feat(sdk): add multi-provider compliance framework JSONs ( #10300 )
...
Co-authored-by: Alan Buscaglia <gentlemanprogramming@gmail.com >
2026-04-24 13:27:31 +02:00
Eran Cohen and Daniel Barranquero
0b461233c1
feat(iam): Add trusted IP configurable option to reduce false positives in 'opensearch' check ( #8631 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-03-10 12:12:54 +01:00
lydiavilchez and Daniel Barranquero
43875b6ae7
feat(gcp): add check to ensure Managed Instance Groups span multiple zones ( #9566 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-12-22 15:12:08 +01:00
Rubén De la Torre Vico and Sergio Garcia
d9a9236ab7
feat(azure/vm): add new check vm_desired_sku_size ( #8191 )
...
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
2025-07-25 17:51:01 +08:00
Rubén De la Torre Vico
1211fe706e
feat(azure/defender): add new check defender_attack_path_notifications_properly_configured ( #8245 )
2025-07-17 12:40:26 +02:00
Felix Dreissig
0b6aa0ddcd
fix(aws): remove SHA-1 from ACM insecure key algorithms ( #7547 )
2025-04-18 16:25:44 -04:00
Bogdan A and MrCloudSec
42f46b0fb1
feat(gcp): add check for unused Service Accounts ( #7419 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-04-14 11:53:54 -04:00
Daniel Barranquero
ba7cd0250a
fix(elasticache): improve logic in elasticache_redis_cluster_backup_enabled ( #7042 )
2025-02-26 10:31:14 +01:00
Pedro Martín
8f3229928e
chore(config): set default values for empty config fields ( #6225 )
2024-12-18 09:48:32 -05:00
johannes-engler-mw and Rubén De la Torre Vico
eded97d735
feat(azure): check for minimal TLS version for Azure SQL server ( #5745 )
...
Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com >
2024-12-11 16:37:53 +01:00
Mario Rodriguez Lopez
9c383baff3
fix(ec2): Change ec2_sg_high_risk_ports configurable parameter name ( #5904 )
2024-11-26 08:24:45 -04:00
Pepe Fagoaga
cb74dae296
refactor(aws): Rename get_regions and validate partition ( #5772 )
2024-11-14 13:02:32 +01:00
Pedro Martín
a419b4b898
feat(aws): get regions by partition ( #5748 )
2024-11-13 18:52:50 +01:00
Sergio Garcia
f1334190d8
fix(aws): remove cloudwatch_log_group_no_critical_pii_in_logs check ( #5736 )
2024-11-12 12:50:47 -05:00
Rubén De la Torre Vico and Sergio
1b50fdba28
feat(secretsmanager): add new check secretsmanager_secret_rotated_periodically ( #5450 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-11-04 16:08:38 -05:00
Sergio Garcia
e3104ae5ee
feat(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs ( #5494 )
2024-11-04 10:20:35 -05:00
Rubén De la Torre Vico
a17cf1bbb6
feat(secretsmanager): add new check secretsmanager_secret_unused ( #5428 )
2024-10-17 10:24:12 -04:00
Sergio Garcia
3c929bd68f
feat(aws): add checks for Bedrock logging configuration and CloudTrail LLM Jacking detection ( #5314 )
2024-10-11 15:01:45 -04:00
Mario Rodriguez Lopez and Sergio
2ffe7f3ef7
feat(ecs): add new check ecs_service_fargate_latest_platform_version ( #5258 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-10-02 16:50:20 -04:00
Jude Bae(Bae cheongho) and MZC01-JUDE
de5742433b
feat(compliance): add KISA ISMS-P compliance framework ( #5086 )
...
Co-authored-by: MZC01-JUDE <mzc01-jude@MZC01-JUDE-2.local >
2024-09-25 09:06:05 +02:00
Rubén De la Torre Vico and Sergio
320a2a2c77
feat(awslambda): add new check awslambda_function_vpc_multi_az ( #4816 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-09-19 09:30:04 -04:00
Pedro Martín
3933440a08
feat(secrets): improve detect secrets checks and add config ( #4915 )
2024-09-04 16:54:55 +02:00
bcb63d0b2d
feat(elb): add new check elb_is_in_multiple_az ( #4829 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2024-08-26 13:27:08 +02:00
Rubén De la Torre Vico and Sergio Garcia
0b238243b1
feat(elbv2): add new check elbv2_is_in_multiple_az ( #4800 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-22 11:08:49 -04:00
5f075b296d
chore(regions_update): Changes in regions for AWS services. ( #4826 )
...
Co-authored-by: sergargar <38561120+sergargar@users.noreply.github.com >
Co-authored-by: Pedro Martín <pedromarting3@gmail.com >
2024-08-22 13:21:45 +02:00
Sergio Garcia
3f56731e6d
fix(version): update version flag logic ( #4688 )
2024-08-16 11:48:57 -04:00
Mario Rodriguez Lopez
49ff901195
feat(EC2): Add new check for security group port restrictions ( #4594 )
2024-08-16 09:43:00 -04:00
Daniel Barranquero and Sergio
62a1d91869
feat(aws): Add new CodeBuild check to validate environment variables ( #4632 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-08-13 08:15:45 -04:00
Mario Rodriguez Lopez and Sergio Garcia
1b18aef0f0
feat(acm): Add new check for insecure algorithms in certificates ( #4551 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-07 08:00:24 -04:00
Amogh Bantwal and Sergio Garcia
086c203e6b
feat(aws) Add check to make sure EKS clusters have a supported version ( #4604 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-06 13:40:05 -04:00
Kay Agahd
02fc034b1f
feat(aws): make check eks_control_plane_logging_all_types_enabled configurable ( #4553 )
2024-07-26 10:24:01 -04:00
Pepe Fagoaga and Sergio Garcia
e296d6e5c1
fix: Some minor fixes in several parts ( #4237 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-06-17 16:54:54 -04:00
William Leung and Sergio
e28300a1db
fix(config/html): handle encoding issues and improve error handling in config and HTML file loading functions ( #4203 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-06-07 12:51:01 -04:00
Rubén De la Torre Vico and Sergio
1a225c334f
chore(acm): Improve near-expiration certificates check ( #4207 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-06-07 12:22:05 -04:00
Kay Agahd and Sergio
e45a189422
chore(AWS): allow ingress to any port for user defined network interface types ( #4094 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-05-31 13:37:52 -04:00
Pepe Fagoaga
6f3eca7249
chore(global_provider): Move methods to class as static ( #3896 )
2024-05-20 11:29:05 +02:00
ur and Pepe Fagoaga
73b7d76219
fix(rds): add ReadReplicaSourceDBInstanceIdentifier to db_instance ( #3912 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2024-05-08 15:54:51 +02:00
Sergio Garcia
99bd637de4
chore(fixer): improve fixer logic and include more ( #3750 )
2024-04-15 17:45:40 +02:00
Pedro Martín
f7fab165ba
fix(aws_lambda): Update obsolete lambda runtimes ( #3735 )
2024-04-09 15:08:19 +02:00
Pedro Martín and Sergio Garcia
d9b6624d65
feat(compliance): Add CIS 1.8 framework for Kubernetes ( #3600 )
...
Co-authored-by: Sergio Garcia <sergargar1@gmail.com >
2024-03-26 14:03:39 +01:00
Pepe Fagoaga and Sergio Garcia
77823afa54
chore(audit_info): Replace for provider and add tests ( #3542 )
...
Co-authored-by: Sergio Garcia <sergargar1@gmail.com >
2024-03-19 09:53:05 +01:00
StylusFrost