StylusFrost
ca72922dca
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-27 17:12:54 +02:00
Daniel Barranquero
2678c6bc9f
feat(okta): add application service with 6 new checks ( #11358 )
2026-05-27 11:16:18 +02:00
Daniel Barranquero
4dd5baadf6
feat(okta): add provider to the SDK with 1 security check ( #11079 )
2026-05-13 15:57:57 +02:00
Hugo Pereira Brito and Hugo P.Brito
0b26c1a39c
feat(aws): add iam_user_access_not_stale_to_sagemaker security check ( #11000 )
...
Co-authored-by: Hugo P.Brito <hugopbrito@Mac.home >
2026-05-11 16:34:18 +02:00
StylusFrost
e8487d0686
fix(sdk): unwrap namespaced config for all built-in and external providers
...
load_and_validate_config_file only detected the namespaced format for 5
hardcoded providers (aws, gcp, azure, kubernetes, m365). For every other
built-in (github, nhn, vercel, cloudflare, iac, llm, image, mongodbatlas,
oraclecloud, openstack, alibabacloud, googleworkspace) and for any
external plug-in, the full YAML was returned wrapped instead of the
provider's own block.
Replace the hardcoded list with a dynamic check: if the file has a
top-level key matching the provider and its value is a dict, unwrap it.
Keep the legacy flat format for AWS only (historical, pre-multicloud)
and identify it by the absence of nested-dict top-level values, which
prevents cross-provider config leakage when a namespaced file has no
section for the requested provider.
2026-04-24 18:01:47 +02:00
Eran Cohen and Daniel Barranquero
0b461233c1
feat(iam): Add trusted IP configurable option to reduce false positives in 'opensearch' check ( #8631 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-03-10 12:12:54 +01:00
mohd4adil and Daniel Barranquero
e97e31c7ca
chore(aws): add support for trusted aws accounts in cross account checks for s3, eventbridge bus, eventbridge schema and dynamodb ( #9692 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-01-29 09:13:34 +01:00
lydiavilchez and Daniel Barranquero
43875b6ae7
feat(gcp): add check to ensure Managed Instance Groups span multiple zones ( #9566 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2025-12-22 15:12:08 +01:00
Rubén De la Torre Vico and Sergio Garcia
d9a9236ab7
feat(azure/vm): add new check vm_desired_sku_size ( #8191 )
...
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
2025-07-25 17:51:01 +08:00
Rubén De la Torre Vico
1211fe706e
feat(azure/defender): add new check defender_attack_path_notifications_properly_configured ( #8245 )
2025-07-17 12:40:26 +02:00
Daniel Barranquero
e2fd3fe36e
feat(defender): add new check defender_malware_policy_comprehensive_attachments_filter_applied ( #7661 )
2025-05-06 10:29:36 +02:00
Daniel Barranquero and MrCloudSec
6b0d73d7f9
feat(exchange): make exchange_user_mailbox_auditing_enabled check configurable ( #7662 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-05-05 15:16:41 -04:00
Daniel Barranquero and Andoni A.
25b1efe532
feat(exchange): add new check exchange_organization_mailtips_enabled ( #7637 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2025-05-02 08:46:14 +02:00
Felix Dreissig
0b6aa0ddcd
fix(aws): remove SHA-1 from ACM insecure key algorithms ( #7547 )
2025-04-18 16:25:44 -04:00
Hugo Pereira Brito and MrCloudSec
52bd48168f
feat: adapt Microsoft365 provider to use PowerShell ( #7331 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-04-15 13:24:09 -04:00
Bogdan A and MrCloudSec
42f46b0fb1
feat(gcp): add check for unused Service Accounts ( #7419 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
2025-04-14 11:53:54 -04:00
Hugo Pereira Brito
e617ff0460
feat(docs): add microsoft365 configurable checks ( #7200 )
2025-03-12 12:52:35 +01:00
Daniel Barranquero
ba7cd0250a
fix(elasticache): improve logic in elasticache_redis_cluster_backup_enabled ( #7042 )
2025-02-26 10:31:14 +01:00
Pedro Martín
8f3229928e
chore(config): set default values for empty config fields ( #6225 )
2024-12-18 09:48:32 -05:00
johannes-engler-mw and Rubén De la Torre Vico
eded97d735
feat(azure): check for minimal TLS version for Azure SQL server ( #5745 )
...
Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com >
2024-12-11 16:37:53 +01:00
Mario Rodriguez Lopez
9c383baff3
fix(ec2): Change ec2_sg_high_risk_ports configurable parameter name ( #5904 )
2024-11-26 08:24:45 -04:00
Sergio Garcia
f1334190d8
fix(aws): remove cloudwatch_log_group_no_critical_pii_in_logs check ( #5736 )
2024-11-12 12:50:47 -05:00
Rubén De la Torre Vico and Sergio
1b50fdba28
feat(secretsmanager): add new check secretsmanager_secret_rotated_periodically ( #5450 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-11-04 16:08:38 -05:00
Sergio Garcia
e3104ae5ee
feat(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs ( #5494 )
2024-11-04 10:20:35 -05:00
Rubén De la Torre Vico
a17cf1bbb6
feat(secretsmanager): add new check secretsmanager_secret_unused ( #5428 )
2024-10-17 10:24:12 -04:00
Sergio Garcia
3c929bd68f
feat(aws): add checks for Bedrock logging configuration and CloudTrail LLM Jacking detection ( #5314 )
2024-10-11 15:01:45 -04:00
Sergio Garcia and Pepe Fagoaga
b703357027
chore(secrets): use master branch of Yelp/detect-secrets ( #5298 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2024-10-08 09:55:46 -04:00
Mario Rodriguez Lopez and Sergio
2ffe7f3ef7
feat(ecs): add new check ecs_service_fargate_latest_platform_version ( #5258 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-10-02 16:50:20 -04:00
Sergio Garcia and pedrooot
9456c6198a
chore(ssm): add trusted accounts variable to ssm check ( #5005 )
...
Co-authored-by: pedrooot <pedromarting3@gmail.com >
2024-09-20 09:12:48 -04:00
Rubén De la Torre Vico and Sergio
320a2a2c77
feat(awslambda): add new check awslambda_function_vpc_multi_az ( #4816 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-09-19 09:30:04 -04:00
Pedro Martín
3933440a08
feat(secrets): improve detect secrets checks and add config ( #4915 )
2024-09-04 16:54:55 +02:00
bcb63d0b2d
feat(elb): add new check elb_is_in_multiple_az ( #4829 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2024-08-26 13:27:08 +02:00
Rubén De la Torre Vico and Sergio Garcia
0b238243b1
feat(elbv2): add new check elbv2_is_in_multiple_az ( #4800 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-22 11:08:49 -04:00
Mario Rodriguez Lopez
49ff901195
feat(EC2): Add new check for security group port restrictions ( #4594 )
2024-08-16 09:43:00 -04:00
Daniel Barranquero and Sergio
62a1d91869
feat(aws): Add new CodeBuild check to validate environment variables ( #4632 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-08-13 08:15:45 -04:00
Mario Rodriguez Lopez and Sergio Garcia
1b18aef0f0
feat(acm): Add new check for insecure algorithms in certificates ( #4551 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-07 08:00:24 -04:00
Amogh Bantwal and Sergio Garcia
086c203e6b
feat(aws) Add check to make sure EKS clusters have a supported version ( #4604 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-08-06 13:40:05 -04:00
Kay Agahd
02fc034b1f
feat(aws): make check eks_control_plane_logging_all_types_enabled configurable ( #4553 )
2024-07-26 10:24:01 -04:00
Rubén De la Torre Vico and Sergio
1a225c334f
chore(acm): Improve near-expiration certificates check ( #4207 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-06-07 12:22:05 -04:00
Kay Agahd and Sergio
e45a189422
chore(AWS): allow ingress to any port for user defined network interface types ( #4094 )
...
Co-authored-by: Sergio <sergio@prowler.com >
2024-05-31 13:37:52 -04:00
ur and Pepe Fagoaga
73b7d76219
fix(rds): add ReadReplicaSourceDBInstanceIdentifier to db_instance ( #3912 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2024-05-08 15:54:51 +02:00
Sergio Garcia
99bd637de4
chore(fixer): improve fixer logic and include more ( #3750 )
2024-04-15 17:45:40 +02:00
Pedro Martín
f7fab165ba
fix(aws_lambda): Update obsolete lambda runtimes ( #3735 )
2024-04-09 15:08:19 +02:00
Pepe Fagoaga and Sergio Garcia
f0c027f54e
chore(merge): Merge master with Prowler 4.0 ( #3467 )
...
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com >
2024-02-29 11:19:17 +01:00
Sergio Garcia and Pepe Fagoaga
c2f8980f1f
feat(kubernetes): add Kubernetes provider ( #3226 )
...
Co-authored-by: Pepe Fagoaga <pepe@verica.io >
2024-01-09 10:31:51 +01:00
Pepe Fagoaga
9e8023d716
fix(config): Pass a configuration file using --config-file config.yaml ( #2679 )
2023-08-09 09:52:45 +02:00
