chore(changelog): v5.33.1 (#11947)

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>

.env

@@ -158,7 +158,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.33.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.33.1
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/pull_request_template.md

@@ -18,8 +18,8 @@ Please add a detailed description of how to review this PR.
 
 <summary><b>Community Checklist</b></summary>
 
-- [ ] This feature/issue is listed in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
-- [ ] Is it assigned to me, if not, request it via the issue/feature in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](goto.prowler.com/slack)
+- [ ] This feature/issue is listed in the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
+- [ ] Is it assigned to me, if not, request it via the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](https://goto.prowler.com/slack)
 
 </details>
 
@@ -28,7 +28,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
 - [ ] Review if backport is needed.
 - [ ] Review if is needed to change the [Readme.md](https://github.com/prowler-cloud/prowler/blob/master/README.md)
-- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/prowler/CHANGELOG.md), if applicable.
+- [ ] Ensure a changelog fragment is added under [prowler/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/prowler/changelog.d), if applicable.
 
 #### SDK/CLI
 - Are there new checks included in this PR? Yes / No
@@ -40,7 +40,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
-- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/ui/CHANGELOG.md), if applicable.
+- [ ] Ensure a changelog fragment is added under [ui/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/ui/changelog.d), if applicable.
 
 #### API
 - [ ] All issue/task requirements work as expected on the API
@@ -50,7 +50,11 @@ Please add a detailed description of how to review this PR.
 - [ ] Any other relevant evidence of the implementation (if applicable)
 - [ ] Verify if API specs need to be regenerated.
 - [ ] Check if version updates are required (e.g., specs, uv, etc.).
-- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/api/CHANGELOG.md), if applicable.
+- [ ] Ensure a changelog fragment is added under [api/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/api/changelog.d), if applicable.
+
+#### MCP Server
+- [ ] All issue/task requirements work as expected on the MCP Server
+- [ ] Ensure a changelog fragment is added under [mcp_server/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/mcp_server/changelog.d), if applicable.
 
 ### License
 

.github/scripts/changelog_attribution.py

@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""Rename changelog fragments to their PR number before running towncrier.
+
+For every <slug>.<type>.md in <component_dir>/changelog.d/, find the commit that
+added it, resolve its PR via the GitHub API (falling back to the squash-commit
+subject), and `git mv` it to <PR>.<type>.md so towncrier renders the PR link.
+Unresolvable fragments become +<slug>.<type>.md orphans (rendered without link).
+"""
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+
+FRAGMENT_RE = re.compile(
+    r"^(?P<slug>[A-Za-z0-9][A-Za-z0-9._-]*?)"
+    r"\.(?P<type>added|changed|deprecated|removed|fixed|security)"
+    r"(?:\.(?P<counter>[0-9]+))?\.md$"
+)
+SUBJECT_PR_RE = re.compile(r" \(#([0-9]+)\)$")
+IGNORED_FILES = {".gitkeep", "README.md"}
+API_TIMEOUT_SECONDS = 10
+
+
+def git(*args: str) -> str:
+    result = subprocess.run(["git", *args], check=True, capture_output=True, text=True)
+    return result.stdout.strip()
+
+
+def find_adding_commit(path: str) -> str | None:
+    """Find the commit that added a file, following renames.
+
+    Falls back to a plain (no --follow) lookup: rename detection can lose the
+    add event for degenerate content (e.g. files identical to many others).
+    """
+    sha = git("log", "--follow", "--diff-filter=A", "--format=%H", "-1", "--", path)
+    if not sha:
+        sha = git("log", "--diff-filter=A", "--format=%H", "-1", "--", path)
+    return sha or None
+
+
+def pr_from_api(repo: str, sha: str) -> int | None:
+    """Resolve the PR associated with a commit via the GitHub API.
+
+    Returns None on any network/API failure so the caller can fall back to
+    parsing the squash-commit subject.
+    """
+    url = f"https://api.github.com/repos/{repo}/commits/{sha}/pulls"
+    headers = {
+        "Accept": "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "User-Agent": "prowler-changelog-attribution",
+    }
+    token = os.environ.get("GITHUB_TOKEN")
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    request = urllib.request.Request(url, headers=headers)
+    try:
+        with urllib.request.urlopen(request, timeout=API_TIMEOUT_SECONDS) as response:
+            pulls = json.load(response)
+    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError):
+        return None
+    if isinstance(pulls, list) and pulls:
+        return pulls[0].get("number")
+    return None
+
+
+def pr_from_subject(sha: str) -> int | None:
+    subject = git("log", "-1", "--format=%s", sha)
+    match = SUBJECT_PR_RE.search(subject)
+    return int(match.group(1)) if match else None
+
+
+def unique_destination(directory: str, base_name: str, fragment_type: str) -> str:
+    """Return a non-colliding fragment path, appending a numeric counter if needed."""
+    candidate = os.path.join(directory, f"{base_name}.{fragment_type}.md")
+    counter = 0
+    while os.path.exists(candidate):
+        counter += 1
+        candidate = os.path.join(directory, f"{base_name}.{fragment_type}.{counter}.md")
+    return candidate
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("component_dir", help="Component directory, e.g. prowler")
+    parser.add_argument("--repo", default="prowler-cloud/prowler")
+    parser.add_argument(
+        "--no-api",
+        action="store_true",
+        help="Skip the GitHub API and resolve PRs from commit subjects only",
+    )
+    args = parser.parse_args()
+
+    fragments_dir = os.path.join(args.component_dir, "changelog.d")
+    if not os.path.isdir(fragments_dir):
+        print(f"::error::Fragments directory not found: {fragments_dir}")
+        return 1
+
+    malformed = []
+    to_process = []
+    for name in sorted(os.listdir(fragments_dir)):
+        if name in IGNORED_FILES or name.startswith("+"):
+            continue
+        match = FRAGMENT_RE.match(name)
+        if not match:
+            malformed.append(name)
+            continue
+        if match.group("slug").isdigit():
+            continue
+        to_process.append((name, match))
+
+    if malformed:
+        for name in malformed:
+            print(
+                f"::error::Malformed fragment filename in {fragments_dir}: {name} "
+                "(expected <slug>.<type>.md with type one of added|changed|"
+                "deprecated|removed|fixed|security)"
+            )
+        return 1
+
+    for name, match in to_process:
+        slug, fragment_type = match.group("slug"), match.group("type")
+
+        path = os.path.join(fragments_dir, name)
+        sha = find_adding_commit(path)
+        pr_number = None
+        if sha:
+            if not args.no_api:
+                pr_number = pr_from_api(args.repo, sha)
+            if pr_number is None:
+                pr_number = pr_from_subject(sha)
+
+        if pr_number is not None:
+            destination = unique_destination(
+                fragments_dir, str(pr_number), fragment_type
+            )
+        else:
+            destination = unique_destination(fragments_dir, f"+{slug}", fragment_type)
+            print(
+                f"::warning::Could not resolve a PR for {path}; renamed to "
+                f"{os.path.basename(destination)} (entry will render without a PR link)"
+            )
+        git("mv", path, destination)
+        print(f"{path} -> {destination}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/towncrier/template.md.jinja

@@ -0,0 +1,13 @@
+{% set category_order = definitions.keys() %}
+{% for section, _ in sections.items() %}
+{% for category in category_order if category in sections[section] %}
+### {{ definitions[category]['name'] }}
+
+{% for text, values in sections[section][category].items() -%}
+- {{ text }}{% if values %} {{ values|join(', ') }}{% endif %}{{ "\n" }}
+{%- endfor %}
+
+{% endfor %}
+{% endfor %}
+---
+{{ "\n" }}

.github/workflows/api-code-quality.yml

@@ -62,6 +62,7 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
+            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-container-checks.yml

@@ -108,6 +108,7 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
+            api/changelog.d/**
             api/AGENTS.md
 
       - name: Set up Docker Buildx

.github/workflows/api-security.yml

@@ -77,6 +77,7 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
+            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-tests.yml

@@ -111,6 +111,7 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
+            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/compile-changelogs.yml

@@ -0,0 +1,478 @@
+name: 'Tools: Compile Changelogs'
+
+run-name: 'Compile changelogs for Prowler ${{ inputs.prowler_version }}'
+
+on:
+  workflow_dispatch:
+    inputs:
+      prowler_version:
+        description: 'Prowler version being released (e.g., 5.31.0)'
+        required: true
+        type: string
+      target_branch:
+        description: 'Branch to compile on (master for minor releases, v5.X for patches)'
+        required: true
+        type: string
+      sdk_version:
+        description: 'SDK version override (empty = auto-derive from prowler/CHANGELOG.md + pending fragment types; "skip" = hold this component back)'
+        required: false
+        type: string
+      api_version:
+        description: 'API version override (empty = auto-derive; "skip" = hold back)'
+        required: false
+        type: string
+      ui_version:
+        description: 'UI version override (empty = auto-derive; "skip" = hold back)'
+        required: false
+        type: string
+      mcp_version:
+        description: 'MCP Server version override (empty = auto-derive; "skip" = hold back)'
+        required: false
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.prowler_version }}
+  cancel-in-progress: false
+
+env:
+  PROWLER_VERSION: ${{ inputs.prowler_version }}
+  TARGET_BRANCH: ${{ inputs.target_branch }}
+  SDK_VERSION: ${{ inputs.sdk_version }}
+  API_VERSION: ${{ inputs.api_version }}
+  UI_VERSION: ${{ inputs.ui_version }}
+  MCP_VERSION: ${{ inputs.mcp_version }}
+
+permissions: {}
+
+jobs:
+  compile-changelogs:
+    if: github.event_name == 'workflow_dispatch' && github.repository == 'prowler-cloud/prowler'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Harden the runner (Block outbound calls)
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.target_branch }}
+          fetch-depth: 0 # PR attribution resolves each fragment's adding commit from history
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: '3.12'
+
+      - name: Install towncrier
+        run: pip install --no-cache-dir towncrier==25.8.0
+
+      - name: Configure Git
+        run: |
+          git config --global user.name 'prowler-bot'
+          git config --global user.email '179230569+prowler-bot@users.noreply.github.com'
+
+      - name: Validate version inputs
+        run: |
+          if [[ ! "$PROWLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Invalid prowler_version syntax: '$PROWLER_VERSION' (must be N.N.N)"
+            exit 1
+          fi
+          if [ "$TARGET_BRANCH" != "master" ] && [[ ! "$TARGET_BRANCH" =~ ^v[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Invalid target_branch syntax: '$TARGET_BRANCH' (must be 'master' or vN.N, e.g. v5.31)"
+            exit 1
+          fi
+          IFS=. read -r prowler_major prowler_minor prowler_patch <<< "$PROWLER_VERSION"
+          prowler_major=$((10#$prowler_major))
+          prowler_minor=$((10#$prowler_minor))
+          prowler_patch=$((10#$prowler_patch))
+          if [ "$prowler_patch" -eq 0 ]; then
+            if [ "$TARGET_BRANCH" != "master" ]; then
+              echo "::error::target_branch must be 'master' for Prowler ${PROWLER_VERSION}; got '${TARGET_BRANCH}'"
+              exit 1
+            fi
+          else
+            expected_target_branch="v${prowler_major}.${prowler_minor}"
+            if [ "$TARGET_BRANCH" != "$expected_target_branch" ]; then
+              echo "::error::target_branch must be '${expected_target_branch}' for Prowler ${PROWLER_VERSION}; got '${TARGET_BRANCH}'"
+              exit 1
+            fi
+          fi
+          for pair in "sdk_version:$SDK_VERSION" "api_version:$API_VERSION" "ui_version:$UI_VERSION" "mcp_version:$MCP_VERSION"; do
+            input_name="${pair%%:*}"
+            input_value="${pair#*:}"
+            if [ -n "$input_value" ] && [ "$input_value" != "skip" ] && [[ ! "$input_value" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "::error::Invalid $input_name syntax: '$input_value' (must be N.N.N, empty for auto-derivation, or 'skip')"
+              exit 1
+            fi
+          done
+
+      - name: Compile changelogs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          component_input() {
+            case "$1" in
+              prowler) echo "$SDK_VERSION" ;;
+              api) echo "$API_VERSION" ;;
+              ui) echo "$UI_VERSION" ;;
+              mcp_server) echo "$MCP_VERSION" ;;
+            esac
+          }
+
+          version_key() {
+            local version="$1"
+            local major minor patch
+            IFS=. read -r major minor patch <<< "$version"
+            printf '%06d.%06d.%06d' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"
+          }
+
+          pending_fragments() {
+            find "$1/changelog.d" -maxdepth 1 -type f ! -name '.gitkeep' ! -name 'README.md' | sort
+          }
+
+          # The component's last released version is the first stamped heading
+          # of its CHANGELOG.md, the same source prepare-release.yml greps.
+          latest_released_version() {
+            grep -m1 -E '^## \[v?[0-9]+\.[0-9]+\.[0-9]+\]' "$1/CHANGELOG.md" | sed -E 's/^## \[v?([0-9]+\.[0-9]+\.[0-9]+)\].*/\1/'
+          }
+
+          has_removed_fragments() {
+            echo "$1" | grep -qE '\.removed(\.[0-9]+)?\.md$'
+          }
+
+          # Resolve every component's effective version before compiling
+          # anything, so a wrong input cannot leave the tree half-compiled.
+          # Empty input = auto-derive (latest released version + semver bump
+          # from the pending fragment types). 'skip' = hold the component back.
+          errors=0
+          compiling=""
+          for component in prowler api ui mcp_server; do
+            input=$(component_input "$component")
+            fragments=$(pending_fragments "$component")
+
+            if [ "$input" = "skip" ]; then
+              if [ -n "$fragments" ]; then
+                echo "::warning::${component}: held back by request; these pending fragments stay for a future release:"
+                echo "$fragments"
+              fi
+              continue
+            fi
+            if [ -n "$input" ] && [ -z "$fragments" ]; then
+              echo "::error::${component}: version input '$input' provided but ${component}/changelog.d/ has no pending fragments (wrong input?)"
+              errors=1
+              continue
+            fi
+            if [ -z "$fragments" ]; then
+              continue
+            fi
+
+            removed_fragments=false
+            if has_removed_fragments "$fragments"; then
+              removed_fragments=true
+            fi
+            current=$(latest_released_version "$component")
+            if [ -z "$current" ]; then
+              echo "::error::${component}: could not read the latest released version from ${component}/CHANGELOG.md; restore the released heading before compiling"
+              errors=1
+              continue
+            fi
+
+            if [ -n "$input" ]; then
+              effective="$input"
+              mode="explicit"
+              current_key=$(version_key "$current")
+              effective_key=$(version_key "$effective")
+              if [[ "$effective_key" < "$current_key" || "$effective_key" == "$current_key" ]]; then
+                echo "::error::${component}: explicit version '${effective}' must be greater than the latest released version (${current})"
+                errors=1
+                continue
+              fi
+            else
+              if [ "$removed_fragments" = "true" ]; then
+                echo "::error::${component}: pending 'removed' fragments imply a major bump (breaking change); provide its version input explicitly"
+                errors=1
+                continue
+              fi
+              IFS=. read -r major minor patch <<< "$current"
+              major=$((10#$major))
+              minor=$((10#$minor))
+              patch=$((10#$patch))
+              if echo "$fragments" | grep -qE '\.(added|changed|deprecated)(\.[0-9]+)?\.md$'; then
+                effective="${major}.$((minor + 1)).0"
+              else
+                effective="${major}.${minor}.$((patch + 1))"
+              fi
+              mode="auto"
+              echo "::notice::${component}: version auto-derived ${current} -> ${effective} from the pending fragment types"
+            fi
+
+            if [ "$removed_fragments" = "true" ]; then
+              IFS=. read -r current_major _ <<< "$current"
+              current_major=$((10#$current_major))
+              IFS=. read -r effective_major effective_minor effective_patch <<< "$effective"
+              effective_major=$((10#$effective_major))
+              effective_minor=$((10#$effective_minor))
+              effective_patch=$((10#$effective_patch))
+              if [ "$effective_major" -le "$current_major" ] || [ "$effective_minor" -ne 0 ] || [ "$effective_patch" -ne 0 ]; then
+                echo "::error::${component}: removed fragments require a major component release (${current} -> X.0.0 with X > ${current_major}); got ${effective}"
+                errors=1
+                continue
+              fi
+            fi
+
+            # Without the marker the build would insert the new block above the
+            # file header instead of below it.
+            if ! grep -q '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
+              echo "::error::${component}/CHANGELOG.md is missing the '<!-- changelog: release notes start -->' marker; restore it after the intro line before compiling"
+              errors=1
+              continue
+            fi
+            # A hand-written UNRELEASED block means someone followed the old
+            # convention; its entries would be left out of the compiled block
+            # and out of the release notes extraction.
+            if grep -q '(Prowler UNRELEASED)' "$component/CHANGELOG.md"; then
+              echo "::error::${component}/CHANGELOG.md contains a hand-written '(Prowler UNRELEASED)' block; convert its entries to fragments in ${component}/changelog.d/ and delete the block before compiling"
+              errors=1
+              continue
+            fi
+
+            echo "${effective} ${mode}" > "${RUNNER_TEMP}/version-${component}.txt"
+            compiling="${compiling}${component} "
+          done
+          if [ "$errors" -ne 0 ]; then
+            exit 1
+          fi
+          if [ -z "$compiling" ]; then
+            echo "::error::Nothing to compile: no component has pending fragments to release"
+            exit 1
+          fi
+
+          body_file="${RUNNER_TEMP}/compile-changelogs-pr-body.md"
+          {
+            echo "### Description"
+            echo ""
+            echo "Compiles the pending changelog fragments into the per-component \`CHANGELOG.md\` files for Prowler v${PROWLER_VERSION}, replacing the manual stamping PR."
+            echo ""
+            echo "| Component | Version | Fragments consumed |"
+            echo "|---|---|---|"
+          } > "$body_file"
+
+          compiled_components=""
+          for component in prowler api ui mcp_server; do
+            if [ ! -f "${RUNNER_TEMP}/version-${component}.txt" ]; then
+              echo "Skipping ${component} (no pending fragments or held back)"
+              echo "| \`${component}\` | - | 0 |" >> "$body_file"
+              continue
+            fi
+            read -r version mode < "${RUNNER_TEMP}/version-${component}.txt"
+            version_label="$version"
+            if [ "$mode" = "auto" ]; then
+              version_label="${version} (auto)"
+            fi
+
+            count=$(pending_fragments "$component" | wc -l | tr -d ' ')
+            echo "Compiling ${component} ${version} (${count} fragments, ${mode} version)..."
+
+            # Captured before attribution renames them: these original paths are
+            # what the forward-sync deletes on master (backports copy fragments
+            # verbatim, so filenames match across branches).
+            pending_fragments "$component" > "${RUNNER_TEMP}/consumed-${component}.txt"
+            pre_lines=$(wc -l < "$component/CHANGELOG.md")
+
+            # Attribution must run before the build: towncrier renders the
+            # first dotted segment of each filename as the PR number.
+            python .github/scripts/changelog_attribution.py "$component"
+            towncrier build --config "$component/towncrier.toml" --version "$version" --name "Prowler v${PROWLER_VERSION}" --yes
+
+            # The build only inserts lines right after the marker, so the new
+            # stamped block is exactly the added lines following it. Captured
+            # for the forward-sync to master.
+            post_lines=$(wc -l < "$component/CHANGELOG.md")
+            delta=$((post_lines - pre_lines))
+            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md" | cut -d: -f1)
+            sed -n "$((marker_line + 1)),$((marker_line + delta))p" "$component/CHANGELOG.md" > "${RUNNER_TEMP}/block-${component}.md"
+
+            compiled_components="${compiled_components}${component} "
+            echo "| \`${component}\` | ${version_label} | ${count} |" >> "$body_file"
+          done
+          echo "COMPILED_COMPONENTS=${compiled_components}" >> "$GITHUB_ENV"
+
+          {
+            echo ""
+            echo "Review that no pending fragment was dropped (the diff must delete every consumed fragment) and that each new version block is correct, then squash-merge."
+            echo ""
+            echo "### License"
+            echo ""
+            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
+          } >> "$body_file"
+
+          echo "PR_BODY_FILE=${body_file}" >> "$GITHUB_ENV"
+
+      - name: Create compile PR
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
+          branch: compile-changelogs-${{ env.PROWLER_VERSION }}
+          base: ${{ env.TARGET_BRANCH }}
+          title: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
+          body-path: ${{ env.PR_BODY_FILE }}
+          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
+          labels: |
+            no-changelog
+
+      # Patch compiles (target_branch = v5.X) leave master holding the consumed
+      # fragments and missing the new version block. This applies the equivalent
+      # change to master: insert the same stamped blocks under the marker and
+      # delete the consumed fragments, so the next minor compile cannot
+      # re-release entries that already shipped in the patch.
+      - name: Apply forward-sync to master
+        if: env.TARGET_BRANCH != 'master'
+        run: |
+          set -euo pipefail
+
+          git checkout -B master origin/master
+
+          version_key() {
+            local version="$1"
+            local major minor patch
+            IFS=. read -r major minor patch <<< "$version"
+            printf '%06d.%06d.%06d' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"
+          }
+
+          release_from_heading() {
+            local heading="$1"
+            echo "$heading" | sed -E 's/^## \[[^]]+\] \(Prowler v?([0-9]+\.[0-9]+\.[0-9]+)\).*/\1/'
+          }
+
+          insert_changelog_block_ordered() {
+            local component="$1"
+            local block_file="$2"
+            local changelog="${component}/CHANGELOG.md"
+            local incoming_heading incoming_release incoming_key
+            local marker_line insertion_line duplicate_line
+            local line heading existing_release existing_key
+
+            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$changelog" | cut -d: -f1)
+            incoming_heading=$(grep -m1 -E '^## \[[^]]+\] \(Prowler v?[0-9]+\.[0-9]+\.[0-9]+\)' "$block_file" || true)
+            if [ -z "$incoming_heading" ]; then
+              echo "::error::${block_file} does not contain a stamped Prowler release heading"
+              exit 1
+            fi
+
+            incoming_release=$(release_from_heading "$incoming_heading")
+            incoming_key=$(version_key "$incoming_release")
+            insertion_line=""
+            duplicate_line=""
+
+            while IFS=: read -r line heading; do
+              existing_release=$(release_from_heading "$heading")
+              existing_key=$(version_key "$existing_release")
+              if [[ "$incoming_key" == "$existing_key" ]]; then
+                duplicate_line="$line"
+                break
+              fi
+              if [[ "$incoming_key" > "$existing_key" ]]; then
+                insertion_line="$line"
+                break
+              fi
+            done < <(grep -n -E '^## \[[^]]+\] \(Prowler v?[0-9]+\.[0-9]+\.[0-9]+\)' "$changelog" || true)
+
+            if [ -n "$duplicate_line" ]; then
+              echo "::error::${changelog} already contains a block for Prowler v${incoming_release} at line ${duplicate_line}; refusing to insert a duplicate"
+              exit 1
+            fi
+            if [ -z "$insertion_line" ]; then
+              insertion_line=$(($(wc -l < "$changelog") + 1))
+            fi
+            if [ "$insertion_line" -le "$marker_line" ]; then
+              insertion_line=$((marker_line + 1))
+            fi
+
+            {
+              head -n "$((insertion_line - 1))" "$changelog"
+              cat "$block_file"
+              tail -n +"$insertion_line" "$changelog"
+            } > "${RUNNER_TEMP}/changelog.tmp"
+            mv "${RUNNER_TEMP}/changelog.tmp" "$changelog"
+
+            echo "::notice::Inserted ${component} changelog block for Prowler v${incoming_release} at line ${insertion_line}"
+          }
+
+          sync_body="${RUNNER_TEMP}/forward-sync-pr-body.md"
+          {
+            echo "### Description"
+            echo ""
+            echo "Forward-syncs the v${PROWLER_VERSION} compiled changelogs from \`${TARGET_BRANCH}\` to \`master\`: inserts the same stamped version blocks under the insertion marker and deletes the consumed fragments, so the next minor compile cannot re-release entries that already shipped in this patch. Opened automatically by the same run that opened the compile PR; review and squash-merge after it."
+            echo ""
+            echo "| Component | Fragments deleted on master | Skipped (only on ${TARGET_BRANCH}) |"
+            echo "|---|---|---|"
+          } > "$sync_body"
+
+          for component in $COMPILED_COMPONENTS; do
+            block_file="${RUNNER_TEMP}/block-${component}.md"
+            consumed_file="${RUNNER_TEMP}/consumed-${component}.txt"
+
+            if ! grep -qm1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
+              echo "::error::${component}/CHANGELOG.md on master is missing the insertion marker; cannot forward-sync"
+              exit 1
+            fi
+
+            deleted=0
+            skipped=0
+            while IFS= read -r fragment; do
+              if [ -z "$fragment" ]; then
+                continue
+              fi
+              if [ -f "$fragment" ]; then
+                git rm -q "$fragment"
+                deleted=$((deleted + 1))
+              else
+                echo "::notice::${fragment} does not exist on master (change landed only on ${TARGET_BRANCH}); skipping its deletion"
+                skipped=$((skipped + 1))
+              fi
+            done < "$consumed_file"
+
+            insert_changelog_block_ordered "$component" "$block_file"
+
+            echo "| \`${component}\` | ${deleted} | ${skipped} |" >> "$sync_body"
+          done
+
+          {
+            echo ""
+            echo "### License"
+            echo ""
+            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
+          } >> "$sync_body"
+
+          echo "SYNC_BODY_FILE=${sync_body}" >> "$GITHUB_ENV"
+
+      - name: Create forward-sync PR
+        if: env.TARGET_BRANCH != 'master'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
+          branch: forward-sync-changelogs-${{ env.PROWLER_VERSION }}
+          base: master
+          title: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
+          body-path: ${{ env.SYNC_BODY_FILE }}
+          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
+          labels: |
+            no-changelog

.github/workflows/mcp-container-checks.yml

@@ -102,6 +102,7 @@ jobs:
           files_ignore: |
             mcp_server/README.md
             mcp_server/CHANGELOG.md
+            mcp_server/changelog.d/**
 
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'

.github/workflows/pr-check-changelog.yml

@@ -19,6 +19,60 @@ concurrency:
 permissions: {}
 
 jobs:
+  test-changelog-attribution:
+    if: github.repository == 'prowler-cloud/prowler'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Fetch PR base ref for tj-actions/changed-files
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: git fetch --depth=1 origin "${BASE_REF}"
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            .github/scripts/changelog_attribution.py
+            .github/workflows/pr-check-changelog.yml
+            .github/workflows/compile-changelogs.yml
+            .github/towncrier/template.md.jinja
+            */towncrier.toml
+            tests/github/**
+
+      - name: Set up Python
+        if: steps.changed-files.outputs.any_changed == 'true'
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: '3.12'
+
+      - name: Test changelog attribution
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          python3 -m pip install --user --disable-pip-version-check pytest==9.0.3 towncrier==25.8.0
+          python3 -m pytest tests/github
+
   check-changelog:
     if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false
     runs-on: ubuntu-latest
@@ -62,53 +116,160 @@ jobs:
             uv.lock
             pyproject.toml
 
-      - name: Check for folder changes and changelog presence
+      - name: Check for folder changes and changelog fragment presence
         id: check-folders
         run: |
-          missing_changelogs=""
+          fragment_name_re='^[A-Za-z0-9][A-Za-z0-9._-]*\.(added|changed|deprecated|removed|fixed|security)(\.[0-9]+)?\.md$'
+          manual_pr_link_re='(\[\(#[0-9]+\)\]|\[#[0-9]+\]\(|\(#[0-9]+\)|github\.com/[^[:space:]/]+/[^[:space:]/]+/(pull|issues)/[0-9]+)'
+          folder_alt=$(echo "$MONITORED_FOLDERS" | tr ' ' '|')
+
+          missing_fragments=""
+          invalid_fragments=""
+          linked_fragments=""
+          handwritten_changelogs=""
+
+          all_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n')
+          added=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" | tr ' ' '\n')
+          added_or_renamed=$(printf '%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
+          added_modified_or_renamed=$(printf '%s\n%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
+
+          # Returns success if the folder has a valid fragment added, modified, or renamed.
+          has_changelog_update() {
+            local folder="$1"
+            if echo "$added_modified_or_renamed" | grep "^${folder}/changelog.d/" | sed "s|^${folder}/changelog.d/||" | grep -qE "$fragment_name_re"; then
+              return 0
+            fi
+            return 1
+          }
 
           if [[ "${STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED}" == "true" ]]; then
             # Check monitored folders
             for folder in $MONITORED_FOLDERS; do
-              # Get files changed in this folder
-              changed_in_folder=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^${folder}/" || true)
+              if echo "$all_changed" | grep -q "^${folder}/CHANGELOG.md$"; then
+                echo "Direct CHANGELOG.md edits are not allowed for ${folder}/"
+                handwritten_changelogs="${handwritten_changelogs}- \`${folder}/CHANGELOG.md\`"$'\n'
+              fi
+
+              changed_in_folder=$(echo "$all_changed" | grep "^${folder}/" | grep -v "^${folder}/CHANGELOG.md$" || true)
 
               if [ -n "$changed_in_folder" ]; then
                 echo "Detected changes in ${folder}/"
 
-                # Check if CHANGELOG.md was updated
-                if ! echo "$changed_in_folder" | grep -q "^${folder}/CHANGELOG.md$"; then
-                  echo "No changelog update found for ${folder}/"
-                  missing_changelogs="${missing_changelogs}- \`${folder}\`"$'\n'
+                if ! has_changelog_update "$folder"; then
+                  echo "No changelog fragment found for ${folder}/"
+                  missing_fragments="${missing_fragments}- \`${folder}\`"$'\n'
                 fi
               fi
             done
 
             # Check root-level dependency files (uv.lock, pyproject.toml)
             # These are associated with the prowler folder changelog
-            root_deps_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
+            root_deps_changed=$(echo "$all_changed" | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
             if [ -n "$root_deps_changed" ]; then
               echo "Detected changes in root dependency files: $root_deps_changed"
-              # Check if prowler/CHANGELOG.md was already updated (might have been caught above)
-              prowler_changelog_updated=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^prowler/CHANGELOG.md$" || true)
-              if [ -z "$prowler_changelog_updated" ]; then
+              if ! has_changelog_update "prowler"; then
                 # Only add if prowler wasn't already flagged
-                if ! echo "$missing_changelogs" | grep -q "prowler"; then
-                  echo "No changelog update found for root dependency changes"
-                  missing_changelogs="${missing_changelogs}- \`prowler\` (root dependency files changed)"$'\n'
+                if ! echo "$missing_fragments" | grep -q "prowler"; then
+                  echo "No changelog fragment found for root dependency changes"
+                  missing_fragments="${missing_fragments}- \`prowler\` (root dependency files changed)"$'\n'
                 fi
               fi
             fi
+
+            # Validate the filename of every fragment added by this PR
+            added_fragments=$(echo "$added_or_renamed" | grep -E "^(${folder_alt})/changelog\.d/" || true)
+            for fragment in $added_fragments; do
+              name=$(basename "$fragment")
+              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ]; then
+                continue
+              fi
+              if ! echo "$name" | grep -qE "$fragment_name_re"; then
+                echo "Invalid fragment filename: $fragment"
+                invalid_fragments="${invalid_fragments}- \`${fragment}\`"$'\n'
+              fi
+            done
+
+            # Lint fragment content: the PR link is attached automatically at
+            # compile time, so a hand-written PR or issue link would be wrong
+            touched_fragments=$(echo "$added_modified_or_renamed" | grep -E "^(${folder_alt})/changelog\.d/" || true)
+            for fragment in $touched_fragments; do
+              name=$(basename "$fragment")
+              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ] || [ ! -f "$fragment" ]; then
+                continue
+              fi
+              if grep -qE "$manual_pr_link_re" "$fragment"; then
+                echo "Fragment contains a hand-written PR or issue link: $fragment"
+                linked_fragments="${linked_fragments}- \`${fragment}\`"$'\n'
+              fi
+            done
           fi
 
-          {
-            echo "missing_changelogs<<EOF"
-            echo -e "${missing_changelogs}"
-            echo "EOF"
-          } >> $GITHUB_OUTPUT
+          # Suggest a slug derived from the branch name for the bot comment
+          suggested_slug=$(echo "$HEAD_REF" | tr '[:upper:]' '[:lower:]' | sed 's|.*/||; s/[^a-z0-9._-]/-/g; s/^[^a-z0-9]*//')
+          if [ -z "$suggested_slug" ]; then
+            suggested_slug="my-change"
+          fi
+
+          fragment_help="A changelog fragment is a small Markdown file named \`<slug>.<type>.md\` under \`<component>/changelog.d/\`, where \`<type>\` is one of \`added\`, \`changed\`, \`deprecated\`, \`removed\`, \`fixed\` or \`security\`. Its content is the changelog entry text, without the PR link (added automatically at release time) and without a trailing period. For example:
+
+          \`\`\`
+          echo 'Entry text describing the change' > <component>/changelog.d/${suggested_slug}.fixed.md
+          \`\`\`
+
+          If this PR does not need a changelog entry, add the \`no-changelog\` label instead."
+
+          if [ -n "$missing_fragments" ] || [ -n "$invalid_fragments" ] || [ -n "$linked_fragments" ] || [ -n "$handwritten_changelogs" ]; then
+            comment_body=""
+            if [ -n "$missing_fragments" ]; then
+              comment_body="⚠️ **Changes detected in the following folders without a changelog fragment:**"$'\n\n'"${missing_fragments}"$'\n'
+            fi
+            if [ -n "$invalid_fragments" ]; then
+              comment_body="${comment_body}⚠️ **Changelog fragment filenames that do not follow the naming convention:**"$'\n\n'"${invalid_fragments}"$'\n'
+            fi
+            if [ -n "$linked_fragments" ]; then
+              comment_body="${comment_body}⚠️ **Changelog fragments containing a hand-written PR or issue link (remove it; the PR link is attached automatically at release time):**"$'\n\n'"${linked_fragments}"$'\n'
+            fi
+            if [ -n "$handwritten_changelogs" ]; then
+              comment_body="${comment_body}⚠️ **Direct \`CHANGELOG.md\` edits are not allowed in regular PRs:**"$'\n\n'"${handwritten_changelogs}"$'\n'
+            fi
+            comment_body="${comment_body}${fragment_help}"
+          else
+            comment_body="✅ All required changelog fragments are present."
+          fi
+
+          write_multiline_output() {
+            local name="$1"
+            local value="$2"
+            local delimiter
+
+            while true; do
+              delimiter="EOF_$(openssl rand -hex 16)"
+              if ! grep -qxF "$delimiter" <<< "$value"; then
+                break
+              fi
+            done
+
+            {
+              echo "${name}<<${delimiter}"
+              if [ -n "$value" ]; then
+                printf '%s\n' "$value"
+              fi
+              echo "${delimiter}"
+            } >> "$GITHUB_OUTPUT"
+          }
+
+          write_multiline_output "missing_fragments" "$missing_fragments"
+          write_multiline_output "invalid_fragments" "$invalid_fragments"
+          write_multiline_output "linked_fragments" "$linked_fragments"
+          write_multiline_output "handwritten_changelogs" "$handwritten_changelogs"
+          write_multiline_output "comment_body" "$comment_body"
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED: ${{ steps.changed-files.outputs.any_changed }}
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+          STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES: ${{ steps.changed-files.outputs.added_files }}
+          STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES: ${{ steps.changed-files.outputs.modified_files }}
+          STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES: ${{ steps.changed-files.outputs.renamed_files }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
 
       - name: Find existing changelog comment
         if: github.event.pull_request.head.repo.full_name == github.repository
@@ -128,14 +289,10 @@ jobs:
           edit-mode: replace
           body: |
             <!-- changelog-check -->
-            ${{ steps.check-folders.outputs.missing_changelogs != '' && format('⚠️ **Changes detected in the following folders without a corresponding update to the `CHANGELOG.md`:**
+            ${{ steps.check-folders.outputs.comment_body }}
 
-            {0}
-
-            Please add an entry to the corresponding `CHANGELOG.md` file to maintain a clear history of changes.', steps.check-folders.outputs.missing_changelogs) || '✅ All necessary `CHANGELOG.md` files have been updated.' }}
-
-      - name: Fail if changelog is missing
-        if: steps.check-folders.outputs.missing_changelogs != ''
+      - name: Fail if changelog fragment is missing or invalid
+        if: steps.check-folders.outputs.missing_fragments != '' || steps.check-folders.outputs.invalid_fragments != '' || steps.check-folders.outputs.linked_fragments != '' || steps.check-folders.outputs.handwritten_changelogs != ''
         run: |
-          echo "::error::Missing changelog updates in some folders"
+          echo "::error::Missing, invalid, or disallowed changelog updates"
           exit 1

.github/workflows/sdk-code-quality.yml

@@ -55,6 +55,7 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
+            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**

.github/workflows/sdk-codeql.yml

@@ -12,6 +12,7 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
+      - '!prowler/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -23,6 +24,7 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
+      - '!prowler/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 

.github/workflows/sdk-container-checks.yml

@@ -113,6 +113,7 @@ jobs:
             .github/workflows/sdk-container-checks.yml
           files_ignore: |
             prowler/CHANGELOG.md
+            prowler/changelog.d/**
             **/AGENTS.md
 
       - name: Set up Docker Buildx

.github/workflows/sdk-security.yml

@@ -73,6 +73,7 @@ jobs:
             .github/scripts/osv-scan.sh
           files_ignore: |
             prowler/CHANGELOG.md
+            prowler/changelog.d/**
             **/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/sdk-tests.yml

@@ -77,6 +77,7 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
+            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**

.github/workflows/ui-codeql.yml

@@ -10,6 +10,7 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
+      - '!ui/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -19,6 +20,7 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
+      - '!ui/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 

.github/workflows/ui-container-checks.yml

@@ -102,6 +102,7 @@ jobs:
           files: ui/**
           files_ignore: |
             ui/CHANGELOG.md
+            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 

.github/workflows/ui-tests.yml

@@ -64,6 +64,7 @@ jobs:
             .github/workflows/ui-tests.yml
           files_ignore: |
             ui/CHANGELOG.md
+            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 

api/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
+<!-- changelog: release notes start -->
+
+## [1.34.1] (Prowler v5.33.1)
+
+### 🐞 Fixed
+
+- Session tokens are rejected after account password updates [(#11914)](https://github.com/prowler-cloud/prowler/pull/11914)
+- Jira dispatch task results now surface user-facing Jira failure messages [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
+- AWS Attack Paths privilege escalation queries no longer fail on Neo4j with `Aggregation column contains implicit grouping expressions` [(#11939)](https://github.com/prowler-cloud/prowler/pull/11939)
+
+### 🔐 Security
+
+- OpenAI-compatible Lighthouse provider base URLs are restricted before connection checks [(#11940)](https://github.com/prowler-cloud/prowler/pull/11940)
+- `LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS` environment variable to allow internal hosts as OpenAI-compatible Lighthouse AI base URLs [(#11942)](https://github.com/prowler-cloud/prowler/pull/11942)
+
+---
+
 ## [1.34.0] (Prowler v5.33.0)
 
 ### 🚀 Added

api/changelog.d/README.md

@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

api/pyproject.toml

@@ -45,7 +45,7 @@ dependencies = [
   "gunicorn==26.0.0",
   "uvloop==0.22.1",
   "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.33",
   "psycopg2-binary==2.9.9",
   "pytest-celery[redis] (==1.3.0)",
   "sentry-sdk[django] (==2.56.0)",
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.34.0"
+version = "1.34.1"
 
 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.

api/src/backend/api/attack_paths/queries/aws.py

@@ -418,7 +418,8 @@ AWS_APPRUNNER_PRIVESC_UPDATE_SERVICE = AttackPathsQueryDefinition(
         // Find existing App Runner services with roles attached (potential targets)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'tasks.apprunner.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -523,7 +524,8 @@ AWS_BEDROCK_PRIVESC_INVOKE_CODE_INTERPRETER = AttackPathsQueryDefinition(
         // Find roles that trust the Bedrock AgentCore service (already attached to existing code interpreters)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'bedrock-agentcore.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -607,7 +609,8 @@ AWS_CLOUDFORMATION_PRIVESC_UPDATE_STACK = AttackPathsQueryDefinition(
         // Find roles that trust CloudFormation service (already attached to existing stacks)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -753,7 +756,8 @@ AWS_CLOUDFORMATION_PRIVESC_CHANGESET = AttackPathsQueryDefinition(
         // Find roles that trust CloudFormation service (already attached to existing stacks)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'cloudformation.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -844,7 +848,8 @@ AWS_CODEBUILD_PRIVESC_START_BUILD = AttackPathsQueryDefinition(
         // Find roles that trust CodeBuild service (already attached to existing projects)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -880,7 +885,8 @@ AWS_CODEBUILD_PRIVESC_START_BUILD_BATCH = AttackPathsQueryDefinition(
         // Find roles that trust CodeBuild service (already attached to existing projects)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'codebuild.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -1096,7 +1102,8 @@ AWS_EC2_PRIVESC_MODIFY_INSTANCE_ATTRIBUTE = AttackPathsQueryDefinition(
         // Find EC2 instances with instance profiles (potential targets)
         MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -1187,7 +1194,8 @@ AWS_EC2_PRIVESC_LAUNCH_TEMPLATE = AttackPathsQueryDefinition(
         // Find launch templates in the account (potential targets)
         MATCH path_target = (aws)--(template:LaunchTemplate)
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -1223,7 +1231,8 @@ AWS_EC2INSTANCECONNECT_PRIVESC_SEND_SSH_PUBLIC_KEY = AttackPathsQueryDefinition(
         // Find EC2 instances with attached roles (targets for credential theft via IMDS)
         MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -1539,7 +1548,8 @@ AWS_ECS_PRIVESC_EXECUTE_COMMAND = AttackPathsQueryDefinition(
         // Target: roles already attached to running tasks (trust ECS tasks service)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'ecs-tasks.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -1622,7 +1632,8 @@ AWS_GLUE_PRIVESC_UPDATE_DEV_ENDPOINT = AttackPathsQueryDefinition(
         // Find roles that trust Glue service (already attached to existing dev endpoints)
         MATCH path_target = (aws)--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(:AWSPrincipal {{arn: 'glue.amazonaws.com'}})
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -3337,7 +3348,8 @@ AWS_SSM_PRIVESC_START_SESSION = AttackPathsQueryDefinition(
         // Find EC2 instances with attached roles (targets for credential theft via IMDS)
         MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 
@@ -3373,7 +3385,8 @@ AWS_SSM_PRIVESC_SEND_COMMAND = AttackPathsQueryDefinition(
         // Find EC2 instances with attached roles (targets for credential theft via IMDS)
         MATCH path_target = (aws)--(ec2:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(target_role:AWSRole)
 
-        WITH principal_paths + collect(DISTINCT path_target) AS paths
+        WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+        WITH principal_paths + target_paths AS paths
         UNWIND paths AS p
         UNWIND nodes(p) AS n
 

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.34.0
+  version: 1.34.1
   description: |-
     Prowler API specification.
 

api/src/backend/api/sse/channelmanager.py

@@ -16,7 +16,7 @@ if TYPE_CHECKING:
 class SSEChannelManager(DefaultChannelManager):
     """Connect `django-eventstream` to the platform's SSE viewsets."""
 
-    def get_channels_for_request(self, request: Request, view_kwargs: dict) -> set[str]:  # noqa: vulture
+    def get_channels_for_request(self, request: Request, view_kwargs: dict) -> set[str]:
         """Return the request's channels scoped to the active JWT tenant.
 
         Args:
@@ -30,6 +30,7 @@ class SSEChannelManager(DefaultChannelManager):
             The subset of `request.sse_channels` whose embedded tenant
             matches the active request tenant.
         """
+        _ = view_kwargs
         try:
             request_tenant_id = UUID(str(getattr(request, "tenant_id", None)))
         except (TypeError, ValueError):

api/src/backend/api/tests/integration/test_authentication.py

@@ -1,3 +1,4 @@
+import json
 import time
 from datetime import UTC, datetime, timedelta
 from uuid import uuid4
@@ -8,6 +9,10 @@ from conftest import TEST_PASSWORD, get_api_tokens, get_authorization_header
 from django.urls import reverse
 from drf_simple_apikey.crypto import get_crypto
 from rest_framework.test import APIClient
+from rest_framework_simplejwt.token_blacklist.models import (
+    BlacklistedToken,
+    OutstandingToken,
+)
 
 
 @pytest.mark.django_db
@@ -103,6 +108,118 @@ def test_refresh_token(create_test_user, tenants_fixture):
     assert new_refresh_response.status_code == 200
 
 
+@pytest.mark.django_db
+def test_password_change_invalidates_existing_tokens(create_test_user, tenants_fixture):
+    client = APIClient()
+    new_password = "ChangedSecret123@"
+
+    access_token, refresh_token = get_api_tokens(
+        client, create_test_user.email, TEST_PASSWORD
+    )
+    auth_headers = get_authorization_header(access_token)
+    outstanding_token_ids = list(
+        OutstandingToken.objects.filter(user=create_test_user).values_list(
+            "id", flat=True
+        )
+    )
+    assert outstanding_token_ids
+    assert not BlacklistedToken.objects.filter(
+        token_id__in=outstanding_token_ids
+    ).exists()
+
+    password_change_payload = {
+        "data": {
+            "type": "users",
+            "id": str(create_test_user.id),
+            "attributes": {"password": new_password},
+        }
+    }
+    password_change_response = client.patch(
+        reverse("user-detail", kwargs={"pk": create_test_user.id}),
+        data=json.dumps(password_change_payload),
+        headers=auth_headers,
+        content_type="application/vnd.api+json",
+    )
+    assert password_change_response.status_code == 200, password_change_response.json()
+    assert BlacklistedToken.objects.filter(
+        token_id__in=outstanding_token_ids
+    ).count() == len(outstanding_token_ids)
+
+    old_access_response = client.get(reverse("user-me"), headers=auth_headers)
+    assert old_access_response.status_code == 401
+
+    old_refresh_response = client.post(
+        reverse("token-refresh"),
+        data={
+            "data": {
+                "type": "tokens-refresh",
+                "attributes": {"refresh": refresh_token},
+            }
+        },
+        format="vnd.api+json",
+    )
+    assert old_refresh_response.status_code == 400
+
+    new_access_token, _ = get_api_tokens(client, create_test_user.email, new_password)
+    new_access_response = client.get(
+        reverse("user-me"), headers=get_authorization_header(new_access_token)
+    )
+    assert new_access_response.status_code == 200
+
+
+@pytest.mark.django_db
+def test_password_change_invalidates_rotated_refresh_token(
+    create_test_user, tenants_fixture
+):
+    client = APIClient()
+    new_password = "ChangedSecret123@"
+
+    access_token, refresh_token = get_api_tokens(
+        client, create_test_user.email, TEST_PASSWORD
+    )
+    rotated_refresh_response = client.post(
+        reverse("token-refresh"),
+        data={
+            "data": {
+                "type": "tokens-refresh",
+                "attributes": {"refresh": refresh_token},
+            }
+        },
+        format="vnd.api+json",
+    )
+    assert rotated_refresh_response.status_code == 200
+    rotated_refresh_token = rotated_refresh_response.json()["data"]["attributes"][
+        "refresh"
+    ]
+
+    password_change_payload = {
+        "data": {
+            "type": "users",
+            "id": str(create_test_user.id),
+            "attributes": {"password": new_password},
+        }
+    }
+    password_change_response = client.patch(
+        reverse("user-detail", kwargs={"pk": create_test_user.id}),
+        data=json.dumps(password_change_payload),
+        headers=get_authorization_header(access_token),
+        content_type="application/vnd.api+json",
+    )
+    assert password_change_response.status_code == 200, password_change_response.json()
+
+    old_rotated_refresh_response = client.post(
+        reverse("token-refresh"),
+        data={
+            "data": {
+                "type": "tokens-refresh",
+                "attributes": {"refresh": rotated_refresh_token},
+            }
+        },
+        format="vnd.api+json",
+    )
+    assert old_rotated_refresh_response.status_code == 400
+
+
 @pytest.mark.django_db
 def test_user_me_when_inviting_users(create_test_user, tenants_fixture, roles_fixture):
     client = APIClient()
@@ -189,6 +306,8 @@ def test_user_me_when_inviting_users(create_test_user, tenants_fixture, roles_fi
 class TestTokenSwitchTenant:
     def test_switch_tenant_with_valid_token(self, tenants_fixture, providers_fixture):
         client = APIClient()
+        aws_provider = providers_fixture[0]
+        assert aws_provider
 
         test_user = "test_email@prowler.com"
         test_password = "Test_password1@"
@@ -1403,6 +1522,8 @@ class TestAPIKeyMultiTenantWorkflows:
         Verifies RLS enforcement after authentication ensures tenant isolation.
         """
         client = APIClient()
+        aws_provider = providers_fixture[0]
+        assert aws_provider
 
         user1 = User.objects.create_user(
             name="tenant1_user",

api/src/backend/api/tests/test_validators.py

@@ -0,0 +1,246 @@
+import socket
+
+import pytest
+from api.validators import (
+    resolve_lighthouse_openai_compatible_host,
+    validate_lighthouse_openai_compatible_base_url,
+)
+from django.core.exceptions import ValidationError
+from django.test import override_settings
+
+
+def test_lighthouse_base_url_rejects_http_scheme():
+    with pytest.raises(ValidationError, match="HTTPS"):
+        validate_lighthouse_openai_compatible_base_url(
+            "http://openrouter.ai/api/v1",
+            resolve_dns=False,
+        )
+
+
+@pytest.mark.parametrize(
+    "base_url",
+    [
+        "https://openrouter.ai:0/api/v1",
+        "https://openrouter.ai:-1/api/v1",
+        "https://openrouter.ai:65536/api/v1",
+        "https://openrouter.ai:invalid/api/v1",
+    ],
+)
+def test_lighthouse_base_url_rejects_invalid_port(base_url):
+    with pytest.raises(ValidationError, match="port is invalid"):
+        validate_lighthouse_openai_compatible_base_url(
+            base_url,
+            resolve_dns=False,
+        )
+
+
+@pytest.mark.parametrize("port", [1, 65535])
+def test_lighthouse_base_url_accepts_valid_port_boundaries(port):
+    assert (
+        validate_lighthouse_openai_compatible_base_url(
+            f"https://openrouter.ai:{port}/api/v1",
+            resolve_dns=False,
+        )
+        is None
+    )
+
+
+def test_lighthouse_base_url_rejects_localhost():
+    with pytest.raises(ValidationError, match="external public endpoint"):
+        validate_lighthouse_openai_compatible_base_url(
+            "https://localhost/v1",
+            resolve_dns=False,
+        )
+
+
+@pytest.mark.parametrize("ip_address", ["10.0.0.1", "172.16.0.1", "192.168.1.1"])
+def test_lighthouse_base_url_rejects_private_ip_literal(ip_address):
+    with pytest.raises(ValidationError, match="external public endpoint"):
+        validate_lighthouse_openai_compatible_base_url(
+            f"https://{ip_address}/v1",
+            resolve_dns=False,
+        )
+
+
+def test_lighthouse_base_url_rejects_metadata_ip_literal():
+    with pytest.raises(ValidationError, match="external public endpoint"):
+        validate_lighthouse_openai_compatible_base_url(
+            "https://169.254.169.254/latest/meta-data",
+            resolve_dns=False,
+        )
+
+
+@pytest.mark.parametrize(
+    "base_url",
+    [
+        "https://[::ffff:169.254.169.254]/v1",
+        "https://[64:ff9b::a9fe:a9fe]/v1",
+        "https://[2002:a9fe:a9fe::]/v1",
+    ],
+)
+def test_lighthouse_base_url_rejects_embedded_non_global_ip(base_url):
+    with pytest.raises(ValidationError, match="external public endpoint"):
+        validate_lighthouse_openai_compatible_base_url(
+            base_url,
+            resolve_dns=False,
+        )
+
+
+@pytest.mark.parametrize(
+    "base_url",
+    [
+        "https://[::ffff:93.184.216.34]/v1",
+        "https://[64:ff9b::5db8:d822]/v1",
+        "https://[2002:5db8:d822::]/v1",
+    ],
+)
+def test_lighthouse_base_url_accepts_embedded_public_ip(base_url):
+    assert (
+        validate_lighthouse_openai_compatible_base_url(
+            base_url,
+            resolve_dns=False,
+        )
+        is None
+    )
+
+
+def test_lighthouse_base_url_accepts_hostname_without_dns_resolution():
+    assert (
+        validate_lighthouse_openai_compatible_base_url(
+            "https://openrouter.ai/api/v1",
+            resolve_dns=False,
+        )
+        is None
+    )
+
+
+def test_lighthouse_base_url_rejects_post_dns_internal_address(monkeypatch):
+    def resolve_to_metadata(*_args, **_kwargs):
+        return [
+            (
+                socket.AF_INET,
+                socket.SOCK_STREAM,
+                6,
+                "",
+                ("169.254.169.254", 443),
+            )
+        ]
+
+    monkeypatch.setattr("api.validators.socket.getaddrinfo", resolve_to_metadata)
+
+    with pytest.raises(ValidationError, match="external public endpoint"):
+        validate_lighthouse_openai_compatible_base_url(
+            "https://metadata.example.test/v1"
+        )
+
+
+def test_lighthouse_base_url_accepts_public_resolved_address(monkeypatch):
+    def resolve_to_public(*_args, **_kwargs):
+        return [
+            (
+                socket.AF_INET,
+                socket.SOCK_STREAM,
+                6,
+                "",
+                ("93.184.216.34", 443),
+            )
+        ]
+
+    monkeypatch.setattr("api.validators.socket.getaddrinfo", resolve_to_public)
+
+    assert (
+        validate_lighthouse_openai_compatible_base_url("https://openrouter.ai/api/v1")
+        is None
+    )
+
+
+@override_settings(
+    LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_base_url_accepts_allowlisted_host_without_resolution(monkeypatch):
+    def fail_resolution(*_args, **_kwargs):
+        raise AssertionError("allowlisted hosts must not be resolved")
+
+    monkeypatch.setattr("api.validators.socket.getaddrinfo", fail_resolution)
+
+    assert (
+        validate_lighthouse_openai_compatible_base_url(
+            "https://custom-openai.internal/v1"
+        )
+        is None
+    )
+
+
+@override_settings(
+    LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_resolve_returns_allowlisted_hostname_unpinned():
+    assert resolve_lighthouse_openai_compatible_host(
+        "Custom-OpenAI.internal.", 443
+    ) == ("custom-openai.internal",)
+
+
+@override_settings(LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["localhost"])
+def test_lighthouse_base_url_accepts_allowlisted_blocked_host():
+    assert (
+        validate_lighthouse_openai_compatible_base_url(
+            "https://localhost/v1",
+            resolve_dns=False,
+        )
+        is None
+    )
+
+
+@override_settings(LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["10.0.0.1"])
+def test_lighthouse_base_url_accepts_allowlisted_private_ip_literal():
+    assert (
+        validate_lighthouse_openai_compatible_base_url(
+            "https://10.0.0.1/v1",
+            resolve_dns=False,
+        )
+        is None
+    )
+
+
+@override_settings(
+    LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=[" Custom-OpenAI.Internal. "]
+)
+def test_lighthouse_allowlist_entries_are_normalized():
+    assert (
+        validate_lighthouse_openai_compatible_base_url(
+            "https://custom-openai.internal/v1",
+            resolve_dns=False,
+        )
+        is None
+    )
+
+
+@override_settings(
+    LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_base_url_rejects_host_not_in_allowlist():
+    with pytest.raises(ValidationError, match="external public endpoint"):
+        validate_lighthouse_openai_compatible_base_url(
+            "https://localhost/v1",
+            resolve_dns=False,
+        )
+
+
+@override_settings(LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=[""])
+def test_lighthouse_allowlist_ignores_empty_entries():
+    with pytest.raises(ValidationError, match="external public endpoint"):
+        validate_lighthouse_openai_compatible_base_url(
+            "https://localhost/v1",
+            resolve_dns=False,
+        )
+
+
+@override_settings(
+    LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=["custom-openai.internal"]
+)
+def test_lighthouse_base_url_allowlisted_host_still_requires_https():
+    with pytest.raises(ValidationError, match="HTTPS"):
+        validate_lighthouse_openai_compatible_base_url(
+            "http://custom-openai.internal/v1",
+            resolve_dns=False,
+        )

api/src/backend/api/tests/test_views.py

@@ -17130,6 +17130,76 @@ class TestLighthouseProviderConfigViewSet:
         error_detail = str(resp.json()).lower()
         assert "base_url" in error_detail
 
+    @pytest.mark.parametrize(
+        "base_url",
+        [
+            "https://127.0.0.1/v1",
+            "https://169.254.169.254/latest/meta-data",
+        ],
+    )
+    def test_openai_compatible_rejects_internal_base_url_on_create(
+        self, authenticated_client, base_url
+    ):
+        payload = {
+            "data": {
+                "type": "lighthouse-providers",
+                "attributes": {
+                    "provider_type": "openai_compatible",
+                    "base_url": base_url,
+                    "credentials": {"api_key": "compat-key"},
+                },
+            }
+        }
+
+        resp = authenticated_client.post(
+            reverse("lighthouse-providers-list"),
+            data=payload,
+            content_type=API_JSON_CONTENT_TYPE,
+        )
+
+        assert resp.status_code == status.HTTP_400_BAD_REQUEST
+        assert "base_url" in str(resp.json()).lower()
+
+    def test_openai_compatible_rejects_internal_base_url_on_update(
+        self, authenticated_client
+    ):
+        create_payload = {
+            "data": {
+                "type": "lighthouse-providers",
+                "attributes": {
+                    "provider_type": "openai_compatible",
+                    "base_url": "https://openrouter.ai/api/v1",
+                    "credentials": {"api_key": "compat-key-123"},
+                },
+            }
+        }
+        create_resp = authenticated_client.post(
+            reverse("lighthouse-providers-list"),
+            data=create_payload,
+            content_type=API_JSON_CONTENT_TYPE,
+        )
+        assert create_resp.status_code == status.HTTP_201_CREATED
+        provider_id = create_resp.json()["data"]["id"]
+
+        patch_payload = {
+            "data": {
+                "type": "lighthouse-providers",
+                "id": provider_id,
+                "attributes": {
+                    "base_url": "https://169.254.169.254/latest/meta-data",
+                },
+            }
+        }
+
+        patch_resp = authenticated_client.patch(
+            reverse("lighthouse-providers-detail", kwargs={"pk": provider_id}),
+            data=patch_payload,
+            content_type=API_JSON_CONTENT_TYPE,
+        )
+
+        assert patch_resp.status_code == status.HTTP_400_BAD_REQUEST
+        assert "base_url" in str(patch_resp.json()).lower()
+
     def test_openai_compatible_invalid_credentials(self, authenticated_client):
         payload = {
             "data": {

api/src/backend/api/v1/serializer_utils/authentication.py

@@ -0,0 +1,18 @@
+from api.db_router import MainRouter
+from rest_framework_simplejwt.token_blacklist.models import (
+    BlacklistedToken,
+    OutstandingToken,
+)
+
+
+def blacklist_user_refresh_tokens(user_id):
+    outstanding_token_ids = list(
+        OutstandingToken.objects.using(MainRouter.admin_db)
+        .filter(user_id=user_id)
+        .values_list("id", flat=True)
+    )
+    if outstanding_token_ids:
+        BlacklistedToken.objects.using(MainRouter.admin_db).bulk_create(
+            [BlacklistedToken(token_id=token_id) for token_id in outstanding_token_ids],
+            ignore_conflicts=True,
+        )

api/src/backend/api/v1/serializers.py

@@ -38,6 +38,7 @@ from api.models import (
     UserRoleRelationship,
 )
 from api.rls import Tenant
+from api.v1.serializer_utils.authentication import blacklist_user_refresh_tokens
 from api.v1.serializer_utils.integrations import (
     AWSCredentialSerializer,
     IntegrationConfigField,
@@ -56,12 +57,13 @@ from api.v1.serializer_utils.lighthouse import (
 )
 from api.v1.serializer_utils.processors import ProcessorConfigField
 from api.v1.serializer_utils.providers import ProviderSecretField
+from api.validators import validate_lighthouse_openai_compatible_base_url
 from django.conf import settings
 from django.contrib.auth import authenticate
 from django.contrib.auth.models import update_last_login
 from django.contrib.auth.password_validation import validate_password
 from django.core.exceptions import ValidationError as DjangoValidationError
-from django.db import IntegrityError
+from django.db import IntegrityError, transaction
 from drf_spectacular.utils import extend_schema_field
 from jwt.exceptions import InvalidKeyError
 from prowler.lib.mutelist.mutelist import Mutelist
@@ -72,11 +74,28 @@ from rest_framework_json_api.relations import SerializerMethodResourceRelatedFie
 from rest_framework_json_api.serializers import ValidationError
 from rest_framework_simplejwt.exceptions import TokenError
 from rest_framework_simplejwt.serializers import TokenObtainPairSerializer
+from rest_framework_simplejwt.settings import api_settings
 from rest_framework_simplejwt.tokens import RefreshToken
+from rest_framework_simplejwt.utils import get_md5_hash_password
 
 # Base
 
 
+def _validate_lighthouse_base_url_without_dns(base_url: str) -> None:
+    try:
+        validate_lighthouse_openai_compatible_base_url(base_url, resolve_dns=False)
+    except DjangoValidationError as error:
+        raise ValidationError({"base_url": error.messages[0]}) from error
+
+
+def _reraise_lighthouse_credentials_errors(error: ValidationError) -> None:
+    details = error.detail.copy()
+    for key, value in details.items():
+        error.detail[f"credentials/{key}"] = value
+        del error.detail[key]
+    raise error
+
+
 class BaseModelSerializerV1(serializers.ModelSerializer):
     def get_root_meta(self, _resource, _many):
         return {"version": "v1"}
@@ -232,6 +251,18 @@ class TokenRefreshSerializer(BaseSerializerV1):
         try:
             # Validate the refresh token
             refresh = RefreshToken(refresh_token)
+            if api_settings.CHECK_REVOKE_TOKEN:
+                user_id = refresh.payload.get(api_settings.USER_ID_CLAIM)
+                try:
+                    user = User.objects.using(MainRouter.admin_db).get(
+                        **{api_settings.USER_ID_FIELD: user_id}
+                    )
+                except User.DoesNotExist:
+                    raise TokenError("User not found.") from None
+                if refresh.get(api_settings.REVOKE_TOKEN_CLAIM) != (
+                    get_md5_hash_password(user.password)
+                ):
+                    raise TokenError("The user's password has been changed.")
             # Generate new access token
             access_token = refresh.access_token
 
@@ -405,7 +436,13 @@ class UserUpdateSerializer(BaseWriteSerializer):
         password = validated_data.pop("password", None)
         if password:
             validate_password(password, user=instance)
-            instance.set_password(password)
+            with transaction.atomic(using=MainRouter.admin_db):
+                instance.set_password(password)
+                for attr, value in validated_data.items():
+                    setattr(instance, attr, value)
+                blacklist_user_refresh_tokens(instance.id)
+                instance.save(using=MainRouter.admin_db)
+                return instance
         return super().update(instance, validated_data)
 
 
@@ -3624,11 +3661,7 @@ class LighthouseProviderConfigCreateSerializer(RLSSerializer, BaseWriteSerialize
                     raise_exception=True
                 )
             except ValidationError as e:
-                details = e.detail.copy()
-                for key, value in details.items():
-                    e.detail[f"credentials/{key}"] = value
-                    del e.detail[key]
-                raise e
+                _reraise_lighthouse_credentials_errors(e)
         elif (
             provider_type == LighthouseProviderConfiguration.LLMProviderChoices.BEDROCK
         ):
@@ -3637,27 +3670,20 @@ class LighthouseProviderConfigCreateSerializer(RLSSerializer, BaseWriteSerialize
                     raise_exception=True
                 )
             except ValidationError as e:
-                details = e.detail.copy()
-                for key, value in details.items():
-                    e.detail[f"credentials/{key}"] = value
-                    del e.detail[key]
-                raise e
+                _reraise_lighthouse_credentials_errors(e)
         elif (
             provider_type
             == LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE
         ):
             if not base_url:
                 raise ValidationError({"base_url": "Base URL is required."})
+            _validate_lighthouse_base_url_without_dns(base_url)
             try:
                 OpenAICompatibleCredentialsSerializer(data=credentials).is_valid(
                     raise_exception=True
                 )
             except ValidationError as e:
-                details = e.detail.copy()
-                for key, value in details.items():
-                    e.detail[f"credentials/{key}"] = value
-                    del e.detail[key]
-                raise e
+                _reraise_lighthouse_credentials_errors(e)
 
         return super().validate(attrs)
 
@@ -3720,11 +3746,7 @@ class LighthouseProviderConfigUpdateSerializer(BaseWriteSerializer):
                     raise_exception=True
                 )
             except ValidationError as e:
-                details = e.detail.copy()
-                for key, value in details.items():
-                    e.detail[f"credentials/{key}"] = value
-                    del e.detail[key]
-                raise e
+                _reraise_lighthouse_credentials_errors(e)
         elif (
             credentials is not None
             and provider_type
@@ -3748,11 +3770,7 @@ class LighthouseProviderConfigUpdateSerializer(BaseWriteSerializer):
                     raise_exception=True
                 )
             except ValidationError as e:
-                details = e.detail.copy()
-                for key, value in details.items():
-                    e.detail[f"credentials/{key}"] = value
-                    del e.detail[key]
-                raise e
+                _reraise_lighthouse_credentials_errors(e)
 
             # Then enforce invariants about not changing the auth method
             # If the existing config uses an API key, forbid introducing access keys.
@@ -3779,24 +3797,23 @@ class LighthouseProviderConfigUpdateSerializer(BaseWriteSerializer):
                     }
                 )
         elif (
-            credentials is not None
-            and provider_type
+            provider_type
             == LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE
         ):
-            if base_url is None:
-                pass
-            elif not base_url:
+            effective_base_url = (
+                base_url if "base_url" in attrs else getattr(self.instance, "base_url")
+            )
+            if not effective_base_url:
                 raise ValidationError({"base_url": "Base URL cannot be empty."})
-            try:
-                OpenAICompatibleCredentialsSerializer(data=credentials).is_valid(
-                    raise_exception=True
-                )
-            except ValidationError as e:
-                details = e.detail.copy()
-                for key, value in details.items():
-                    e.detail[f"credentials/{key}"] = value
-                    del e.detail[key]
-                raise e
+            if "base_url" in attrs:
+                _validate_lighthouse_base_url_without_dns(effective_base_url)
+            if credentials is not None:
+                try:
+                    OpenAICompatibleCredentialsSerializer(data=credentials).is_valid(
+                        raise_exception=True
+                    )
+                except ValidationError as e:
+                    _reraise_lighthouse_credentials_errors(e)
 
         return super().validate(attrs)
 

api/src/backend/api/validators.py

@@ -1,14 +1,155 @@
+import ipaddress
+import socket
 import string
+from urllib.parse import urlparse
 
+from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.utils.translation import gettext as _
 
+LIGHTHOUSE_OPENAI_COMPATIBLE_ALLOWED_SCHEMES = frozenset({"https"})
+LIGHTHOUSE_NAT64_WELL_KNOWN_PREFIX = ipaddress.IPv6Network("64:ff9b::/96")
+LIGHTHOUSE_BLOCKED_METADATA_HOSTS = frozenset(
+    {
+        "169.254.169.254",
+        "169.254.170.2",
+        "fd00:ec2::254",
+        "localhost",
+        "metadata.google.internal",
+    }
+)
+
+
+def _normalize_hostname(hostname: str) -> str:
+    return hostname.rstrip(".").lower()
+
+
+def _lighthouse_openai_compatible_allowed_hosts() -> frozenset[str]:
+    return frozenset(
+        _normalize_hostname(allowed_host.strip())
+        for allowed_host in settings.LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS
+        if allowed_host and allowed_host.strip()
+    )
+
+
+def _validate_lighthouse_public_ip(address: str) -> None:
+    ip_address = ipaddress.ip_address(address)
+    if isinstance(ip_address, ipaddress.IPv6Address):
+        # Classify transition addresses by their effective IPv4 destination.
+        embedded_ip_address = ip_address.ipv4_mapped or ip_address.sixtofour
+        if (
+            embedded_ip_address is None
+            and ip_address in LIGHTHOUSE_NAT64_WELL_KNOWN_PREFIX
+        ):
+            embedded_ip_address = ipaddress.IPv4Address(int(ip_address) & 0xFFFFFFFF)
+        if embedded_ip_address is not None:
+            ip_address = embedded_ip_address
+    if not ip_address.is_global:
+        raise ValidationError(
+            _("Base URL must use an external public endpoint."),
+            code="lighthouse_base_url_not_public",
+        )
+
+
+def resolve_lighthouse_openai_compatible_host(
+    hostname: str,
+    port: int,
+    *,
+    resolve_dns: bool = True,
+) -> tuple[str, ...]:
+    """Return public IP addresses that are safe for Lighthouse outbound use."""
+    hostname = _normalize_hostname(hostname)
+    if hostname in _lighthouse_openai_compatible_allowed_hosts():
+        # Operator-allowlisted hosts skip the public-endpoint checks; returning
+        # the hostname makes the network backend connect through regular DNS
+        # resolution instead of pinned addresses.
+        return (hostname,)
+
+    if hostname in LIGHTHOUSE_BLOCKED_METADATA_HOSTS or hostname.endswith(".localhost"):
+        raise ValidationError(
+            _("Base URL must use an external public endpoint."),
+            code="lighthouse_base_url_blocked_host",
+        )
+
+    try:
+        _validate_lighthouse_public_ip(hostname)
+    except ValueError:
+        if not resolve_dns:
+            return ()
+    else:
+        return (hostname,)
+
+    try:
+        resolved_addresses = socket.getaddrinfo(hostname, port, type=socket.SOCK_STREAM)
+    except socket.gaierror as error:
+        raise ValidationError(
+            _("Base URL host could not be resolved."),
+            code="lighthouse_base_url_resolution_failed",
+        ) from error
+
+    if not resolved_addresses:
+        raise ValidationError(
+            _("Base URL host could not be resolved."),
+            code="lighthouse_base_url_resolution_failed",
+        )
+
+    public_addresses: list[str] = []
+    for resolved_address in resolved_addresses:
+        socket_address = resolved_address[4]
+        resolved_ip_address = socket_address[0]
+        _validate_lighthouse_public_ip(resolved_ip_address)
+        if resolved_ip_address not in public_addresses:
+            public_addresses.append(resolved_ip_address)
+
+    return tuple(public_addresses)
+
+
+def validate_lighthouse_openai_compatible_base_url(
+    base_url: str,
+    *,
+    resolve_dns: bool = True,
+) -> None:
+    """Validate an OpenAI-compatible Lighthouse base URL before outbound use."""
+    parsed = urlparse(str(base_url))
+    if parsed.scheme.lower() not in LIGHTHOUSE_OPENAI_COMPATIBLE_ALLOWED_SCHEMES:
+        raise ValidationError(
+            _("Base URL must use HTTPS."),
+            code="lighthouse_base_url_invalid_scheme",
+        )
+
+    if not parsed.hostname:
+        raise ValidationError(
+            _("Base URL must include a host."),
+            code="lighthouse_base_url_missing_host",
+        )
+
+    try:
+        port = parsed.port
+    except ValueError as error:
+        raise ValidationError(
+            _("Base URL port is invalid."),
+            code="lighthouse_base_url_invalid_port",
+        ) from error
+
+    if port is not None and not 1 <= port <= 65535:
+        raise ValidationError(
+            _("Base URL port is invalid."),
+            code="lighthouse_base_url_invalid_port",
+        )
+
+    resolve_lighthouse_openai_compatible_host(
+        parsed.hostname,
+        port or 443,
+        resolve_dns=resolve_dns,
+    )
+
 
 class MaximumLengthValidator:
     def __init__(self, max_length=72):
         self.max_length = max_length
 
     def validate(self, password, user=None):
+        del user
         if len(password) > self.max_length:
             raise ValidationError(
                 _(
@@ -31,6 +172,7 @@ class SpecialCharactersValidator:
         self.min_special_characters = min_special_characters
 
     def validate(self, password, user=None):
+        del user
         if (
             sum(1 for char in password if char in self.special_characters)
             < self.min_special_characters
@@ -55,6 +197,7 @@ class UppercaseValidator:
         self.min_uppercase = min_uppercase
 
     def validate(self, password, user=None):
+        del user
         if sum(1 for char in password if char.isupper()) < self.min_uppercase:
             raise ValidationError(
                 _(
@@ -75,6 +218,7 @@ class LowercaseValidator:
         self.min_lowercase = min_lowercase
 
     def validate(self, password, user=None):
+        del user
         if sum(1 for char in password if char.islower()) < self.min_lowercase:
             raise ValidationError(
                 _(
@@ -95,6 +239,7 @@ class NumericValidator:
         self.min_numeric = min_numeric
 
     def validate(self, password, user=None):
+        del user
         if sum(1 for char in password if char.isdigit()) < self.min_numeric:
             raise ValidationError(
                 _(

api/src/backend/config/django/base.py

@@ -230,6 +230,7 @@ SIMPLE_JWT = {
     "JTI_CLAIM": "jti",
     "USER_ID_FIELD": "id",
     "USER_ID_CLAIM": "sub",
+    "CHECK_REVOKE_TOKEN": True,
     # Issuer and Audience claims, for the moment we will keep these values as default values, they may change in the
     # future.
     "AUDIENCE": env.str("DJANGO_JWT_AUDIENCE", "https://api.prowler.com"),
@@ -316,6 +317,15 @@ ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES = env.int(
 # Valid values: "neo4j" (default, OSS and local dev), "neptune" (hosted).
 ATTACK_PATHS_SINK_DATABASE = env.str("ATTACK_PATHS_SINK_DATABASE", default="neo4j")
 
+# Lighthouse AI
+# Comma-separated hostnames (or IP literals) that bypass the SSRF validation
+# applied to OpenAI-compatible provider base URLs, so self-hosted deployments
+# can point Lighthouse AI at internal endpoints. Empty by default: every base
+# URL must resolve to a public endpoint.
+LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS = env.list(
+    "LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS", default=[]
+)
+
 # Orphan task recovery feature flags. The master switch is OFF by default, so task
 # recovery is opt-in; enable it with DJANGO_TASK_RECOVERY_ENABLED=true. The per-group
 # toggles default to enabled, so once the master is on every group recovers unless a

api/src/backend/tasks/jobs/integrations.py

@@ -14,6 +14,7 @@ from prowler.lib.outputs.compliance.generic.generic import GenericCompliance
 from prowler.lib.outputs.csv.csv import CSV
 from prowler.lib.outputs.finding import Finding as FindingOutput
 from prowler.lib.outputs.html.html import HTML
+from prowler.lib.outputs.jira.exceptions.exceptions import JiraBaseException
 from prowler.lib.outputs.ocsf.ocsf import OCSF
 from prowler.providers.aws.aws_provider import AwsProvider
 from prowler.providers.aws.lib.s3.s3 import S3
@@ -26,6 +27,8 @@ from tasks.utils import batched
 
 logger = get_task_logger(__name__)
 
+JIRA_GENERIC_SEND_ERROR = "Failed to create Jira issue."
+
 
 def get_s3_client_from_integration(
     integration: Integration,
@@ -483,6 +486,7 @@ def send_findings_to_jira(
         jira_integration = initialize_prowler_integration(integration)
 
     num_tickets_created = 0
+    error_messages = []
     for finding_id in finding_ids:
         with rls_transaction(tenant_id):
             finding_instance = (
@@ -512,35 +516,54 @@ def send_findings_to_jira(
             recommendation = remediation.get("recommendation", {})
             remediation_code = remediation.get("code", {})
 
-            # Send the individual finding to Jira
-            result = jira_integration.send_finding(
-                check_id=finding_instance.check_id,
-                check_title=check_metadata.get("checktitle", ""),
-                severity=finding_instance.severity,
-                status=finding_instance.status,
-                status_extended=finding_instance.status_extended or "",
-                provider=finding_instance.scan.provider.provider,
-                region=region,
-                resource_uid=resource_uid,
-                resource_name=resource_name,
-                risk=check_metadata.get("risk", ""),
-                recommendation_text=recommendation.get("text", ""),
-                recommendation_url=recommendation.get("url", ""),
-                remediation_code_native_iac=remediation_code.get("nativeiac", ""),
-                remediation_code_terraform=remediation_code.get("terraform", ""),
-                remediation_code_cli=remediation_code.get("cli", ""),
-                remediation_code_other=remediation_code.get("other", ""),
-                resource_tags=resource_tags,
-                compliance=finding_instance.compliance or {},
-                project_key=project_key,
-                issue_type=issue_type,
-            )
+            try:
+                # Send the individual finding to Jira
+                result = jira_integration.send_finding(
+                    check_id=finding_instance.check_id,
+                    check_title=check_metadata.get("checktitle", ""),
+                    severity=finding_instance.severity,
+                    status=finding_instance.status,
+                    status_extended=finding_instance.status_extended or "",
+                    provider=finding_instance.scan.provider.provider,
+                    region=region,
+                    resource_uid=resource_uid,
+                    resource_name=resource_name,
+                    risk=check_metadata.get("risk", ""),
+                    recommendation_text=recommendation.get("text", ""),
+                    recommendation_url=recommendation.get("url", ""),
+                    remediation_code_native_iac=remediation_code.get("nativeiac", ""),
+                    remediation_code_terraform=remediation_code.get("terraform", ""),
+                    remediation_code_cli=remediation_code.get("cli", ""),
+                    remediation_code_other=remediation_code.get("other", ""),
+                    resource_tags=resource_tags,
+                    compliance=finding_instance.compliance or {},
+                    project_key=project_key,
+                    issue_type=issue_type,
+                )
+            except JiraBaseException as error:
+                error_message = error.message or JIRA_GENERIC_SEND_ERROR
+                logger.exception(
+                    "Failed to send finding %s to Jira: %s", finding_id, error_message
+                )
+                error_messages.append(error_message)
+                continue
+            except Exception:
+                logger.exception("Failed to send finding %s to Jira", finding_id)
+                error_messages.append(JIRA_GENERIC_SEND_ERROR)
+                continue
+
             if result:
                 num_tickets_created += 1
             else:
-                logger.error(f"Failed to send finding {finding_id} to Jira")
+                error_message = JIRA_GENERIC_SEND_ERROR
+                logger.error(error_message)
+                error_messages.append(error_message)
 
-    return {
+    result = {
         "created_count": num_tickets_created,
         "failed_count": len(finding_ids) - num_tickets_created,
     }
+    if error_messages:
+        result["error"] = "; ".join(dict.fromkeys(error_messages))
+
+    return result

api/src/backend/tasks/jobs/lighthouse_providers.py

@@ -1,6 +1,15 @@
+import ssl
+from collections.abc import Iterable
+
 import boto3
+import httpcore
+import httpx
 import openai
 from api.models import LighthouseProviderConfiguration, LighthouseProviderModels
+from api.validators import (
+    resolve_lighthouse_openai_compatible_host,
+    validate_lighthouse_openai_compatible_base_url,
+)
 from botocore import UNSIGNED
 from botocore.config import Config
 from botocore.exceptions import BotoCoreError, ClientError
@@ -43,6 +52,90 @@ EXCLUDED_OPENAI_MODEL_SUBSTRINGS = (
     "-instruct",  # Legacy instruct models (gpt-3.5-turbo-instruct, etc.)
 )
 
+OPENAI_COMPATIBLE_AUTHENTICATION_ERROR = "API key is invalid or missing"
+OPENAI_COMPATIBLE_CONNECTION_ERROR = "Provider connection failed"
+
+
+class _OpenAICompatibleProviderError(Exception):
+    """Sanitized OpenAI-compatible provider error safe for task results."""
+
+
+def _sanitize_openai_compatible_error(error: Exception) -> str:
+    status_code = getattr(error, "status_code", None)
+    if status_code is None:
+        response = getattr(error, "response", None)
+        status_code = getattr(response, "status_code", None)
+
+    if status_code == 401:
+        return OPENAI_COMPATIBLE_AUTHENTICATION_ERROR
+    return OPENAI_COMPATIBLE_CONNECTION_ERROR
+
+
+class _LighthouseOpenAICompatibleNetworkBackend(httpcore.SyncBackend):
+    """Validate and pin DNS results immediately before TCP connections."""
+
+    def connect_tcp(
+        self,
+        host: str,
+        port: int,
+        timeout: float | None = None,
+        local_address: str | None = None,
+        socket_options: Iterable[httpcore.SOCKET_OPTION] | None = None,
+    ) -> httpcore.NetworkStream:
+        resolved_addresses = resolve_lighthouse_openai_compatible_host(host, port)
+        last_error: httpcore.ConnectError | httpcore.ConnectTimeout | None = None
+
+        for address in resolved_addresses:
+            try:
+                return super().connect_tcp(
+                    address,
+                    port,
+                    timeout=timeout,
+                    local_address=local_address,
+                    socket_options=socket_options,
+                )
+            except (httpcore.ConnectError, httpcore.ConnectTimeout) as error:
+                last_error = error
+
+        if last_error:
+            raise last_error
+        raise httpcore.ConnectError("No resolved addresses are available")
+
+
+class _LighthouseOpenAICompatibleHTTPTransport(httpx.HTTPTransport):
+    """HTTP transport that connects only to validated public IP addresses."""
+
+    def __init__(self) -> None:
+        self._pool = httpcore.ConnectionPool(
+            ssl_context=ssl.create_default_context(),
+            network_backend=_LighthouseOpenAICompatibleNetworkBackend(),
+        )
+
+
+def _create_openai_compatible_http_client() -> httpx.Client:
+    """Create the restricted HTTP client used for OpenAI-compatible providers."""
+    return httpx.Client(
+        follow_redirects=False,
+        trust_env=False,
+        transport=_LighthouseOpenAICompatibleHTTPTransport(),
+    )
+
+
+def _list_openai_compatible_models(base_url: str, api_key: str):
+    validate_lighthouse_openai_compatible_base_url(base_url)
+    try:
+        with _create_openai_compatible_http_client() as http_client:
+            client = openai.OpenAI(
+                api_key=api_key,
+                base_url=base_url,
+                http_client=http_client,
+            )
+            return client.models.list()
+    except Exception as error:
+        raise _OpenAICompatibleProviderError(
+            _sanitize_openai_compatible_error(error)
+        ) from error
+
 
 def _extract_error_message(e: Exception) -> str:
     """
@@ -114,6 +207,7 @@ def _extract_openai_compatible_params(
         return None
     if not isinstance(base_url, str) or not base_url:
         return None
+    validate_lighthouse_openai_compatible_base_url(base_url, resolve_dns=False)
     return {"base_url": base_url, "api_key": api_key}
 
 
@@ -285,13 +379,7 @@ def check_lighthouse_provider_connection(provider_config_id: str) -> dict:
                     "error": "Base URL or API key is invalid or missing",
                 }
 
-            # Test connection using OpenAI SDK with custom base_url
-            # Note: base_url should include version (e.g., https://openrouter.ai/api/v1)
-            client = openai.OpenAI(
-                api_key=params["api_key"],
-                base_url=params["base_url"],
-            )
-            _ = client.models.list()
+            _ = _list_openai_compatible_models(params["base_url"], params["api_key"])
 
         else:
             return {"connected": False, "error": "Unsupported provider type"}
@@ -361,8 +449,7 @@ def _fetch_openai_compatible_models(base_url: str, api_key: str) -> dict[str, st
 
     Note: base_url should include version (e.g., https://openrouter.ai/api/v1)
     """
-    client = openai.OpenAI(api_key=api_key, base_url=base_url)
-    models = client.models.list()
+    models = _list_openai_compatible_models(base_url, api_key)
 
     available_models: dict[str, str] = {}
     for model in models.data:

api/src/backend/tasks/tests/test_integrations.py

@@ -5,6 +5,10 @@ from api.db_router import READ_REPLICA_ALIAS, MainRouter
 from api.models import Integration
 from api.utils import prowler_integration_connection_test
 from django.db import OperationalError
+from prowler.lib.outputs.jira.exceptions.exceptions import (
+    JiraRefreshTokenError,
+    JiraRequiredCustomFieldsError,
+)
 from prowler.providers.aws.lib.security_hub.security_hub import SecurityHubConnection
 from prowler.providers.common.models import Connection
 from tasks.jobs.integrations import (
@@ -1830,10 +1834,213 @@ class TestJiraIntegration:
         )
 
         # Assertions
-        assert result == {"created_count": 2, "failed_count": 1}
+        assert result == {
+            "created_count": 2,
+            "failed_count": 1,
+            "error": "Failed to create Jira issue.",
+        }
 
         # Verify error was logged for the failed finding
-        mock_logger.error.assert_called_with("Failed to send finding finding-2 to Jira")
+        mock_logger.error.assert_called_with("Failed to create Jira issue.")
+
+    @patch("tasks.jobs.integrations.rls_transaction")
+    @patch("tasks.jobs.integrations.Finding")
+    @patch("tasks.jobs.integrations.Integration")
+    @patch("tasks.jobs.integrations.initialize_prowler_integration")
+    @patch("tasks.jobs.integrations.logger")
+    def test_send_findings_to_jira_preserves_exception_message(
+        self,
+        mock_logger,
+        mock_initialize_integration,
+        mock_integration_model,
+        mock_finding_model,
+        mock_rls_transaction,
+    ):
+        """Test Jira send exceptions are returned for UI polling."""
+        tenant_id = "tenant-123"
+        integration_id = "integration-456"
+        project_key = "PROJ"
+        issue_type = "Task"
+        finding_ids = ["finding-1"]
+        error_message = "Jira project requires custom fields: Team is required"
+
+        mock_rls_transaction.return_value.__enter__ = MagicMock()
+        mock_rls_transaction.return_value.__exit__ = MagicMock()
+
+        integration = MagicMock()
+        mock_integration_model.objects.get.return_value = integration
+
+        mock_jira_integration = MagicMock()
+
+        mock_jira_integration.send_finding.side_effect = JiraRequiredCustomFieldsError(
+            message=error_message
+        )
+        mock_initialize_integration.return_value = mock_jira_integration
+
+        finding = MagicMock()
+        finding.id = "finding-1"
+        finding.check_id = "check_001"
+        finding.severity = "high"
+        finding.status = "FAIL"
+        finding.status_extended = "Resource is not compliant"
+        finding.compliance = {}
+        finding.resources.exists.return_value = False
+        finding.resources.first.return_value = None
+        finding.scan.provider.provider = "aws"
+        finding.check_metadata = {
+            "checktitle": "Check Title",
+            "risk": "High risk",
+            "remediation": {"recommendation": {}, "code": {}},
+        }
+        mock_select_related = mock_finding_model.all_objects.select_related.return_value
+        mock_finding_query = mock_select_related.prefetch_related.return_value
+        mock_finding_query.get.return_value = finding
+
+        result = send_findings_to_jira(
+            tenant_id, integration_id, project_key, issue_type, finding_ids
+        )
+
+        assert result == {
+            "created_count": 0,
+            "failed_count": 1,
+            "error": error_message,
+        }
+        mock_logger.exception.assert_called_with(
+            "Failed to send finding %s to Jira: %s",
+            "finding-1",
+            error_message,
+        )
+
+    @patch("tasks.jobs.integrations.rls_transaction")
+    @patch("tasks.jobs.integrations.Finding")
+    @patch("tasks.jobs.integrations.Integration")
+    @patch("tasks.jobs.integrations.initialize_prowler_integration")
+    @patch("tasks.jobs.integrations.logger")
+    def test_send_findings_to_jira_preserves_refresh_token_error_message(
+        self,
+        mock_logger,
+        mock_initialize_integration,
+        mock_integration_model,
+        mock_finding_model,
+        mock_rls_transaction,
+    ):
+        """Test Jira refresh token exceptions return their UI-friendly message."""
+        tenant_id = "tenant-123"
+        integration_id = "integration-456"
+        project_key = "PROJ"
+        issue_type = "Task"
+        finding_ids = ["finding-1"]
+        error_message = "Failed to refresh the access token"
+
+        mock_rls_transaction.return_value.__enter__ = MagicMock()
+        mock_rls_transaction.return_value.__exit__ = MagicMock()
+
+        integration = MagicMock()
+        mock_integration_model.objects.get.return_value = integration
+
+        mock_jira_integration = MagicMock()
+
+        mock_jira_integration.send_finding.side_effect = JiraRefreshTokenError(
+            message=error_message
+        )
+        mock_initialize_integration.return_value = mock_jira_integration
+
+        finding = MagicMock()
+        finding.id = "finding-1"
+        finding.check_id = "check_001"
+        finding.severity = "high"
+        finding.status = "FAIL"
+        finding.status_extended = "Resource is not compliant"
+        finding.compliance = {}
+        finding.resources.exists.return_value = False
+        finding.resources.first.return_value = None
+        finding.scan.provider.provider = "aws"
+        finding.check_metadata = {
+            "checktitle": "Check Title",
+            "risk": "High risk",
+            "remediation": {"recommendation": {}, "code": {}},
+        }
+        mock_select_related = mock_finding_model.all_objects.select_related.return_value
+        mock_finding_query = mock_select_related.prefetch_related.return_value
+        mock_finding_query.get.return_value = finding
+
+        result = send_findings_to_jira(
+            tenant_id, integration_id, project_key, issue_type, finding_ids
+        )
+
+        assert result == {
+            "created_count": 0,
+            "failed_count": 1,
+            "error": error_message,
+        }
+        mock_logger.exception.assert_called_with(
+            "Failed to send finding %s to Jira: %s",
+            "finding-1",
+            error_message,
+        )
+
+    @patch("tasks.jobs.integrations.rls_transaction")
+    @patch("tasks.jobs.integrations.Finding")
+    @patch("tasks.jobs.integrations.Integration")
+    @patch("tasks.jobs.integrations.initialize_prowler_integration")
+    @patch("tasks.jobs.integrations.logger")
+    def test_send_findings_to_jira_sanitizes_unexpected_exception_message(
+        self,
+        mock_logger,
+        mock_initialize_integration,
+        mock_integration_model,
+        mock_finding_model,
+        mock_rls_transaction,
+    ):
+        """Test unexpected Jira send exceptions do not leak raw details to UI."""
+        tenant_id = "tenant-123"
+        integration_id = "integration-456"
+        project_key = "PROJ"
+        issue_type = "Task"
+        finding_ids = ["finding-1"]
+
+        mock_rls_transaction.return_value.__enter__ = MagicMock()
+        mock_rls_transaction.return_value.__exit__ = MagicMock()
+
+        integration = MagicMock()
+        mock_integration_model.objects.get.return_value = integration
+
+        mock_jira_integration = MagicMock()
+        mock_jira_integration.send_finding.side_effect = Exception("token=secret-value")
+        mock_initialize_integration.return_value = mock_jira_integration
+
+        finding = MagicMock()
+        finding.id = "finding-1"
+        finding.check_id = "check_001"
+        finding.severity = "high"
+        finding.status = "FAIL"
+        finding.status_extended = "Resource is not compliant"
+        finding.compliance = {}
+        finding.resources.exists.return_value = False
+        finding.resources.first.return_value = None
+        finding.scan.provider.provider = "aws"
+        finding.check_metadata = {
+            "checktitle": "Check Title",
+            "risk": "High risk",
+            "remediation": {"recommendation": {}, "code": {}},
+        }
+        mock_select_related = mock_finding_model.all_objects.select_related.return_value
+        mock_finding_query = mock_select_related.prefetch_related.return_value
+        mock_finding_query.get.return_value = finding
+
+        result = send_findings_to_jira(
+            tenant_id, integration_id, project_key, issue_type, finding_ids
+        )
+
+        assert result == {
+            "created_count": 0,
+            "failed_count": 1,
+            "error": "Failed to create Jira issue.",
+        }
+        assert "secret-value" not in result["error"]
+        mock_logger.exception.assert_called_with(
+            "Failed to send finding %s to Jira", "finding-1"
+        )
 
     @patch("tasks.jobs.integrations.rls_transaction")
     @patch("tasks.jobs.integrations.Finding")

api/src/backend/tasks/tests/test_tasks.py

@@ -3,6 +3,7 @@ from contextlib import contextmanager
 from datetime import UTC, datetime, timedelta
 from unittest.mock import MagicMock, patch
 
+import httpx
 import openai
 import pytest
 from api.models import (
@@ -20,6 +21,7 @@ from django_celery_results.models import TaskResult
 from tasks.jobs.lighthouse_providers import (
     _create_bedrock_client,
     _extract_bedrock_credentials,
+    _LighthouseOpenAICompatibleNetworkBackend,
 )
 from tasks.tasks import (
     DJANGO_TMP_OUTPUT_DIRECTORY,
@@ -1566,7 +1568,7 @@ class TestCheckLighthouseProviderConnectionTask:
             (
                 LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
                 {"api_key": "sk-test123"},
-                "https://openrouter.ai/api/v1",
+                "https://93.184.216.34/api/v1",
                 {"connected": True, "error": None},
             ),
             (
@@ -1641,7 +1643,7 @@ class TestCheckLighthouseProviderConnectionTask:
             (
                 LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
                 {"api_key": "sk-invalid"},
-                "https://openrouter.ai/api/v1",
+                "https://93.184.216.34/api/v1",
                 openai.APIConnectionError(request=MagicMock()),
             ),
             (
@@ -1755,6 +1757,166 @@ class TestCheckLighthouseProviderConnectionTask:
             provider_cfg.refresh_from_db()
             assert provider_cfg.is_active is False
 
+    def test_openai_compatible_connection_rejects_metadata_base_url_without_request(
+        self, tenants_fixture
+    ):
+        provider_cfg = LighthouseProviderConfiguration(
+            tenant_id=tenants_fixture[0].id,
+            provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+            base_url="https://169.254.169.254/latest/meta-data",
+            is_active=True,
+        )
+        provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+        provider_cfg.save()
+
+        with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+            eager_result = check_lighthouse_provider_connection_task.apply(
+                kwargs={
+                    "provider_config_id": str(provider_cfg.id),
+                    "tenant_id": str(tenants_fixture[0].id),
+                }
+            )
+
+        assert eager_result.successful()
+        result = eager_result.result
+        assert result["connected"] is False
+        assert "base url" in result["error"].lower()
+        mock_openai.assert_not_called()
+        provider_cfg.refresh_from_db()
+        assert provider_cfg.is_active is False
+
+    def test_openai_compatible_connection_disables_redirects(self, tenants_fixture):
+        provider_cfg = LighthouseProviderConfiguration(
+            tenant_id=tenants_fixture[0].id,
+            provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+            base_url="https://93.184.216.34/api/v1",
+            is_active=False,
+        )
+        provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+        provider_cfg.save()
+
+        with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+            mock_client = MagicMock()
+            mock_client.models.list.return_value = MagicMock()
+            mock_openai.return_value = mock_client
+
+            eager_result = check_lighthouse_provider_connection_task.apply(
+                kwargs={
+                    "provider_config_id": str(provider_cfg.id),
+                    "tenant_id": str(tenants_fixture[0].id),
+                }
+            )
+
+        assert eager_result.successful()
+        result = eager_result.result
+        assert result == {"connected": True, "error": None}
+        http_client = mock_openai.call_args.kwargs["http_client"]
+        assert http_client.follow_redirects is False
+        assert http_client.trust_env is False
+
+    def test_openai_compatible_connection_masks_remote_http_error(
+        self, tenants_fixture
+    ):
+        provider_cfg = LighthouseProviderConfiguration(
+            tenant_id=tenants_fixture[0].id,
+            provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+            base_url="https://93.184.216.34/api/v1",
+            is_active=True,
+        )
+        provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+        provider_cfg.save()
+        remote_body = "<!DOCTYPE HTML><p>remote 404 body</p>"
+        response = httpx.Response(
+            404,
+            request=httpx.Request("GET", "https://provider.example/v1/models"),
+        )
+
+        with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+            mock_client = MagicMock()
+            mock_client.models.list.side_effect = openai.NotFoundError(
+                remote_body,
+                response=response,
+                body=remote_body,
+            )
+            mock_openai.return_value = mock_client
+
+            eager_result = check_lighthouse_provider_connection_task.apply(
+                kwargs={
+                    "provider_config_id": str(provider_cfg.id),
+                    "tenant_id": str(tenants_fixture[0].id),
+                }
+            )
+
+        assert eager_result.successful()
+        result = eager_result.result
+        assert result == {"connected": False, "error": "Provider connection failed"}
+        assert remote_body not in result["error"]
+        provider_cfg.refresh_from_db()
+        assert provider_cfg.is_active is False
+
+    def test_openai_compatible_connection_masks_remote_auth_error(
+        self, tenants_fixture
+    ):
+        provider_cfg = LighthouseProviderConfiguration(
+            tenant_id=tenants_fixture[0].id,
+            provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+            base_url="https://93.184.216.34/api/v1",
+            is_active=True,
+        )
+        provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+        provider_cfg.save()
+        remote_body = {"error": {"message": "remote auth detail"}}
+        response = httpx.Response(
+            401,
+            request=httpx.Request("GET", "https://provider.example/v1/models"),
+        )
+
+        with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+            mock_client = MagicMock()
+            mock_client.models.list.side_effect = openai.AuthenticationError(
+                "Unauthorized",
+                response=response,
+                body=remote_body,
+            )
+            mock_openai.return_value = mock_client
+
+            eager_result = check_lighthouse_provider_connection_task.apply(
+                kwargs={
+                    "provider_config_id": str(provider_cfg.id),
+                    "tenant_id": str(tenants_fixture[0].id),
+                }
+            )
+
+        assert eager_result.successful()
+        result = eager_result.result
+        assert result == {"connected": False, "error": "API key is invalid or missing"}
+        assert "remote auth detail" not in result["error"]
+        provider_cfg.refresh_from_db()
+        assert provider_cfg.is_active is False
+
+    def test_openai_compatible_network_backend_uses_validated_ip(self, monkeypatch):
+        backend = _LighthouseOpenAICompatibleNetworkBackend()
+        stream = MagicMock()
+
+        def resolve_to_public_ip(host, port):
+            del host, port
+            return ("93.184.216.34",)
+
+        monkeypatch.setattr(
+            "tasks.jobs.lighthouse_providers.resolve_lighthouse_openai_compatible_host",
+            resolve_to_public_ip,
+        )
+
+        with patch(
+            "tasks.jobs.lighthouse_providers.httpcore.SyncBackend.connect_tcp",
+            return_value=stream,
+        ) as mock_connect_tcp:
+            result = backend.connect_tcp("provider.example", 443, timeout=1.0)
+
+        assert result is stream
+        assert mock_connect_tcp.call_args.args[:2] == ("93.184.216.34", 443)
+        assert mock_connect_tcp.call_args.kwargs["timeout"] == 1.0
+
     def test_check_connection_provider_does_not_exist(self, tenants_fixture):
         """Test that checking non-existent provider raises DoesNotExist."""
         non_existent_id = str(uuid.uuid4())
@@ -1784,7 +1946,7 @@ class TestRefreshLighthouseProviderModelsTask:
             (
                 LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
                 {"api_key": "sk-test123"},
-                "https://openrouter.ai/api/v1",
+                "https://93.184.216.34/api/v1",
                 {"model-1": "Model One", "model-2": "Model Two"},
                 2,
             ),
@@ -1864,6 +2026,106 @@ class TestRefreshLighthouseProviderModelsTask:
                 == expected_count
             )
 
+    def test_refresh_models_rejects_metadata_base_url_without_request(
+        self, tenants_fixture
+    ):
+        provider_cfg = LighthouseProviderConfiguration(
+            tenant_id=tenants_fixture[0].id,
+            provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+            base_url="https://169.254.169.254/latest/meta-data",
+            is_active=True,
+        )
+        provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+        provider_cfg.save()
+
+        with patch(
+            "tasks.jobs.lighthouse_providers._fetch_openai_compatible_models"
+        ) as mock_fetch:
+            eager_result = refresh_lighthouse_provider_models_task.apply(
+                kwargs={
+                    "provider_config_id": str(provider_cfg.id),
+                    "tenant_id": str(tenants_fixture[0].id),
+                }
+            )
+
+        assert eager_result.successful()
+        result = eager_result.result
+        assert result["created"] == 0
+        assert result["updated"] == 0
+        assert result["deleted"] == 0
+        assert "base url" in result["error"].lower()
+        mock_fetch.assert_not_called()
+
+    def test_refresh_models_disables_redirects(self, tenants_fixture):
+        provider_cfg = LighthouseProviderConfiguration(
+            tenant_id=tenants_fixture[0].id,
+            provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+            base_url="https://93.184.216.34/api/v1",
+            is_active=True,
+        )
+        provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+        provider_cfg.save()
+
+        with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+            mock_client = MagicMock()
+            mock_client.models.list.return_value = MagicMock(data=[])
+            mock_openai.return_value = mock_client
+
+            eager_result = refresh_lighthouse_provider_models_task.apply(
+                kwargs={
+                    "provider_config_id": str(provider_cfg.id),
+                    "tenant_id": str(tenants_fixture[0].id),
+                }
+            )
+
+        assert eager_result.successful()
+        result = eager_result.result
+        assert result["created"] == 0
+        assert result["updated"] == 0
+        assert result["deleted"] == 0
+        http_client = mock_openai.call_args.kwargs["http_client"]
+        assert http_client.follow_redirects is False
+        assert http_client.trust_env is False
+
+    def test_refresh_models_masks_remote_http_error(self, tenants_fixture):
+        provider_cfg = LighthouseProviderConfiguration(
+            tenant_id=tenants_fixture[0].id,
+            provider_type=LighthouseProviderConfiguration.LLMProviderChoices.OPENAI_COMPATIBLE,
+            base_url="https://93.184.216.34/api/v1",
+            is_active=True,
+        )
+        provider_cfg.credentials_decoded = {"api_key": "compatible-key"}
+        provider_cfg.save()
+        remote_body = "<!DOCTYPE HTML><p>remote 404 body</p>"
+        response = httpx.Response(
+            404,
+            request=httpx.Request("GET", "https://provider.example/v1/models"),
+        )
+
+        with patch("tasks.jobs.lighthouse_providers.openai.OpenAI") as mock_openai:
+            mock_client = MagicMock()
+            mock_client.models.list.side_effect = openai.NotFoundError(
+                remote_body,
+                response=response,
+                body=remote_body,
+            )
+            mock_openai.return_value = mock_client
+
+            eager_result = refresh_lighthouse_provider_models_task.apply(
+                kwargs={
+                    "provider_config_id": str(provider_cfg.id),
+                    "tenant_id": str(tenants_fixture[0].id),
+                }
+            )
+
+        assert eager_result.successful()
+        result = eager_result.result
+        assert result["created"] == 0
+        assert result["updated"] == 0
+        assert result["deleted"] == 0
+        assert result["error"] == "Provider connection failed"
+        assert remote_body not in result["error"]
+
     def test_refresh_models_mixed_operations(self, tenants_fixture):
         """Test mixed create, update, and delete operations."""
         # Create provider configuration

api/towncrier.toml

@@ -0,0 +1,39 @@
+[tool.towncrier]
+directory = "changelog.d"
+filename = "CHANGELOG.md"
+start_string = "<!-- changelog: release notes start -->\n"
+title_format = "## [{version}] ({name})"
+issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
+template = "../.github/towncrier/template.md.jinja"
+underlines = ["", "", ""]
+ignore = [".gitkeep", "README.md"]
+
+[[tool.towncrier.type]]
+directory = "added"
+name = "🚀 Added"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "changed"
+name = "🔄 Changed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "deprecated"
+name = "⚠️ Deprecated"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "removed"
+name = "❌ Removed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "fixed"
+name = "🐞 Fixed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "security"
+name = "🔐 Security"
+showcontent = true

api/uv.lock

@@ -4673,8 +4673,8 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.32.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#5dac8a0a53272e4db68c476fb969dc03e88beb68" }
+version = "5.33.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=v5.33#76a2d7bfe61a3ac6c96e497eded30a2978cd3ffe" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },
@@ -4762,7 +4762,7 @@ dependencies = [
 
 [[package]]
 name = "prowler-api"
-version = "1.34.0"
+version = "1.34.1"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },
@@ -4862,7 +4862,7 @@ requires-dist = [
     { name = "matplotlib", specifier = "==3.10.8" },
     { name = "neo4j", specifier = "==6.1.0" },
     { name = "openai", specifier = "==1.109.1" },
-    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=master" },
+    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=v5.33" },
     { name = "psycopg2-binary", specifier = "==2.9.9" },
     { name = "pytest-celery", extras = ["redis"], specifier = "==1.3.0" },
     { name = "reportlab", specifier = "==4.4.10" },

docs/developer-guide/provider.mdx

@@ -3421,7 +3421,7 @@ Use existing providers as templates, this will help you to understand better the
 - **Documentation & Maintenance**
 
     - **README Updates**: Update provider-specific documentation
-    - **Changelog**: Document changes and new features
+    - **Changelog**: Document changes and new features with a fragment under `prowler/changelog.d/` (see the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md))
     - **Examples**: Provide usage examples and common scenarios
     - **Troubleshooting**: Include common issues and solutions
     - **Documentation**: Update the provider documentation to include your new tool provider in the examples and implementation guidance.

docs/developer-guide/security-compliance-framework.mdx

@@ -778,7 +778,7 @@ Before opening the pull request:
     uv run pre-commit run --all-files
     uv run pytest -n auto
     ```
-2. Add a changelog entry under the `### 🚀 Added` section of `prowler/CHANGELOG.md`, describing the new framework and the providers it covers.
+2. Add a changelog fragment `prowler/changelog.d/<slug>.added.md`, describing the new framework and the providers it covers (no PR link in the text; it is attached automatically at release time).
 3. Follow the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md) and set the PR title using Conventional Commits, e.g. `feat(compliance): add My Framework 1.0 for AWS`.
 4. Request review from the compliance codeowners listed in `.github/CODEOWNERS`.
 

docs/user-guide/providers/azure/authentication.mdx

@@ -210,7 +210,9 @@ For more detailed guidance on subscription management and permissions:
 The following security checks require the `ProwlerRole` permissions for execution. Ensure the role is assigned to the identity assumed by Prowler before running these checks:
 
 - `app_function_access_keys_configured`
+- `app_function_application_insights_enabled`
 - `app_function_ftps_deployment_disabled`
+- `app_function_latest_runtime_version`
 
 ---
 

docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx

@@ -128,6 +128,25 @@ To connect a provider:
     3. Configure in Lighthouse AI:
        - **API Key**: OpenRouter API key
        - **Base URL**: `https://openrouter.ai/api/v1`
+
+    ### Base URL Validation
+
+    To prevent server-side request forgery (SSRF), Prowler API validates the base URL before connecting to it:
+
+    - The URL must use HTTPS.
+    - The host must resolve to a public IP address. Private, loopback, link-local, and cloud metadata addresses are rejected.
+
+    <Warning>
+    This validation can break configurations that point to internal endpoints, such as a self-hosted Ollama server. This is intentional: it fixes a security issue where the Prowler API could be directed to internal services. Internal endpoints must now be allowed explicitly through `LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS`.
+    </Warning>
+
+    To allow internal endpoints, set a comma-separated list of hostnames or IP addresses in the Prowler API environment (for Docker Compose deployments, the shared `.env` file):
+
+    ```bash
+    LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS=custom-openai.internal,10.0.0.20
+    ```
+
+    Hosts in this list skip the public-endpoint validation. HTTPS is still required, so the endpoint needs a certificate the Prowler API trusts.
   </Tab>
 </Tabs>
 

mcp_server/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 All notable changes to the **Prowler MCP Server** are documented in this file.
 
+<!-- changelog: release notes start -->
+
 ## [0.7.2] (Prowler v5.28.1)
 
 ### 🐞 Fixed

mcp_server/changelog.d/README.md

@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

mcp_server/towncrier.toml

@@ -0,0 +1,39 @@
+[tool.towncrier]
+directory = "changelog.d"
+filename = "CHANGELOG.md"
+start_string = "<!-- changelog: release notes start -->\n"
+title_format = "## [{version}] ({name})"
+issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
+template = "../.github/towncrier/template.md.jinja"
+underlines = ["", "", ""]
+ignore = [".gitkeep", "README.md"]
+
+[[tool.towncrier.type]]
+directory = "added"
+name = "🚀 Added"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "changed"
+name = "🔄 Changed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "deprecated"
+name = "⚠️ Deprecated"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "removed"
+name = "❌ Removed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "fixed"
+name = "🐞 Fixed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "security"
+name = "🔐 Security"
+showcontent = true

prowler/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+<!-- changelog: release notes start -->
+
+## [5.33.1] (Prowler v5.33.1)
+
+### 🐞 Fixed
+
+- ECS task definition resource limits now select the latest task definitions by registration date instead of relying on ARN ordering [(#11891)](https://github.com/prowler-cloud/prowler/pull/11891)
+- `dlm_ebs_snapshot_lifecycle_policy_exists` no longer initializes the full EC2 inventory just to detect EBS snapshots, avoiding slow scans when checking DLM lifecycle policies [(#11900)](https://github.com/prowler-cloud/prowler/pull/11900)
+- `dms_instance_no_public_access` no longer initializes the full EC2 service when there are no DMS replication instances [(#11902)](https://github.com/prowler-cloud/prowler/pull/11902)
+- `organizations_scp_check_deny_regions` no longer reports false `FAIL` for AWS Organizations that restrict regions with Allow-based SCPs; the Allow path now checks the statement `Effect` instead of an always-false comparison that made it unreachable [(#11915)](https://github.com/prowler-cloud/prowler/pull/11915)
+- Jira issue creation failures now preserve safe structured response details from Jira [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
+- Azure Function App optional permission failures now log as warnings, and Function App environment variable fields use the correct spelling internally [(#11926)](https://github.com/prowler-cloud/prowler/pull/11926)
+
+---
+
 ## [5.33.0] (Prowler v5.33.0)
 
 ### 🐞 Fixed

prowler/changelog.d/README.md

@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

prowler/config/config.py

@@ -49,7 +49,7 @@ class _MutableTimestamp:
 
 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.33.0"
+prowler_version = "5.33.1"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"

prowler/lib/outputs/jira/jira.py

@@ -51,6 +51,39 @@ class JiraConnection(Connection):
     issue_types: dict = None
 
 
+def _format_jira_issue_creation_error(response_json: object, status_code: int) -> str:
+    """Build a safe Jira issue creation error message from structured fields.
+
+    Args:
+        response_json: Parsed Jira response body.
+        status_code: HTTP status code returned by Jira.
+
+    Returns:
+        Safe issue creation error message for user-facing propagation.
+    """
+    message_parts = []
+
+    if not isinstance(response_json, dict):
+        return f"Failed to create Jira issue: Jira returned status code {status_code}."
+
+    errors = response_json.get("errors")
+    if isinstance(errors, dict):
+        message_parts.extend(
+            f"'{field}': '{message}'" for field, message in errors.items() if message
+        )
+
+    error_messages = response_json.get("errorMessages")
+    if isinstance(error_messages, list):
+        message_parts.extend(str(message) for message in error_messages if message)
+    elif isinstance(error_messages, str) and error_messages:
+        message_parts.append(error_messages)
+
+    if message_parts:
+        return f"Failed to create Jira issue: {'; '.join(message_parts)}"
+
+    return f"Failed to create Jira issue: Jira returned status code {status_code}."
+
+
 class MarkdownToADFConverter:
     """Helper to convert Markdown strings into Atlassian Document Format blocks."""
 
@@ -2060,6 +2093,7 @@ class Jira:
         Raises:
             - JiraRefreshTokenError: Failed to refresh the access token
             - JiraRefreshTokenResponseError: Failed to refresh the access token, response code did not match 200
+            - JiraNoTokenError: Failed to get an access token
             - JiraCreateIssueError: Failed to create an issue in Jira
             - JiraSendFindingsResponseError: Failed to send the finding to Jira
             - JiraRequiredCustomFieldsError: Jira project requires custom fields that are not supported
@@ -2155,31 +2189,45 @@ class Jira:
                 try:
                     response_json = response.json()
                 except (ValueError, requests.exceptions.JSONDecodeError):
-                    response_error = f"Failed to send finding: {response.status_code} - {response.text}"
+                    response_error = _format_jira_issue_creation_error(
+                        {}, response.status_code
+                    )
                     logger.error(response_error)
-                    return False
+                    raise JiraSendFindingsResponseError(
+                        message=response_error, file=os.path.basename(__file__)
+                    )
 
                 # Check if the error is due to required custom fields
-                if response.status_code == 400 and "errors" in response_json:
+                if (
+                    response.status_code == 400
+                    and isinstance(response_json, dict)
+                    and "errors" in response_json
+                ):
                     errors = response_json.get("errors", {})
                     # Look for custom field errors (fields starting with "customfield_")
-                    custom_field_errors = {
-                        k: v for k, v in errors.items() if k.startswith("customfield_")
-                    }
+                    custom_field_errors = {}
+                    if isinstance(errors, dict):
+                        custom_field_errors = {
+                            k: v
+                            for k, v in errors.items()
+                            if k.startswith("customfield_")
+                        }
                     if custom_field_errors:
                         custom_fields_formatted = ", ".join(
                             [f"'{k}': '{v}'" for k, v in custom_field_errors.items()]
                         )
-                        logger.error(
-                            f"Jira project requires custom fields that are not supported: {custom_fields_formatted}"
+                        raise JiraRequiredCustomFieldsError(
+                            message=f"Jira project requires custom fields that are not supported: {custom_fields_formatted}",
+                            file=os.path.basename(__file__),
                         )
-                        return False
 
-                response_error = (
-                    f"Failed to send finding: {response.status_code} - {response_json}"
+                response_error = _format_jira_issue_creation_error(
+                    response_json, response.status_code
                 )
                 logger.error(response_error)
-                return False
+                raise JiraSendFindingsResponseError(
+                    message=response_error, file=os.path.basename(__file__)
+                )
             else:
                 try:
                     response_json = response.json()
@@ -2191,13 +2239,17 @@ class Jira:
                 return True
         except JiraRequiredCustomFieldsError as custom_fields_error:
             logger.error(f"Custom fields error: {custom_fields_error}")
-            return False
+            raise custom_fields_error
+        except JiraSendFindingsResponseError as response_error:
+            logger.error(f"Jira response error: {response_error}")
+            raise response_error
         except JiraRefreshTokenError as refresh_error:
             logger.error(f"Token refresh error: {refresh_error}")
-            return False
+            raise refresh_error
         except JiraRefreshTokenResponseError as response_error:
-            logger.error(f"Token response error: {response_error}")
-            return False
+            raise response_error
+        except JiraNoTokenError as no_token_error:
+            raise no_token_error
         except Exception as e:
             logger.error(f"Failed to send finding: {e}")
             return False

prowler/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists.py

@@ -1,6 +1,5 @@
 from prowler.lib.check.models import Check, Check_Report_AWS
 from prowler.providers.aws.services.dlm.dlm_client import dlm_client
-from prowler.providers.aws.services.ec2.ec2_client import ec2_client
 
 
 class dlm_ebs_snapshot_lifecycle_policy_exists(Check):
@@ -8,8 +7,8 @@ class dlm_ebs_snapshot_lifecycle_policy_exists(Check):
         findings = []
         for region in dlm_client.lifecycle_policies:
             if (
-                region in ec2_client.regions_with_snapshots
-                and ec2_client.regions_with_snapshots[region]
+                region in dlm_client.regions_with_snapshots
+                and dlm_client.regions_with_snapshots[region]
             ):
                 report = Check_Report_AWS(
                     metadata=self.metadata(),

prowler/providers/aws/services/dlm/dlm_service.py

@@ -9,7 +9,13 @@ class DLM(AWSService):
         # Call AWSService's __init__
         super().__init__(__class__.__name__, provider)
         self.lifecycle_policies = {}
+        self.regions_with_snapshots = {}
         self.__threading_call__(self._get_lifecycle_policies)
+        ec2_regional_clients = provider.generate_regional_clients("ec2") or {}
+        self.__threading_call__(
+            self._get_regions_with_snapshots,
+            iterator=ec2_regional_clients.values(),
+        )
 
     def _get_lifecycle_policy_arn_template(self, region):
         return (
@@ -35,6 +41,34 @@ class DLM(AWSService):
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _get_regions_with_snapshots(self, regional_client):
+        logger.info("DLM - Checking regions with self-owned EBS snapshots...")
+        try:
+            self.regions_with_snapshots[regional_client.region] = False
+            next_token = None
+            while True:
+                describe_snapshots_args = {
+                    "OwnerIds": ["self"],
+                    "MaxResults": 5,
+                }
+                if next_token:
+                    describe_snapshots_args["NextToken"] = next_token
+
+                snapshots = regional_client.describe_snapshots(
+                    **describe_snapshots_args
+                )
+                if snapshots.get("Snapshots"):
+                    self.regions_with_snapshots[regional_client.region] = True
+                    break
+
+                next_token = snapshots.get("NextToken")
+                if not next_token:
+                    break
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
 
 class LifecyclePolicy(BaseModel):
     id: str

prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py

@@ -1,9 +1,14 @@
 from prowler.lib.check.models import Check, Check_Report_AWS
 from prowler.providers.aws.services.dms.dms_client import dms_client
-from prowler.providers.aws.services.ec2.ec2_client import ec2_client
 from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
 
 
+def _get_ec2_client():
+    from prowler.providers.aws.services.ec2.ec2_client import ec2_client
+
+    return ec2_client
+
+
 class dms_instance_no_public_access(Check):
     def execute(self):
         findings = []
@@ -19,7 +24,7 @@ class dms_instance_no_public_access(Check):
                 if instance.security_groups:
                     report.status = "PASS"
                     report.status_extended = f"DMS Replication Instance {instance.id} is set as publicly accessible but filtered with security groups."
-                    for security_group in ec2_client.security_groups.values():
+                    for security_group in _get_ec2_client().security_groups.values():
                         if security_group.id in instance.security_groups:
                             for ingress_rule in security_group.ingress_rules:
                                 if check_security_group(

prowler/providers/aws/services/ecs/ecs_service.py

@@ -81,12 +81,13 @@ class ECS(AWSService):
 
         Resources already fetched are memoized in ``self.task_definitions`` and
         reused across checks (checks run sequentially, so no locking is needed).
-        The configured resource limit bounds ``describe_task_definition`` calls.
+        Task definitions are described before applying the configured resource
+        limit because AWS exposes ``registeredAt`` only through
+        ``describe_task_definition``. The limit bounds the task definitions
+        exposed to checks for analysis.
         """
         task_definitions = []
-        for arn, region in limit_resources(
-            self._list_task_definition_arns(), self.task_definition_limit
-        ):
+        for arn, region in self._list_task_definition_arns():
             task_definition = self.task_definitions.get(arn)
             if task_definition is None:
                 task_definition = TaskDefinition(
@@ -102,12 +103,42 @@ class ECS(AWSService):
 
         self.__threading_call__(self._describe_task_definition, task_definitions)
 
-        for arn, _ in limit_resources(
-            self._list_task_definition_arns(), self.task_definition_limit
-        ):
-            task_definition = self.task_definitions[arn]
+        selected_task_definitions = list(
+            limit_resources(
+                self._sort_task_definitions_by_registration_date(
+                    self.task_definitions.values()
+                ),
+                self.task_definition_limit,
+            )
+        )
+        self.task_definitions = {
+            task_definition.arn: task_definition
+            for task_definition in selected_task_definitions
+        }
+        for task_definition in selected_task_definitions:
             yield task_definition
 
+    @staticmethod
+    def _sort_task_definitions_by_registration_date(task_definitions):
+        task_definitions = list(task_definitions)
+        if not any(
+            task_definition.registered_at for task_definition in task_definitions
+        ):
+            return task_definitions
+
+        return sorted(
+            task_definitions,
+            key=lambda task_definition: (
+                task_definition.registered_at is None,
+                (
+                    -task_definition.registered_at.timestamp()
+                    if task_definition.registered_at
+                    else 0
+                ),
+                task_definition.arn,
+            ),
+        )
+
     def _describe_task_definition(self, task_definition):
         logger.info("ECS - Describing Task Definition...")
         try:

prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py

@@ -67,7 +67,7 @@ class organizations_scp_check_deny_regions(Check):
 
                             # Allow if Condition = {"StringEquals": {"aws:RequestedRegion": [region1, region2]}}
                             if (
-                                policy.content.get("Statement") == "Allow"
+                                statement.get("Effect") == "Allow"
                                 and "Condition" in statement
                                 and "StringEquals" in statement["Condition"]
                                 and "aws:RequestedRegion"

prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py

@@ -14,7 +14,7 @@ class app_function_application_insights_enabled(Check):
                 subscription_id, subscription_id
             )
             for function in functions.values():
-                if function.enviroment_variables is not None:
+                if function.environment_variables is not None:
                     report = Check_Report_Azure(
                         metadata=self.metadata(), resource=function
                     )
@@ -22,9 +22,9 @@ class app_function_application_insights_enabled(Check):
                     report.status = "FAIL"
                     report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using Application Insights."
 
-                    if function.enviroment_variables.get(
+                    if function.environment_variables.get(
                         "APPINSIGHTS_INSTRUMENTATIONKEY", None
-                    ) or function.enviroment_variables.get(
+                    ) or function.environment_variables.get(
                         "APPLICATIONINSIGHTS_CONNECTION_STRING", None
                     ):
                         report.status = "PASS"

prowler/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version.py

@@ -14,7 +14,7 @@ class app_function_latest_runtime_version(Check):
                 subscription_id, subscription_id
             )
             for function in functions.values():
-                if function.enviroment_variables is not None:
+                if function.environment_variables is not None:
                     report = Check_Report_Azure(
                         metadata=self.metadata(), resource=function
                     )
@@ -23,13 +23,13 @@ class app_function_latest_runtime_version(Check):
                     report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is using the latest runtime."
 
                     if (
-                        function.enviroment_variables.get(
+                        function.environment_variables.get(
                             "FUNCTIONS_EXTENSION_VERSION", ""
                         )
                         != "~4"
                     ):
                         report.status = "FAIL"
-                        report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using the latest runtime. The current runtime is '{function.enviroment_variables.get('FUNCTIONS_EXTENSION_VERSION', '')}' and should be '~4'."
+                        report.status_extended = f"Function {function.name} from subscription {subscription_name} ({subscription_id}) is not using the latest runtime. The current runtime is '{function.environment_variables.get('FUNCTIONS_EXTENSION_VERSION', '')}' and should be '~4'."
 
                     findings.append(report)
 

prowler/providers/azure/services/app/app_service.py

@@ -158,7 +158,7 @@ class App(AzureService):
                                     location=function.location,
                                     kind=function.kind,
                                     function_keys=function_keys,
-                                    enviroment_variables=getattr(
+                                    environment_variables=getattr(
                                         application_settings, "properties", None
                                     ),
                                     identity=getattr(function, "identity", None),
@@ -225,7 +225,7 @@ class App(AzureService):
                 name=name,
             )
         except Exception as error:
-            logger.error(
+            logger.warning(
                 f"Error getting host keys for {name} in {resource_group}: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
             return None
@@ -249,7 +249,7 @@ class App(AzureService):
                 name=name,
             )
         except Exception as error:
-            logger.error(
+            logger.warning(
                 f"Error getting application settings for {name} in {resource_group}: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
             return None
@@ -296,7 +296,7 @@ class FunctionApp:
     location: str
     kind: str
     function_keys: Optional[Dict[str, str]]
-    enviroment_variables: Optional[Dict[str, str]]
+    environment_variables: Optional[Dict[str, str]]
     identity: ManagedServiceIdentity
     public_access: bool
     vnet_subnet_id: str

prowler/towncrier.toml

@@ -0,0 +1,39 @@
+[tool.towncrier]
+directory = "changelog.d"
+filename = "CHANGELOG.md"
+start_string = "<!-- changelog: release notes start -->\n"
+title_format = "## [{version}] ({name})"
+issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
+template = "../.github/towncrier/template.md.jinja"
+underlines = ["", "", ""]
+ignore = [".gitkeep", "README.md"]
+
+[[tool.towncrier.type]]
+directory = "added"
+name = "🚀 Added"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "changed"
+name = "🔄 Changed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "deprecated"
+name = "⚠️ Deprecated"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "removed"
+name = "❌ Removed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "fixed"
+name = "🐞 Fixed"
+showcontent = true
+
+[[tool.towncrier.type]]
+directory = "security"
+name = "🔐 Security"
+showcontent = true

pyproject.toml

@@ -125,7 +125,7 @@ maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"}
 name = "prowler"
 readme = "README.md"
 requires-python = ">=3.10,<3.14"
-version = "5.33.0"
+version = "5.33.1"
 
 [project.scripts]
 prowler = "prowler.__main__:prowler"

skills/prowler-attack-paths-query/SKILL.md

@@ -195,7 +195,8 @@ When all matching principals can target the same independent resource set, colle
 ```cypher
 WITH aws, collect(DISTINCT path_principal) AS principal_paths
 MATCH path_target = (aws)--(target)
-WITH principal_paths + collect(DISTINCT path_target) AS paths
+WITH principal_paths, collect(DISTINCT path_target) AS target_paths
+WITH principal_paths + target_paths AS paths
 ```
 
 Statements that constrain a target are still checked via `HAS_RESOURCE` traversals (`res`, `res2`). See IAM-015 or EC2-001 in `aws.py`.
@@ -419,6 +420,7 @@ Queries must run on both Neo4j and Amazon Neptune. Avoid these constructs:
 | `FOREACH`                               | `WITH` + `UNWIND` + `SET`                                                                                                                   |
 | Regex `=~`                              | `toLower()` + exact match, or `STARTS WITH` / `CONTAINS`                                                                                    |
 | `CALL () { UNION }`                     | Multi-label `OR` in `WHERE` (see pattern above)                                                                                             |
+| Carried value plus aggregate expression | Project the aggregate first: `WITH principal_paths, collect(...) AS target_paths`, then combine lists in the next `WITH`                    |
 | `any(x IN list ...)`                    | `size([x IN list WHERE pred]) > 0`                                                                                                          |
 | `all(x IN list ...)`                    | `size([x IN list WHERE pred]) = size(list)`                                                                                                 |
 | `none(x IN list ...)`                   | `size([x IN list WHERE pred]) = 0`                                                                                                          |

skills/prowler-changelog/SKILL.md

@@ -6,7 +6,7 @@ description: >
 license: Apache-2.0
 metadata:
   author: prowler-cloud
-  version: "1.0"
+  version: "2.0"
   scope: [root, ui, api, sdk, mcp_server]
   auto_invoke:
     - "Add changelog entry for a PR or feature"
@@ -16,70 +16,80 @@ metadata:
 allowed-tools: Read, Edit, Write, Glob, Grep, Bash
 ---
 
-## Changelog Locations
+## How changelog entries work: fragments
 
-| Component | File | Version Prefix | Current Version |
-|-----------|------|----------------|-----------------|
-| UI | `ui/CHANGELOG.md` | None | 1.x.x |
-| API | `api/CHANGELOG.md` | None | 1.x.x |
-| MCP Server | `mcp_server/CHANGELOG.md` | None | 0.x.x |
-| SDK | `prowler/CHANGELOG.md` | None | 5.x.x |
+A PR never edits unreleased `CHANGELOG.md` content directly; use fragments instead. Released-block typo/correction fixes are the only direct-edit exception and are described below. For regular entries, add one small **fragment file** per entry under the component's `changelog.d/` directory. Fragments are compiled into the component's `CHANGELOG.md` at release time (deleting the consumed fragments), so concurrent PRs never conflict on the changelog.
 
-## Format Rules (keepachangelog.com)
+| Component | Fragments directory | Compiled file |
+|-----------|---------------------|---------------|
+| UI | `ui/changelog.d/` | `ui/CHANGELOG.md` |
+| API | `api/changelog.d/` | `api/CHANGELOG.md` |
+| MCP Server | `mcp_server/changelog.d/` | `mcp_server/CHANGELOG.md` |
+| SDK | `prowler/changelog.d/` | `prowler/CHANGELOG.md` |
 
-### Section Order (ALWAYS this order)
+"What's unreleased" = "what's in `changelog.d/`". The compiled `CHANGELOG.md` files contain only released versions.
 
-```markdown
-## [X.Y.Z] (Prowler vA.B.C) OR (Prowler UNRELEASED)
+## Fragment filename
 
-### Added
-### Changed
-### Deprecated
-### Removed
-### Fixed
-### Security
+```text
+<slug>.<type>.md
 ```
 
-### Emoji Prefixes (REQUIRED for ALL components)
+- `<slug>` is free-form (`[A-Za-z0-9][A-Za-z0-9._-]*`), chosen by the author, ideally descriptive of the change (e.g. `securityhub-delegated-admin`). The PR number is also a valid slug (e.g. `11259`) when it is already known; it is never required.
+- `<type>` maps 1:1 to the keepachangelog sections:
 
-| Section | Emoji | Usage |
-|---------|-------|-------|
-| Added | `### 🚀 Added` | New features, checks, endpoints |
-| Changed | `### 🔄 Changed` | Modifications to existing functionality |
-| Deprecated | `### ⚠️ Deprecated` | Features marked for removal |
-| Removed | `### ❌ Removed` | Deleted features |
-| Fixed | `### 🐞 Fixed` | Bug fixes |
-| Security | `### 🔐 Security` | Security patches, CVE fixes |
+| `<type>` | Section | Usage |
+|----------|---------|-------|
+| `added` | `### 🚀 Added` | New features, checks, endpoints |
+| `changed` | `### 🔄 Changed` | Modifications to existing functionality |
+| `deprecated` | `### ⚠️ Deprecated` | Features marked for removal |
+| `removed` | `### ❌ Removed` | Deleted features |
+| `fixed` | `### 🐞 Fixed` | Bug fixes |
+| `security` | `### 🔐 Security` | Security patches, CVE fixes |
 
-### Entry Format
+- A PR adds as many fragment files as entries it needs, freely mixing types: one file per entry. E.g. a PR touching Added, Changed and Fixed ships `kms-rotation-check.added.md` + `kms-metadata-cache.changed.md` + `kms-disabled-keys.fixed.md`, and all compile with the same PR link into their own sections.
+- Several entries of the SAME type: a different slug per entry (`kms-rotation-check.added.md`, `kms-rotation-docs.added.md`).
+- At least one fragment per touched component, same as the old one-entry-per-changelog rule.
 
-```markdown
-### Added
+## Fragment content
 
-- Existing entry one [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- Existing entry two [(#YYYY)](https://github.com/prowler-cloud/prowler/pull/YYYY)
-- NEW ENTRY GOES HERE at the BOTTOM [(#ZZZZ)](https://github.com/prowler-cloud/prowler/pull/ZZZZ)
+The file contains ONLY the entry text, exactly as it should appear in the changelog, on a single line ending with a trailing newline:
 
-### Changed
-
-- Existing change [(#AAAA)](https://github.com/prowler-cloud/prowler/pull/AAAA)
-- NEW CHANGE ENTRY at BOTTOM [(#BBBB)](https://github.com/prowler-cloud/prowler/pull/BBBB)
+```bash
+echo '`securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on' > prowler/changelog.d/securityhub-delegated-admin.added.md
 ```
 
-**Rules:**
-- **ADD NEW ENTRIES AT THE BOTTOM of each section** (before next section header or `---`)
-- **Blank line after section header** before first entry
-- **Blank line between sections**
+**Rules (same prose conventions as always):**
+
+- **NEVER write the PR link in the text.** It is attached automatically at compile time (the compile workflow resolves the PR that added the fragment from git history). Writing `[(#NNNN)](...)` in a fragment produces a duplicated link.
+- No period at the end
+- Do NOT start with redundant verbs (the section header already provides the action)
 - Be specific: what changed, not why (that's in the PR)
 - Keep entries readable: use spaces around inline code and product names, and wrap endpoints, commands, errors, task names, and file paths in backticks
 - Avoid long run-on sentences; split complex changes into one concise result plus one concise context clause
-- One entry per PR (can link multiple PRs for related changes)
-- No period at the end
-- Do NOT start with redundant verbs (section header already provides the action)
-- **CRITICAL: Preserve section order** — when adding a new section to the UNRELEASED block, insert it in the correct position relative to existing sections (Added → Changed → Deprecated → Removed → Fixed → Security). Never append a new section at the top or bottom without checking order
-- **CRITICAL: ALWAYS link to the PR, NEVER to the issue.** Every entry MUST use `https://github.com/prowler-cloud/prowler/pull/N`. Linking to `/issues/N` is FORBIDDEN, even when the PR fixes an issue. The issue↔PR relationship belongs in the PR body (`Fixes #N`), not in the changelog. If a fix has no PR yet, do not add the entry until the PR exists.
 
-### Semantic Versioning Rules
+### Good fragments
+
+```text
+# ui/changelog.d/provider-search-bar.added.md
+Search bar when adding a provider
+
+# api/changelog.d/scan-dispatch-race.fixed.md
+`POST /api/v1/scans` no longer intermittently fails with `Scan matching query does not exist`; scan dispatch now publishes the `scan-perform` Celery task after the transaction commits
+
+# ui/changelog.d/node-24-bump.security.md
+Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs
+```
+
+### Bad fragments
+
+```text
+Fixed bug.                              # Too vague, has period, redundant verb
+Add search bar                          # Redundant verb (the section already says "Added")
+Search bar [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634)   # NEVER include the PR link; it is added at compile time
+```
+
+## Semantic Versioning Rules
 
 Prowler follows [semver.org](https://semver.org/):
 
@@ -89,69 +99,26 @@ Prowler follows [semver.org](https://semver.org/):
 | New features (backwards compatible) | MINOR (x.**Y**.0) | 1.16.2 → 1.17.0 |
 | Breaking changes, removals | MAJOR (**X**.0.0) | 1.17.0 → 2.0.0 |
 
-**CRITICAL:** `### ❌ Removed` entries MUST only appear in MAJOR version releases. Removing features is a breaking change.
-
-### Released Versions Are Immutable
-
-**NEVER modify already released versions.** Once a version is released (has a Prowler version tag like `v5.16.0`), its changelog section is frozen.
-
-**Common issue:** A PR is created during release cycle X, includes a changelog entry, but merges after release. The entry is now in the wrong section.
-
-```markdown
-## [1.16.0] (Prowler v5.16.0)    ← RELEASED, DO NOT MODIFY
-
-### Added
-- Feature from merged PR [(#9999)]   ← WRONG! PR merged after release
-
-## [1.17.0] (Prowler UNRELEASED)  ← Move entry HERE
-```
-
-**Fix:** Move the entry from the released version to the UNRELEASED section.
-
-### Version Header Format
-
-```markdown
-## [1.17.0] (Prowler UNRELEASED)    # For unreleased changes
-## [1.16.0] (Prowler v5.16.0)       # For released versions
-
----                                  # Horizontal rule between versions
-```
-
-## Mandatory Changelog Preflight
-
-Before editing any `CHANGELOG.md`, always inspect the active release boundary:
-
-1. Read the UNRELEASED block plus the latest three released version blocks:
-   ```bash
-   awk '/^## \[/{n++} n<=4 {print}' ui/CHANGELOG.md
-   ```
-2. Identify the **only writable block**: the block whose header contains `(Prowler UNRELEASED)`.
-3. Treat every block whose header contains `(Prowler vX.Y.Z)` as immutable. Do not add, move, reword, reorder, or deduplicate entries there.
-4. If your PR's entry appears in any of the latest three released blocks, remove it from the released block and add it to the correct section in the UNRELEASED block.
-5. If there is no UNRELEASED block at the top, stop and ask before editing.
-
-**Do not trust the current topmost matching section name.** A released block can contain the same section heading (`### 🚀 Added`, `### 🔄 Changed`, etc.). Always anchor edits to the `Prowler UNRELEASED` version block first.
+**CRITICAL:** `removed` fragments MUST only ship in MAJOR version releases. Removing features is a breaking change.
 
 ## Mandatory Human Confirmation Gate
 
-Before creating or editing any changelog file (`CHANGELOG.md`), the agent MUST stop and get explicit user confirmation. This applies even when the changelog gate is failing, the required edit seems obvious, or the user asked to "fix the changelog".
+Before creating or editing any changelog fragment or `CHANGELOG.md` file, the agent MUST stop and get explicit user confirmation. This applies even when the changelog gate is failing, the required file seems obvious, or the user asked to "fix the changelog".
 
-Present the proposed changelog action before writing:
+Present the proposed action before writing:
 
-1. Target file path.
-2. Target version block and section.
-3. Exact entry to add, move, remove, or rewrite.
-4. Reason the changelog is needed.
+1. Target fragment path (component, slug, type) or CHANGELOG.md edit.
+2. Exact entry text.
+3. Reason the changelog entry is needed.
 
-Only proceed after an explicit approval such as "confirm", "approved", "sí", or equivalent. If the user rejects or does not answer, do not edit or create the changelog. Offer alternatives such as adding `no-changelog` when appropriate.
+Only proceed after an explicit approval such as "confirm", "approved", "sí", or equivalent. If the user rejects or does not answer, do not create or edit anything. Offer alternatives such as adding `no-changelog` when appropriate.
 
 ## Adding a Changelog Entry
 
 ### Step 1: Determine Affected Component(s)
 
 ```bash
-# Check which files changed
-git diff main...HEAD --name-only
+git diff master...HEAD --name-only | grep -E '^(ui|api|mcp_server|prowler)/' | cut -d/ -f1 | sort -u
 ```
 
 | Path Pattern | Component |
@@ -160,114 +127,63 @@ git diff main...HEAD --name-only
 | `api/**` | API |
 | `mcp_server/**` | MCP Server |
 | `prowler/**` | SDK |
-| Multiple | Update ALL affected changelogs |
+| Root `uv.lock` / `pyproject.toml` | SDK (the gate requires a `prowler/changelog.d/` fragment) |
+| Multiple | One fragment per affected component |
 
-### Step 2: Determine Change Type
+### Step 2: Create the fragment(s)
 
-| Change | Section |
-|--------|---------|
-| New feature, check, endpoint | 🚀 Added |
-| Behavior change, refactor | 🔄 Changed |
-| Bug fix | 🐞 Fixed |
-| CVE patch, security improvement | 🔐 Security |
-| Feature removal | ❌ Removed |
-| Deprecation notice | ⚠️ Deprecated |
-
-### Step 3: Add Entry at BOTTOM of Appropriate Section
-
-**CRITICAL:** Add new entries at the BOTTOM of each section, NOT at the top.
-
-**CRITICAL:** The link MUST point to the PR (`/pull/N`). Linking to `/issues/N` is FORBIDDEN. If the PR closes an issue, that mapping goes in the PR body via `Fixes #N` — never in the changelog entry.
-
-```markdown
-## [1.17.0] (Prowler UNRELEASED)
-
-### 🐞 Fixed
-
-- Existing fix one [(#9997)](https://github.com/prowler-cloud/prowler/pull/9997)
-- Existing fix two [(#9998)](https://github.com/prowler-cloud/prowler/pull/9998)
-- Button alignment in dashboard header [(#9999)](https://github.com/prowler-cloud/prowler/pull/9999)  ← NEW ENTRY AT BOTTOM
-
-### 🔐 Security
+```bash
+echo 'Entry text describing the change' > <component>/changelog.d/<slug>.<type>.md
 ```
 
-This maintains chronological order within each section (oldest at top, newest at bottom).
+### Step 3: Check pending fragments
 
-## Examples
-
-### Good Entries
-
-```markdown
-### 🚀 Added
-- Search bar when adding a provider [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634)
-
-### 🐞 Fixed
-- OCI update credentials form failing silently due to missing provider UID [(#9746)](https://github.com/prowler-cloud/prowler/pull/9746)
-
-### 🔐 Security
-- Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs [(#9797)](https://github.com/prowler-cloud/prowler/pull/9797)
-```
-
-### Readable Technical Entries
-
-```markdown
-# GOOD - Technical but readable
-### 🐞 Fixed
-- `POST /api/v1/scans` no longer intermittently fails with `Scan matching query does not exist`; scan dispatch now publishes the `scan-perform` Celery task after the transaction commits [(#11122)](https://github.com/prowler-cloud/prowler/pull/11122)
-- `entra_users_mfa_capable` no longer flags disabled guest users; Microsoft Graph is now the source of truth for `account_enabled` because EXO `Get-User` omits guest users [(#11002)](https://github.com/prowler-cloud/prowler/pull/11002)
-```
-
-### Bad Entries
-
-```markdown
-# BAD - Wrong section order (Fixed before Added)
-### 🐞 Fixed
-- Some bug fix [(#123)](...)
-
-### 🚀 Added
-- Some new feature [(#456)](...)
-
-- Fixed bug.                              # Too vague, has period
-- Added new feature for users             # Missing PR link, redundant verb
-- Add search bar [(#123)]                 # Redundant verb (section already says "Added")
-- This PR adds a cool new thing (#123)    # Wrong link format, conversational
-- Some bug fix [(#123)](https://github.com/prowler-cloud/prowler/issues/123)   # FORBIDDEN: must link to /pull/N, never /issues/N
-- POST /api/v1/scanswas intermittently failing withScan matching query does not existin thescan-performworker (#11122)  # Missing spaces/backticks, unreadable
-- entra_users_mfa_capable no longer flags disabled guest users by requesting accountEnabled and userType from Microsoft Graph via $select and using Graph as the source of truth for account_enabled (EXO Get-User does not return guest users) (#11002)  # Run-on sentence, identifiers not formatted
+```bash
+ls prowler/changelog.d/ api/changelog.d/ ui/changelog.d/ mcp_server/changelog.d/
 ```
 
 ## PR Changelog Gate
 
-The `pr-check-changelog.yml` workflow enforces changelog entries:
+The `pr-check-changelog.yml` workflow enforces fragments:
 
-1. **REQUIRED**: PRs touching `ui/`, `api/`, `mcp_server/`, or `prowler/` MUST update the corresponding changelog
-2. **SKIP**: Add `no-changelog` label to bypass (use sparingly for docs-only, CI-only changes)
+1. **REQUIRED**: PRs touching `ui/`, `api/`, `mcp_server/`, or `prowler/` MUST add (or fix) a fragment under the corresponding `changelog.d/`
+2. **VALIDATED**: added fragment filenames must match `<slug>.<type>.md` with a valid type
+3. **LINTED**: fragment content must NOT contain a hand-written PR link (`[(#N)](...)`); the gate fails if one is found because the link is attached automatically at compile time
+4. **SKIP**: Add `no-changelog` label to bypass (use sparingly for docs-only, CI-only changes)
 
-## Commands
+## Release flow (compile)
 
-```bash
-# Check which changelogs need updates based on changed files
-git diff main...HEAD --name-only | grep -E '^(ui|api|mcp_server|prowler)/' | cut -d/ -f1 | sort -u
+- At release time, the `compile-changelogs` workflow (manual dispatch: `prowler_version` + `target_branch`; per-component versions are auto-derived from each changelog's latest stamped heading plus the pending fragment types, with optional explicit overrides or `skip`) resolves each fragment's PR from git history, runs the compiler per component, and opens a `chore(changelog): vX.Y.Z` PR (labeled `no-changelog`) that inserts the stamped `## [X.Y.Z] (Prowler vX.Y.Z)` block into each `CHANGELOG.md` and deletes the consumed fragments. A human reviews and squash-merges it. `prepare-release.yml` then extracts the stamped sections exactly as before.
+- **Minor release (X.Y.0):** compile on `master` and merge the compile PR BEFORE cutting the `v5.X` branch.
+- **Patch release (X.Y.Z):** fixes are backported to `v5.X` with their fragment files (conflict-free); compile on `v5.X` and merge its PR there. The same workflow run automatically opens a second forward-sync PR against master (labeled `no-changelog`) that inserts the same stamped block under master's marker and deletes the consumed fragments, so the next minor cannot re-release them; merge it right after. Fragments that only existed on `v5.X` are skipped with a notice. No manual git is involved.
+- Entries within a section are ordered by PR number ascending (approximately chronological). Do not fight this ordering.
 
-# View current UNRELEASED section
-head -50 ui/CHANGELOG.md
-head -50 api/CHANGELOG.md
-head -50 mcp_server/CHANGELOG.md
-head -50 prowler/CHANGELOG.md
-```
+## Fixing an already-released entry
 
-## Migration Note
+Released version blocks in `CHANGELOG.md` are otherwise immutable, but typo/correction fixes to already-released entries are the one case where a PR edits `CHANGELOG.md` directly: make the edit and add the `no-changelog` label.
 
-**API, MCP Server, and SDK changelogs currently lack emojis.** When editing these files, add emoji prefixes to section headers as you update them:
+If a PR's entry shipped in the wrong released block (e.g. the PR merged after its release was cut), move the entry back to a fragment: delete it from the released block and recreate it as `<component>/changelog.d/<PR>.<type>.md` (label the PR `no-changelog` since it edits `CHANGELOG.md`).
+
+## Compiled CHANGELOG.md format (for reference)
+
+The compiler renders, per release, into each `CHANGELOG.md` right under the `<!-- changelog: release notes start -->` marker (never remove that marker):
 
 ```markdown
-# Before (legacy)
-### Added
+## [X.Y.Z] (Prowler vA.B.C)
 
-# After (standardized)
 ### 🚀 Added
+
+- Entry text [(#NNNN)](https://github.com/prowler-cloud/prowler/pull/NNNN)
+
+### 🐞 Fixed
+
+- Fix entry [(#NNNN)](https://github.com/prowler-cloud/prowler/pull/NNNN)
+
+---
 ```
 
+Section order is always: Added → Changed → Deprecated → Removed → Fixed → Security. `X.Y.Z` is the COMPONENT version; `A.B.C` is the Prowler release version. Every entry ends with its PR link; linking to `/issues/N` is forbidden (the issue↔PR mapping belongs in the PR body via `Fixes #N`).
+
 ## Resources
 
 - **Templates**: See [assets/](assets/) for entry templates

skills/prowler-changelog/assets/entry-templates.md

@@ -1,101 +1,73 @@
-# Changelog Entry Templates
+# Changelog Fragment Templates
 
-## Entry Placement Rule
+## Fragment basics
 
-**CRITICAL:** Always add new entries at the **BOTTOM** of each section (before the next section header or `---`).
+One fragment file per entry, under the component's `changelog.d/`:
 
-This maintains chronological order: oldest entries at top, newest at bottom.
-
-## Section Headers
-
-```markdown
-### 🚀 Added
-### 🔄 Changed
-### ⚠️ Deprecated
-### ❌ Removed
-### 🐞 Fixed
-### 🔐 Security
+```text
+<component>/changelog.d/<slug>.<type>.md
 ```
 
-## Entry Patterns
+- `<slug>`: free-form, descriptive (`[A-Za-z0-9][A-Za-z0-9._-]*`)
+- `<type>`: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: a single line with the entry text. **No PR link** (attached automatically at compile time) and no trailing period.
 
-> **Note:** Section headers already provide the verb. Entries describe WHAT, not the action.
->
-> **Link target rule:** Every entry MUST link to the PR (`https://github.com/prowler-cloud/prowler/pull/N`). Linking to `/issues/N` is FORBIDDEN — even when the PR fixes an issue. The issue↔PR mapping belongs in the PR body (`Fixes #N`), not here.
+> **Note:** The section header already provides the verb. Entries describe WHAT, not the action.
 
-### Feature Addition (🚀 Added)
-```markdown
-- Search bar when adding a provider [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- `{check_id}` check for {provider} provider [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- `/api/v1/{endpoint}` endpoint to {description} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+## Content Patterns by Type
+
+### Feature Addition (`.added.md`)
+
+```text
+Search bar when adding a provider
+`{check_id}` check for {provider} provider
+`/api/v1/{endpoint}` endpoint to {description}
 ```
 
-### Behavior Change (🔄 Changed)
-```markdown
-- Lighthouse AI MCP tool filtering from blacklist to whitelist approach [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- {package} from {old} to {new} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+### Behavior Change (`.changed.md`)
+
+```text
+Lighthouse AI MCP tool filtering from blacklist to whitelist approach
+{package} from {old} to {new}
 ```
 
-### Bug Fix (🐞 Fixed)
-```markdown
-- OCI update credentials form failing silently due to missing provider UID [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- {What was broken} in {component} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+### Bug Fix (`.fixed.md`)
+
+```text
+OCI update credentials form failing silently due to missing provider UID
+{What was broken} in {component}
 ```
 
-> When a PR fixes a reported issue, the link still goes to the PR (`/pull/N`), never the issue (`/issues/N`). Reference the issue from the PR body with `Fixes #N`.
+### Security Patch (`.security.md`)
 
-### Security Patch (🔐 Security)
-```markdown
-- Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-- {package} to version {version} (CVE-XXXX-XXXXX) [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+```text
+Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs
+{package} to version {version} (CVE-XXXX-XXXXX)
 ```
 
-### Removal (❌ Removed)
-```markdown
-- Deprecated {feature} from {location} [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
+### Removal (`.removed.md`)
+
+```text
+Deprecated {feature} from {location}
 ```
 
-## Version Header Templates
+## Full Examples
 
-### Unreleased
-```markdown
-## [X.Y.Z] (Prowler UNRELEASED)
+```bash
+echo 'Search bar when adding a provider' > ui/changelog.d/provider-search-bar.added.md
+
+echo '`kms_key_rotation_max_90_days` check for GCP provider, verifying KMS customer-managed keys are rotated every 90 days or less' > prowler/changelog.d/kms-rotation-90d.added.md
+
+echo 'OCI update credentials form failing silently due to missing provider UID' > ui/changelog.d/oci-credentials-form.fixed.md
 ```
 
-### Released
-```markdown
-## [X.Y.Z] (Prowler vA.B.C)
+Several entries in one PR → one file per entry, freely mixing types (different slugs when the type repeats):
 
----
+```text
+prowler/changelog.d/kms-rotation-check.added.md
+prowler/changelog.d/kms-rotation-docs.added.md
+prowler/changelog.d/kms-metadata-cache.changed.md
+prowler/changelog.d/kms-disabled-keys.fixed.md
 ```
 
-## Full Entry Example
-
-```markdown
-## [1.17.0] (Prowler UNRELEASED)
-
-### 🚀 Added
-
-- Search bar when adding a provider [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634)
-- New findings table UI with new design system components [(#9699)](https://github.com/prowler-cloud/prowler/pull/9699)
-- YOUR NEW ENTRY GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
-### 🔄 Changed
-
-- Lighthouse AI MCP tool filtering from blacklist to whitelist approach [(#9802)](https://github.com/prowler-cloud/prowler/pull/9802)
-- YOUR NEW CHANGE GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
-### 🐞 Fixed
-
-- OCI update credentials form failing silently due to missing provider UID [(#9746)](https://github.com/prowler-cloud/prowler/pull/9746)
-- YOUR NEW FIX GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
-### 🔐 Security
-
-- Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs [(#9797)](https://github.com/prowler-cloud/prowler/pull/9797)
-- YOUR NEW SECURITY FIX GOES HERE AT BOTTOM [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
-
----
-```
-
-> **Remember:** Each new entry is added at the BOTTOM of its section to maintain chronological order.
+> **Remember:** never include the PR link in the fragment text; the compile step resolves and appends it automatically.

skills/prowler-ci/SKILL.md

@@ -31,7 +31,8 @@ Use this skill whenever you are:
 
 - PR template: `.github/pull_request_template.md`
 - PR title validation: `.github/workflows/conventional-commit.yml`
-- Changelog gate: `.github/workflows/pr-check-changelog.yml`
+- Changelog gate: `.github/workflows/pr-check-changelog.yml` (requires a fragment under `<component>/changelog.d/`)
+- Changelog compile (release time): `.github/workflows/compile-changelogs.yml`
 - Conflict markers check: `.github/workflows/pr-conflict-checker.yml`
 - Secret scanning: `.github/workflows/find-secrets.yml`
 - Auto labels: `.github/workflows/labeler.yml` and `.github/labeler.yml`
@@ -42,7 +43,7 @@ Use this skill whenever you are:
 1. Identify which workflow/job is failing (name + file under `.github/workflows/`).
 2. Check path filters: is the workflow supposed to run for your changed files?
 3. If it's a title check: verify PR title matches Conventional Commits.
-4. If it's changelog: verify the right `CHANGELOG.md` is updated OR apply `no-changelog` label.
+4. If it's changelog: verify a valid fragment exists under the right `<component>/changelog.d/` OR apply `no-changelog` label.
 5. If it's conflict checker: remove `<<<<<<<`, `=======`, `>>>>>>>` markers.
 6. If it's secrets (TruffleHog): see section below.
 

skills/prowler-compliance-review/SKILL.md

@@ -27,7 +27,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
 | JSON Valid | `python3 -m json.tool file.json` | No syntax errors |
 | All Checks Exist | Run validation script | 0 missing checks |
 | No Duplicate IDs | Run validation script | 0 duplicate requirement IDs |
-| CHANGELOG Entry | Manual review | Present under correct version |
+| Changelog fragment | Manual review | Fragment present under `prowler/changelog.d/` |
 | Dashboard File | Compare with existing | Follows established pattern |
 | Framework Metadata | Manual review | All required fields populated |
 
@@ -63,8 +63,8 @@ JSON Valid?
         Duplicate Requirement IDs?
         ├── Yes → FAIL: Fix duplicate IDs
         └── No ↓
-            CHANGELOG Entry Present?
-            ├── No → REQUEST CHANGES: Add CHANGELOG entry
+            Changelog Fragment Present?
+            ├── No → REQUEST CHANGES: Add changelog fragment
             └── Yes ↓
                 Dashboard File Follows Pattern?
                 ├── No → REQUEST CHANGES: Fix dashboard pattern
@@ -124,7 +124,7 @@ Compliance frameworks are JSON files in: `prowler/compliance/{provider}/{framewo
 | Empty Checks for Automated | AssessmentStatus is Automated but Checks is empty | Add checks or change to Manual |
 | Wrong file location | Framework not in `prowler/compliance/{provider}/` | Move to correct directory |
 | Missing dashboard file | No corresponding `dashboard/compliance/{framework}.py` | Create dashboard file following pattern |
-| CHANGELOG missing | Not under correct version section | Add entry to prowler/CHANGELOG.md |
+| Changelog fragment missing | No fragment file in the PR diff | Add a fragment under prowler/changelog.d/ |
 
 ---
 

skills/prowler-compliance-review/references/review-checklist.md

@@ -16,7 +16,7 @@
 |-----------|----------|
 | Compliance JSON | `prowler/compliance/{provider}/{framework}.json` |
 | Dashboard | `dashboard/compliance/{framework}_{provider}.py` |
-| CHANGELOG | `prowler/CHANGELOG.md` |
+| Changelog fragment | `prowler/changelog.d/` |
 | Checks | `prowler/providers/{provider}/services/{service}/{check}/` |
 
 ## Validation Script
@@ -40,7 +40,7 @@ When completing a compliance framework review, use this summary format:
 | JSON Valid | PASS/FAIL |
 | All Checks Exist | PASS/FAIL (N missing) |
 | No Duplicate IDs | PASS/FAIL |
-| CHANGELOG Entry | PASS/FAIL |
+| Changelog fragment | PASS/FAIL |
 | Dashboard File | PASS/FAIL |
 
 ### Statistics

skills/prowler-pr/SKILL.md

@@ -56,7 +56,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
 - [ ] Review if code is being documented following https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
 - [ ] Review if backport is needed.
 - [ ] Review if is needed to change the Readme.md
-- [ ] Ensure new entries are added to CHANGELOG.md, if applicable.
+- [ ] Ensure a changelog fragment is added under <component>/changelog.d/, if applicable.
 
 #### SDK/CLI
 - Are there new checks included in this PR? Yes / No
@@ -67,7 +67,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
 - [ ] Screenshots/Video - Mobile (X < 640px)
 - [ ] Screenshots/Video - Tablet (640px > X < 1024px)
 - [ ] Screenshots/Video - Desktop (X > 1024px)
-- [ ] Ensure new entries are added to ui/CHANGELOG.md
+- [ ] Ensure a changelog fragment is added under ui/changelog.d/
 
 #### API (if applicable)
 - [ ] All issue/task requirements work as expected on the API
@@ -77,7 +77,7 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
 - [ ] Any other relevant evidence of the implementation (if applicable)
 - [ ] Verify if API specs need to be regenerated.
 - [ ] Check if version updates are required.
-- [ ] Ensure new entries are added to api/CHANGELOG.md
+- [ ] Ensure a changelog fragment is added under api/changelog.d/
 
 ### License
 
@@ -86,12 +86,12 @@ By submitting this pull request, I confirm that my contribution is made under th
 
 ## Component-Specific Rules
 
-| Component | CHANGELOG | Extra Checks |
-|-----------|-----------|--------------|
-| SDK | `prowler/CHANGELOG.md` | New checks → permissions update? |
-| API | `api/CHANGELOG.md` | API specs, version bump, endpoint output, EXPLAIN ANALYZE, performance |
-| UI | `ui/CHANGELOG.md` | Screenshots for Mobile/Tablet/Desktop |
-| MCP | `mcp_server/CHANGELOG.md` | N/A |
+| Component | Changelog fragment | Extra Checks |
+|-----------|--------------------|--------------|
+| SDK | `prowler/changelog.d/` | New checks → permissions update? |
+| API | `api/changelog.d/` | API specs, version bump, endpoint output, EXPLAIN ANALYZE, performance |
+| UI | `ui/changelog.d/` | Screenshots for Mobile/Tablet/Desktop |
+| MCP | `mcp_server/changelog.d/` | N/A |
 
 ## Commands
 
@@ -128,7 +128,7 @@ Follow conventional commits:
 
 1. ✅ All tests pass locally
 2. ✅ Linting passes (`make lint` or component-specific)
-3. ✅ CHANGELOG updated (if applicable)
+3. ✅ Changelog fragment added (if applicable)
 4. ✅ Branch is up to date with main
 5. ✅ Commits are clean and descriptive
 

tests/github/changelog_attribution_test.py

@@ -0,0 +1,178 @@
+import importlib.util
+import shutil
+import sys
+from pathlib import Path
+
+MODULE_PATH = (
+    Path(__file__).resolve().parents[2]
+    / ".github"
+    / "scripts"
+    / "changelog_attribution.py"
+)
+SPEC = importlib.util.spec_from_file_location("changelog_attribution", MODULE_PATH)
+changelog_attribution = importlib.util.module_from_spec(SPEC)
+assert SPEC.loader is not None
+SPEC.loader.exec_module(changelog_attribution)
+
+
+def make_component(tmp_path):
+    component = tmp_path / "prowler"
+    fragments_dir = component / "changelog.d"
+    fragments_dir.mkdir(parents=True)
+    return component, fragments_dir
+
+
+def fake_git_mv(*args):
+    if args[0] != "mv":
+        raise AssertionError(f"Unexpected git command: {args}")
+    shutil.move(args[1], args[2])
+    return ""
+
+
+def fail_git(*args):
+    raise AssertionError(f"Unexpected git command: {args}")
+
+
+def fail_api(*args):
+    raise AssertionError(f"Unexpected GitHub API call: {args}")
+
+
+def run_main(monkeypatch, component, *extra_args):
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["changelog_attribution.py", str(component), *extra_args],
+    )
+    return changelog_attribution.main()
+
+
+class TestChangelogAttribution:
+    def test_renames_slug_fragment_to_resolved_pr_number(self, tmp_path, monkeypatch):
+        component, fragments_dir = make_component(tmp_path)
+        fragment = fragments_dir / "add-workflow.fixed.md"
+        fragment.write_text("Fix changelog workflow.\n")
+
+        monkeypatch.setattr(
+            changelog_attribution, "find_adding_commit", lambda path: "abc123"
+        )
+        monkeypatch.setattr(
+            changelog_attribution, "pr_from_api", lambda repo, sha: 11572
+        )
+        monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+        assert run_main(monkeypatch, component) == 0
+        assert not fragment.exists()
+        assert (fragments_dir / "11572.fixed.md").read_text() == (
+            "Fix changelog workflow.\n"
+        )
+
+    def test_appends_counter_when_pr_fragment_already_exists(
+        self, tmp_path, monkeypatch
+    ):
+        component, fragments_dir = make_component(tmp_path)
+        (fragments_dir / "11572.fixed.md").write_text("Existing fix.\n")
+        fragment = fragments_dir / "another-fix.fixed.md"
+        fragment.write_text("Another fix.\n")
+
+        monkeypatch.setattr(
+            changelog_attribution, "find_adding_commit", lambda path: "abc123"
+        )
+        monkeypatch.setattr(
+            changelog_attribution, "pr_from_api", lambda repo, sha: 11572
+        )
+        monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+        assert run_main(monkeypatch, component) == 0
+        assert (fragments_dir / "11572.fixed.md").read_text() == "Existing fix.\n"
+        assert (fragments_dir / "11572.fixed.1.md").read_text() == "Another fix.\n"
+
+    def test_uses_subject_fallback_when_api_is_disabled(self, tmp_path, monkeypatch):
+        component, fragments_dir = make_component(tmp_path)
+        fragment = fragments_dir / "fallback.added.md"
+        fragment.write_text("Add fallback behavior.\n")
+
+        monkeypatch.setattr(
+            changelog_attribution, "find_adding_commit", lambda path: "abc123"
+        )
+        monkeypatch.setattr(
+            changelog_attribution,
+            "pr_from_api",
+            fail_api,
+        )
+        monkeypatch.setattr(changelog_attribution, "pr_from_subject", lambda sha: 42)
+        monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+        assert run_main(monkeypatch, component, "--no-api") == 0
+        assert not fragment.exists()
+        assert (fragments_dir / "42.added.md").read_text() == "Add fallback behavior.\n"
+
+    def test_renames_unresolved_fragment_to_orphan(self, tmp_path, monkeypatch, capsys):
+        component, fragments_dir = make_component(tmp_path)
+        fragment = fragments_dir / "manual.changed.md"
+        fragment.write_text("Change manual entry.\n")
+
+        monkeypatch.setattr(
+            changelog_attribution, "find_adding_commit", lambda path: None
+        )
+        monkeypatch.setattr(changelog_attribution, "git", fake_git_mv)
+
+        assert run_main(monkeypatch, component) == 0
+        assert not fragment.exists()
+        assert (fragments_dir / "+manual.changed.md").read_text() == (
+            "Change manual entry.\n"
+        )
+        assert "Could not resolve a PR" in capsys.readouterr().out
+
+    def test_rejects_malformed_fragment_names(self, tmp_path, monkeypatch, capsys):
+        component, fragments_dir = make_component(tmp_path)
+        fragment = fragments_dir / "bad.bugfix.md"
+        fragment.write_text("Invalid type.\n")
+
+        monkeypatch.setattr(
+            changelog_attribution,
+            "git",
+            fail_git,
+        )
+
+        assert run_main(monkeypatch, component) == 1
+        assert fragment.exists()
+        assert "Malformed fragment filename" in capsys.readouterr().out
+
+    def test_rejects_malformed_names_before_renaming_any_fragment(
+        self, tmp_path, monkeypatch, capsys
+    ):
+        component, fragments_dir = make_component(tmp_path)
+        valid_fragment = fragments_dir / "valid.fixed.md"
+        malformed_fragment = fragments_dir / "bad.bugfix.md"
+        valid_fragment.write_text("Valid fix.\n")
+        malformed_fragment.write_text("Invalid type.\n")
+
+        monkeypatch.setattr(
+            changelog_attribution, "find_adding_commit", lambda path: "abc123"
+        )
+        monkeypatch.setattr(
+            changelog_attribution, "pr_from_api", lambda repo, sha: 11572
+        )
+        monkeypatch.setattr(changelog_attribution, "git", fail_git)
+
+        assert run_main(monkeypatch, component) == 1
+        assert valid_fragment.read_text() == "Valid fix.\n"
+        assert malformed_fragment.read_text() == "Invalid type.\n"
+        assert not (fragments_dir / "11572.fixed.md").exists()
+        assert "Malformed fragment filename" in capsys.readouterr().out
+
+    def test_skips_fragments_that_already_start_with_pr_number(
+        self, tmp_path, monkeypatch
+    ):
+        component, fragments_dir = make_component(tmp_path)
+        fragment = fragments_dir / "11572.added.md"
+        fragment.write_text("Already attributed.\n")
+
+        monkeypatch.setattr(
+            changelog_attribution,
+            "git",
+            fail_git,
+        )
+
+        assert run_main(monkeypatch, component) == 0
+        assert fragment.read_text() == "Already attributed.\n"

tests/github/changelog_fragments_test.py

@@ -0,0 +1,314 @@
+import re
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+EXPECTED_CHANGELOG_TYPE_ORDER = [
+    "added",
+    "changed",
+    "deprecated",
+    "removed",
+    "fixed",
+    "security",
+]
+EXPECTED_CHANGELOG_SECTION_NAMES = [
+    "🚀 Added",
+    "🔄 Changed",
+    "⚠️ Deprecated",
+    "❌ Removed",
+    "🐞 Fixed",
+    "🔐 Security",
+]
+COMPONENTS = ["prowler", "api", "ui", "mcp_server"]
+
+
+def read_workflow(name):
+    return (REPO_ROOT / ".github" / "workflows" / name).read_text()
+
+
+def render_towncrier(tmp_path, type_definitions, fragments):
+    pytest.importorskip("towncrier")
+
+    fragments_dir = tmp_path / "changelog.d"
+    fragments_dir.mkdir()
+    (tmp_path / "CHANGELOG.md").write_text(
+        "# Changelog\n\n<!-- changelog: release notes start -->\n"
+    )
+    for filename, content in fragments.items():
+        (fragments_dir / filename).write_text(f"{content}\n")
+
+    type_config = "\n".join(
+        "\n".join(
+            [
+                "[[tool.towncrier.type]]",
+                f'directory = "{directory}"',
+                f'name = "{name}"',
+                "showcontent = true",
+            ]
+        )
+        for directory, name in type_definitions
+    )
+    config = "\n".join(
+        [
+            "[tool.towncrier]",
+            'directory = "changelog.d"',
+            'filename = "CHANGELOG.md"',
+            'start_string = "<!-- changelog: release notes start -->\\n"',
+            f'template = "{(REPO_ROOT / ".github/towncrier/template.md.jinja").as_posix()}"',
+            'title_format = "## [{version}] ({name})"',
+            'issue_format = "[(#{issue})](https://example.com/pull/{issue})"',
+            'underlines = ["", "", ""]',
+            type_config,
+        ]
+    )
+    config_path = tmp_path / "towncrier.toml"
+    config_path.write_text(config)
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "towncrier",
+            "build",
+            "--config",
+            str(config_path),
+            "--version",
+            "0.1.0",
+            "--name",
+            "Test",
+            "--draft",
+        ],
+        cwd=tmp_path,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return result.stdout.split("## [0.1.0] (Test)", 1)[1]
+
+
+def test_towncrier_template_uses_configured_changelog_section_order(tmp_path):
+    template = (REPO_ROOT / ".github/towncrier/template.md.jinja").read_text()
+
+    assert "{% set category_order = definitions.keys() %}" in template
+    assert (
+        "{% for category in category_order if category in sections[section] %}"
+        in template
+    )
+    assert "definitions.items()" not in template
+    assert (
+        '["added", "changed", "deprecated", "removed", "fixed", "security"]'
+        not in template
+    )
+
+    output = render_towncrier(
+        tmp_path,
+        [("fixed", "Fixed"), ("added", "Added"), ("custom", "Custom")],
+        {
+            "1.added.md": "Entry one",
+            "2.added.md": "Entry two",
+            "3.fixed.md": "Fix entry",
+            "4.custom.md": "Custom entry",
+        },
+    )
+
+    headings = re.findall(r"^### (.+)$", output, re.MULTILINE)
+    assert headings == ["Fixed", "Added", "Custom"]
+    assert (
+        "- Entry one [(#1)](https://example.com/pull/1)\n"
+        "- Entry two [(#2)](https://example.com/pull/2)"
+    ) in output
+    assert (
+        "- Entry one [(#1)](https://example.com/pull/1)\n\n"
+        "- Entry two [(#2)](https://example.com/pull/2)"
+    ) not in output
+
+
+def test_component_towncrier_configs_keep_changelog_section_order():
+    for component in COMPONENTS:
+        config = tomllib.loads((REPO_ROOT / component / "towncrier.toml").read_text())
+        type_definitions = config["tool"]["towncrier"]["type"]
+
+        assert [item["directory"] for item in type_definitions] == (
+            EXPECTED_CHANGELOG_TYPE_ORDER
+        )
+        assert [item["name"] for item in type_definitions] == (
+            EXPECTED_CHANGELOG_SECTION_NAMES
+        )
+
+
+def test_pull_request_template_links_to_all_fragment_locations():
+    template = (REPO_ROOT / ".github/pull_request_template.md").read_text()
+
+    assert "[Prowler Community Slack](https://goto.prowler.com/slack)" in template
+    assert "[Prowler Community Slack](goto.prowler.com/slack)" not in template
+    for component in COMPONENTS:
+        assert f"{component}/changelog.d/" in template
+
+
+def test_changelog_gate_rejects_direct_changelog_edits():
+    workflow = read_workflow("pr-check-changelog.yml")
+    has_update = re.search(
+        r"(?ms)^\s*has_changelog_update\(\) \{\n(?P<body>.*?)^\s*\}\n",
+        workflow,
+    )
+
+    assert has_update is not None
+    assert "CHANGELOG.md" not in has_update.group("body")
+    assert "handwritten_changelogs" in workflow
+    assert "Direct CHANGELOG.md edits are not allowed" in workflow
+    assert "direct CHANGELOG.md edit" not in workflow
+
+
+def test_changelog_gate_tests_compile_workflow_changes():
+    workflow = read_workflow("pr-check-changelog.yml")
+
+    assert ".github/workflows/compile-changelogs.yml" in workflow
+
+
+def test_changelog_attribution_tests_use_pinned_python():
+    workflow = read_workflow("pr-check-changelog.yml")
+    match = re.search(
+        r"(?ms)^  test-changelog-attribution:\n(?P<body>.*?)^  check-changelog:",
+        workflow,
+    )
+
+    assert match is not None
+    job = match.group("body")
+    assert "uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c" in job
+    assert "python-version: '3.12'" in job
+    assert "python3 -m pip install" in job
+    assert "python3 -m pytest tests/github" in job
+    assert "objects.githubusercontent.com:443" in job
+
+
+def test_changelog_gate_rejects_common_manual_pr_link_forms():
+    workflow = read_workflow("pr-check-changelog.yml")
+
+    assert "manual_pr_link_re=" in workflow
+    assert r"\[\(#[0-9]+\)\]" in workflow
+    assert r"\[#[0-9]+\]\(" in workflow
+    assert r"\(#[0-9]+\)" in workflow
+    assert r"github\.com/[^[:space:]/]+/[^[:space:]/]+/(pull|issues)/[0-9]+" in workflow
+
+
+def test_changelog_gate_derives_fragment_paths_from_monitored_folders():
+    workflow = read_workflow("pr-check-changelog.yml")
+
+    assert "folder_alt=$(echo \"$MONITORED_FOLDERS\" | tr ' ' '|')" in workflow
+    assert "^(api|ui|prowler|mcp_server)/changelog\\.d/" not in workflow
+
+
+def test_changelog_gate_lints_renamed_fragments():
+    workflow = read_workflow("pr-check-changelog.yml")
+
+    assert "STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES" in workflow
+    assert "${{ steps.changed-files.outputs.renamed_files }}" in workflow
+    assert "added_or_renamed=" in workflow
+    assert "added_modified_or_renamed=" in workflow
+    assert (
+        'echo "$added_or_renamed" | grep -E "^(${folder_alt})/changelog\\.d/"'
+        in workflow
+    )
+    assert (
+        'echo "$added_modified_or_renamed" | grep -E "^(${folder_alt})/changelog\\.d/"'
+        in workflow
+    )
+
+
+def test_changelog_gate_uses_random_github_output_delimiters():
+    workflow = read_workflow("pr-check-changelog.yml")
+
+    assert "write_multiline_output()" in workflow
+    assert "openssl rand -hex 16" in workflow
+    assert '>> "$GITHUB_OUTPUT"' in workflow
+    assert "<<EOF" not in workflow
+
+
+def test_compile_workflow_blocks_egress_for_privileged_job():
+    workflow = read_workflow("compile-changelogs.yml")
+
+    assert "Harden the runner (Block outbound calls)" in workflow
+    assert "egress-policy: block" in workflow
+    for endpoint in [
+        "api.github.com:443",
+        "github.com:443",
+        "objects.githubusercontent.com:443",
+        "pypi.org:443",
+        "files.pythonhosted.org:443",
+    ]:
+        assert endpoint in workflow
+
+
+def test_forward_sync_inserts_release_blocks_by_prowler_version_order():
+    workflow = read_workflow("compile-changelogs.yml")
+
+    assert "insert_changelog_block_ordered()" in workflow
+    assert 'incoming_release=$(release_from_heading "$incoming_heading")' in workflow
+    assert 'incoming_key=$(version_key "$incoming_release")' in workflow
+    assert '[[ "$incoming_key" > "$existing_key" ]]' in workflow
+    assert "already contains a block for Prowler v${incoming_release}" in workflow
+    assert 'head -n "$marker_line" "$component/CHANGELOG.md"' not in workflow
+
+
+def test_compile_workflow_rejects_explicit_versions_that_do_not_bump():
+    workflow = read_workflow("compile-changelogs.yml")
+
+    assert 'current=$(latest_released_version "$component")' in workflow
+    assert 'current_key=$(version_key "$current")' in workflow
+    assert 'effective_key=$(version_key "$effective")' in workflow
+    assert (
+        '[[ "$effective_key" < "$current_key" || "$effective_key" == "$current_key" ]]'
+        in workflow
+    )
+    assert (
+        "explicit version '${effective}' must be greater than the latest released version"
+        in workflow
+    )
+
+
+def test_compile_workflow_requires_target_branch_to_match_prowler_version():
+    workflow = read_workflow("compile-changelogs.yml")
+
+    assert (
+        'IFS=. read -r prowler_major prowler_minor prowler_patch <<< "$PROWLER_VERSION"'
+        in workflow
+    )
+    assert "prowler_patch=$((10#$prowler_patch))" in workflow
+    assert 'if [ "$prowler_patch" -eq 0 ]; then' in workflow
+    assert "target_branch must be 'master' for Prowler ${PROWLER_VERSION}" in workflow
+    assert 'expected_target_branch="v${prowler_major}.${prowler_minor}"' in workflow
+    assert 'if [ "$TARGET_BRANCH" != "$expected_target_branch" ]; then' in workflow
+    assert (
+        "target_branch must be '${expected_target_branch}' for Prowler ${PROWLER_VERSION}"
+        in workflow
+    )
+
+
+def test_compile_workflow_normalizes_version_segments_before_arithmetic():
+    workflow = read_workflow("compile-changelogs.yml")
+
+    assert (
+        'printf \'%06d.%06d.%06d\' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"'
+        in workflow
+    )
+    assert "major=$((10#$major))" in workflow
+    assert "minor=$((10#$minor))" in workflow
+    assert "patch=$((10#$patch))" in workflow
+    assert "current_major=$((10#$current_major))" in workflow
+    assert "effective_major=$((10#$effective_major))" in workflow
+    assert "effective_minor=$((10#$effective_minor))" in workflow
+    assert "effective_patch=$((10#$effective_patch))" in workflow
+
+
+def test_compile_workflow_requires_removed_fragments_in_major_releases():
+    workflow = read_workflow("compile-changelogs.yml")
+
+    assert "has_removed_fragments" in workflow
+    assert "removed fragments require a major component release" in workflow
+    assert "effective_major" in workflow
+    assert "effective_minor" in workflow
+    assert "effective_patch" in workflow

tests/lib/outputs/jira/jira_test.py

@@ -16,8 +16,11 @@ from prowler.lib.outputs.jira.exceptions.exceptions import (
     JiraGetProjectsError,
     JiraGetProjectsResponseError,
     JiraNoProjectsError,
+    JiraNoTokenError,
     JiraRefreshTokenError,
+    JiraRefreshTokenResponseError,
     JiraRequiredCustomFieldsError,
+    JiraSendFindingsResponseError,
     JiraTestConnectionError,
 )
 from prowler.lib.outputs.jira.jira import Jira
@@ -1692,7 +1695,7 @@ class TestJiraIntegration:
         mock_cloud_id,
         mock_get_access_token,
     ):
-        """Test that send_finding returns False when the request fails."""
+        """Test that send_finding raises with Jira JSON error details."""
         # To disable vulture
         mock_cloud_id = mock_cloud_id
         mock_get_access_token = mock_get_access_token
@@ -1702,19 +1705,66 @@ class TestJiraIntegration:
         # Mock failed response
         mock_response = MagicMock()
         mock_response.status_code = 400
-        mock_response.json.return_value = {"errors": {"summary": "Required field"}}
+        mock_response.json.return_value = {
+            "errors": {"Team": "Team is required."},
+            "errorMessages": ["Field 'Team' cannot be set."],
+        }
         mock_post.return_value = mock_response
 
-        result = self.jira_integration.send_finding(
-            check_id="test-check",
-            check_title="Test Finding",
-            severity="High",
-            status="FAIL",
-            project_key="TEST",
-            issue_type="Bug",
-        )
+        with pytest.raises(JiraSendFindingsResponseError) as error:
+            self.jira_integration.send_finding(
+                check_id="test-check",
+                check_title="Test Finding",
+                severity="High",
+                status="FAIL",
+                project_key="TEST",
+                issue_type="Bug",
+            )
 
-        assert result is False
+        assert "Failed to create Jira issue" in str(error.value)
+        assert "'Team': 'Team is required.'" in str(error.value)
+        assert "Field 'Team' cannot be set." in str(error.value)
+        mock_post.assert_called_once()
+
+    @patch.object(Jira, "get_access_token", return_value="valid_access_token")
+    @patch.object(
+        Jira, "cloud_id", new_callable=PropertyMock, return_value="test_cloud_id"
+    )
+    @patch.object(Jira, "get_projects", return_value={"TEST": {"name": "Test Project"}})
+    @patch.object(Jira, "get_available_issue_types", return_value=["Bug"])
+    @patch("prowler.lib.outputs.jira.jira.requests.post")
+    def test_send_finding_response_error_without_json_body(
+        self,
+        mock_post,
+        mock_get_issue_types,
+        mock_get_projects,
+        mock_cloud_id,
+        mock_get_access_token,
+    ):
+        """Test send_finding raises with status-code context for non-JSON errors."""
+        # To disable vulture
+        mock_cloud_id = mock_cloud_id
+        mock_get_access_token = mock_get_access_token
+        mock_get_projects = mock_get_projects
+        mock_get_issue_types = mock_get_issue_types
+
+        mock_response = MagicMock()
+        mock_response.status_code = 502
+        mock_response.json.side_effect = ValueError("No JSON body")
+        mock_post.return_value = mock_response
+
+        with pytest.raises(JiraSendFindingsResponseError) as error:
+            self.jira_integration.send_finding(
+                check_id="test-check",
+                check_title="Test Finding",
+                severity="High",
+                status="FAIL",
+                project_key="TEST",
+                issue_type="Bug",
+            )
+
+        assert "Failed to create Jira issue" in str(error.value)
+        assert "Jira returned status code 502" in str(error.value)
         mock_post.assert_called_once()
 
     @patch.object(Jira, "get_access_token", return_value="valid_access_token")
@@ -1732,7 +1782,7 @@ class TestJiraIntegration:
         mock_cloud_id,
         mock_get_access_token,
     ):
-        """Test that send_finding returns False when custom fields cause an error."""
+        """Test that send_finding raises when custom fields cause an error."""
         # To disable vulture
         mock_cloud_id = mock_cloud_id
         mock_get_access_token = mock_get_access_token
@@ -1750,18 +1800,89 @@ class TestJiraIntegration:
         }
         mock_post.return_value = mock_response
 
-        result = self.jira_integration.send_finding(
-            check_id="test-check",
-            check_title="Test Finding",
-            severity="High",
-            status="FAIL",
-            project_key="TEST",
-            issue_type="Bug",
-        )
+        with pytest.raises(JiraRequiredCustomFieldsError) as error:
+            self.jira_integration.send_finding(
+                check_id="test-check",
+                check_title="Test Finding",
+                severity="High",
+                status="FAIL",
+                project_key="TEST",
+                issue_type="Bug",
+            )
 
-        assert result is False
+        assert "Jira project requires custom fields" in str(error.value)
+        assert "customfield_10001" in str(error.value)
         mock_post.assert_called_once()
 
+    @patch.object(
+        Jira,
+        "get_access_token",
+        side_effect=JiraRefreshTokenError(message="Failed to refresh the access token"),
+    )
+    def test_send_finding_reraises_refresh_token_error(self, mock_get_access_token):
+        """Test send_finding re-raises refresh token errors for API propagation."""
+        # To disable vulture
+        mock_get_access_token = mock_get_access_token
+
+        with pytest.raises(JiraRefreshTokenError) as error:
+            self.jira_integration.send_finding(
+                check_id="test-check",
+                check_title="Test Finding",
+                severity="High",
+                status="FAIL",
+                project_key="TEST",
+                issue_type="Bug",
+            )
+
+        assert error.value.message == "Failed to refresh the access token"
+
+    @patch.object(Jira, "get_access_token", return_value=None)
+    def test_send_finding_reraises_no_token_error(self, mock_get_access_token):
+        """Test send_finding re-raises missing token errors for API propagation."""
+        # To disable vulture
+        mock_get_access_token = mock_get_access_token
+
+        with pytest.raises(JiraNoTokenError) as error:
+            self.jira_integration.send_finding(
+                check_id="test-check",
+                check_title="Test Finding",
+                severity="High",
+                status="FAIL",
+                project_key="TEST",
+                issue_type="Bug",
+            )
+
+        assert error.value.message == "No token was found"
+
+    @patch.object(
+        Jira,
+        "get_access_token",
+        side_effect=JiraRefreshTokenResponseError(
+            message="Failed to refresh the access token, response code did not match 200"
+        ),
+    )
+    def test_send_finding_reraises_refresh_token_response_error(
+        self, mock_get_access_token
+    ):
+        """Test send_finding re-raises refresh token response errors for API propagation."""
+        # To disable vulture
+        mock_get_access_token = mock_get_access_token
+
+        with pytest.raises(JiraRefreshTokenResponseError) as error:
+            self.jira_integration.send_finding(
+                check_id="test-check",
+                check_title="Test Finding",
+                severity="High",
+                status="FAIL",
+                project_key="TEST",
+                issue_type="Bug",
+            )
+
+        assert (
+            error.value.message
+            == "Failed to refresh the access token, response code did not match 200"
+        )
+
     def test_get_headers_oauth_with_access_token(self):
         """Test get_headers returns correct OAuth headers with access token."""
         self.jira_integration._using_basic_auth = False

tests/providers/aws/services/dlm/dlm_ebs_snapshot_lifecycle_policy_exists/dlm_ebs_snapshot_lifecycle_policy_exists_test.py

@@ -1,3 +1,5 @@
+import builtins
+import sys
 from unittest import mock
 
 from boto3 import client, resource
@@ -12,38 +14,42 @@ from tests.providers.aws.utils import (
 )
 
 LIFECYCLE_POLICY_ID = "policy-XXXXXXXXXXXX"
+CHECK_MODULE = (
+    "prowler.providers.aws.services.dlm."
+    "dlm_ebs_snapshot_lifecycle_policy_exists."
+    "dlm_ebs_snapshot_lifecycle_policy_exists"
+)
+DLM_CLIENT_MODULE = "prowler.providers.aws.services.dlm.dlm_client"
+EC2_CLIENT_MODULE = "prowler.providers.aws.services.ec2.ec2_client"
+
+
+def unload_dlm_check_modules():
+    sys.modules.pop(CHECK_MODULE, None)
+    sys.modules.pop(DLM_CLIENT_MODULE, None)
 
 
 class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
     @mock_aws
     def test_no_ebs_snapshot_no_lifecycle_policies(self):
         # DLM Mock Client
-        dlm_client = mock.MagicMock
+        dlm_client = mock.MagicMock()
         dlm_client.audited_account = AWS_ACCOUNT_NUMBER
         dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
         dlm_client.lifecycle_policies = {}
+        dlm_client.regions_with_snapshots = {}
 
         aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
-        from prowler.providers.aws.services.ec2.ec2_service import EC2
+        unload_dlm_check_modules()
 
         with (
             mock.patch(
                 "prowler.providers.aws.services.dlm.dlm_service.DLM",
-                new=dlm_client,
+                new=mock.MagicMock(return_value=dlm_client),
             ),
             mock.patch(
                 "prowler.providers.common.provider.Provider.get_global_provider",
                 return_value=aws_provider,
             ),
-            mock.patch(
-                "prowler.providers.aws.services.ec2.ec2_service.EC2",
-                return_value=EC2(aws_provider),
-            ) as ec2_client,
-            mock.patch(
-                "prowler.providers.aws.services.ec2.ec2_client.ec2_client",
-                new=ec2_client,
-            ),
         ):
             from prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists import (
                 dlm_ebs_snapshot_lifecycle_policy_exists,
@@ -92,22 +98,22 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
                 )
             }
         }
+        dlm_client.regions_with_snapshots = {AWS_REGION_US_EAST_1: True}
         dlm_client.lifecycle_policy_arn_template = f"arn:{dlm_client.audited_partition}:dlm:{dlm_client.region}:{dlm_client.audited_account}:policy"
         dlm_client._get_lifecycle_policy_arn_template = mock.MagicMock(
             return_value=dlm_client.lifecycle_policy_arn_template
         )
         aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
-        from prowler.providers.aws.services.ec2.ec2_service import EC2
+        unload_dlm_check_modules()
 
         with (
             mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
+                "prowler.providers.aws.services.dlm.dlm_service.DLM",
+                new=mock.MagicMock(return_value=dlm_client),
             ),
             mock.patch(
-                "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.ec2_client",
-                new=EC2(aws_provider),
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
             ),
             mock.patch(
                 "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_client",
@@ -154,25 +160,23 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
         )["SnapshotId"]
 
         # DLM Mock Client
-        dlm_client = mock.MagicMock
+        dlm_client = mock.MagicMock()
         dlm_client.audited_account = AWS_ACCOUNT_NUMBER
         dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
         dlm_client.lifecycle_policies = {}
-
-        # from prowler.providers.aws.services.ec2.ec2_service import EC2
+        dlm_client.regions_with_snapshots = {AWS_REGION_US_EAST_1: True}
 
         aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
-        from prowler.providers.aws.services.ec2.ec2_service import EC2
+        unload_dlm_check_modules()
 
         with (
             mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
+                "prowler.providers.aws.services.dlm.dlm_service.DLM",
+                new=mock.MagicMock(return_value=dlm_client),
             ),
             mock.patch(
-                "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.ec2_client",
-                new=EC2(aws_provider),
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
             ),
             mock.patch(
                 "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_client",
@@ -190,7 +194,7 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
     @mock_aws
     def test_no_ebs_snapshot_and_dlm_lifecycle_policy(self):
         # DLM Mock Client
-        dlm_client = mock.MagicMock
+        dlm_client = mock.MagicMock()
         dlm_client.audited_account = AWS_ACCOUNT_NUMBER
         dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
         dlm_client.lifecycle_policies = {
@@ -203,30 +207,25 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
                 )
             }
         }
-
-        # from prowler.providers.aws.services.ec2.ec2_service import EC2
+        dlm_client.regions_with_snapshots = {}
 
         aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
-        from prowler.providers.aws.services.ec2.ec2_service import EC2
+        unload_dlm_check_modules()
 
         with (
+            mock.patch(
+                "prowler.providers.aws.services.dlm.dlm_service.DLM",
+                new=mock.MagicMock(return_value=dlm_client),
+            ),
             mock.patch(
                 "prowler.providers.common.provider.Provider.get_global_provider",
                 return_value=aws_provider,
             ),
-            mock.patch(
-                "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.ec2_client",
-                new=EC2(aws_provider),
-            ) as ec2_client,
             mock.patch(
                 "prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_client",
                 new=dlm_client,
             ),
         ):
-            # Remove all snapshots
-            ec2_client.regions_with_snapshots = {}
-
             from prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists import (
                 dlm_ebs_snapshot_lifecycle_policy_exists,
             )
@@ -234,3 +233,45 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
             check = dlm_ebs_snapshot_lifecycle_policy_exists()
             result = check.execute()
             assert len(result) == 0
+
+    @mock_aws
+    def test_check_does_not_import_ec2_service_client(self):
+        dlm_client = mock.MagicMock()
+        dlm_client.audited_account = AWS_ACCOUNT_NUMBER
+        dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
+        dlm_client.audited_partition = "aws"
+        dlm_client.lifecycle_policies = {AWS_REGION_US_EAST_1: {}}
+        dlm_client.regions_with_snapshots = {AWS_REGION_US_EAST_1: True}
+        dlm_client._get_lifecycle_policy_arn_template = mock.MagicMock(
+            return_value=f"arn:aws:dlm:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:policy"
+        )
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        unload_dlm_check_modules()
+        sys.modules.pop(EC2_CLIENT_MODULE, None)
+        real_import = builtins.__import__
+
+        def guarded_import(name, *args, **kwargs):
+            if name == EC2_CLIENT_MODULE:
+                raise AssertionError("DLM check must not import the EC2 service client")
+            return real_import(name, *args, **kwargs)
+
+        with (
+            mock.patch(
+                "prowler.providers.aws.services.dlm.dlm_service.DLM",
+                new=mock.MagicMock(return_value=dlm_client),
+            ),
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch("builtins.__import__", side_effect=guarded_import),
+        ):
+            from prowler.providers.aws.services.dlm.dlm_ebs_snapshot_lifecycle_policy_exists.dlm_ebs_snapshot_lifecycle_policy_exists import (
+                dlm_ebs_snapshot_lifecycle_policy_exists,
+            )
+
+            result = dlm_ebs_snapshot_lifecycle_policy_exists().execute()
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"

tests/providers/aws/services/dlm/dlm_service_test.py

@@ -34,6 +34,8 @@ def mock_make_api_call(self, operation_name, kwargs):
                 }
             ]
         }
+    if operation_name == "DescribeSnapshots":
+        return {"Snapshots": [{"SnapshotId": "snap-1234567890abcdef0"}]}
 
     return make_api_call(self, operation_name, kwargs)
 
@@ -46,6 +48,13 @@ def mock_generate_regional_clients(provider, service):
     return {AWS_REGION_US_EAST_1: regional_client}
 
 
+def mock_generate_regional_clients_without_ec2(provider, service):
+    if service == "ec2":
+        return None
+
+    return mock_generate_regional_clients(provider, service)
+
+
 @patch(
     "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
     new=mock_generate_regional_clients,
@@ -92,3 +101,62 @@ class Test_DLM_Service:
                 )
             }
         }
+
+    def test_get_regions_with_snapshots(self):
+        aws_provider = set_mocked_aws_provider()
+        dlm = DLM(aws_provider)
+        assert dlm.regions_with_snapshots == {AWS_REGION_US_EAST_1: True}
+
+
+@patch(
+    "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+    new=mock_generate_regional_clients_without_ec2,
+)
+@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+class Test_DLM_Service_Without_EC2_Regional_Clients:
+    def test_service_handles_missing_ec2_regional_clients(self):
+        aws_provider = set_mocked_aws_provider()
+        dlm = DLM(aws_provider)
+
+        assert dlm.regions_with_snapshots == {}
+
+
+class FakeEC2RegionalClient:
+    def __init__(self, responses):
+        self.region = AWS_REGION_US_EAST_1
+        self.requests = []
+        self.responses = list(responses)
+
+    def describe_snapshots(self, **kwargs):
+        self.requests.append(kwargs)
+        return self.responses.pop(0)
+
+
+class Test_DLM_Regions_With_Snapshots:
+    def test_get_regions_without_snapshots(self):
+        dlm = DLM.__new__(DLM)
+        dlm.regions_with_snapshots = {}
+        regional_client = FakeEC2RegionalClient([{"Snapshots": []}])
+
+        dlm._get_regions_with_snapshots(regional_client)
+
+        assert dlm.regions_with_snapshots == {AWS_REGION_US_EAST_1: False}
+        assert regional_client.requests == [{"OwnerIds": ["self"], "MaxResults": 5}]
+
+    def test_get_regions_with_snapshots_after_pagination(self):
+        dlm = DLM.__new__(DLM)
+        dlm.regions_with_snapshots = {}
+        regional_client = FakeEC2RegionalClient(
+            [
+                {"Snapshots": [], "NextToken": "next-page"},
+                {"Snapshots": [{"SnapshotId": "snap-1234567890abcdef0"}]},
+            ]
+        )
+
+        dlm._get_regions_with_snapshots(regional_client)
+
+        assert dlm.regions_with_snapshots == {AWS_REGION_US_EAST_1: True}
+        assert regional_client.requests == [
+            {"OwnerIds": ["self"], "MaxResults": 5},
+            {"OwnerIds": ["self"], "MaxResults": 5, "NextToken": "next-page"},
+        ]

tests/providers/aws/services/dms/dms_instance_no_public_access/dms_no_public_access_test.py

@@ -1,3 +1,5 @@
+import ast
+from pathlib import Path
 from unittest import mock
 
 import botocore
@@ -61,6 +63,42 @@ def mock_make_api_call_private(self, operation_name, kwargs):
 
 
 class Test_dms_instance_no_public_access:
+    def test_ec2_client_is_not_imported_at_module_level(self):
+        repo_root = Path(__file__).parents[6]
+        check_source = repo_root / (
+            "prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py"
+        )
+        check_tree = ast.parse(check_source.read_text())
+
+        top_level_imports = [
+            node
+            for node in check_tree.body
+            if isinstance(node, (ast.Import, ast.ImportFrom))
+        ]
+
+        top_level_ec2_client_imports = [
+            node
+            for node in top_level_imports
+            if (
+                isinstance(node, ast.ImportFrom)
+                and node.module == "prowler.providers.aws.services.ec2.ec2_client"
+            )
+            or (
+                isinstance(node, ast.ImportFrom)
+                and node.module == "prowler.providers.aws.services.ec2"
+                and any(alias.name == "ec2_client" for alias in node.names)
+            )
+            or (
+                isinstance(node, ast.Import)
+                and any(
+                    alias.name == "prowler.providers.aws.services.ec2.ec2_client"
+                    for alias in node.names
+                )
+            )
+        ]
+
+        assert top_level_ec2_client_imports == []
+
     @mock_aws
     def test_dms_no_instances(self):
         dms_client = client("dms", region_name=AWS_REGION_US_EAST_1)
@@ -79,6 +117,10 @@ class Test_dms_instance_no_public_access:
                 "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.dms_client",
                 new=DMS(aws_provider),
             ),
+            mock.patch(
+                "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+                side_effect=AssertionError("EC2 client should not be loaded"),
+            ) as get_ec2_client_mock,
         ):
             from prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access import (
                 dms_instance_no_public_access,
@@ -87,6 +129,7 @@ class Test_dms_instance_no_public_access:
             check = dms_instance_no_public_access()
             result = check.execute()
             assert len(result) == 0
+            get_ec2_client_mock.assert_not_called()
 
     @mock_aws
     def test_dms_private(self):
@@ -108,6 +151,10 @@ class Test_dms_instance_no_public_access:
                     "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.dms_client",
                     new=DMS(aws_provider),
                 ),
+                mock.patch(
+                    "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+                    side_effect=AssertionError("EC2 client should not be loaded"),
+                ) as get_ec2_client_mock,
             ):
                 from prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access import (
                     dms_instance_no_public_access,
@@ -125,6 +172,7 @@ class Test_dms_instance_no_public_access:
                 assert result[0].resource_id == DMS_INSTANCE_NAME
                 assert result[0].resource_arn == DMS_INSTANCE_ARN
                 assert result[0].resource_tags == []
+                get_ec2_client_mock.assert_not_called()
 
     @mock_aws
     def test_dms_public(self):
@@ -146,6 +194,10 @@ class Test_dms_instance_no_public_access:
                     "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.dms_client",
                     new=DMS(aws_provider),
                 ),
+                mock.patch(
+                    "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+                    side_effect=AssertionError("EC2 client should not be loaded"),
+                ) as get_ec2_client_mock,
             ):
                 from prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access import (
                     dms_instance_no_public_access,
@@ -163,6 +215,7 @@ class Test_dms_instance_no_public_access:
                 assert result[0].resource_id == DMS_INSTANCE_NAME
                 assert result[0].resource_arn == DMS_INSTANCE_ARN
                 assert result[0].resource_tags == []
+                get_ec2_client_mock.assert_not_called()
 
     @mock_aws
     def test_dms_public_with_public_sg(self):
@@ -218,8 +271,8 @@ class Test_dms_instance_no_public_access:
                     new=dms_client,
                 ),
                 mock.patch(
-                    "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.ec2_client",
-                    new=EC2(aws_provider),
+                    "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+                    return_value=EC2(aws_provider),
                 ),
             ):
                 # Test Check
@@ -298,8 +351,8 @@ class Test_dms_instance_no_public_access:
                     new=dms_client,
                 ),
                 mock.patch(
-                    "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access.ec2_client",
-                    new=EC2(aws_provider),
+                    "prowler.providers.aws.services.dms.dms_instance_no_public_access.dms_instance_no_public_access._get_ec2_client",
+                    return_value=EC2(aws_provider),
                 ),
             ):
                 # Test Check

tests/providers/aws/services/ecs/ecs_service_test.py

@@ -1,3 +1,4 @@
+from datetime import datetime, timezone
 from unittest.mock import patch
 
 import botocore
@@ -136,6 +137,110 @@ def mock_generate_multi_region_clients(provider, service):
     }
 
 
+def mock_make_api_call_task_definitions_by_registration_date(
+    self, operation_name, kwarg
+):
+    task_definition_dates = {
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/eu-old:1": datetime(
+            2024, 1, 1, tzinfo=timezone.utc
+        ),
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/eu-second-newest:1": datetime(
+            2024, 5, 1, tzinfo=timezone.utc
+        ),
+        f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:123456789012:task-definition/us-newest:1": datetime(
+            2024, 6, 1, tzinfo=timezone.utc
+        ),
+        f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:123456789012:task-definition/us-old:1": datetime(
+            2024, 2, 1, tzinfo=timezone.utc
+        ),
+    }
+    task_definitions_by_region = {
+        AWS_REGION_EU_WEST_1: [
+            task_definition
+            for task_definition in task_definition_dates
+            if f":{AWS_REGION_EU_WEST_1}:" in task_definition
+        ],
+        AWS_REGION_US_EAST_1: [
+            task_definition
+            for task_definition in task_definition_dates
+            if f":{AWS_REGION_US_EAST_1}:" in task_definition
+        ],
+    }
+
+    if operation_name == "ListTaskDefinitions":
+        return {"taskDefinitionArns": task_definitions_by_region[self.region]}
+    if operation_name == "DescribeTaskDefinition":
+        return {
+            "taskDefinition": {
+                "containerDefinitions": [],
+                "registeredAt": task_definition_dates[kwarg["taskDefinition"]],
+            },
+            "tags": [],
+        }
+    if operation_name == "ListClusters":
+        return {"clusterArns": []}
+    return make_api_call(self, operation_name, kwarg)
+
+
+def mock_make_api_call_task_definitions_with_equal_registration_dates(
+    self, operation_name, kwarg
+):
+    registered_at = datetime(2024, 1, 1, tzinfo=timezone.utc)
+    task_definition_dates = {
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/zzz-task:1": registered_at,
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/aaa-task:1": registered_at,
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/mmm-task:1": registered_at,
+    }
+
+    if operation_name == "ListTaskDefinitions":
+        return {"taskDefinitionArns": list(task_definition_dates)}
+    if operation_name == "DescribeTaskDefinition":
+        return {
+            "taskDefinition": {
+                "containerDefinitions": [],
+                "registeredAt": task_definition_dates[kwarg["taskDefinition"]],
+            },
+            "tags": [],
+        }
+    if operation_name == "ListClusters":
+        return {"clusterArns": []}
+    return make_api_call(self, operation_name, kwarg)
+
+
+DESCRIBED_TASK_DEFINITIONS = []
+
+
+def mock_make_api_call_task_definitions_with_audit_resources(
+    self, operation_name, kwarg
+):
+    task_definition_dates = {
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/audited-older:1": datetime(
+            2024, 1, 1, tzinfo=timezone.utc
+        ),
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/audited-newer:1": datetime(
+            2024, 2, 1, tzinfo=timezone.utc
+        ),
+        f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/unaudited-newest:1": datetime(
+            2024, 3, 1, tzinfo=timezone.utc
+        ),
+    }
+
+    if operation_name == "ListTaskDefinitions":
+        return {"taskDefinitionArns": list(task_definition_dates)}
+    if operation_name == "DescribeTaskDefinition":
+        DESCRIBED_TASK_DEFINITIONS.append(kwarg["taskDefinition"])
+        return {
+            "taskDefinition": {
+                "containerDefinitions": [],
+                "registeredAt": task_definition_dates[kwarg["taskDefinition"]],
+            },
+            "tags": [],
+        }
+    if operation_name == "ListClusters":
+        return {"clusterArns": []}
+    return make_api_call(self, operation_name, kwarg)
+
+
 @patch(
     "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
     new=mock_generate_regional_clients,
@@ -292,9 +397,9 @@ class Test_ECS_Service:
             ecs = ECS(aws_provider)
 
             assert [td.revision for td in ecs.task_definitions.values()] == ["3", "2"]
-            assert len(describe_calls) == 2
+            assert len(describe_calls) == 3
 
-    def test_task_definition_limit_bounds_describe_calls(self):
+    def test_task_definition_limit_describes_candidates_before_exposing_limit(self):
         describe_calls = []
 
         def counting_make_api_call(self, operation_name, kwarg):
@@ -326,9 +431,82 @@ class Test_ECS_Service:
             ecs = ECS(aws_provider)
 
             assert [td.revision for td in ecs.task_definitions.values()] == ["3"]
-            assert describe_calls == [
-                "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:3"
-            ]
+            assert sorted(describe_calls) == sorted(
+                [
+                    "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:3",
+                    "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:2",
+                    "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:1",
+                ]
+            )
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_task_definitions_by_registration_date,
+    )
+    def test_task_definition_limit_uses_global_latest_registration_dates(self):
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+            audit_config={"max_ecs_task_definitions": 2},
+        )
+        with patch(
+            "prowler.providers.aws.aws_provider.AwsProvider.generate_regional_clients",
+            new=mock_generate_multi_region_clients,
+        ):
+            ecs = ECS(aws_provider)
+
+        assert list(ecs.task_definitions) == [
+            f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:123456789012:task-definition/us-newest:1",
+            f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/eu-second-newest:1",
+        ]
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_task_definitions_with_equal_registration_dates,
+    )
+    def test_task_definition_limit_uses_arn_order_for_equal_registration_dates(self):
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1], audit_config={"max_ecs_task_definitions": 2}
+        )
+        ecs = ECS(aws_provider)
+
+        assert list(ecs.task_definitions) == [
+            f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/aaa-task:1",
+            f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:task-definition/mmm-task:1",
+        ]
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_task_definitions_with_audit_resources,
+    )
+    def test_task_definition_limit_applies_after_audit_resources_filter(self):
+        DESCRIBED_TASK_DEFINITIONS.clear()
+        audited_older_task_definition = (
+            f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:"
+            "task-definition/audited-older:1"
+        )
+        audited_newer_task_definition = (
+            f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:"
+            "task-definition/audited-newer:1"
+        )
+        unaudited_newest_task_definition = (
+            f"arn:aws:ecs:{AWS_REGION_EU_WEST_1}:123456789012:"
+            "task-definition/unaudited-newest:1"
+        )
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1], audit_config={"max_ecs_task_definitions": 1}
+        )
+        aws_provider._audit_resources = [
+            audited_older_task_definition,
+            audited_newer_task_definition,
+        ]
+
+        ecs = ECS(aws_provider)
+
+        assert sorted(DESCRIBED_TASK_DEFINITIONS) == sorted(
+            [audited_older_task_definition, audited_newer_task_definition]
+        )
+        assert list(ecs.task_definitions) == [audited_newer_task_definition]
+        assert unaudited_newest_task_definition not in ecs.task_definitions
 
     def test_task_definition_limit_does_not_starve_later_regions(self):
         describe_calls = []
@@ -381,6 +559,8 @@ class Test_ECS_Service:
             ]
             assert set(describe_calls) == {
                 "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:3",
+                "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:2",
+                "arn:aws:ecs:eu-west-1:123456789012:task-definition/fam:1",
                 "arn:aws:ecs:us-east-1:123456789012:task-definition/fam:9",
             }
 

tests/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions_test.py

@@ -17,6 +17,10 @@ def scp_restrict_regions_with_deny():
     return '{"Version":"2012-10-17","Statement":{"Effect":"Deny","NotAction":"s3:*","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":["eu-central-1","eu-west-1"]}}}}'
 
 
+def scp_restrict_regions_with_allow():
+    return '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":"*","Resource":"*","Condition":{"StringEquals":{"aws:RequestedRegion":["eu-central-1","eu-west-1"]}}}}'
+
+
 def scp_restrict_regions_without_statement():
     return '{"Version":"2012-10-17"}'
 
@@ -352,3 +356,137 @@ class Test_organizations_scp_check_deny_regions:
                     == f"AWS Organization {org_id} has SCP policies but don't restrict AWS Regions."
                 )
                 assert result[0].region == AWS_REGION_EU_WEST_1
+
+    @mock_aws
+    def test_organization_with_scp_allow_regions_valid(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        conn = client("organizations", region_name=AWS_REGION_EU_WEST_1)
+        response = conn.describe_organization()
+        response_policy = conn.create_policy(
+            Content=scp_restrict_regions_with_allow(),
+            Description="Test",
+            Name="Test",
+            Type="SERVICE_CONTROL_POLICY",
+        )
+        org_id = response["Organization"]["Id"]
+        policy_id = response_policy["Policy"]["PolicySummary"]["Id"]
+
+        aws_provider._audit_config = {"organizations_enabled_regions": ["eu-central-1"]}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions.organizations_client",
+                new=Organizations(aws_provider),
+            ):
+                from prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions import (
+                    organizations_scp_check_deny_regions,
+                )
+
+                check = organizations_scp_check_deny_regions()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert result[0].resource_id == response["Organization"]["Id"]
+                assert result[0].resource_arn == response["Organization"]["Arn"]
+                assert (
+                    result[0].status_extended
+                    == f"AWS Organization {org_id} has SCP policy {policy_id} restricting all configured regions found."
+                )
+                assert result[0].region == AWS_REGION_EU_WEST_1
+
+    @mock_aws
+    def test_organization_with_scp_allow_regions_not_valid(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        conn = client("organizations", region_name=AWS_REGION_EU_WEST_1)
+        response = conn.describe_organization()
+        response_policy = conn.create_policy(
+            Content=scp_restrict_regions_with_allow(),
+            Description="Test",
+            Name="Test",
+            Type="SERVICE_CONTROL_POLICY",
+        )
+        org_id = response["Organization"]["Id"]
+        policy_id = response_policy["Policy"]["PolicySummary"]["Id"]
+
+        aws_provider._audit_config = {"organizations_enabled_regions": ["us-east-1"]}
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions.organizations_client",
+                new=Organizations(aws_provider),
+            ):
+                from prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions import (
+                    organizations_scp_check_deny_regions,
+                )
+
+                check = organizations_scp_check_deny_regions()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert result[0].resource_id == response["Organization"]["Id"]
+                assert (
+                    "arn:aws:organizations::123456789012:organization/o-"
+                    in result[0].resource_arn
+                )
+                assert (
+                    result[0].status_extended
+                    == f"AWS Organization {org_id} has SCP policies {policy_id} restricting some AWS Regions, but not all the configured ones, please check config."
+                )
+                assert result[0].region == AWS_REGION_EU_WEST_1
+
+    @mock_aws
+    def test_organization_with_scp_allow_all_regions_valid(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        conn = client("organizations", region_name=AWS_REGION_EU_WEST_1)
+        response = conn.describe_organization()
+        response_policy = conn.create_policy(
+            Content=scp_restrict_regions_with_allow(),
+            Description="Test",
+            Name="Test",
+            Type="SERVICE_CONTROL_POLICY",
+        )
+        org_id = response["Organization"]["Id"]
+        policy_id = response_policy["Policy"]["PolicySummary"]["Id"]
+
+        aws_provider._audit_config = {
+            "organizations_enabled_regions": [
+                AWS_REGION_EU_WEST_1,
+                AWS_REGION_EU_CENTRAL_1,
+            ]
+        }
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions.organizations_client",
+                new=Organizations(aws_provider),
+            ):
+                from prowler.providers.aws.services.organizations.organizations_scp_check_deny_regions.organizations_scp_check_deny_regions import (
+                    organizations_scp_check_deny_regions,
+                )
+
+                check = organizations_scp_check_deny_regions()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert result[0].resource_id == response["Organization"]["Id"]
+                assert result[0].resource_arn == response["Organization"]["Arn"]
+                assert (
+                    result[0].status_extended
+                    == f"AWS Organization {org_id} has SCP policy {policy_id} restricting all configured regions found."
+                )
+                assert result[0].region == AWS_REGION_EU_WEST_1

tests/providers/azure/services/app/app_function_access_keys_configured/app_function_access_keys_configured_test.py

@@ -87,7 +87,7 @@ class Test_app_function_access_keys_configured:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,
@@ -143,7 +143,7 @@ class Test_app_function_access_keys_configured:
                             "default": "key1",
                             "key2": "key2",
                         },
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py

@@ -87,7 +87,7 @@ class Test_app_function_application_insights_enabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,
@@ -138,7 +138,9 @@ class Test_app_function_application_insights_enabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={"APPINSIGHTS_INSTRUMENTATIONKEY": "1234"},
+                        environment_variables={
+                            "APPINSIGHTS_INSTRUMENTATIONKEY": "1234"
+                        },
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,
@@ -189,7 +191,9 @@ class Test_app_function_application_insights_enabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={"APPINSIGHTS_INSTRUMENTATIONKEY": "1234"},
+                        environment_variables={
+                            "APPINSIGHTS_INSTRUMENTATIONKEY": "1234"
+                        },
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,
@@ -240,7 +244,7 @@ class Test_app_function_application_insights_enabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_function_ftps_deployment_disabled/app_function_ftps_deployment_disabled_test.py

@@ -87,7 +87,7 @@ class Test_app_function_ftps_deployment_disabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(type="SystemAssigned"),
                         public_access=False,
                         vnet_subnet_id=None,
@@ -138,7 +138,7 @@ class Test_app_function_ftps_deployment_disabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(type="SystemAssigned"),
                         public_access=False,
                         vnet_subnet_id=None,
@@ -189,7 +189,7 @@ class Test_app_function_ftps_deployment_disabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(type="SystemAssigned"),
                         public_access=False,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_function_identity_is_configured/app_function_identity_is_configured_test.py

@@ -87,7 +87,7 @@ class Test_app_function_identity_is_configured:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,
@@ -138,7 +138,7 @@ class Test_app_function_identity_is_configured:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(type="SystemAssigned"),
                         public_access=False,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_function_identity_without_admin_privileges/app_function_identity_without_admin_privileges_test.py

@@ -88,7 +88,7 @@ class Test_app_function_identity_without_admin_privileges:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,
@@ -140,7 +140,7 @@ class Test_app_function_identity_without_admin_privileges:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(principal_id="123"),
                         public_access=False,
                         vnet_subnet_id=None,
@@ -228,7 +228,7 @@ class Test_app_function_identity_without_admin_privileges:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(principal_id="123"),
                         public_access=False,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version_test.py

@@ -87,7 +87,7 @@ class Test_app_function_latest_runtime_version:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={"FUNCTIONS_EXTENSION_VERSION": "~4"},
+                        environment_variables={"FUNCTIONS_EXTENSION_VERSION": "~4"},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,
@@ -137,7 +137,7 @@ class Test_app_function_latest_runtime_version:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={"FUNCTIONS_EXTENSION_VERSION": "2"},
+                        environment_variables={"FUNCTIONS_EXTENSION_VERSION": "2"},
                         identity=None,
                         public_access=False,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_function_not_publicly_accessible/app_function_not_publicly_accessible_test.py

@@ -87,7 +87,7 @@ class Test_app_function_not_publicly_accessible:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(type="SystemAssigned"),
                         public_access=False,
                         vnet_subnet_id=None,
@@ -138,7 +138,7 @@ class Test_app_function_not_publicly_accessible:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=mock.MagicMock(type="SystemAssigned"),
                         public_access=True,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_function_vnet_integration_enabled/app_function_vnet_integration_enabled_test.py

@@ -87,7 +87,7 @@ class Test_app_function_vnet_integration_enabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=True,
                         vnet_subnet_id="vnet_subnet_id",
@@ -138,7 +138,7 @@ class Test_app_function_vnet_integration_enabled:
                         location="West Europe",
                         kind="functionapp,linux",
                         function_keys={},
-                        enviroment_variables={},
+                        environment_variables={},
                         identity=None,
                         public_access=True,
                         vnet_subnet_id=None,

tests/providers/azure/services/app/app_service_test.py

@@ -222,7 +222,7 @@ class Test_App_Service:
                 location="West Europe",
                 kind="functionapp",
                 function_keys=None,
-                enviroment_variables=None,
+                environment_variables=None,
                 identity=ManagedServiceIdentity(type="SystemAssigned"),
                 public_access=True,
                 vnet_subnet_id="",
@@ -247,6 +247,56 @@ class Test_App_Service:
                 == "functionapp-1"
             )
 
+    def test_get_function_host_keys_logs_warning_on_optional_failure(self):
+        from prowler.providers.azure.services.app.app_service import App
+
+        mock_client = MagicMock()
+        mock_client.web_apps.list_host_keys.side_effect = Exception("Forbidden")
+        app = object.__new__(App)
+        app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+
+        with (
+            patch(
+                "prowler.providers.azure.services.app.app_service.logger.warning"
+            ) as mock_warning,
+            patch(
+                "prowler.providers.azure.services.app.app_service.logger.error"
+            ) as mock_error,
+        ):
+            result = app._get_function_host_keys(
+                AZURE_SUBSCRIPTION_ID, RESOURCE_GROUP, "functionapp-1"
+            )
+
+        assert result is None
+        mock_warning.assert_called_once()
+        mock_error.assert_not_called()
+
+    def test_list_application_settings_logs_warning_on_optional_failure(self):
+        from prowler.providers.azure.services.app.app_service import App
+
+        mock_client = MagicMock()
+        mock_client.web_apps.list_application_settings.side_effect = Exception(
+            "Forbidden"
+        )
+        app = object.__new__(App)
+        app.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
+
+        with (
+            patch(
+                "prowler.providers.azure.services.app.app_service.logger.warning"
+            ) as mock_warning,
+            patch(
+                "prowler.providers.azure.services.app.app_service.logger.error"
+            ) as mock_error,
+        ):
+            result = app._list_application_settings(
+                AZURE_SUBSCRIPTION_ID, RESOURCE_GROUP, "functionapp-1"
+            )
+
+        assert result is None
+        mock_warning.assert_called_once()
+        mock_error.assert_not_called()
+
 
 class Test_App_get_apps:
     def test_get_apps_no_resource_groups(self):

ui/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to the **Prowler UI** are documented in this file.
 
+<!-- changelog: release notes start -->
+
+## [1.34.0] (Prowler v5.33.1)
+
+### 🔄 Changed
+
+- RBAC role forms now explain Unlimited Visibility inside the Visibility section and keep the setting visible while group selection is hidden [(#11890)](https://github.com/prowler-cloud/prowler/pull/11890)
+
+### 🐞 Fixed
+
+- CIS Level 1 and Level 2 compliance filters now match profiles prefixed with a license tier (e.g. "E3 Level 1"), so M365 CIS requirements are no longer hidden [(#11924)](https://github.com/prowler-cloud/prowler/pull/11924)
+- Jira dispatch polling now reports failed issue creation tasks instead of treating partial failures as successful [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
+
+---
+
 ## [1.33.0] (Prowler v5.33.0)
 
 ### 🚀 Added

ui/actions/integrations/jira-dispatch.test.ts

@@ -0,0 +1,152 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { pollTaskUntilSettledMock } = vi.hoisted(() => ({
+  pollTaskUntilSettledMock: vi.fn(),
+}));
+
+vi.mock("@/actions/task/poll", () => ({
+  pollTaskUntilSettled: pollTaskUntilSettledMock,
+}));
+
+vi.mock("@/lib", () => ({
+  apiBaseUrl: "https://api.example.com/api/v1",
+  getAuthHeaders: vi.fn(),
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+  handleApiError: vi.fn(),
+}));
+
+import { pollJiraDispatchTask } from "./jira-dispatch";
+
+describe("pollJiraDispatchTask", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("should return the backend error when a completed task has failed Jira dispatches", async () => {
+    // Given
+    pollTaskUntilSettledMock.mockResolvedValue({
+      ok: true,
+      state: "completed",
+      result: {
+        created_count: 0,
+        failed_count: 1,
+        error: "Jira project requires custom fields: Team is required",
+      },
+    });
+
+    // When
+    const result = await pollJiraDispatchTask("task-123");
+
+    // Then
+    expect(result).toEqual({
+      success: false,
+      error: "Jira project requires custom fields: Team is required",
+    });
+  });
+
+  it("should return a fallback error when a completed task has failures without an error", async () => {
+    // Given
+    pollTaskUntilSettledMock.mockResolvedValue({
+      ok: true,
+      state: "completed",
+      result: {
+        created_count: 0,
+        failed_count: 1,
+      },
+    });
+
+    // When
+    const result = await pollJiraDispatchTask("task-123");
+
+    // Then
+    expect(result).toEqual({
+      success: false,
+      error: "Failed to create Jira issue.",
+    });
+  });
+
+  it("should return a plural fallback error when a completed task has multiple failures without an error", async () => {
+    // Given
+    pollTaskUntilSettledMock.mockResolvedValue({
+      ok: true,
+      state: "completed",
+      result: {
+        created_count: 0,
+        failed_count: 3,
+      },
+    });
+
+    // When
+    const result = await pollJiraDispatchTask("task-123");
+
+    // Then
+    expect(result).toEqual({
+      success: false,
+      error: "Failed to create 3 Jira issues.",
+    });
+  });
+
+  it("should surface task failure result errors", async () => {
+    // Given
+    pollTaskUntilSettledMock.mockResolvedValue({
+      ok: true,
+      state: "failed",
+      result: {
+        error: "Jira credentials are invalid.",
+      },
+    });
+
+    // When
+    const result = await pollJiraDispatchTask("task-123");
+
+    // Then
+    expect(result).toEqual({
+      success: false,
+      error: "Jira credentials are invalid.",
+    });
+  });
+
+  it("should return success when a completed task has no failures", async () => {
+    // Given
+    pollTaskUntilSettledMock.mockResolvedValue({
+      ok: true,
+      state: "completed",
+      result: {
+        created_count: 1,
+        failed_count: 0,
+      },
+    });
+
+    // When
+    const result = await pollJiraDispatchTask("task-123");
+
+    // Then
+    expect(result).toEqual({
+      success: true,
+      message: "Finding successfully sent to Jira!",
+    });
+  });
+
+  it("should return a fallback error when no Jira issue was created", async () => {
+    // Given
+    pollTaskUntilSettledMock.mockResolvedValue({
+      ok: true,
+      state: "completed",
+      result: {
+        created_count: 0,
+        failed_count: 0,
+      },
+    });
+
+    // When
+    const result = await pollJiraDispatchTask("task-123");
+
+    // Then
+    expect(result).toEqual({
+      success: false,
+      error: "Failed to create Jira issue.",
+    });
+  });
+});

ui/actions/integrations/jira-dispatch.ts

@@ -159,12 +159,18 @@ export const pollJiraDispatchTask = async (
   const jiraResult = result as JiraTaskResult | undefined;
 
   if (state === "completed") {
-    if (!jiraResult?.error) {
+    const createdCount = jiraResult?.created_count ?? 0;
+    const failedCount = jiraResult?.failed_count ?? 0;
+    if (!jiraResult?.error && failedCount === 0 && createdCount > 0) {
       return { success: true, message: "Finding successfully sent to Jira!" };
     }
     return {
       success: false,
-      error: jiraResult?.error || "Failed to create Jira issue.",
+      error:
+        jiraResult?.error ||
+        (failedCount > 1
+          ? `Failed to create ${failedCount} Jira issues.`
+          : "Failed to create Jira issue."),
     };
   }
 

ui/changelog.d/README.md

@@ -0,0 +1,10 @@
+# Changelog fragments
+
+Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
+
+- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
+- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
+- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
+- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
+
+Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

ui/components/roles/workflow/forms/add-role-form.test.tsx

@@ -1,6 +1,6 @@
 import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
 import { AddRoleForm } from "./add-role-form";
 
@@ -76,6 +76,17 @@ vi.mock("@/components/ui", () => ({
   useToast: () => ({ toast: vi.fn() }),
 }));
 
+beforeAll(() => {
+  class ResizeObserverMock {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  }
+
+  globalThis.ResizeObserver = ResizeObserverMock;
+  window.ResizeObserver = ResizeObserverMock;
+});
+
 describe("AddRoleForm", () => {
   afterEach(() => {
     routerMocks.push.mockClear();
@@ -117,4 +128,207 @@ describe("AddRoleForm", () => {
     // Then
     expect(routerMocks.push).toHaveBeenCalledWith("/roles");
   });
+
+  it("shows a subtle inline Unlimited Visibility description", () => {
+    // Given / When
+    render(<AddRoleForm groups={[]} />);
+
+    // Then
+    expect(screen.queryByRole("alert")).not.toBeInTheDocument();
+    expect(
+      screen.getByText(/tenant-wide visibility setting/i),
+    ).toHaveTextContent(
+      /grants visibility into every provider, account, resource, finding, scan, and compliance result.*required to use the Jira integration/i,
+    );
+    expect(
+      screen.getByText(/required to use the Jira integration/i),
+    ).toHaveProperty("tagName", "STRONG");
+    expect(
+      screen.queryByRole("heading", { name: "Unlimited Visibility" }),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(
+        /does not grant admin actions such as managing users, providers, scans, integrations, billing, or alerts/i,
+      ),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(
+        /enable it only for roles that need tenant-wide security visibility/i,
+      ),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(
+        /manage providers enables unlimited visibility in this form because provider administration needs tenant-wide provider-group context/i,
+      ),
+    ).not.toBeInTheDocument();
+
+    const visibilityHeading = screen.getByText("Visibility");
+    const unlimitedVisibilityCheckbox = screen.getByRole("checkbox", {
+      name: "Enable Unlimited Visibility for this role",
+    });
+
+    expect(
+      visibilityHeading.compareDocumentPosition(unlimitedVisibilityCheckbox) &
+        Node.DOCUMENT_POSITION_FOLLOWING,
+    ).toBeTruthy();
+  });
+
+  it("keeps the Visibility section and hides only groups when Unlimited Visibility is enabled", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<AddRoleForm groups={[{ id: "group-1", name: "Production" }]} />);
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+
+    // Then
+    expect(screen.getByText("Visibility")).toBeInTheDocument();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).toBeChecked();
+    expect(
+      screen.getByText(/tenant-wide visibility setting/i),
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId("group-select")).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/select the groups this role will have access to/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not force Unlimited Visibility when Manage Providers is selected", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<AddRoleForm groups={[]} />);
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).not.toBeChecked();
+    expect(
+      screen.queryByText(
+        /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+      ),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not force Unlimited Visibility when granting all admin permissions", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<AddRoleForm groups={[]} />);
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    ).toBeChecked();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).not.toBeChecked();
+  });
+
+  it("keeps Unlimited Visibility user-controlled when Manage Providers is selected", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<AddRoleForm groups={[]} />);
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    ).toBeChecked();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).not.toBeChecked();
+    expect(screen.getByTestId("group-select")).toBeInTheDocument();
+  });
+
+  it("keeps explicitly enabled Unlimited Visibility when all admin permissions are toggled off", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<AddRoleForm groups={[]} />);
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    ).not.toBeChecked();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).toBeChecked();
+  });
+
+  it("does not show extra Manage Providers guidance for explicitly enabled Unlimited Visibility", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<AddRoleForm groups={[]} />);
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    );
+
+    // Then
+    expect(
+      screen.queryByText(
+        /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+      ),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/remove this automatic visibility grant/i),
+    ).not.toBeInTheDocument();
+  });
 });

ui/components/roles/workflow/forms/add-role-form.tsx

@@ -1,85 +1,38 @@
 "use client";
 
-import { Checkbox } from "@heroui/checkbox";
-import { Divider } from "@heroui/divider";
-import { Tooltip } from "@heroui/tooltip";
-import { zodResolver } from "@hookform/resolvers/zod";
-import clsx from "clsx";
-import { InfoIcon } from "lucide-react";
 import { useRouter } from "next/navigation";
-import { useEffect } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { z } from "zod";
+import { DefaultValues } from "react-hook-form";
 
 import { addRole } from "@/actions/roles/roles";
-import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
 import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form, FormButtons } from "@/components/ui/form";
-import { getErrorMessage, permissionFormFields } from "@/lib";
-import { addRoleFormSchema, ApiError } from "@/types";
+import { getErrorMessage } from "@/lib";
+import { RoleFormValues } from "@/types";
 
-type FormValues = z.input<typeof addRoleFormSchema>;
+import { RoleForm, RoleFormSubmitContext, RoleGroupOption } from "./role-form";
 
-export const AddRoleForm = ({
-  groups,
-}: {
-  groups: { id: string; name: string }[];
-}) => {
+export const AddRoleForm = ({ groups }: { groups: RoleGroupOption[] }) => {
   const { toast } = useToast();
   const router = useRouter();
   const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
-  const visiblePermissionFormFields = permissionFormFields.filter(
-    (permission) =>
-      !["manage_billing", "manage_alerts"].includes(permission.field) ||
-      isCloudEnvironment,
-  );
 
-  const form = useForm<FormValues>({
-    resolver: zodResolver(addRoleFormSchema),
-    defaultValues: {
-      name: "",
-      manage_users: false,
-      manage_providers: false,
-      manage_integrations: false,
-      manage_scans: false,
-      unlimited_visibility: false,
-      groups: [],
-      ...(isCloudEnvironment && {
-        manage_billing: false,
-        manage_alerts: false,
-      }),
-    },
-  });
-
-  const { watch, setValue } = form;
-
-  const manageProviders = watch("manage_providers");
-  const unlimitedVisibility = watch("unlimited_visibility");
-
-  useEffect(() => {
-    if (manageProviders && !unlimitedVisibility) {
-      setValue("unlimited_visibility", true, {
-        shouldValidate: true,
-        shouldDirty: true,
-        shouldTouch: true,
-      });
-    }
-  }, [manageProviders, unlimitedVisibility, setValue]);
-
-  const isLoading = form.formState.isSubmitting;
-
-  const onSelectAllChange = (checked: boolean) => {
-    visiblePermissionFormFields.forEach(({ field }) => {
-      form.setValue(field as keyof FormValues, checked, {
-        shouldValidate: true,
-        shouldDirty: true,
-        shouldTouch: true,
-      });
-    });
+  const defaultValues: DefaultValues<RoleFormValues> = {
+    name: "",
+    manage_users: false,
+    manage_providers: false,
+    manage_integrations: false,
+    manage_scans: false,
+    unlimited_visibility: false,
+    groups: [],
+    ...(isCloudEnvironment && {
+      manage_billing: false,
+      manage_alerts: false,
+    }),
   };
 
-  const onSubmitClient = async (values: FormValues) => {
+  const onSubmit = async (
+    values: RoleFormValues,
+    { handleServerResponse }: RoleFormSubmitContext,
+  ) => {
     const formData = new FormData();
 
     formData.append("name", values.name);
@@ -107,33 +60,13 @@ export const AddRoleForm = ({
 
     try {
       const data = await addRole(formData);
+      if (!handleServerResponse(data)) return;
 
-      if (data?.errors && data.errors.length > 0) {
-        data.errors.forEach((error: ApiError) => {
-          const errorMessage = error.detail;
-          const pointer = error.source?.pointer;
-          switch (pointer) {
-            case "/data/attributes/name":
-              form.setError("name", {
-                type: "server",
-                message: errorMessage,
-              });
-              break;
-            default:
-              toast({
-                variant: "destructive",
-                title: "Error",
-                description: errorMessage,
-              });
-          }
-        });
-      } else {
-        toast({
-          title: "Role Added",
-          description: "The role was added successfully.",
-        });
-        router.push("/roles");
-      }
+      toast({
+        title: "Role Added",
+        description: "The role was added successfully.",
+      });
+      router.push("/roles");
     } catch (error) {
       toast({
         variant: "destructive",
@@ -144,120 +77,11 @@ export const AddRoleForm = ({
   };
 
   return (
-    <Form {...form}>
-      <form
-        onSubmit={form.handleSubmit(onSubmitClient)}
-        className="flex flex-col gap-6"
-      >
-        <CustomInput
-          control={form.control}
-          name="name"
-          type="text"
-          label="Role Name"
-          labelPlacement="inside"
-          placeholder="Enter role name"
-          variant="bordered"
-          isRequired
-        />
-
-        <div className="flex flex-col gap-4">
-          <span className="text-lg font-semibold">Admin Permissions</span>
-
-          {/* Select All Checkbox */}
-          <Checkbox
-            isSelected={visiblePermissionFormFields.every((perm) =>
-              form.watch(perm.field as keyof FormValues),
-            )}
-            onChange={(e) => onSelectAllChange(e.target.checked)}
-            classNames={{
-              label: "text-small",
-              wrapper: "checkbox-update",
-            }}
-            color="default"
-          >
-            Grant all admin permissions
-          </Checkbox>
-
-          {/* Permissions Grid */}
-          <div className="grid grid-cols-2 gap-4">
-            {visiblePermissionFormFields.map(
-              ({ field, label, description }) => (
-                <div key={field} className="flex items-center gap-2">
-                  <Checkbox
-                    {...form.register(field as keyof FormValues)}
-                    isSelected={!!form.watch(field as keyof FormValues)}
-                    classNames={{
-                      label: "text-small",
-                      wrapper: "checkbox-update",
-                    }}
-                    color="default"
-                  >
-                    {label}
-                  </Checkbox>
-                  <Tooltip content={description} placement="right">
-                    <div className="flex w-fit items-center justify-center">
-                      <InfoIcon
-                        className={clsx(
-                          "text-default-400 group-data-[selected=true]:text-foreground cursor-pointer",
-                        )}
-                        aria-hidden={"true"}
-                        width={16}
-                      />
-                    </div>
-                  </Tooltip>
-                </div>
-              ),
-            )}
-          </div>
-        </div>
-        <Divider className="my-4" />
-
-        {!unlimitedVisibility && (
-          <div className="flex flex-col gap-4">
-            <span className="text-lg font-semibold">
-              Groups and Account Visibility
-            </span>
-
-            <p className="text-small text-default-700 font-medium">
-              Select the groups this role will have access to. If no groups are
-              selected and unlimited visibility is not enabled, the role will
-              not have access to any accounts.
-            </p>
-
-            <Controller
-              name="groups"
-              control={form.control}
-              render={({ field }) => (
-                <div className="flex flex-col gap-2">
-                  <EnhancedMultiSelect
-                    options={groups.map((group) => ({
-                      label: group.name,
-                      value: group.id,
-                    }))}
-                    onValueChange={field.onChange}
-                    defaultValue={field.value || []}
-                    placeholder="Select groups"
-                    searchable={true}
-                    hideSelectAll={true}
-                    emptyIndicator="No results found"
-                    resetOnDefaultValueChange={true}
-                  />
-                </div>
-              )}
-            />
-            {form.formState.errors.groups && (
-              <p className="mt-2 text-sm text-red-600">
-                {form.formState.errors.groups.message}
-              </p>
-            )}
-          </div>
-        )}
-        <FormButtons
-          submitText="Add Role"
-          isDisabled={isLoading}
-          onCancel={() => router.push("/roles")}
-        />
-      </form>
-    </Form>
+    <RoleForm
+      groups={groups}
+      defaultValues={defaultValues}
+      submitText="Add Role"
+      onSubmit={onSubmit}
+    />
   );
 };

ui/components/roles/workflow/forms/edit-role-form.test.tsx

@@ -0,0 +1,326 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+import { EditRoleForm } from "./edit-role-form";
+
+const routerMocks = vi.hoisted(() => ({
+  push: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => routerMocks,
+}));
+
+vi.mock("@/actions/roles/roles", () => ({
+  updateRole: vi.fn(),
+}));
+
+vi.mock("@/lib", () => ({
+  cn: (...classes: Array<string | false | null | undefined>) =>
+    classes.filter(Boolean).join(" "),
+  getErrorMessage: (error: unknown) => String(error),
+  permissionFormFields: [
+    {
+      field: "manage_users",
+      label: "Invite and Manage Users",
+      description:
+        "Allows inviting new users and managing existing user details",
+    },
+    {
+      field: "manage_account",
+      label: "Manage Account",
+      description: "Provides access to account settings and RBAC configuration",
+    },
+    {
+      field: "unlimited_visibility",
+      label: "Unlimited Visibility",
+      description:
+        "Provides complete visibility across all the providers and its related resources",
+    },
+    {
+      field: "manage_providers",
+      label: "Manage Providers",
+      description:
+        "Allows configuration and management of provider connections",
+    },
+    {
+      field: "manage_integrations",
+      label: "Manage Integrations",
+      description:
+        "Allows configuration and management of third-party integrations",
+    },
+    {
+      field: "manage_scans",
+      label: "Manage Scans",
+      description: "Allows launching and configuring scans security scans",
+    },
+    {
+      field: "manage_alerts",
+      label: "Manage Alerts",
+      description: "Allows creating and managing custom alerts",
+    },
+    {
+      field: "manage_billing",
+      label: "Manage Billing",
+      description: "Provides access to billing settings and invoices",
+    },
+  ],
+}));
+
+vi.mock("@/components/shadcn/select/enhanced-multi-select", () => ({
+  EnhancedMultiSelect: () => <div data-testid="group-select" />,
+}));
+
+vi.mock("@/components/ui", () => ({
+  useToast: () => ({ toast: vi.fn() }),
+}));
+
+beforeAll(() => {
+  class ResizeObserverMock {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  }
+
+  globalThis.ResizeObserver = ResizeObserverMock;
+  window.ResizeObserver = ResizeObserverMock;
+});
+
+const roleData = ({
+  manageProviders = false,
+  unlimitedVisibility = false,
+}: {
+  manageProviders?: boolean;
+  unlimitedVisibility?: boolean;
+} = {}) => ({
+  data: {
+    attributes: {
+      name: "Existing role",
+      manage_users: false,
+      manage_account: false,
+      manage_providers: manageProviders,
+      manage_integrations: false,
+      manage_scans: false,
+      unlimited_visibility: unlimitedVisibility,
+      groups: [],
+    },
+    relationships: {
+      provider_groups: {
+        data: [],
+      },
+    },
+  },
+});
+
+const renderEditRoleForm = (options?: Parameters<typeof roleData>[0]) =>
+  render(
+    <EditRoleForm roleId="role-1" roleData={roleData(options)} groups={[]} />,
+  );
+
+describe("EditRoleForm", () => {
+  afterEach(() => {
+    routerMocks.push.mockClear();
+    vi.unstubAllEnvs();
+  });
+
+  it("shows the subtle Unlimited Visibility description inside Visibility", () => {
+    // Given / When
+    renderEditRoleForm();
+
+    // Then
+    expect(screen.queryByRole("alert")).not.toBeInTheDocument();
+    expect(
+      screen.getByText(/tenant-wide visibility setting/i),
+    ).toHaveTextContent(
+      /grants visibility into every provider, account, resource, finding, scan, and compliance result.*required to use the Jira integration/i,
+    );
+    expect(
+      screen.getByText(/required to use the Jira integration/i),
+    ).toHaveProperty("tagName", "STRONG");
+    expect(
+      screen.queryByText(
+        /manage providers enables unlimited visibility in this form because provider administration needs tenant-wide provider-group context/i,
+      ),
+    ).not.toBeInTheDocument();
+
+    const visibilityHeading = screen.getByText("Visibility");
+    const unlimitedVisibilityCheckbox = screen.getByRole("checkbox", {
+      name: "Enable Unlimited Visibility for this role",
+    });
+
+    expect(
+      visibilityHeading.compareDocumentPosition(unlimitedVisibilityCheckbox) &
+        Node.DOCUMENT_POSITION_FOLLOWING,
+    ).toBeTruthy();
+  });
+
+  it("keeps the Visibility section and hides only groups when Unlimited Visibility is enabled", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(
+      <EditRoleForm
+        roleId="role-1"
+        roleData={roleData()}
+        groups={[{ id: "group-1", name: "Production" }]}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+
+    // Then
+    expect(screen.getByText("Visibility")).toBeInTheDocument();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).toBeChecked();
+    expect(
+      screen.getByText(/tenant-wide visibility setting/i),
+    ).toBeInTheDocument();
+    expect(screen.queryByTestId("group-select")).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/select the groups this role will have access to/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not force Unlimited Visibility when Manage Providers is selected", async () => {
+    // Given
+    const user = userEvent.setup();
+    renderEditRoleForm();
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).not.toBeChecked();
+    expect(
+      screen.queryByText(
+        /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+      ),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not force Unlimited Visibility when granting all admin permissions", async () => {
+    // Given
+    const user = userEvent.setup();
+    renderEditRoleForm();
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    ).toBeChecked();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).not.toBeChecked();
+  });
+
+  it("keeps Unlimited Visibility user-controlled when Manage Providers is selected", async () => {
+    // Given
+    const user = userEvent.setup();
+    renderEditRoleForm();
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    ).toBeChecked();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).not.toBeChecked();
+    expect(screen.getByTestId("group-select")).toBeInTheDocument();
+  });
+
+  it("keeps explicitly enabled Unlimited Visibility when all admin permissions are toggled off", async () => {
+    // Given
+    const user = userEvent.setup();
+    renderEditRoleForm();
+
+    // When
+    await user.click(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+    );
+    await user.click(
+      screen.getByRole("checkbox", { name: "Grant all admin permissions" }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    ).not.toBeChecked();
+    expect(
+      screen.getByRole("checkbox", {
+        name: "Enable Unlimited Visibility for this role",
+      }),
+    ).toBeChecked();
+  });
+
+  it("does not show extra Manage Providers guidance", () => {
+    // Given / When
+    renderEditRoleForm({ manageProviders: true, unlimitedVisibility: true });
+
+    // Then
+    expect(
+      screen.queryByText(
+        /Manage Providers is selected, so Unlimited Visibility stays enabled in this form/i,
+      ),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(/remove this automatic visibility grant/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("keeps existing inconsistent Manage Providers and Unlimited Visibility values on initial render", () => {
+    // Given / When
+    renderEditRoleForm({ manageProviders: true, unlimitedVisibility: false });
+
+    // Then
+    expect(
+      screen.getByRole("checkbox", { name: "Manage Providers" }),
+    ).toBeChecked();
+    const unlimitedVisibilityCheckbox = screen.getByRole("checkbox", {
+      name: "Enable Unlimited Visibility for this role",
+    });
+    expect(unlimitedVisibilityCheckbox).not.toBeChecked();
+    expect(unlimitedVisibilityCheckbox).toBeEnabled();
+  });
+});

ui/components/roles/workflow/forms/edit-role-form.tsx

@@ -1,25 +1,14 @@
 "use client";
 
-import { Checkbox } from "@heroui/checkbox";
-import { Divider } from "@heroui/divider";
-import { Tooltip } from "@heroui/tooltip";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { clsx } from "clsx";
-import { InfoIcon } from "lucide-react";
 import { useRouter } from "next/navigation";
-import { useEffect } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { z } from "zod";
+import { DefaultValues } from "react-hook-form";
 
 import { updateRole } from "@/actions/roles/roles";
-import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
 import { useToast } from "@/components/ui";
-import { CustomInput } from "@/components/ui/custom";
-import { Form, FormButtons } from "@/components/ui/form";
-import { getErrorMessage, permissionFormFields } from "@/lib";
-import { ApiError, editRoleFormSchema } from "@/types";
+import { getErrorMessage } from "@/lib";
+import { RoleFormValues } from "@/types";
 
-type FormValues = z.input<typeof editRoleFormSchema>;
+import { RoleForm, RoleFormSubmitContext, RoleGroupOption } from "./role-form";
 
 export const EditRoleForm = ({
   roleId,
@@ -29,7 +18,7 @@ export const EditRoleForm = ({
   roleId: string;
   roleData: {
     data: {
-      attributes: FormValues;
+      attributes: RoleFormValues;
       relationships?: {
         provider_groups?: {
           data: Array<{ id: string; type: string }>;
@@ -37,57 +26,24 @@ export const EditRoleForm = ({
       };
     };
   };
-  groups: { id: string; name: string }[];
+  groups: RoleGroupOption[];
 }) => {
   const { toast } = useToast();
   const router = useRouter();
   const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
-  const visiblePermissionFormFields = permissionFormFields.filter(
-    (permission) =>
-      !["manage_billing", "manage_alerts"].includes(permission.field) ||
-      isCloudEnvironment,
-  );
 
-  const form = useForm<FormValues>({
-    resolver: zodResolver(editRoleFormSchema),
-    defaultValues: {
-      ...roleData.data.attributes,
-      groups:
-        roleData.data.relationships?.provider_groups?.data.map((g) => g.id) ||
-        [],
-    },
-  });
-
-  const { watch, setValue } = form;
-
-  const manageProviders = watch("manage_providers");
-  const unlimitedVisibility = watch("unlimited_visibility");
-
-  useEffect(() => {
-    if (manageProviders && !unlimitedVisibility) {
-      setValue("unlimited_visibility", true, {
-        shouldValidate: true,
-        shouldDirty: true,
-        shouldTouch: true,
-      });
-    }
-  }, [manageProviders, unlimitedVisibility, setValue]);
-
-  const isLoading = form.formState.isSubmitting;
-
-  const onSelectAllChange = (checked: boolean) => {
-    visiblePermissionFormFields.forEach(({ field }) => {
-      form.setValue(field as keyof FormValues, checked, {
-        shouldValidate: true,
-        shouldDirty: true,
-        shouldTouch: true,
-      });
-    });
+  const defaultValues: DefaultValues<RoleFormValues> = {
+    ...roleData.data.attributes,
+    groups:
+      roleData.data.relationships?.provider_groups?.data.map((g) => g.id) || [],
   };
 
-  const onSubmitClient = async (values: FormValues) => {
+  const onSubmit = async (
+    values: RoleFormValues,
+    { handleServerResponse }: RoleFormSubmitContext,
+  ) => {
     try {
-      const updatedFields: Partial<FormValues> = {};
+      const updatedFields: Partial<RoleFormValues> = {};
 
       if (values.name !== roleData.data.attributes.name) {
         updatedFields.name = values.name;
@@ -127,33 +83,13 @@ export const EditRoleForm = ({
       });
 
       const data = await updateRole(formData, roleId);
+      if (!handleServerResponse(data)) return;
 
-      if (data?.errors && data.errors.length > 0) {
-        data.errors.forEach((error: ApiError) => {
-          const errorMessage = error.detail;
-          const pointer = error.source?.pointer;
-          switch (pointer) {
-            case "/data/attributes/name":
-              form.setError("name", {
-                type: "server",
-                message: errorMessage,
-              });
-              break;
-            default:
-              toast({
-                variant: "destructive",
-                title: "Error",
-                description: errorMessage,
-              });
-          }
-        });
-      } else {
-        toast({
-          title: "Role Updated",
-          description: "The role was updated successfully.",
-        });
-        router.push("/roles");
-      }
+      toast({
+        title: "Role Updated",
+        description: "The role was updated successfully.",
+      });
+      router.push("/roles");
     } catch (error) {
       toast({
         variant: "destructive",
@@ -164,119 +100,11 @@ export const EditRoleForm = ({
   };
 
   return (
-    <Form {...form}>
-      <form
-        onSubmit={form.handleSubmit(onSubmitClient)}
-        className="flex flex-col gap-6"
-      >
-        <CustomInput
-          control={form.control}
-          name="name"
-          type="text"
-          label="Role Name"
-          labelPlacement="inside"
-          placeholder="Enter role name"
-          variant="bordered"
-          isRequired
-        />
-
-        <div className="flex flex-col gap-4">
-          <span className="text-lg font-semibold">Admin Permissions</span>
-
-          {/* Select All Checkbox */}
-          <Checkbox
-            isSelected={visiblePermissionFormFields.every((perm) =>
-              form.watch(perm.field as keyof FormValues),
-            )}
-            onChange={(e) => onSelectAllChange(e.target.checked)}
-            classNames={{
-              label: "text-small",
-              wrapper: "checkbox-update",
-            }}
-            color="default"
-          >
-            Grant all admin permissions
-          </Checkbox>
-
-          {/* Permissions Grid */}
-          <div className="grid grid-cols-2 gap-4">
-            {visiblePermissionFormFields.map(
-              ({ field, label, description }) => (
-                <div key={field} className="flex items-center gap-2">
-                  <Checkbox
-                    {...form.register(field as keyof FormValues)}
-                    isSelected={!!form.watch(field as keyof FormValues)}
-                    classNames={{
-                      label: "text-small",
-                      wrapper: "checkbox-update",
-                    }}
-                    color="default"
-                  >
-                    {label}
-                  </Checkbox>
-                  <Tooltip content={description} placement="right">
-                    <div className="flex w-fit items-center justify-center">
-                      <InfoIcon
-                        className={clsx(
-                          "text-default-400 group-data-[selected=true]:text-foreground cursor-pointer",
-                        )}
-                        aria-hidden={"true"}
-                        width={16}
-                      />
-                    </div>
-                  </Tooltip>
-                </div>
-              ),
-            )}
-          </div>
-        </div>
-        <Divider className="my-4" />
-
-        {!unlimitedVisibility && (
-          <div className="flex flex-col gap-4">
-            <span className="text-lg font-semibold">Groups visibility</span>
-
-            <p className="text-small text-default-700 font-medium">
-              Select the groups this role will have access to. If no groups are
-              selected and unlimited visibility is not enabled, the role will
-              not have access to any accounts.
-            </p>
-
-            <Controller
-              name="groups"
-              control={form.control}
-              render={({ field }) => (
-                <div className="flex flex-col gap-2">
-                  <EnhancedMultiSelect
-                    options={groups.map((group) => ({
-                      label: group.name,
-                      value: group.id,
-                    }))}
-                    onValueChange={field.onChange}
-                    defaultValue={field.value || []}
-                    placeholder="Select groups"
-                    searchable={true}
-                    hideSelectAll={true}
-                    emptyIndicator="No results found"
-                    resetOnDefaultValueChange={true}
-                  />
-                </div>
-              )}
-            />
-
-            {form.formState.errors.groups && (
-              <p className="mt-2 text-sm text-red-600">
-                {form.formState.errors.groups.message}
-              </p>
-            )}
-          </div>
-        )}
-        <FormButtons
-          submitText="Update Role"
-          isDisabled={isLoading}
-          onCancel={() => router.push("/roles")}
-        />
-      </form>
-    </Form>
+    <RoleForm
+      groups={groups}
+      defaultValues={defaultValues}
+      submitText="Update Role"
+      onSubmit={onSubmit}
+    />
   );
 };

ui/components/roles/workflow/forms/role-form.tsx

@@ -0,0 +1,236 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+import { InfoIcon } from "lucide-react";
+import { useRouter } from "next/navigation";
+import {
+  Controller,
+  DefaultValues,
+  useForm,
+  UseFormReturn,
+} from "react-hook-form";
+
+import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
+import { Input } from "@/components/shadcn/input/input";
+import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
+import { Separator } from "@/components/shadcn/separator/separator";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/shadcn/tooltip";
+import {
+  Form,
+  FormButtons,
+  FormControl,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from "@/components/ui/form";
+import { useFormServerErrors } from "@/hooks/use-form-server-errors";
+import { useManageProvidersUnlimitedVisibility } from "@/hooks/use-manage-providers-unlimited-visibility";
+import {
+  getUnlimitedVisibilityField,
+  getVisiblePermissionFormFields,
+} from "@/lib/role-permissions";
+import { roleFormSchema, RoleFormValues } from "@/types";
+
+import { UnlimitedVisibilityField } from "./unlimited-visibility-section";
+
+export interface RoleGroupOption {
+  id: string;
+  name: string;
+}
+
+export interface RoleFormSubmitContext {
+  form: UseFormReturn<RoleFormValues>;
+  handleServerResponse: (data: unknown) => boolean;
+}
+
+interface RoleFormProps {
+  groups: RoleGroupOption[];
+  defaultValues: DefaultValues<RoleFormValues>;
+  submitText: string;
+  onSubmit: (
+    values: RoleFormValues,
+    ctx: RoleFormSubmitContext,
+  ) => void | Promise<void>;
+  onCancel?: () => void;
+}
+
+export const RoleForm = ({
+  groups,
+  defaultValues,
+  submitText,
+  onSubmit,
+  onCancel,
+}: RoleFormProps) => {
+  const router = useRouter();
+
+  const form = useForm<RoleFormValues>({
+    resolver: zodResolver(roleFormSchema),
+    defaultValues,
+  });
+
+  const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+  const visiblePermissionFormFields =
+    getVisiblePermissionFormFields(isCloudEnvironment);
+  const showUnlimitedVisibilityField = !!getUnlimitedVisibilityField();
+
+  const { setPermissionValue, setUnlimitedVisibility } =
+    useManageProvidersUnlimitedVisibility(form);
+  const { handleServerResponse } = useFormServerErrors(form, {
+    "/data/attributes/name": "name",
+  });
+
+  const unlimitedVisibility = !!form.watch("unlimited_visibility");
+  const isLoading = form.formState.isSubmitting;
+
+  const onSelectAllChange = (checked: boolean) => {
+    visiblePermissionFormFields.forEach(({ field }) => {
+      setPermissionValue(field, checked);
+    });
+  };
+
+  const handleCancel = onCancel ?? (() => router.push("/roles"));
+
+  return (
+    <Form {...form}>
+      <form
+        onSubmit={form.handleSubmit((values) =>
+          onSubmit(values, { form, handleServerResponse }),
+        )}
+        className="flex flex-col gap-6"
+      >
+        <FormField
+          control={form.control}
+          name="name"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>
+                Role Name <span className="text-text-error-primary">*</span>
+              </FormLabel>
+              <FormControl>
+                <Input
+                  placeholder="Enter role name"
+                  {...field}
+                  value={field.value ?? ""}
+                />
+              </FormControl>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <div className="flex flex-col gap-4">
+          <span className="text-lg font-semibold">Admin Permissions</span>
+
+          {/* Select All Checkbox */}
+          <div className="flex items-center gap-2">
+            <Checkbox
+              id="select-all"
+              size="sm"
+              checked={visiblePermissionFormFields.every((perm) =>
+                form.watch(perm.field as keyof RoleFormValues),
+              )}
+              onCheckedChange={(checked) => onSelectAllChange(Boolean(checked))}
+            />
+            <label htmlFor="select-all" className="text-small">
+              Grant all admin permissions
+            </label>
+          </div>
+
+          {/* Permissions Grid */}
+          <div className="grid grid-cols-2 gap-4">
+            {visiblePermissionFormFields.map(
+              ({ field, label, description }) => (
+                <div key={field} className="flex items-center gap-2">
+                  <Checkbox
+                    id={field}
+                    size="sm"
+                    checked={!!form.watch(field as keyof RoleFormValues)}
+                    onCheckedChange={(checked) =>
+                      setPermissionValue(field, Boolean(checked))
+                    }
+                  />
+                  <label htmlFor={field} className="text-small">
+                    {label}
+                  </label>
+                  <Tooltip>
+                    <TooltipTrigger asChild>
+                      <div className="flex w-fit items-center justify-center">
+                        <InfoIcon
+                          className="text-muted-foreground cursor-pointer"
+                          aria-hidden="true"
+                          width={16}
+                        />
+                      </div>
+                    </TooltipTrigger>
+                    <TooltipContent side="right">{description}</TooltipContent>
+                  </Tooltip>
+                </div>
+              ),
+            )}
+          </div>
+        </div>
+
+        <Separator className="my-4" />
+
+        <div className="flex flex-col gap-4">
+          <span className="text-lg font-semibold">Visibility</span>
+
+          {showUnlimitedVisibilityField && (
+            <UnlimitedVisibilityField
+              isSelected={unlimitedVisibility}
+              onValueChange={setUnlimitedVisibility}
+            />
+          )}
+
+          {!unlimitedVisibility && (
+            <>
+              <p className="text-small text-default-700 font-medium">
+                Select the groups this role will have access to. If no groups
+                are selected and unlimited visibility is not enabled, the role
+                will not have access to any accounts.
+              </p>
+
+              <Controller
+                name="groups"
+                control={form.control}
+                render={({ field }) => (
+                  <div className="flex flex-col gap-2">
+                    <EnhancedMultiSelect
+                      options={groups.map((group) => ({
+                        label: group.name,
+                        value: group.id,
+                      }))}
+                      onValueChange={field.onChange}
+                      defaultValue={field.value || []}
+                      placeholder="Select groups"
+                      searchable={true}
+                      hideSelectAll={true}
+                      emptyIndicator="No results found"
+                      resetOnDefaultValueChange={true}
+                    />
+                  </div>
+                )}
+              />
+
+              {form.formState.errors.groups && (
+                <p className="mt-2 text-sm text-red-600">
+                  {form.formState.errors.groups.message}
+                </p>
+              )}
+            </>
+          )}
+        </div>
+        <FormButtons
+          submitText={submitText}
+          isDisabled={isLoading}
+          onCancel={handleCancel}
+        />
+      </form>
+    </Form>
+  );
+};

ui/components/roles/workflow/forms/unlimited-visibility-section.tsx

@@ -0,0 +1,56 @@
+import { InfoIcon } from "lucide-react";
+import { ReactNode } from "react";
+
+import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
+
+export const UnlimitedVisibilitySection = ({
+  children,
+}: {
+  children: ReactNode;
+}) => {
+  return (
+    <section className="space-y-2">
+      <div className="text-muted-foreground flex items-start gap-2 text-sm">
+        <InfoIcon
+          aria-hidden="true"
+          className="text-bg-data-info mt-0.5 h-4 w-4 shrink-0"
+        />
+        <p>
+          This is a tenant-wide visibility setting. It grants visibility into
+          every provider, account, resource, finding, scan, and compliance
+          result, regardless of the groups selected below. It is also{" "}
+          <strong>required to use the Jira integration</strong>.
+        </p>
+      </div>
+      <div>{children}</div>
+    </section>
+  );
+};
+
+export const UnlimitedVisibilityField = ({
+  isSelected,
+  onValueChange,
+}: {
+  isSelected: boolean;
+  onValueChange: (checked: boolean) => void;
+}) => {
+  return (
+    <UnlimitedVisibilitySection>
+      <div className="flex items-center gap-2">
+        <Checkbox
+          id="unlimited_visibility"
+          name="unlimited_visibility"
+          checked={isSelected}
+          onCheckedChange={(checked) => onValueChange(Boolean(checked))}
+          size="sm"
+        />
+        <label
+          htmlFor="unlimited_visibility"
+          className="text-small font-medium peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+        >
+          Enable Unlimited Visibility for this role
+        </label>
+      </div>
+    </UnlimitedVisibilitySection>
+  );
+};

ui/hooks/use-manage-providers-unlimited-visibility.ts

@@ -0,0 +1,42 @@
+import type {
+  FieldValues,
+  Path,
+  PathValue,
+  UseFormReturn,
+} from "react-hook-form";
+
+type RolePermissionValues = {
+  manage_providers?: boolean;
+  unlimited_visibility?: boolean;
+};
+
+const setBooleanFormValue = <T extends FieldValues>(
+  form: Pick<UseFormReturn<T>, "setValue">,
+  field: Path<T>,
+  value: boolean,
+) => {
+  form.setValue(field, value as PathValue<T, Path<T>>, {
+    shouldValidate: true,
+    shouldDirty: true,
+    shouldTouch: true,
+  });
+};
+
+export const useManageProvidersUnlimitedVisibility = <
+  T extends FieldValues & RolePermissionValues,
+>(
+  form: Pick<UseFormReturn<T>, "setValue" | "watch">,
+) => {
+  const setUnlimitedVisibility = (checked: boolean) => {
+    setBooleanFormValue(form, "unlimited_visibility" as Path<T>, checked);
+  };
+
+  const setPermissionValue = (field: string, checked: boolean) => {
+    setBooleanFormValue(form, field as Path<T>, checked);
+  };
+
+  return {
+    setPermissionValue,
+    setUnlimitedVisibility,
+  };
+};

ui/lib/compliance/cis.tsx

@@ -38,8 +38,11 @@ export const mapComplianceData = (
     const attrs = metadataArray?.[0];
     if (!attrs) continue;
 
-    // Apply profile filter
-    if (filter === "Level 1" && attrs.Profile !== "Level 1") {
+    // Apply profile filter.
+    // Most CIS benchmarks use "Level 1"/"Level 2" as the Profile, but some
+    // (e.g. M365) prefix it with the license tier: "E3 Level 1", "E5 Level 2".
+    // Match by suffix so the Level 1 filter works across all CIS variants.
+    if (filter === "Level 1" && !attrs.Profile?.endsWith("Level 1")) {
       continue; // Skip Level 2 requirements when Level 1 is selected
     }
 

ui/lib/helper.ts

@@ -433,7 +433,7 @@ export const permissionFormFields: PermissionInfo[] = [
     field: "unlimited_visibility",
     label: "Unlimited Visibility",
     description:
-      "Provides complete visibility across all the providers and its related resources",
+      "Grants tenant-wide visibility across all providers, accounts, resources, findings, scans, and compliance results without granting admin actions.",
   },
   {
     field: "manage_providers",