chore(sdk): update dependency pytest to v9 [security]

.env

@@ -145,7 +145,7 @@ SENTRY_RELEASE=local
 NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.29.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.28.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/renovate.json

@@ -13,7 +13,7 @@
     "customManagers:dockerfileVersions"
   ],
   "timezone": "Europe/Madrid",
-  "baseBranchPatterns": [
+  "baseBranches": [
     "master"
   ],
   "labels": [
@@ -30,16 +30,6 @@
   "minimumReleaseAge": "7 days",
   "rangeStrategy": "pin",
   "packageRules": [
-    {
-      "description": "Patches: 1st of every month, Madrid overnight window (22:00-06:00)",
-      "matchUpdateTypes": [
-        "patch"
-      ],
-      "schedule": [
-        "* 22-23,0-5 1 * *"
-      ],
-      "enabled": false
-    },
     {
       "description": "Minors: 8th of every 3 months, Madrid overnight window (22:00-06:00)",
       "matchUpdateTypes": [
@@ -47,8 +37,7 @@
       ],
       "schedule": [
         "* 22-23,0-5 8 */3 *"
-      ],
-      "enabled": false
+      ]
     },
     {
       "description": "Majors: 15th of every 3 months, Madrid overnight window",
@@ -57,8 +46,7 @@
       ],
       "schedule": [
         "* 22-23,0-5 15 */3 *"
-      ],
-      "enabled": false
+      ]
     },
     {
       "description": "GitHub Actions - single grouped PR, no changelog, scope=ci",

Dockerfile

@@ -100,4 +100,4 @@ RUN pip uninstall dash-html-components -y && \
     pip uninstall dash-core-components -y
 
 USER prowler
-ENTRYPOINT ["/home/prowler/.venv/bin/prowler"]
+ENTRYPOINT [".venv/bin/prowler"]

api/CHANGELOG.md

@@ -2,28 +2,11 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
-## [1.30.0] (Prowler UNRELEASED)
-
-### 🔄 Changed
-
-- Scan finding ingestion: bulk-resolve `Resource`/`ResourceTag` rows, replace per-mapping `SELECT FOR UPDATE` with deferred `ResourceTagMapping.bulk_create(ignore_conflicts=True)`, wrap each micro-batch in a single `rls_transaction`, and raise `SCAN_DB_BATCH_SIZE` to 1000 [(#11249)](https://github.com/prowler-cloud/prowler/pull/11249)
-
----
-
-## [1.29.1] (Prowler v5.28.1)
-
-### 🐞 Fixed
-
-- `finding-groups` slow response with finding-level filters such as `region`; check title and description are now read from the daily summaries, which drops sorting by `check_title` [(#11326)](https://github.com/prowler-cloud/prowler/pull/11326)
-
----
-
-## [1.29.0] (Prowler v5.28.0)
+## [1.29.0] (Prowler UNRELEASED)
 
 ### 🚀 Added
 
 - `okta` provider support [(#11184)](https://github.com/prowler-cloud/prowler/pull/11184)
-- `resource.metadata` attribute included in `/api/v1/findings?include=resources` [(#11187)](https://github.com/prowler-cloud/prowler/pull/11187)
 
 ---
 
@@ -45,6 +28,7 @@ All notable changes to the **Prowler API** are documented in this file.
 - `perform_scan_task` and `perform_scheduled_scan_task` now short-circuit with a warning and `return None` when the target provider no longer exists, instead of letting `handle_provider_deletion` raise `ProviderDeletedException`. `perform_scheduled_scan_task` also removes any orphan `PeriodicTask` it finds so beat stops re-firing scans for deleted providers. Prevents queued messages for deleted providers from being recorded as `FAILURE` [(#11185)](https://github.com/prowler-cloud/prowler/pull/11185)
 - Attack Paths: `BEDROCK-001` and `BEDROCK-002` now target roles trusting `bedrock-agentcore.amazonaws.com` instead of `bedrock.amazonaws.com`, eliminating false positives against regular Bedrock service roles (Agents, Knowledge Bases, model invocation) [(#11141)](https://github.com/prowler-cloud/prowler/pull/11141)
 
+
 ---
 
 ## [1.27.1] (Prowler v5.26.1)

api/pyproject.toml

@@ -68,7 +68,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.30.0"
+version = "1.29.0"
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.30.0
+  version: 1.29.0
   description: |-
     Prowler API specification.
 

api/src/backend/api/tests/test_views.py

@@ -7158,32 +7158,6 @@ class TestFindingViewSet:
             "id"
         ] == str(finding_1.resources.first().id)
 
-    def test_findings_retrieve_include_resource_metadata(
-        self, authenticated_client, findings_fixture
-    ):
-        finding_1, *_ = findings_fixture
-        resource = finding_1.resources.first()
-        resource.metadata = '{"VulnerabilityID": "CVE-2026-0001"}'
-        resource.details = "Python 3.12 base image"
-        resource.save()
-
-        response = authenticated_client.get(
-            reverse("finding-detail", kwargs={"pk": finding_1.id}),
-            {"include": "resources"},
-        )
-        assert response.status_code == status.HTTP_200_OK
-
-        included_resource = next(
-            item
-            for item in response.json()["included"]
-            if item["type"] == "resources" and item["id"] == str(resource.id)
-        )
-        assert (
-            included_resource["attributes"]["metadata"]
-            == '{"VulnerabilityID": "CVE-2026-0001"}'
-        )
-        assert included_resource["attributes"]["details"] == "Python 3.12 base image"
-
     def test_findings_invalid_retrieve(self, authenticated_client):
         response = authenticated_client.get(
             reverse("finding-detail", kwargs={"pk": "random_id"}),
@@ -15921,12 +15895,6 @@ class TestFindingGroupViewSet:
         assert attrs["fail_count"] == 0
         assert attrs["resources_total"] == 1
         assert attrs["resources_fail"] == 0
-        # check_title / check_description are resolved post-pagination from the
-        # summary table, not from the finding's check_metadata.
-        assert attrs["check_title"] == "Ensure EC2 instances do not have public IPs"
-        assert (
-            attrs["check_description"] == "EC2 instances should use private IPs only."
-        )
 
     def test_finding_groups_status_pass_when_no_fail(
         self, authenticated_client, finding_groups_fixture
@@ -17168,12 +17136,6 @@ class TestFindingGroupViewSet:
         assert attrs["fail_count"] == 0
         assert attrs["resources_total"] == 1
         assert attrs["resources_fail"] == 0
-        # check_title / check_description are resolved post-pagination from the
-        # summary table, not from the finding's check_metadata.
-        assert attrs["check_title"] == "Ensure EC2 instances do not have public IPs"
-        assert (
-            attrs["check_description"] == "EC2 instances should use private IPs only."
-        )
 
     def test_finding_groups_latest_status_in_filter(
         self, authenticated_client, finding_groups_fixture
@@ -17431,20 +17393,18 @@ class TestFindingGroupViewSet:
         check_ids = [item["id"] for item in data]
         assert check_ids == sorted(check_ids)
 
-    def test_finding_groups_latest_sort_by_check_title_not_supported(
+    def test_finding_groups_latest_sort_by_check_title(
         self, authenticated_client, finding_groups_fixture
     ):
-        """check_title is not a sortable field for finding groups.
-
-        Titles live in the TOASTed check_metadata blob and are resolved after
-        pagination from the summary table, so they cannot drive DB-level
-        ordering. Requesting that sort is rejected.
-        """
+        """Test /latest supports sorting by check_title."""
         response = authenticated_client.get(
             reverse("finding-group-latest"),
             {"sort": "check_title"},
         )
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        check_titles = [item["attributes"]["check_title"] for item in data]
+        assert check_titles == sorted(check_titles)
 
     @pytest.mark.parametrize(
         "endpoint_name", ["finding-group-list", "finding-group-latest"]

api/src/backend/api/v1/serializers.py

@@ -1397,7 +1397,6 @@ class ResourceIncludeSerializer(RLSSerializer):
             "service",
             "type_",
             "tags",
-            "metadata",
             "details",
             "partition",
         ]
@@ -1405,7 +1404,6 @@ class ResourceIncludeSerializer(RLSSerializer):
             "id": {"read_only": True},
             "inserted_at": {"read_only": True},
             "updated_at": {"read_only": True},
-            "metadata": {"read_only": True},
             "details": {"read_only": True},
             "partition": {"read_only": True},
         }

api/src/backend/api/v1/views.py

@@ -7369,15 +7369,6 @@ class FindingGroupViewSet(BaseRLSViewSet):
             output_field=IntegerField(),
         )
 
-        # `check_title` / `check_description` are intentionally NOT resolved
-        # here. They live in the large JSONB `check_metadata` blob (TOASTed),
-        # so reading them per finding row is very expensive, and pulling them
-        # in via a correlated subquery makes Django add the subquery to GROUP
-        # BY, which re-evaluates it once per input row. They are identical for
-        # every finding of a `check_id`, so `_post_process_aggregation` fills
-        # them from the summary table's plain columns in a single batched
-        # lookup scoped to the paginated page.
-
         # `pass_count`, `fail_count` and `manual_count` only count non-muted
         # findings. Muted findings are tracked separately via the
         # `*_muted_count` fields.
@@ -7448,6 +7439,15 @@ class FindingGroupViewSet(BaseRLSViewSet):
                 agg_failing_since=Min(
                     "first_seen_at", filter=Q(status="FAIL", muted=False)
                 ),
+                check_title=Coalesce(
+                    Max(KeyTextTransform("checktitle", "check_metadata")),
+                    Max(KeyTextTransform("CheckTitle", "check_metadata")),
+                    Max(KeyTextTransform("Checktitle", "check_metadata")),
+                ),
+                check_description=Coalesce(
+                    Max(KeyTextTransform("description", "check_metadata")),
+                    Max(KeyTextTransform("Description", "check_metadata")),
+                ),
             )
             .annotate(
                 # Group is muted only if it has zero non-muted findings.
@@ -7503,38 +7503,9 @@ class FindingGroupViewSet(BaseRLSViewSet):
         - Computes aggregated status (FAIL > PASS > MANUAL); the orthogonal
           ``muted`` boolean is already on the row from the SQL aggregation
         - Converts provider string to list
-        - Fills check_title / check_description for the findings path
         """
-        rows = list(aggregated_data)
-
-        # The findings-aggregation path omits check_title / check_description
-        # (they sit in TOASTed JSONB; see _aggregate_findings). Fill them from
-        # the summary table's plain columns in one query scoped to this page.
-        # The summary-aggregation path already carries them, so skip it there.
-        if rows and "check_title" not in rows[0]:
-            check_ids = [row["check_id"] for row in rows]
-            role = get_role(self.request.user, self.request.tenant_id)
-            summaries = FindingGroupDailySummary.objects.filter(
-                tenant_id=self.request.tenant_id,
-                check_id__in=check_ids,
-            )
-            # Scope to the user's providers, mirroring get_queryset(), so titles
-            # are read only from providers the user can see.
-            if not role.unlimited_visibility:
-                summaries = summaries.filter(provider__in=get_providers(role))
-            metadata_by_check = {
-                item["check_id"]: item
-                for item in summaries.order_by("check_id", "-inserted_at")
-                .distinct("check_id")
-                .values("check_id", "check_title", "check_description")
-            }
-            for row in rows:
-                metadata = metadata_by_check.get(row["check_id"], {})
-                row["check_title"] = metadata.get("check_title")
-                row["check_description"] = metadata.get("check_description")
-
         results = []
-        for row in rows:
+        for row in aggregated_data:
             # Convert severity order back to string
             severity_order = row.get("severity_order", 1)
             row["severity"] = SEVERITY_ORDER_REVERSE.get(
@@ -7580,6 +7551,7 @@ class FindingGroupViewSet(BaseRLSViewSet):
 
     _FINDING_GROUP_SORT_MAP = {
         "check_id": "check_id",
+        "check_title": "check_title",
         "severity": "severity_order",
         "status": "status_order",
         "muted": "muted",

api/src/backend/tasks/jobs/scan.py

@@ -42,6 +42,7 @@ from api.db_utils import (
     SET_CONFIG_QUERY,
     psycopg_connection,
     rls_transaction,
+    update_objects_in_batches,
 )
 from api.exceptions import ProviderConnectionError
 from api.models import (
@@ -58,7 +59,6 @@ from api.models import (
     ResourceFindingMapping,
     ResourceScanSummary,
     ResourceTag,
-    ResourceTagMapping,
     Scan,
     ScanCategorySummary,
     ScanGroupSummary,
@@ -97,16 +97,8 @@ COMPLIANCE_REQUIREMENT_COPY_COLUMNS = (
 )
 # Controls how many findings we process per micro-batch before flushing to DB writes
 FINDINGS_MICRO_BATCH_SIZE = env.int("DJANGO_FINDINGS_MICRO_BATCH_SIZE", default=3000)
-# Controls how many rows each ORM bulk_create/bulk_update call sends to Postgres.
-SCAN_DB_BATCH_SIZE = env.int("DJANGO_SCAN_DB_BATCH_SIZE", default=1000)
-# Throttle scan progress persistence: minimum progress delta (fraction 0-1)
-# between two persisted progress updates.
-PROGRESS_THROTTLE_DELTA = env.float("DJANGO_SCAN_PROGRESS_THROTTLE_DELTA", default=0.01)
-# Throttle scan progress persistence: maximum seconds without persisting progress
-# regardless of delta (so slow checks still show progress in the UI).
-PROGRESS_THROTTLE_SECONDS = env.float(
-    "DJANGO_SCAN_PROGRESS_THROTTLE_SECONDS", default=10.0
-)
+# Controls how many rows each ORM bulk_create/bulk_update call sends to Postgres
+SCAN_DB_BATCH_SIZE = env.int("DJANGO_SCAN_DB_BATCH_SIZE", default=500)
 
 ATTACK_SURFACE_PROVIDER_COMPATIBILITY = {
     "internet-exposed": None,  # Compatible with all providers
@@ -536,26 +528,16 @@ def _process_finding_micro_batch(
     """
     # Accumulate objects for bulk operations
     findings_to_create = []
+    mappings_to_create = []
     dirty_resources = {}
-    resources_with_new_tag_mappings: set[str] = set()
     resource_denormalized_data = []  # (finding_instance, resource_instance) pairs
-    tag_mappings_to_create: list[ResourceTagMapping] = []
     skipped_findings_count = 0  # Track findings skipped due to UID length
 
-    # Separate findings into those persistable (uid <= 300) and over-limit.
-    # Resources/tags ARE still resolved for over-limit findings to preserve the
-    # original behavior (resources are persisted even when their finding is dropped).
-    non_null_findings = [f for f in findings_batch if f is not None]
-    persistable_findings = [f for f in non_null_findings if len(f.uid) <= 300]
-    skipped_findings_count = len(non_null_findings) - len(persistable_findings)
-    none_count = len(findings_batch) - len(non_null_findings)
-    if none_count:
-        logger.error(
-            f"{none_count} None finding(s) detected on scan {scan_instance.id}."
-        )
-
-    # Prefetch last statuses for all persistable findings in this batch (read replica)
-    finding_uids = [f.uid for f in persistable_findings]
+    # Prefetch last statuses for all findings in this batch
+    # TEMPORARY WORKAROUND: Filter out UIDs > 300 chars to avoid query errors
+    finding_uids = [
+        f.uid for f in findings_batch if f is not None and len(f.uid) <= 300
+    ]
     with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
         last_statuses = {
             item["uid"]: (item["status"], item["first_seen_at"])
@@ -566,411 +548,281 @@ def _process_finding_micro_batch(
             .order_by("uid", "-inserted_at")
             .distinct("uid")
         }
+        # Update cache
         for uid, data in last_statuses.items():
             if uid not in last_status_cache:
                 last_status_cache[uid] = data
 
-    # All DB writes for this micro-batch run inside ONE rls_transaction,
-    # with deadlock-retry at micro-batch granularity instead of per-finding.
-    for attempt in range(CELERY_DEADLOCK_ATTEMPTS):
-        try:
-            with rls_transaction(tenant_id):
-                # 1) Pre-resolve Resources in bulk
-                # Collect all uids referenced by this batch that are not in cache yet.
-                # NOTE: we intentionally include empty-string uids here. The SDK
-                # explicitly emits findings with `resource_uid=""` for some flows
-                # (IaC scans, some Azure/GCP/K8s checks). The original
-                # `get_or_create` behavior was to create/share a Resource with
-                # uid="" for these findings rather than dropping them. Preserve
-                # that behavior; do NOT filter by truthiness.
-                batch_resource_uids: set[str] = set()
-                for f in non_null_findings:
-                    if f.resource_uid not in resource_cache:
-                        batch_resource_uids.add(f.resource_uid)
+    # Process each finding in the batch
+    for finding in findings_batch:
+        if finding is None:
+            logger.error(f"None finding detected on scan {scan_instance.id}.")
+            continue
 
-                if batch_resource_uids:
-                    existing_resources = {
-                        r.uid: r
-                        for r in Resource.objects.filter(
-                            tenant_id=tenant_id,
-                            provider_id=provider_instance.id,
-                            uid__in=batch_resource_uids,
-                        )
-                    }
-                    missing_uids = batch_resource_uids - existing_resources.keys()
-                    if missing_uids:
-                        # Build defaults from the first finding referencing each uid.
-                        first_finding_per_uid: dict[str, ProwlerFinding] = {}
-                        for f in non_null_findings:
-                            if f.resource_uid in missing_uids:
-                                first_finding_per_uid.setdefault(f.resource_uid, f)
-                        resources_to_create = []
-                        for uid in missing_uids:
-                            f = first_finding_per_uid[uid]
-                            check_metadata = f.get_metadata()
-                            group = check_metadata.get("resourcegroup") or None
-                            resources_to_create.append(
-                                Resource(
-                                    tenant_id=tenant_id,
-                                    provider=provider_instance,
-                                    uid=uid,
-                                    region=f.region,
-                                    service=f.service_name,
-                                    type=f.resource_type,
-                                    name=f.resource_name,
-                                    groups=[group] if group else None,
-                                )
-                            )
-                        Resource.objects.bulk_create(
-                            resources_to_create,
-                            batch_size=SCAN_DB_BATCH_SIZE,
-                            ignore_conflicts=True,
-                            unique_fields=["tenant_id", "provider_id", "uid"],
-                        )
-                        # Re-fetch to obtain instances we just created AND any
-                        # created concurrently by another scan against the same provider.
-                        existing_resources.update(
-                            {
-                                r.uid: r
-                                for r in Resource.objects.filter(
-                                    tenant_id=tenant_id,
-                                    provider_id=provider_instance.id,
-                                    uid__in=missing_uids,
-                                )
-                            }
-                        )
-                    for uid, r in existing_resources.items():
-                        resource_cache[uid] = r
-                        resource_failed_findings_cache.setdefault(uid, 0)
-
-                # 2) Pre-resolve ResourceTags in bulk
-                batch_tag_kv: set[tuple[str, str]] = set()
-                for f in non_null_findings:
-                    for k, v in f.resource_tags.items():
-                        if (k, v) not in tag_cache:
-                            batch_tag_kv.add((k, v))
-
-                if batch_tag_kv:
-                    keys_to_query = {k for k, _ in batch_tag_kv}
-                    existing_tags = {
-                        (t.key, t.value): t
-                        for t in ResourceTag.objects.filter(
-                            tenant_id=tenant_id, key__in=keys_to_query
-                        )
-                        if (t.key, t.value) in batch_tag_kv
-                    }
-                    missing_kv = batch_tag_kv - existing_tags.keys()
-                    if missing_kv:
-                        ResourceTag.objects.bulk_create(
-                            [
-                                ResourceTag(tenant_id=tenant_id, key=k, value=v)
-                                for k, v in missing_kv
-                            ],
-                            batch_size=SCAN_DB_BATCH_SIZE,
-                            ignore_conflicts=True,
-                            unique_fields=["tenant_id", "key", "value"],
-                        )
-                        existing_tags.update(
-                            {
-                                (t.key, t.value): t
-                                for t in ResourceTag.objects.filter(
-                                    tenant_id=tenant_id,
-                                    key__in={k for k, _ in missing_kv},
-                                )
-                                if (t.key, t.value) in missing_kv
-                            }
-                        )
-                    tag_cache.update(existing_tags)
-
-                # 3) Per-finding in-memory processing
-                for finding in non_null_findings:
+        # Process resource with deadlock retry
+        for attempt in range(CELERY_DEADLOCK_ATTEMPTS):
+            try:
+                with rls_transaction(tenant_id):
                     resource_uid = finding.resource_uid
-                    resource_instance = resource_cache.get(resource_uid)
-                    if resource_instance is None:
-                        # Should be unreachable after the pre-resolve step. Defensive log.
-                        logger.error(
-                            f"Resource {resource_uid} missing from cache after pre-resolve "
-                            f"on scan {scan_instance.id}; skipping finding."
-                        )
-                        continue
-
-                    # Detect resource field changes (defer save until end-of-batch bulk_update).
-                    check_metadata = finding.get_metadata()
-                    group = check_metadata.get("resourcegroup") or None
-                    updated = False
-                    if finding.region and resource_instance.region != finding.region:
-                        resource_instance.region = finding.region
-                        updated = True
-                    if resource_instance.service != finding.service_name:
-                        resource_instance.service = finding.service_name
-                        updated = True
-                    if resource_instance.type != finding.resource_type:
-                        resource_instance.type = finding.resource_type
-                        updated = True
-                    if resource_instance.metadata != finding.resource_metadata:
-                        resource_instance.metadata = json.dumps(
-                            finding.resource_metadata, cls=CustomEncoder
-                        )
-                        updated = True
-                    if resource_instance.details != finding.resource_details:
-                        resource_instance.details = finding.resource_details
-                        updated = True
-                    if resource_instance.partition != finding.partition:
-                        resource_instance.partition = finding.partition
-                        updated = True
-                    if group and (
-                        not resource_instance.groups
-                        or group not in resource_instance.groups
-                    ):
-                        resource_instance.groups = (resource_instance.groups or []) + [
-                            group
-                        ]
-                        updated = True
-
-                    if updated:
-                        dirty_resources[resource_uid] = resource_instance
-
-                    # Accumulate ResourceTagMapping rows; bulk_create at end of block.
-                    for k, v in finding.resource_tags.items():
-                        tag_instance = tag_cache.get((k, v))
-                        if tag_instance is None:
-                            # Should not happen after pre-resolve; skip defensively.
-                            continue
-                        tag_mappings_to_create.append(
-                            ResourceTagMapping(
-                                tenant_id=tenant_id,
-                                resource=resource_instance,
-                                tag=tag_instance,
-                            )
-                        )
-
-                    unique_resources.add(
-                        (resource_instance.uid, resource_instance.region)
-                    )
-
-                    # TEMPORARY WORKAROUND: Skip findings with UID > 300 chars
-                    # TODO: Remove this after implementing text field migration for finding.uid
-                    if len(finding.uid) > 300:
-                        logger.warning(
-                            f"Skipping finding with UID exceeding 300 characters. "
-                            f"Length: {len(finding.uid)}, "
-                            f"Check: {finding.check_id}, "
-                            f"Resource: {finding.resource_name}, "
-                            f"UID: {finding.uid}"
-                        )
-                        continue
-
-                    finding_uid = finding.uid
-                    last_status, last_first_seen_at = last_status_cache.get(
-                        finding_uid, (None, None)
-                    )
-
-                    status = FindingStatus[finding.status]
-                    delta = _create_finding_delta(last_status, status)
-
-                    if not last_first_seen_at:
-                        last_first_seen_at = datetime.now(tz=timezone.utc)
-
-                    # Determine if finding should be muted and why
-                    # Priority: mutelist processor (highest) > manual mute rules
-                    is_muted = False
-                    muted_reason = None
-                    if finding.muted:
-                        is_muted = True
-                        muted_reason = "Muted by mutelist"
-                    elif finding_uid in mute_rules_cache:
-                        is_muted = True
-                        muted_reason = mute_rules_cache[finding_uid]
-
-                    if status == FindingStatus.FAIL and not is_muted:
-                        resource_failed_findings_cache[resource_uid] += 1
-
-                    check_metadata["compliance"] = finding.compliance
-                    finding_instance = Finding(
-                        tenant_id=tenant_id,
-                        uid=finding_uid,
-                        delta=delta,
-                        check_metadata=check_metadata,
-                        status=status,
-                        status_extended=finding.status_extended,
-                        severity=finding.severity,
-                        impact=finding.severity,
-                        raw_result=finding.raw,
-                        check_id=finding.check_id,
-                        scan=scan_instance,
-                        first_seen_at=last_first_seen_at,
-                        muted=is_muted,
-                        muted_at=datetime.now(tz=timezone.utc) if is_muted else None,
-                        muted_reason=muted_reason,
-                        compliance=finding.compliance,
-                        categories=check_metadata.get("categories", []) or [],
-                        resource_groups=check_metadata.get("resourcegroup") or None,
-                        # Denormalized resource arrays populated directly on insert
-                        # (was previously a separate bulk_update; saves a CASE WHEN
-                        # over thousands of rows per micro-batch).
-                        resource_regions=[resource_instance.region]
-                        if resource_instance.region
-                        else [],
-                        resource_services=[resource_instance.service]
-                        if resource_instance.service
-                        else [],
-                        resource_types=[resource_instance.type]
-                        if resource_instance.type
-                        else [],
-                    )
-                    findings_to_create.append(finding_instance)
-                    resource_denormalized_data.append(
-                        (finding_instance, resource_instance)
-                    )
-
-                    scan_resource_cache.add(
-                        (
-                            str(resource_instance.id),
-                            resource_instance.service,
-                            resource_instance.region,
-                            resource_instance.type,
-                        )
-                    )
-
-                    aggregate_category_counts(
-                        categories=check_metadata.get("categories", []) or [],
-                        severity=finding.severity.value,
-                        status=status.value,
-                        delta=delta.value if delta else None,
-                        muted=is_muted,
-                        cache=scan_categories_cache,
-                    )
-
-                    aggregate_resource_group_counts(
-                        resource_group=check_metadata.get("resourcegroup") or None,
-                        severity=finding.severity.value,
-                        status=status.value,
-                        delta=delta.value if delta else None,
-                        muted=is_muted,
-                        resource_uid=resource_instance.uid if resource_instance else "",
-                        cache=scan_resource_groups_cache,
-                        group_resources_cache=group_resources_cache,
-                    )
-
-                # 4) Bulk create ResourceTagMappings
-                # Replaces the original per-resource `upsert_or_delete_tags`
-                # (which did one `update_or_create` + SELECT FOR UPDATE per mapping).
-                if tag_mappings_to_create:
-                    # Pre-SELECT existing pairs: `bulk_create(ignore_conflicts=True)`
-                    # does not populate `pk`, so we cannot tell new vs existing from
-                    # the result; we need that to bump `updated_at` only on resources
-                    # that actually gain a mapping.
-                    candidate_resource_ids = {
-                        m.resource_id for m in tag_mappings_to_create
-                    }
-                    candidate_tag_ids = {m.tag_id for m in tag_mappings_to_create}
-                    existing_pairs = set(
-                        ResourceTagMapping.objects.filter(
+                    if resource_uid not in resource_cache:
+                        check_metadata = finding.get_metadata()
+                        group = check_metadata.get("resourcegroup") or None
+                        resource_instance, _ = Resource.objects.get_or_create(
                             tenant_id=tenant_id,
-                            resource_id__in=candidate_resource_ids,
-                            tag_id__in=candidate_tag_ids,
-                        ).values_list("resource_id", "tag_id")
-                    )
-                    resource_uid_by_id = {
-                        str(r.id): uid for uid, r in resource_cache.items()
-                    }
-                    for m in tag_mappings_to_create:
-                        if (m.resource_id, m.tag_id) not in existing_pairs:
-                            uid = resource_uid_by_id.get(str(m.resource_id))
-                            if uid is not None:
-                                resources_with_new_tag_mappings.add(uid)
-
-                    ResourceTagMapping.objects.bulk_create(
-                        tag_mappings_to_create,
-                        batch_size=SCAN_DB_BATCH_SIZE,
-                        ignore_conflicts=True,
-                        unique_fields=["tenant_id", "resource_id", "tag_id"],
-                    )
-
-                # 5) Bulk create Findings
-                if findings_to_create:
-                    Finding.objects.bulk_create(
-                        findings_to_create, batch_size=SCAN_DB_BATCH_SIZE
-                    )
-
-                # 6) Bulk create ResourceFindingMapping rows
-                mappings_to_create = [
-                    ResourceFindingMapping(
-                        tenant_id=tenant_id,
-                        resource=resource_instance,
-                        finding=finding_instance,
-                    )
-                    for finding_instance, resource_instance in resource_denormalized_data
-                ]
-                if mappings_to_create:
-                    created_mappings = ResourceFindingMapping.objects.bulk_create(
-                        mappings_to_create,
-                        batch_size=SCAN_DB_BATCH_SIZE,
-                        ignore_conflicts=True,
-                        unique_fields=["tenant_id", "resource_id", "finding_id"],
-                    )
-                    inserted = sum(1 for m in created_mappings if m.pk)
-                    if inserted != len(mappings_to_create):
-                        logger.error(
-                            f"scan {scan_instance.id}: expected "
-                            f"{len(mappings_to_create)} ResourceFindingMapping rows, "
-                            f"inserted {inserted}. Rolling back micro-batch."
+                            provider=provider_instance,
+                            uid=resource_uid,
+                            defaults={
+                                "region": finding.region,
+                                "service": finding.service_name,
+                                "type": finding.resource_type,
+                                "name": finding.resource_name,
+                                "groups": [group] if group else None,
+                            },
                         )
+                        resource_cache[resource_uid] = resource_instance
+                        resource_failed_findings_cache[resource_uid] = 0
+                    else:
+                        resource_instance = resource_cache[resource_uid]
+                break
+            except (OperationalError, IntegrityError) as db_err:
+                if attempt < CELERY_DEADLOCK_ATTEMPTS - 1:
+                    logger.warning(
+                        f"{'Deadlock error' if isinstance(db_err, OperationalError) else 'Integrity error'} "
+                        f"detected when processing resource {resource_uid} on scan {scan_instance.id}. Retrying..."
+                    )
+                    time.sleep(0.1 * (2**attempt))
+                    continue
+                else:
+                    raise db_err
 
-                # 7) Bulk update Resources
-                # Union of:
-                #  - resources whose fields changed (dirty_resources)
-                #  - resources that got new tag mappings (need updated_at bump,
-                #    preserving the original `self.save(update_fields=["updated_at"])`
-                #    behavior of `upsert_or_delete_tags`)
-                all_resource_uids_to_touch = (
-                    set(dirty_resources.keys()) | resources_with_new_tag_mappings
+        # Track resource field changes (defer save)
+        updated = False
+        check_metadata = finding.get_metadata()
+        group = check_metadata.get("resourcegroup") or None
+        if finding.region and resource_instance.region != finding.region:
+            resource_instance.region = finding.region
+            updated = True
+        if resource_instance.service != finding.service_name:
+            resource_instance.service = finding.service_name
+            updated = True
+        if resource_instance.type != finding.resource_type:
+            resource_instance.type = finding.resource_type
+            updated = True
+        if resource_instance.metadata != finding.resource_metadata:
+            resource_instance.metadata = json.dumps(
+                finding.resource_metadata, cls=CustomEncoder
+            )
+            updated = True
+        if resource_instance.details != finding.resource_details:
+            resource_instance.details = finding.resource_details
+            updated = True
+        if resource_instance.partition != finding.partition:
+            resource_instance.partition = finding.partition
+            updated = True
+        if group and (
+            not resource_instance.groups or group not in resource_instance.groups
+        ):
+            resource_instance.groups = (resource_instance.groups or []) + [group]
+            updated = True
+
+        if updated:
+            dirty_resources[resource_uid] = resource_instance
+
+        # Process tags
+        tags = []
+        with rls_transaction(tenant_id):
+            for key, value in finding.resource_tags.items():
+                tag_key = (key, value)
+                if tag_key not in tag_cache:
+                    tag_instance, _ = ResourceTag.objects.get_or_create(
+                        tenant_id=tenant_id, key=key, value=value
+                    )
+                    tag_cache[tag_key] = tag_instance
+                else:
+                    tag_instance = tag_cache[tag_key]
+                tags.append(tag_instance)
+            resource_instance.upsert_or_delete_tags(tags=tags)
+
+        unique_resources.add((resource_instance.uid, resource_instance.region))
+
+        # Prepare finding data
+        finding_uid = finding.uid
+
+        # TEMPORARY WORKAROUND: Skip findings with UID > 300 chars
+        # TODO: Remove this after implementing text field migration for finding.uid
+        if len(finding_uid) > 300:
+            skipped_findings_count += 1
+            logger.warning(
+                f"Skipping finding with UID exceeding 300 characters. "
+                f"Length: {len(finding_uid)}, "
+                f"Check: {finding.check_id}, "
+                f"Resource: {finding.resource_name}, "
+                f"UID: {finding_uid}"
+            )
+            continue
+
+        last_status, last_first_seen_at = last_status_cache.get(
+            finding_uid, (None, None)
+        )
+
+        status = FindingStatus[finding.status]
+        delta = _create_finding_delta(last_status, status)
+
+        if not last_first_seen_at:
+            last_first_seen_at = datetime.now(tz=timezone.utc)
+
+        # Determine if finding should be muted and why
+        # Priority: mutelist processor (highest) > manual mute rules
+        is_muted = False
+        muted_reason = None
+
+        # Check mutelist processor first (highest priority)
+        if finding.muted:
+            is_muted = True
+            muted_reason = "Muted by mutelist"
+        # If not muted by mutelist, check manual mute rules
+        elif finding_uid in mute_rules_cache:
+            is_muted = True
+            muted_reason = mute_rules_cache[finding_uid]
+
+        # Increment failed_findings_count cache if needed
+        if status == FindingStatus.FAIL and not is_muted:
+            resource_failed_findings_cache[resource_uid] += 1
+
+        # Create finding object (don't save yet)
+        check_metadata = finding.get_metadata()
+        check_metadata["compliance"] = finding.compliance
+        finding_instance = Finding(
+            tenant_id=tenant_id,
+            uid=finding_uid,
+            delta=delta,
+            check_metadata=check_metadata,
+            status=status,
+            status_extended=finding.status_extended,
+            severity=finding.severity,
+            impact=finding.severity,
+            raw_result=finding.raw,
+            check_id=finding.check_id,
+            scan=scan_instance,
+            first_seen_at=last_first_seen_at,
+            muted=is_muted,
+            muted_at=datetime.now(tz=timezone.utc) if is_muted else None,
+            muted_reason=muted_reason,
+            compliance=finding.compliance,
+            categories=check_metadata.get("categories", []) or [],
+            resource_groups=check_metadata.get("resourcegroup") or None,
+        )
+        findings_to_create.append(finding_instance)
+        resource_denormalized_data.append((finding_instance, resource_instance))
+
+        # Track for scan summary
+        scan_resource_cache.add(
+            (
+                str(resource_instance.id),
+                resource_instance.service,
+                resource_instance.region,
+                resource_instance.type,
+            )
+        )
+
+        # Track categories with counts for ScanCategorySummary by (category, severity)
+        aggregate_category_counts(
+            categories=check_metadata.get("categories", []) or [],
+            severity=finding.severity.value,
+            status=status.value,
+            delta=delta.value if delta else None,
+            muted=is_muted,
+            cache=scan_categories_cache,
+        )
+
+        # Track resource groups with counts for ScanGroupSummary
+        aggregate_resource_group_counts(
+            resource_group=check_metadata.get("resourcegroup") or None,
+            severity=finding.severity.value,
+            status=status.value,
+            delta=delta.value if delta else None,
+            muted=is_muted,
+            resource_uid=resource_instance.uid if resource_instance else "",
+            cache=scan_resource_groups_cache,
+            group_resources_cache=group_resources_cache,
+        )
+
+    # Bulk operations within single transaction
+    with rls_transaction(tenant_id):
+        # Bulk create findings
+        if findings_to_create:
+            Finding.objects.bulk_create(
+                findings_to_create, batch_size=SCAN_DB_BATCH_SIZE
+            )
+
+        # Bulk create resource-finding mappings
+        for finding_instance, resource_instance in resource_denormalized_data:
+            mappings_to_create.append(
+                ResourceFindingMapping(
+                    tenant_id=tenant_id,
+                    resource=resource_instance,
+                    finding=finding_instance,
                 )
-                if all_resource_uids_to_touch:
-                    now_utc = datetime.now(tz=timezone.utc)
-                    resources_to_bulk_update = []
-                    for uid in all_resource_uids_to_touch:
-                        # Use the instance from dirty_resources if present (has mutated
-                        # fields), otherwise the cached one (for updated_at bump only).
-                        r = dirty_resources.get(uid) or resource_cache.get(uid)
-                        if r is None:
-                            continue
-                        # Manually bump updated_at since bulk_update bypasses auto_now.
-                        r.updated_at = now_utc
-                        resources_to_bulk_update.append(r)
-                    if resources_to_bulk_update:
-                        Resource.objects.bulk_update(
-                            resources_to_bulk_update,
-                            [
-                                "metadata",
-                                "details",
-                                "partition",
-                                "region",
-                                "service",
-                                "type",
-                                "groups",
-                                "updated_at",
-                            ],
-                            batch_size=1000,
-                        )
-            # Successful execution: leave deadlock retry loop.
-            break
-        except (OperationalError, IntegrityError) as db_err:
-            if attempt < CELERY_DEADLOCK_ATTEMPTS - 1:
-                logger.warning(
-                    f"{'Deadlock error' if isinstance(db_err, OperationalError) else 'Integrity error'} "
-                    f"on micro-batch for scan {scan_instance.id}. Retrying (attempt {attempt + 1})..."
+            )
+
+        if mappings_to_create:
+            created_mappings = ResourceFindingMapping.objects.bulk_create(
+                mappings_to_create,
+                batch_size=SCAN_DB_BATCH_SIZE,
+                ignore_conflicts=True,
+                unique_fields=["tenant_id", "resource_id", "finding_id"],
+            )
+            inserted = sum(1 for m in created_mappings if m.pk)
+            if inserted != len(mappings_to_create):
+                logger.error(
+                    f"scan {scan_instance.id}: expected "
+                    f"{len(mappings_to_create)} ResourceFindingMapping rows, "
+                    f"inserted {inserted}. Rolling back micro-batch."
                 )
-                time.sleep(0.1 * (2**attempt))
-                # Clear accumulators that we appended to inside the failed transaction
-                # so the retry produces consistent results.
-                findings_to_create.clear()
-                resource_denormalized_data.clear()
-                tag_mappings_to_create.clear()
-                dirty_resources.clear()
-                resources_with_new_tag_mappings.clear()
-                continue
-            raise
+
+        # Update finding denormalized arrays
+        findings_to_update = []
+        for finding_instance, resource_instance in resource_denormalized_data:
+            if not finding_instance.resource_regions:
+                finding_instance.resource_regions = []
+            if not finding_instance.resource_services:
+                finding_instance.resource_services = []
+            if not finding_instance.resource_types:
+                finding_instance.resource_types = []
+
+            if resource_instance.region not in finding_instance.resource_regions:
+                finding_instance.resource_regions.append(resource_instance.region)
+            if resource_instance.service not in finding_instance.resource_services:
+                finding_instance.resource_services.append(resource_instance.service)
+            if resource_instance.type not in finding_instance.resource_types:
+                finding_instance.resource_types.append(resource_instance.type)
+
+            findings_to_update.append(finding_instance)
+
+        if findings_to_update:
+            Finding.objects.bulk_update(
+                findings_to_update,
+                ["resource_regions", "resource_services", "resource_types"],
+                batch_size=SCAN_DB_BATCH_SIZE,
+            )
+
+    # Bulk update dirty resources
+    if dirty_resources:
+        update_objects_in_batches(
+            tenant_id=tenant_id,
+            model=Resource,
+            objects=list(dirty_resources.values()),
+            fields=[
+                "metadata",
+                "details",
+                "partition",
+                "region",
+                "service",
+                "type",
+                "groups",
+            ],
+            batch_size=1000,
+        )
 
     # Log skipped findings summary
     if skipped_findings_count > 0:
@@ -1021,7 +873,7 @@ def perform_prowler_scan(
         scan_instance = Scan.objects.get(pk=scan_id)
         scan_instance.state = StateChoices.EXECUTING
         scan_instance.started_at = datetime.now(tz=timezone.utc)
-        scan_instance.save(update_fields=["state", "started_at", "updated_at"])
+        scan_instance.save()
 
     # Find the mutelist processor if it exists
     with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
@@ -1066,13 +918,7 @@ def perform_prowler_scan(
                 provider_instance.connection_last_checked_at = datetime.now(
                     tz=timezone.utc
                 )
-                provider_instance.save(
-                    update_fields=[
-                        "connected",
-                        "connection_last_checked_at",
-                        "updated_at",
-                    ]
-                )
+                provider_instance.save()
 
         # If the provider is not connected, raise an exception outside the transaction.
         # If raised within the transaction, the transaction will be rolled back and the provider will not be marked
@@ -1087,13 +933,6 @@ def perform_prowler_scan(
         last_status_cache = {}
         resource_failed_findings_cache = defaultdict(int)
 
-        # Throttle scan_instance progress writes to avoid hammering the writer:
-        # only persist when progress moves by at least `PROGRESS_THROTTLE_DELTA`
-        # OR `PROGRESS_THROTTLE_SECONDS` have elapsed. The final progress (1.0)
-        # always persists in the `finally` block below.
-        last_persisted_progress = -1.0
-        last_persisted_progress_at = 0.0
-
         for progress, findings in prowler_scan.scan():
             # Process findings in micro-batches
             findings_list = list(findings)
@@ -1120,20 +959,10 @@ def perform_prowler_scan(
                     group_resources_cache=group_resources_cache,
                 )
 
-            # Throttled progress save (the final save in the `finally` block
-            # below always runs regardless of throttle).
-            now = time.time()
-            progress_delta = progress - last_persisted_progress
-            elapsed = now - last_persisted_progress_at
-            if (
-                progress_delta >= PROGRESS_THROTTLE_DELTA
-                or elapsed >= PROGRESS_THROTTLE_SECONDS
-            ):
-                with rls_transaction(tenant_id):
-                    scan_instance.progress = progress
-                    scan_instance.save(update_fields=["progress", "updated_at"])
-                last_persisted_progress = progress
-                last_persisted_progress_at = now
+            # Update scan progress
+            with rls_transaction(tenant_id):
+                scan_instance.progress = progress
+                scan_instance.save()
 
         scan_instance.state = StateChoices.COMPLETED
 
@@ -1147,16 +976,13 @@ def perform_prowler_scan(
                     resources_to_update.append(resource_instance)
 
             if resources_to_update:
-                # Single rls_transaction wrapping the bulk_update (previously
-                # `update_objects_in_batches` opened one rls_transaction per
-                # chunk; for tenants with many resources this collapsed N
-                # BEGINs/COMMITs into 1).
-                with rls_transaction(tenant_id):
-                    Resource.objects.bulk_update(
-                        resources_to_update,
-                        ["failed_findings_count"],
-                        batch_size=SCAN_DB_BATCH_SIZE,
-                    )
+                update_objects_in_batches(
+                    tenant_id=tenant_id,
+                    model=Resource,
+                    objects=resources_to_update,
+                    fields=["failed_findings_count"],
+                    batch_size=1000,
+                )
 
     except Exception as e:
         logger.error(f"Error performing scan {scan_id}: {e}")
@@ -1168,16 +994,7 @@ def perform_prowler_scan(
             scan_instance.duration = time.time() - start_time
             scan_instance.completed_at = datetime.now(tz=timezone.utc)
             scan_instance.unique_resource_count = len(unique_resources)
-            scan_instance.save(
-                update_fields=[
-                    "state",
-                    "duration",
-                    "completed_at",
-                    "unique_resource_count",
-                    "progress",
-                    "updated_at",
-                ]
-            )
+            scan_instance.save()
 
     if exception is not None:
         raise exception

api/uv.lock

@@ -4494,7 +4494,7 @@ dependencies = [
 
 [[package]]
 name = "prowler-api"
-version = "1.30.0"
+version = "1.29.0"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },

docs/getting-started/installation/prowler-app.mdx

@@ -118,8 +118,8 @@ To update the environment file:
 Edit the `.env` file and change version values:
 
 ```env
-PROWLER_UI_VERSION="5.28.0"
-PROWLER_API_VERSION="5.28.0"
+PROWLER_UI_VERSION="5.27.0"
+PROWLER_API_VERSION="5.27.0"
 ```
 
 <Note>

docs/user-guide/cli/tutorials/configuration_file.mdx

@@ -91,7 +91,6 @@ The following list includes all the Azure checks with configurable variables tha
 | `sqlserver_recommended_minimal_tls_version`                   | `recommended_minimal_tls_versions`               | List of Strings |
 | `vm_sufficient_daily_backup_retention_period`                 | `vm_backup_min_daily_retention_days`             | Integer         |
 | `vm_desired_sku_size`                                         | `desired_vm_sku_sizes`                           | List of Strings |
-| `storage_smb_channel_encryption_with_secure_algorithm`        | `recommended_smb_channel_encryption_algorithms`  | List of Strings |
 | `defender_attack_path_notifications_properly_configured`      | `defender_attack_path_minimal_risk_level`        | String          |
 | `apim_threat_detection_llm_jacking`                           | `apim_threat_detection_llm_jacking_threshold`    | Float           |
 | `apim_threat_detection_llm_jacking`                           | `apim_threat_detection_llm_jacking_minutes`      | Integer         |
@@ -166,7 +165,6 @@ The following list includes all the Okta checks with configurable variables that
 
 | Check Name                                                    | Value                              | Type    |
 |---------------------------------------------------------------|------------------------------------|---------|
-| `application_admin_console_session_idle_timeout_15min`        | `okta_admin_console_idle_timeout_max_minutes` | Integer |
 | `signon_global_session_idle_timeout_15min`                    | `okta_max_session_idle_minutes`    | Integer |
 
 ## Config YAML File Structure
@@ -536,18 +534,6 @@ azure:
       "1.3"
     ]
 
-  # Azure Storage
-  # azure.storage_smb_channel_encryption_with_secure_algorithm
-  # List of SMB channel encryption algorithms allowed on file shares. A storage
-  # account passes only if every enabled algorithm is in this list. Defaults to
-  # the value required by CIS (AES-256-GCM only, excluding weaker AES-128 ciphers).
-  recommended_smb_channel_encryption_algorithms:
-    [
-      "AES-256-GCM",
-      # "AES-128-CCM",
-      # "AES-128-GCM",
-    ]
-
   # Azure Virtual Machines
   # azure.vm_desired_sku_size
   # List of desired VM SKU sizes that are allowed in the organization

docs/user-guide/providers/okta/authentication.mdx

@@ -30,49 +30,25 @@ If a different authentication method is needed (SSWS API token, OAuth with user
 
 ### Required OAuth Scopes
 
-The bundled checks require the following read-only scopes:
+The bundled signon checks require the following read-only scopes:
 
 - `okta.policies.read`
 - `okta.brands.read`
-- `okta.apps.read`
 
 Additional scopes will be needed as more services and checks are added. These are the current ones needed:
 
 | Scope | Used by |
 |---|---|
-| `okta.policies.read` | Sign-on, password, and authentication policies |
+| `okta.policies.read` | Sign-on / password / authentication policies |
 | `okta.brands.read` | Sign-in page customizations (DOD Notice and Consent Banner check) |
-| `okta.apps.read` | First-party app settings (Okta Admin Console session), integrated app inventory, and the Authentication Policies bound to Okta applications |
 
 ### Required Admin Role
 
-The service application must be assigned **one** of the following Okta admin roles:
+The service application must be assigned the built-in **Read-Only Administrator** role.
 
-- **Read-Only Administrator** — covers every `signon` check and runs `application_authentication_policy_network_zone_enforced` against the apps it can see. **Visibility caveat:** under Read-Only Administrator the `/api/v1/apps` endpoint returns only the apps the service application is itself assigned to — typically just the service app's own row (for example, `Prowler Scanner`). The check still produces a finding for that app, but the rest of the org's app inventory is invisible at this role level.
-- **Super Administrator** — required additionally to evaluate five application-service checks that target Okta's first-party apps (Okta Admin Console, Okta Dashboard). With Super Administrator, `application_authentication_policy_network_zone_enforced` also evaluates the full org-wide app inventory instead of the service-app-only slice.
+Okta's Management API enforces a two-layer authorization model: an OAuth **scope** decides which API endpoints the token can call, and an **admin role** decides whether the call returns data. With only a scope granted, the token mint succeeds but every read returns `403 Forbidden`. The Read-Only Administrator role is the minimum that lets the granted `okta.*.read` scopes actually return configuration data to Prowler's checks — without it, the credential probe at provider startup fails and the scan never gets to evaluate any check.
 
-Okta's Management API enforces a two-layer authorization model: an OAuth **scope** decides which API endpoints the token can call, and an **admin role** decides whether the call returns data. With only a scope granted, the token mint succeeds but every read returns `403 Forbidden`. Read-Only Administrator is the minimum role that lets the granted `okta.*.read` scopes return configuration data to Prowler's checks; without it, the credential probe at provider startup fails and the scan never gets to evaluate any check.
-
-#### When Super Administrator is required
-
-Four checks need to resolve the Authentication Policy bound to Okta's first-party apps (Okta Admin Console, Okta Dashboard) and depend on `/api/v1/apps` returning those system apps — which Okta restricts to Super Administrator:
-
-| Check | STIG |
-|---|---|
-| `application_admin_console_mfa_required` | V-273193 |
-| `application_admin_console_phishing_resistant_authentication` | V-273191 |
-| `application_dashboard_mfa_required` | V-273194 |
-| `application_dashboard_phishing_resistant_authentication` | V-273190 |
-
-Okta filters the first-party apps (`saasure`, `okta_enduser`) out of `/api/v1/apps` for every role below Super Administrator, so `okta.apps.read` alone is not enough. The `okta.apps.manageFirstPartyApps` permission exists only in the paid Okta Identity Governance role `ACCESS_REQUESTS_ADMIN` and cannot be added to custom roles ([Okta Permissions Catalog](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions)).
-
-A fifth check — `application_admin_console_session_idle_timeout_15min` (STIG V-273187) — also requires Super Administrator: it calls `GET /api/v1/first-party-app-settings/admin-console`, which returns `403 E0000006` for every role below Super Administrator.
-
-When the service app runs with Read-Only Administrator, the five checks listed in this section return **MANUAL** instead of PASS/FAIL — the rest of the scan keeps running.
-
-<Note>
-Read-Only Administrator stays the recommended default for the least-privilege framing that aligns with DISA STIG. Assign Super Administrator on a separate run when full coverage of the first-party app checks is needed.
-</Note>
+Read-Only Administrator is intentionally the narrowest role that satisfies this requirement and aligns with the least-privilege guidance in DISA STIG.
 
 ## Step-by-Step Setup
 
@@ -122,21 +98,19 @@ Okta displays the private key **only once**. If you close the modal without copy
 
 ### 5. Grant the required OAuth scopes
 
-On the app, open the **Okta API Scopes** tab and click **Grant** on every scope Prowler needs. The bundled checks require `okta.policies.read`, `okta.brands.read`, and `okta.apps.read`.
+On the app, open the **Okta API Scopes** tab and click **Grant** on every scope Prowler needs. The bundled signon checks require `okta.policies.read` and `okta.brands.read`.
 
 ![Okta — grant OAuth scopes](/user-guide/providers/okta/images/grant-permissions.png)
 
-### 6. Assign an admin role
+### 6. Assign the Read-Only Administrator role
 
 On the app, open the **Admin roles** tab and click **Edit assignments → Add assignment**:
 
-- **Role:** Read-Only Administrator (default) — covers every `signon` check and runs the per-app network-zone check against the apps the service app can see (typically only the service app's own row).
+- **Role:** Read-Only Administrator
 - **Resources:** All resources
 
 Save the changes.
 
-To additionally evaluate the first-party application checks (Okta Admin Console / Okta Dashboard idle timeout, MFA, and phishing-resistant authentication) and to widen the per-app network-zone check to the full org-wide app inventory, assign **Super Administrator** instead. Without Super Administrator, the five first-party checks return MANUAL and the network-zone check is limited to the service app's own visibility — the rest of the scan still runs. See [Required Admin Role](#required-admin-role) for the full breakdown.
-
 ![Okta — grant Read-Only role](/user-guide/providers/okta/images/grant-roles.png)
 
 ### 7. [Optional] Verify DPoP setting
@@ -158,8 +132,8 @@ export OKTA_PRIVATE_KEY_FILE="/secure/path/to/prowler-okta.pem"
 # or
 export OKTA_PRIVATE_KEY="$(cat /secure/path/to/prowler-okta.pem)"
 
-# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read"
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read"
+# Optional — defaults to "okta.policies.read,okta.brands.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read"
 
 uv run python prowler-cli.py okta
 ```
@@ -200,12 +174,8 @@ Prowler validates credentials at startup by listing one sign-on policy. This err
 
 Raised when the credential probe succeeds at the OAuth layer but the request is rejected because the service app lacks the required scope or admin role:
 
-- **`invalid_scope`** — one of the requested scopes (`okta.policies.read`, `okta.brands.read`, or `okta.apps.read`) is not granted on the service app. Grant the missing scope from **Okta API Scopes**.
-- **`Forbidden` / `not authorized`** — no admin role is assigned to the service app. Assign **Read-Only Administrator** (or **Super Administrator** for the first-party application checks) from **Admin roles**.
-
-### Application-service checks return MANUAL on first-party apps
-
-When the service app runs with Read-Only Administrator, the five application-service checks targeting the Okta Admin Console and Okta Dashboard return MANUAL. This is by design — Okta restricts the underlying endpoints (`/api/v1/first-party-app-settings/{appName}` and `/api/v1/apps` for first-party app `name` values `saasure` / `okta_enduser`) to **Super Administrator**. Assign the Super Administrator role to the service app to evaluate those checks. See [Required Admin Role](#required-admin-role) for the full list.
+- **`invalid_scope`** — one of the requested scopes (`okta.policies.read` or `okta.brands.read`) is not granted on the service app. Grant the missing scope from **Okta API Scopes**.
+- **`Forbidden` / `not authorized`** — the **Read-Only Administrator** role is not assigned to the service app. Assign it from **Admin roles**.
 
 ### `invalid_dpop_proof`
 

docs/user-guide/providers/okta/getting-started-okta.mdx

@@ -12,7 +12,7 @@ Set up authentication for Okta with the [Okta Authentication](/user-guide/provid
 
 - An Okta organization. The UI examples below use **Identity Engine** terminology such as **Global Session Policy**; Classic Engine exposes the equivalent sign-on policy concepts under older names.
 - A **Super Administrator** account on that organization for the one-time service-app setup.
-- An **API Services** app integration in the Okta Admin Console with the `okta.policies.read`, `okta.brands.read`, and `okta.apps.read` scopes granted and an admin role assigned. **Read-Only Administrator** covers every `signon` check and runs the per-app network-zone check against the apps the service app can see (under Read-Only Administrator that is typically only the service app's own row — the rest of the org's app inventory stays invisible). **Super Administrator** is required additionally to evaluate the five first-party application checks (Okta Admin Console / Okta Dashboard idle timeout, MFA, phishing-resistant authentication) and to widen the network-zone check to the full app inventory — see [Okta Authentication](/user-guide/providers/okta/authentication#required-admin-role) for the full breakdown.
+- An **API Services** app integration in the Okta Admin Console with the `okta.policies.read` and `okta.brands.read` scopes granted and the **Read-Only Administrator** role assigned.
 - Python 3.10+ and Prowler 5.27.0 or later installed locally.
 
 <CardGroup cols={2}>
@@ -26,51 +26,10 @@ Set up authentication for Okta with the [Okta Authentication](/user-guide/provid
 
 ## Prowler Cloud
 
-<VersionBadge version="5.28.0" />
-
-### Step 1: Add the Provider
-
-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
-2. Navigate to "Configuration" > "Providers".
-
-    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
-
-3. Click "Add Provider".
-
-    ![Add a Provider](/images/prowler-app/add-cloud-provider.png)
-
-4. Select "Okta".
-
-    ![Select Okta](/user-guide/providers/okta/images/select-okta-provider.png)
-
-5. Enter the **Org Domain** of the target Okta organization and an optional alias, then click "Next".
-
-    ![Add Okta Org Domain](/user-guide/providers/okta/images/okta-org-domain-form.png)
-
 <Note>
-The Org Domain must be the bare hostname of an Okta-managed organization — for example, `acme.okta.com`, `acme.oktapreview.com`, `acme.okta-emea.com`, `acme.okta-gov.com`, `acme.okta.mil`, `acme.okta-miltest.com`, or `acme.trex-govcloud.com`. Omit the `https://` scheme, any path, and any trailing slash.
+Prowler Cloud onboarding for Okta is coming soon. Track the [Prowler GitHub repository](https://github.com/prowler-cloud/prowler) for release updates. Use the [Prowler CLI](#prowler-cli) workflow below in the meantime.
 </Note>
 
-### Step 2: Provide Credentials
-
-Prowler Cloud authenticates to Okta with the **OAuth 2.0 Private Key JWT** flow exposed by an Okta **API Services** app. The service application, keypair, scope grants, and Read-Only Administrator role are set up once in the Okta Admin Console — full instructions are in the [Okta Authentication](/user-guide/providers/okta/authentication) guide.
-
-1. Enter the **Client ID** of the Okta API Services app (for example, `0oa123456789abcdef`).
-2. Paste the **Private Key** whose matching public key (JWK) is registered on the service app. Both PEM-encoded RSA keys and JWK JSON documents are accepted.
-3. Click "Next".
-
-    ![Okta Credentials Form](/user-guide/providers/okta/images/okta-credentials-form.png)
-
-<Note>
-The private key is transmitted over TLS and stored as an encrypted secret in the backend. Rotate or revoke the matching public key from the Okta Admin Console at any time to invalidate the credential without changes on the Prowler side.
-</Note>
-
-### Step 3: Launch the Scan
-
-1. Review the connection summary. Prowler Cloud runs a credential probe against the Okta Management API before saving — a failed probe surfaces the underlying Okta error (`invalid_scope`, `Forbidden`, invalid credentials, etc.) so the configuration can be corrected before the first scan.
-2. Choose the scan schedule: run a single scan or set up daily scans (every 24 hours).
-3. Click **Launch Scan** to start auditing the Okta organization.
-
 ---
 
 ## Prowler CLI
@@ -85,8 +44,8 @@ Follow the [Okta Authentication](/user-guide/providers/okta/authentication) guid
 export OKTA_ORG_DOMAIN="acme.okta.com"
 export OKTA_CLIENT_ID="0oa1234567890abcdef"
 export OKTA_PRIVATE_KEY_FILE="/secure/path/to/prowler-okta.pem"
-# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read"
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read"
+# Optional — defaults to "okta.policies.read,okta.brands.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read"
 ```
 
 The private key file may contain either a PEM-encoded RSA key or a JWK JSON document.
@@ -128,9 +87,6 @@ okta:
   # okta.signon_global_session_idle_timeout_15min
   # Defaults to 15 minutes per DISA STIG V-273186.
   okta_max_session_idle_minutes: 15
-  # okta.application_admin_console_session_idle_timeout_15min
-  # Defaults to 15 minutes per DISA STIG V-273187.
-  okta_admin_console_idle_timeout_max_minutes: 15
 ```
 
 To use a custom configuration:
@@ -143,10 +99,9 @@ prowler okta --config-file /path/to/config.yaml
 
 Prowler for Okta includes security checks across the following services:
 
-| Service         | Description                                                                                                                            |
-| --------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| **Sign-On**     | Global session policy controls (idle timeout, lifetime, rule priority and ordering)                                                    |
-| **Application** | Okta Admin Console sign-on settings plus Authentication Policy controls for Okta applications (session idle, MFA, phishing resistance, network zones) |
+| Service     | Description                                                                         |
+| ----------- | ----------------------------------------------------------------------------------- |
+| **Sign-On** | Global session policy controls (idle timeout, lifetime, rule priority and ordering) |
 
 ## Troubleshooting
 
@@ -158,11 +113,10 @@ This is stricter than simply finding the same timeout value somewhere else in th
 
 ### Default Scopes
 
-Prowler requests a fixed set of OAuth scopes on every token exchange. The defaults cover every bundled check across the Sign-On and Application services:
+Prowler requests a fixed set of OAuth scopes on every token exchange. The defaults cover the bundled signon checks:
 
 - `okta.policies.read`
 - `okta.brands.read`
-- `okta.apps.read`
 
 The service app must have these scopes granted in the **Okta API Scopes** tab. When the granted set is narrower than the requested set, the token request fails with an `invalid_scope` error and the scan stops at provider initialization.
 

mcp_server/CHANGELOG.md

@@ -2,15 +2,7 @@
 
 All notable changes to the **Prowler MCP Server** are documented in this file.
 
-## [0.7.2] (Prowler v5.28.1)
-
-### 🐞 Fixed
-
-- Preserve authorization header in HTTP mode [(#11366)](https://github.com/prowler-cloud/prowler/pull/11366)
-
----
-
-## [0.7.1] (Prowler v5.28.0)
+## [0.7.1] (Prowler UNRELEASED)
 
 ### 🔐 Security
 
@@ -52,8 +44,6 @@ All notable changes to the **Prowler MCP Server** are documented in this file.
 
 - Attack Path tool to get Neo4j DB schema [(#10321)](https://github.com/prowler-cloud/prowler/pull/10321)
 
----
-
 ## [0.4.0] (Prowler v5.19.0)
 
 ### 🚀 Added

mcp_server/prowler_mcp_server/prowler_app/utils/auth.py

@@ -5,7 +5,6 @@ from datetime import datetime
 from typing import Dict, Optional
 
 from fastmcp.server.dependencies import get_http_headers
-
 from prowler_mcp_server import __version__
 from prowler_mcp_server.lib.logger import logger
 
@@ -69,7 +68,7 @@ class ProwlerAppAuth:
     async def authenticate(self) -> str:
         """Authenticate and return token (API key for STDIO, API key or JWT for HTTP)."""
         if self.mode == "http":
-            headers = get_http_headers(include={"authorization"})
+            headers = get_http_headers()
             authorization_header = headers.get("authorization", None)
 
             if not authorization_header:

prowler/CHANGELOG.md

@@ -2,36 +2,10 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
-## [5.29.0] (Prowler UNRELEASED)
+## [5.28.0] (Prowler UNRELEASED)
 
 ### 🚀 Added
 
-- `application` service for Okta provider with `application_admin_console_session_idle_timeout_15min`, `application_admin_console_mfa_required`, `application_admin_console_phishing_resistant_authentication`, `application_dashboard_mfa_required`, `application_dashboard_phishing_resistant_authentication`, and `application_authentication_policy_network_zone_enforced` checks [(#11358)](https://github.com/prowler-cloud/prowler/pull/11358)
-- AWS AI Security Framework compliance for AWS provider [(#11353)](https://github.com/prowler-cloud/prowler/pull/11353)
-- `storage_account_public_network_access_disabled` check for Azure provider and remapped the Azure CIS "Public Network Access is Disabled" requirements to it [(#11334)](https://github.com/prowler-cloud/prowler/pull/11334)
-
-### 🐞 Fixed
-
-- ENS RD 311/2022 (AWS) compliance mapping: `vpc_different_regions` was uncorrectly mapped under the `mp.com.4` family (Network segregation). That check is now mapped to a new `op.cont.2.aws.vpc.1` requirement under the Continuity of Service control [(#11372)](https://github.com/prowler-cloud/prowler/pull/11372)
-- Compliance CSV row count now matches the UI per requirement by sourcing rows from the framework JSON's `requirement.Checks` instead of the stale `finding.compliance` snapshot [(#11370)](https://github.com/prowler-cloud/prowler/pull/11370)
-
----
-
-## [5.28.1] (Prowler 5.28.1)
-
-### 🐞 Fixed
-
-- `compute_project_os_login_enabled` and `compute_project_os_login_2fa_enabled` checks for GCP provider no longer false-FAIL on projects where the `enable-oslogin` / `enable-oslogin-2fa` metadata is not set explicitly but is inherited automatically from the `constraints/compute.requireOsLogin` org policy. The policy controller writes the inherited value in lowercase (`"true"`), but the service-layer parser compared it to the uppercase string literal `"TRUE"`. Comparison is now case-insensitive [(#11341)](https://github.com/prowler-cloud/prowler/pull/11341)
-- `storage_smb_channel_encryption_with_secure_algorithm` check for Azure provider no longer passes when a storage account allows a weak SMB channel encryption algorithm (e.g. `AES-128-CCM`/`AES-128-GCM`) alongside `AES-256-GCM`; it now requires every enabled algorithm to be in the recommended list, configurable via `azure.recommended_smb_channel_encryption_algorithms` (defaults to `AES-256-GCM` only, as required by CIS) [(#11327)](https://github.com/prowler-cloud/prowler/pull/11327)
-- Azure and M365 providers crashing with `RuntimeError: There is no current event loop` on Python 3.12 when called from threads without an active event loop (e.g. Celery workers) [(#11360)](https://github.com/prowler-cloud/prowler/pull/11360)
-
----
-
-## [5.28.0] (Prowler v5.28.0)
-
-### 🚀 Added
-
-- Sites, Additional Google services, and Marketplace checks for Google Workspace provider using the Cloud Identity Policy API [(#11281)](https://github.com/prowler-cloud/prowler/pull/11281)
 - `entra_app_registration_client_secret_unused` check for M365 provider [(#11232)](https://github.com/prowler-cloud/prowler/pull/11232)
 - `cloudsql_instance_cmek_encryption_enabled` check for GCP provider [(#11023)](https://github.com/prowler-cloud/prowler/pull/11023)
 - Google Workspace Groups service with 3 new checks [(#11186)](https://github.com/prowler-cloud/prowler/pull/11186)
@@ -42,12 +16,6 @@ All notable changes to the **Prowler SDK** are documented in this file.
 ### 🔄 Changed
 
 - `OktaProvider.test_connection` accepts an optional `provider_id` (org domain) and raises `OktaInvalidProviderIdError` (14007) when it doesn't match the authenticated org — guards against stored UID drifting from the credentials' org [(#11184)](https://github.com/prowler-cloud/prowler/pull/11184)
-- Use single-quoted strings for credential variables in the M365 provider PowerShell session, following PowerShell best practices for literal values [(#9997)](https://github.com/prowler-cloud/prowler/pull/9997)
-
-### 🐞 Fixed
-
-- OCI Audit service configuration lookup when the configured region differs from the tenancy home region [(#10347)](https://github.com/prowler-cloud/prowler/pull/10347)
-- Container image now uses an absolute `ENTRYPOINT` (`/home/prowler/.venv/bin/prowler`) so it works under any runtime `--workdir`. The relative entrypoint was breaking the official GitHub Action (`prowler-cloud/prowler@v5.27.0`) and any `docker run` with a custom `-w` [(#11313)](https://github.com/prowler-cloud/prowler/pull/11313)
 
 ---
 

prowler/compliance/aws/ens_rd2022_aws.json

@@ -2539,7 +2539,8 @@
         }
       ],
       "Checks": [
-        "vpc_subnet_separate_private_public"
+        "vpc_subnet_separate_private_public",
+        "vpc_different_regions"
       ]
     },
     {
@@ -2592,8 +2593,8 @@
         }
       ],
       "Checks": [
-        "vpc_different_regions",
-        "vpc_subnet_different_az"
+        "vpc_subnet_different_az",
+        "vpc_different_regions"
       ]
     },
     {
@@ -4261,29 +4262,6 @@
       ],
       "Checks": []
     },
-    {
-      "Id": "op.cont.2.aws.vpc.1",
-      "Description": "Plan de continuidad",
-      "Attributes": [
-        {
-          "IdGrupoControl": "op.cont.2",
-          "Marco": "operacional",
-          "Categoria": "continuidad del servicio",
-          "DescripcionControl": "Distribución de las VPCs entre múltiples regiones y zonas de disponibilidad de AWS para garantizar la continuidad del servicio ante fallos regionales o zonales.",
-          "Nivel": "alto",
-          "Tipo": "requisito",
-          "Dimensiones": [
-            "disponibilidad"
-          ],
-          "ModoEjecucion": "automático",
-          "Dependencias": []
-        }
-      ],
-      "Checks": [
-        "vpc_different_regions",
-        "vpc_subnet_different_az"
-      ]
-    },
     {
       "Id": "op.cont.3.aws.drs.1",
       "Description": "Pruebas periódicas",

prowler/compliance/azure/cis_2.1_azure.json

@@ -1383,7 +1383,7 @@
       "Id": "3.7",
       "Description": "Ensure that 'Public Network Access' is `Disabled' for storage accounts",
       "Checks": [
-        "storage_account_public_network_access_disabled"
+        "storage_blob_public_access_level_is_disabled"
       ],
       "Attributes": [
         {

prowler/compliance/azure/cis_3.0_azure.json

@@ -1651,7 +1651,7 @@
       "Id": "4.6",
       "Description": "Ensure that 'Public Network Access' is 'Disabled' for storage accounts",
       "Checks": [
-        "storage_account_public_network_access_disabled"
+        "storage_blob_public_access_level_is_disabled"
       ],
       "Attributes": [
         {

prowler/compliance/azure/cis_4.0_azure.json

@@ -3021,7 +3021,7 @@
       "Id": "10.3.2.2",
       "Description": "Ensure that 'Public Network Access' is 'Disabled' for storage accounts",
       "Checks": [
-        "storage_account_public_network_access_disabled"
+        "storage_blob_public_access_level_is_disabled"
       ],
       "Attributes": [
         {

prowler/compliance/azure/cis_5.0_azure.json

@@ -3182,7 +3182,7 @@
       "Id": "9.3.2.2",
       "Description": "Ensure that 'Public Network Access' is 'Disabled' for storage accounts",
       "Checks": [
-        "storage_account_public_network_access_disabled"
+        "storage_blob_public_access_level_is_disabled"
       ],
       "Attributes": [
         {

prowler/compliance/azure/prowler_threatscore_azure.json

@@ -459,7 +459,7 @@
       "Id": "2.2.6",
       "Description": "Ensure that 'Public Network Access' is 'Disabled' for storage accounts",
       "Checks": [
-        "storage_account_public_network_access_disabled"
+        "storage_blob_public_access_level_is_disabled"
       ],
       "Attributes": [
         {

prowler/compliance/googleworkspace/cis_1.3_googleworkspace.json

@@ -1291,9 +1291,7 @@
     {
       "Id": "3.1.7.1",
       "Description": "Ensure service status for Google Sites is set to off",
-      "Checks": [
-        "sites_service_disabled"
-      ],
+      "Checks": [],
       "Attributes": [
         {
           "Section": "3 Apps",
@@ -1314,9 +1312,7 @@
     {
       "Id": "3.1.8.1",
       "Description": "Ensure access to external Google Groups is OFF for Everyone",
-      "Checks": [
-        "additionalservices_external_groups_disabled"
-      ],
+      "Checks": [],
       "Attributes": [
         {
           "Section": "3 Apps",
@@ -1337,9 +1333,7 @@
     {
       "Id": "3.1.9.1.1",
       "Description": "Ensure users access to Google Workspace Marketplace apps is restricted",
-      "Checks": [
-        "marketplace_apps_access_restricted"
-      ],
+      "Checks": [],
       "Attributes": [
         {
           "Section": "3 Apps",

prowler/compliance/googleworkspace/cisa_scuba_0.6_googleworkspace.json

@@ -374,9 +374,7 @@
     {
       "Id": "GWS.COMMONCONTROLS.11.1",
       "Description": "Only approved Marketplace apps SHALL be allowed for installation",
-      "Checks": [
-        "marketplace_apps_access_restricted"
-      ],
+      "Checks": [],
       "Attributes": [
         {
           "Section": "Common Controls",
@@ -1716,9 +1714,7 @@
     {
       "Id": "GWS.SITES.1.1",
       "Description": "Sites Service SHOULD be disabled for all users",
-      "Checks": [
-        "sites_service_disabled"
-      ],
+      "Checks": [],
       "Attributes": [
         {
           "Section": "Sites",

prowler/config/config.py

@@ -48,7 +48,7 @@ class _MutableTimestamp:
 
 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.29.0"
+prowler_version = "5.28.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"

prowler/config/config.yaml

@@ -467,18 +467,6 @@ azure:
       "1.3",
     ]
 
-  # Azure Storage
-  # azure.storage_smb_channel_encryption_with_secure_algorithm
-  # List of SMB channel encryption algorithms allowed on file shares. A storage
-  # account passes only if every enabled algorithm is in this list. Defaults to
-  # the value required by CIS (AES-256-GCM only, excluding weaker AES-128 ciphers).
-  recommended_smb_channel_encryption_algorithms:
-    [
-      "AES-256-GCM",
-      # "AES-128-CCM",
-      # "AES-128-GCM",
-    ]
-
   # Azure Virtual Machines
   # azure.vm_desired_sku_size
   # List of desired VM SKU sizes that are allowed in the organization
@@ -669,9 +657,3 @@ okta:
   # 15 per DISA STIG V-273186 (OKTA-APP-000020); raise it only with an
   # explicit risk acceptance.
   okta_max_session_idle_minutes: 15
-  # Okta Applications
-  # okta.application_admin_console_session_idle_timeout_15min
-  # Maximum acceptable Okta Admin Console app idle timeout, in minutes.
-  # Defaults to 15 per DISA STIG V-273187 (OKTA-APP-000025); raise it only
-  # with an explicit risk acceptance.
-  okta_admin_console_idle_timeout_max_minutes: 15

prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_aws.py

@@ -37,9 +37,9 @@ class ASDEssentialEightAWS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = ASDEssentialEightAWSModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/aws_well_architected/aws_well_architected.py

@@ -37,9 +37,10 @@ class AWSWellArchitected(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AWSWellArchitectedModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/c5/c5_aws.py

@@ -35,9 +35,10 @@ class AWSC5(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AWSC5Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/c5/c5_azure.py

@@ -35,9 +35,10 @@ class AzureC5(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AzureC5Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/c5/c5_gcp.py

@@ -35,9 +35,10 @@ class GCPC5(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GCPC5Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/ccc/ccc_aws.py

@@ -35,9 +35,10 @@ class CCC_AWS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = CCC_AWSModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/ccc/ccc_azure.py

@@ -35,9 +35,10 @@ class CCC_Azure(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = CCC_AzureModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/ccc/ccc_gcp.py

@@ -35,9 +35,10 @@ class CCC_GCP(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = CCC_GCPModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_alibabacloud.py

@@ -35,9 +35,10 @@ class AlibabaCloudCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AlibabaCloudCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_aws.py

@@ -35,9 +35,10 @@ class AWSCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AWSCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_azure.py

@@ -35,9 +35,10 @@ class AzureCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AzureCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_gcp.py

@@ -35,9 +35,10 @@ class GCPCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GCPCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_github.py

@@ -35,9 +35,10 @@ class GithubCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GithubCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_googleworkspace.py

@@ -35,9 +35,10 @@ class GoogleWorkspaceCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GoogleWorkspaceCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_kubernetes.py

@@ -35,9 +35,10 @@ class KubernetesCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = KubernetesCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_m365.py

@@ -35,9 +35,10 @@ class M365CIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = M365CISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cis/cis_oraclecloud.py

@@ -35,9 +35,10 @@ class OracleCloudCIS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = OracleCloudCISModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/cisa_scuba/cisa_scuba_googleworkspace.py

@@ -37,9 +37,10 @@ class GoogleWorkspaceCISASCuBA(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GoogleWorkspaceCISASCuBAModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/csa/csa_alibabacloud.py

@@ -35,9 +35,10 @@ class AlibabaCloudCSA(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AlibabaCloudCSAModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/csa/csa_aws.py

@@ -35,9 +35,10 @@ class AWSCSA(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AWSCSAModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/csa/csa_azure.py

@@ -35,9 +35,10 @@ class AzureCSA(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AzureCSAModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/csa/csa_gcp.py

@@ -35,9 +35,10 @@ class GCPCSA(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GCPCSAModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/csa/csa_oraclecloud.py

@@ -35,9 +35,10 @@ class OracleCloudCSA(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = OracleCloudCSAModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/ens/ens_aws.py

@@ -35,9 +35,10 @@ class AWSENS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AWSENSModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/ens/ens_azure.py

@@ -35,9 +35,10 @@ class AzureENS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AzureENSModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/ens/ens_gcp.py

@@ -35,9 +35,10 @@ class GCPENS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GCPENSModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/generic/generic.py

@@ -35,9 +35,10 @@ class GenericCompliance(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GenericComplianceModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/iso27001/iso27001_aws.py

@@ -35,9 +35,10 @@ class AWSISO27001(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AWSISO27001Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/iso27001/iso27001_azure.py

@@ -35,9 +35,10 @@ class AzureISO27001(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AzureISO27001Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/iso27001/iso27001_gcp.py

@@ -35,9 +35,10 @@ class GCPISO27001(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = GCPISO27001Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/iso27001/iso27001_kubernetes.py

@@ -35,9 +35,10 @@ class KubernetesISO27001(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = KubernetesISO27001Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/iso27001/iso27001_m365.py

@@ -35,9 +35,9 @@ class M365ISO27001(ComplianceOutput):
             - None
         """
         for finding in findings:
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = M365ISO27001Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/iso27001/iso27001_nhn.py

@@ -35,9 +35,9 @@ class NHNISO27001(ComplianceOutput):
             - None
         """
         for finding in findings:
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = NHNISO27001Model(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py

@@ -35,9 +35,10 @@ class AWSKISAISMSP(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = AWSKISAISMSPModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/mitre_attack/mitre_attack_aws.py

@@ -36,9 +36,10 @@ class AWSMitreAttack(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     compliance_row = AWSMitreAttackModel(
                         Provider=finding.provider,
                         Description=compliance.Description,

prowler/lib/outputs/compliance/mitre_attack/mitre_attack_azure.py

@@ -36,9 +36,10 @@ class AzureMitreAttack(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     compliance_row = AzureMitreAttackModel(
                         Provider=finding.provider,
                         Description=compliance.Description,

prowler/lib/outputs/compliance/mitre_attack/mitre_attack_gcp.py

@@ -36,9 +36,10 @@ class GCPMitreAttack(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     compliance_row = GCPMitreAttackModel(
                         Provider=finding.provider,
                         Description=compliance.Description,

prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_alibaba.py

@@ -37,9 +37,10 @@ class ProwlerThreatScoreAlibaba(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = ProwlerThreatScoreAlibabaModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws.py

@@ -37,9 +37,10 @@ class ProwlerThreatScoreAWS(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = ProwlerThreatScoreAWSModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure.py

@@ -37,9 +37,10 @@ class ProwlerThreatScoreAzure(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = ProwlerThreatScoreAzureModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp.py

@@ -37,9 +37,10 @@ class ProwlerThreatScoreGCP(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = ProwlerThreatScoreGCPModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_kubernetes.py

@@ -37,9 +37,10 @@ class ProwlerThreatScoreKubernetes(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = ProwlerThreatScoreKubernetesModel(
                             Provider=finding.provider,

prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365.py

@@ -37,9 +37,10 @@ class ProwlerThreatScoreM365(ComplianceOutput):
             - None
         """
         for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
             for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
+                if requirement.Id in finding_requirements:
                     for attribute in requirement.Attributes:
                         compliance_row = ProwlerThreatScoreM365Model(
                             Provider=finding.provider,

prowler/providers/aws/aws_regions_by_service.json

@@ -482,7 +482,6 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
           "eu-central-1",
@@ -507,9 +506,7 @@
           "cn-north-1",
           "cn-northwest-1"
         ],
-        "aws-eusc": [
-          "eusc-de-east-1"
-        ],
+        "aws-eusc": [],
         "aws-us-gov": [
           "us-gov-east-1",
           "us-gov-west-1"
@@ -1234,21 +1231,6 @@
         "aws-us-gov": []
       }
     },
-    "aws-devops-agent": {
-      "regions": {
-        "aws": [
-          "ap-northeast-1",
-          "ap-southeast-2",
-          "eu-central-1",
-          "eu-west-1",
-          "us-east-1",
-          "us-west-2"
-        ],
-        "aws-cn": [],
-        "aws-eusc": [],
-        "aws-us-gov": []
-      }
-    },
     "awshealthdashboard": {
       "regions": {
         "aws": [
@@ -1608,7 +1590,6 @@
           "ap-southeast-2",
           "ca-central-1",
           "eu-central-1",
-          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "us-east-1",
@@ -2212,7 +2193,6 @@
           "ap-southeast-2",
           "ap-southeast-3",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -2275,8 +2255,6 @@
           "ap-southeast-2",
           "ap-southeast-3",
           "ap-southeast-4",
-          "ap-southeast-5",
-          "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
           "eu-central-1",
@@ -2466,9 +2444,6 @@
           "ap-southeast-2",
           "ap-southeast-3",
           "ap-southeast-4",
-          "ap-southeast-5",
-          "ap-southeast-6",
-          "ap-southeast-7",
           "ca-central-1",
           "eu-central-1",
           "eu-central-2",
@@ -2614,9 +2589,7 @@
           "cn-north-1",
           "cn-northwest-1"
         ],
-        "aws-eusc": [
-          "eusc-de-east-1"
-        ],
+        "aws-eusc": [],
         "aws-us-gov": [
           "us-gov-east-1",
           "us-gov-west-1"
@@ -2823,7 +2796,6 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
-          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -2834,7 +2806,6 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -3796,7 +3767,6 @@
           "ap-southeast-5",
           "ap-southeast-7",
           "ca-central-1",
-          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -3859,9 +3829,7 @@
           "us-west-2"
         ],
         "aws-cn": [],
-        "aws-eusc": [
-          "eusc-de-east-1"
-        ],
+        "aws-eusc": [],
         "aws-us-gov": [
           "us-gov-east-1",
           "us-gov-west-1"
@@ -3922,22 +3890,17 @@
     "dsql": {
       "regions": {
         "aws": [
-          "ap-east-1",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
-          "ap-south-1",
-          "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-4",
           "ca-central-1",
           "ca-west-1",
           "eu-central-1",
-          "eu-north-1",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
-          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -4718,19 +4681,15 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
-          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
-          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
-          "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
           "eu-central-1",
@@ -4744,7 +4703,6 @@
           "il-central-1",
           "me-central-1",
           "me-south-1",
-          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -5302,7 +5260,6 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -5353,7 +5310,6 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -5404,7 +5360,6 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -5455,7 +5410,6 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -5506,7 +5460,6 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -6081,7 +6034,6 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
-          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -6129,7 +6081,6 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
-          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -7730,8 +7681,6 @@
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
-          "ap-southeast-5",
-          "ap-southeast-7",
           "ca-central-1",
           "eu-central-1",
           "eu-north-1",
@@ -8116,7 +8065,6 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
-          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -8127,10 +8075,8 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
-          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -8142,7 +8088,6 @@
           "il-central-1",
           "me-central-1",
           "me-south-1",
-          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -8334,31 +8279,22 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
-          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
-          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
-          "ap-southeast-3",
-          "ap-southeast-4",
           "ap-southeast-5",
-          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
-          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
-          "eu-south-1",
           "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
-          "il-central-1",
-          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -8379,7 +8315,6 @@
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
-          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
@@ -8639,7 +8574,6 @@
           "il-central-1",
           "me-central-1",
           "me-south-1",
-          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -8772,19 +8706,13 @@
         "aws": [
           "ap-northeast-1",
           "ap-northeast-2",
-          "ap-northeast-3",
           "ap-south-1",
           "ap-south-2",
           "ap-southeast-2",
-          "ap-southeast-4",
           "ca-central-1",
           "eu-central-1",
-          "eu-central-2",
-          "eu-south-1",
-          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
-          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -9106,7 +9034,6 @@
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
-          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -9209,14 +9136,11 @@
       "regions": {
         "aws": [
           "ap-northeast-1",
-          "ap-northeast-3",
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
           "eu-central-1",
           "eu-north-1",
-          "eu-south-1",
-          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
@@ -9453,7 +9377,6 @@
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-5",
-          "ap-southeast-7",
           "ca-central-1",
           "eu-central-1",
           "eu-central-2",
@@ -9472,9 +9395,7 @@
         "aws-cn": [
           "cn-northwest-1"
         ],
-        "aws-eusc": [
-          "eusc-de-east-1"
-        ],
+        "aws-eusc": [],
         "aws-us-gov": [
           "us-gov-west-1"
         ]
@@ -9944,12 +9865,10 @@
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
-          "ap-southeast-4",
           "ap-southeast-5",
           "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
-          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -10093,10 +10012,7 @@
         ],
         "aws-cn": [],
         "aws-eusc": [],
-        "aws-us-gov": [
-          "us-gov-east-1",
-          "us-gov-west-1"
-        ]
+        "aws-us-gov": []
       }
     },
     "resource-groups": {
@@ -10777,10 +10693,7 @@
           "us-west-1",
           "us-west-2"
         ],
-        "aws-cn": [
-          "cn-north-1",
-          "cn-northwest-1"
-        ],
+        "aws-cn": [],
         "aws-eusc": [],
         "aws-us-gov": []
       }
@@ -11402,9 +11315,7 @@
           "ap-southeast-2",
           "ap-southeast-3",
           "ap-southeast-4",
-          "ap-southeast-6",
           "ca-central-1",
-          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -11736,6 +11647,26 @@
         ]
       }
     },
+    "simspaceweaver": {
+      "regions": {
+        "aws": [
+          "ap-southeast-1",
+          "ap-southeast-2",
+          "eu-central-1",
+          "eu-north-1",
+          "eu-west-1",
+          "us-east-1",
+          "us-east-2",
+          "us-west-2"
+        ],
+        "aws-cn": [],
+        "aws-eusc": [],
+        "aws-us-gov": [
+          "us-gov-east-1",
+          "us-gov-west-1"
+        ]
+      }
+    },
     "sms": {
       "regions": {
         "aws": [
@@ -13132,7 +13063,6 @@
           "eu-west-3",
           "me-central-1",
           "me-south-1",
-          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -13484,7 +13414,6 @@
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
-          "ap-southeast-5",
           "ca-central-1",
           "eu-central-1",
           "eu-west-1",
@@ -13493,7 +13422,6 @@
           "il-central-1",
           "sa-east-1",
           "us-east-1",
-          "us-east-2",
           "us-west-2"
         ],
         "aws-cn": [

prowler/providers/azure/azure_provider.py

@@ -949,7 +949,7 @@ class AzureProvider(Provider):
                             f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
                         )
 
-            asyncio.run(get_azure_identity())
+            asyncio.get_event_loop().run_until_complete(get_azure_identity())
 
         # Managed identities only can be assigned resource, resource group and subscription scope permissions
         elif managed_identity_auth:

prowler/providers/azure/services/storage/storage_account_public_network_access_disabled/storage_account_public_network_access_disabled.metadata.json

@@ -1,37 +0,0 @@
-{
-  "Provider": "azure",
-  "CheckID": "storage_account_public_network_access_disabled",
-  "CheckTitle": "Storage account has 'Public Network Access' disabled",
-  "CheckType": [],
-  "ServiceName": "storage",
-  "SubServiceName": "",
-  "ResourceIdTemplate": "",
-  "Severity": "high",
-  "ResourceType": "microsoft.storage/storageaccounts",
-  "ResourceGroup": "storage",
-  "Description": "**Azure Storage accounts** with **public network access** disabled cannot be reached from public networks. Setting `publicNetworkAccess` to `Disabled` overrides the public access settings of individual containers and forces access through private endpoints or trusted services. This is independent from the 'Allow Blob Anonymous Access' setting.",
-  "Risk": "Leaving **public network access** enabled exposes the storage account endpoints to the **public Internet**, widening the attack surface and undermining **defense in depth**.\n\nThis increases the risk of **unauthorized access**, **data exfiltration**, and reconnaissance against the account, especially when combined with weak network rules or overly permissive access policies.",
-  "RelatedUrl": "",
-  "AdditionalURLs": [
-    "https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#change-the-default-network-access-rule",
-    "https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-set-default-access"
-  ],
-  "Remediation": {
-    "Code": {
-      "CLI": "az storage account update --name <storage-account> --resource-group <resource-group> --public-network-access Disabled",
-      "NativeIaC": "```bicep\n// Storage account with public network access disabled\nresource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'StorageV2'\n  sku: { name: 'Standard_LRS' }\n  properties: {\n    publicNetworkAccess: 'Disabled' // Critical: disables public network access to the account\n  }\n}\n```",
-      "Other": "1. In the Azure portal, go to Storage accounts and select the target account\n2. Under Security + networking, click Networking\n3. Set Public network access to Disabled\n4. Click Save",
-      "Terraform": "```hcl\nresource \"azurerm_storage_account\" \"<example_resource_name>\" {\n  name                          = \"<example_resource_name>\"\n  resource_group_name           = \"<example_resource_name>\"\n  location                      = \"<example_location>\"\n  account_tier                  = \"Standard\"\n  account_replication_type      = \"LRS\"\n  public_network_access_enabled = false # Critical: disables public network access\n}\n```"
-    },
-    "Recommendation": {
-      "Text": "Disable **public network access** on the storage account and reach it through **private endpoints** or trusted Azure services only. Combine this with **least privilege** RBAC, short-lived `SAS` tokens, and network restrictions. Validate client connectivity before disabling public access in production.",
-      "Url": "https://hub.prowler.com/check/storage_account_public_network_access_disabled"
-    }
-  },
-  "Categories": [
-    "internet-exposed"
-  ],
-  "DependsOn": [],
-  "RelatedTo": [],
-  "Notes": "This check evaluates the storage account publicNetworkAccess property. It is independent from the 'Allow Blob Anonymous Access' setting evaluated by storage_blob_public_access_level_is_disabled."
-}

prowler/providers/azure/services/storage/storage_account_public_network_access_disabled/storage_account_public_network_access_disabled.py

@@ -1,38 +0,0 @@
-from prowler.lib.check.models import Check, Check_Report_Azure
-from prowler.providers.azure.services.storage.storage_client import storage_client
-
-
-class storage_account_public_network_access_disabled(Check):
-    """
-    Ensure that 'Public Network Access' is 'Disabled' for storage accounts.
-
-    This check evaluates the storage account's publicNetworkAccess property, which controls
-    whether the account is reachable from public networks. It is independent from the
-    'Allow Blob Anonymous Access' setting (covered by
-    storage_blob_public_access_level_is_disabled).
-    - PASS: The storage account has public network access disabled.
-    - FAIL: The storage account has public network access enabled (or unset, which Azure treats as enabled).
-    """
-
-    def execute(self) -> list[Check_Report_Azure]:
-        findings = []
-        for subscription, storage_accounts in storage_client.storage_accounts.items():
-            subscription_name = storage_client.subscriptions.get(
-                subscription, subscription
-            )
-            for storage_account in storage_accounts:
-                report = Check_Report_Azure(
-                    metadata=self.metadata(), resource=storage_account
-                )
-                report.subscription = subscription
-
-                if storage_account.public_network_access == "Disabled":
-                    report.status = "PASS"
-                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has public network access disabled."
-                else:
-                    report.status = "FAIL"
-                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has public network access enabled."
-
-                findings.append(report)
-
-        return findings

prowler/providers/azure/services/storage/storage_blob_public_access_level_is_disabled/storage_blob_public_access_level_is_disabled.metadata.json

@@ -1,7 +1,7 @@
 {
   "Provider": "azure",
   "CheckID": "storage_blob_public_access_level_is_disabled",
-  "CheckTitle": "Storage account has 'Allow Blob Anonymous Access' disabled",
+  "CheckTitle": "Storage account has 'Allow blob public access' disabled",
   "CheckType": [],
   "ServiceName": "storage",
   "SubServiceName": "",
@@ -9,7 +9,7 @@
   "Severity": "high",
   "ResourceType": "microsoft.storage/storageaccounts",
   "ResourceGroup": "storage",
-  "Description": "**Azure Storage accounts** with **blob anonymous (public) access** disabled prevent containers or blobs from being set to a public access level. Setting `allowBlobPublicAccess` to `false` enforces no anonymous reads across the account. This is independent from the account's 'Public Network Access' setting, which is evaluated by storage_account_public_network_access_disabled.",
+  "Description": "**Azure Storage accounts** with **blob public access** disabled prevent containers or blobs from being set to a public access level. Setting `allow blob public access` to `false` enforces no anonymous reads across the account.",
   "Risk": "Allowing public access permits unauthenticated users to read blob data or enumerate container contents when any container is made public, compromising confidentiality.\n\nExposed objects can be scraped at scale, enabling data exfiltration and intelligence gathering without audit attribution.",
   "RelatedUrl": "",
   "AdditionalURLs": [
@@ -33,5 +33,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": "This check evaluates the 'Allow Blob Anonymous Access' (allowBlobPublicAccess) setting. The account's 'Public Network Access' (publicNetworkAccess) setting is evaluated by storage_account_public_network_access_disabled."
+  "Notes": ""
 }

prowler/providers/azure/services/storage/storage_service.py

@@ -42,9 +42,6 @@ class Storage(AzureService):
                             enable_https_traffic_only=storage_account.enable_https_traffic_only,
                             infrastructure_encryption=storage_account.encryption.require_infrastructure_encryption,
                             allow_blob_public_access=storage_account.allow_blob_public_access,
-                            public_network_access=getattr(
-                                storage_account, "public_network_access", None
-                            ),
                             network_rule_set=NetworkRuleSet(
                                 bypass=getattr(
                                     storage_account.network_rule_set,
@@ -304,7 +301,6 @@ class Account(BaseModel):
     enable_https_traffic_only: bool
     infrastructure_encryption: Optional[bool] = None
     allow_blob_public_access: bool
-    public_network_access: Optional[str] = None
     network_rule_set: NetworkRuleSet
     encryption_type: str
     minimum_tls_version: str

prowler/providers/azure/services/storage/storage_smb_channel_encryption_with_secure_algorithm/storage_smb_channel_encryption_with_secure_algorithm.metadata.json

@@ -34,5 +34,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": "This check passes only if every SMB channel encryption algorithm allowed on the file shares is in the recommended list, which is configurable via azure.recommended_smb_channel_encryption_algorithms and defaults to AES-256-GCM only, as required by CIS."
+  "Notes": "This check passes if SMB channel encryption is set to a secure algorithm."
 }

prowler/providers/azure/services/storage/storage_smb_channel_encryption_with_secure_algorithm/storage_smb_channel_encryption_with_secure_algorithm.py

@@ -1,38 +1,32 @@
 from prowler.lib.check.models import Check, Check_Report_Azure
 from prowler.providers.azure.services.storage.storage_client import storage_client
 
-DEFAULT_SECURE_ENCRYPTION_ALGORITHMS = ["AES-256-GCM"]
+SECURE_ENCRYPTION_ALGORITHMS = ["AES-256-GCM"]
 
 
 class storage_smb_channel_encryption_with_secure_algorithm(Check):
     """
-    Ensure SMB channel encryption for file shares only allows secure algorithms (AES-256-GCM or higher by default).
-
-    The list of allowed algorithms is configurable via
-    azure.recommended_smb_channel_encryption_algorithms in the Prowler configuration file.
+    Ensure SMB channel encryption for file shares is set to the recommended algorithm (AES-256-GCM or higher).
 
     This check evaluates whether SMB file shares are configured to use only the recommended SMB channel encryption algorithms.
-    - PASS: Storage account only allows secure SMB channel encryption algorithms for file shares.
-    - FAIL: Storage account does not have SMB channel encryption enabled, or it allows at least one algorithm that is not in the recommended list.
+    - PASS: Storage account has the recommended SMB channel encryption (AES-256-GCM or higher) enabled for file shares.
+    - FAIL: Storage account does not have the recommended SMB channel encryption enabled for file shares or uses an unsupported algorithm.
     """
 
     def execute(self) -> list[Check_Report_Azure]:
         findings = []
-        secure_encryption_algorithms = storage_client.audit_config.get(
-            "recommended_smb_channel_encryption_algorithms",
-            DEFAULT_SECURE_ENCRYPTION_ALGORITHMS,
-        )
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             subscription_name = storage_client.subscriptions.get(
                 subscription, subscription
             )
             for account in storage_accounts:
                 if account.file_service_properties:
-                    channel_encryption = (
-                        account.file_service_properties.smb_protocol_settings.channel_encryption
-                    )
                     pretty_current_algorithms = (
-                        ", ".join(channel_encryption) if channel_encryption else "none"
+                        ", ".join(
+                            account.file_service_properties.smb_protocol_settings.channel_encryption
+                        )
+                        if account.file_service_properties.smb_protocol_settings.channel_encryption
+                        else "none"
                     )
                     report = Check_Report_Azure(
                         metadata=self.metadata(),
@@ -41,18 +35,20 @@ class storage_smb_channel_encryption_with_secure_algorithm(Check):
                     report.subscription = subscription
                     report.resource_name = account.name
 
-                    if not channel_encryption:
+                    if (
+                        not account.file_service_properties.smb_protocol_settings.channel_encryption
+                    ):
                         report.status = "FAIL"
                         report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) does not have SMB channel encryption enabled for file shares."
-                    elif all(
-                        algorithm in secure_encryption_algorithms
-                        for algorithm in channel_encryption
+                    elif any(
+                        algorithm in SECURE_ENCRYPTION_ALGORITHMS
+                        for algorithm in account.file_service_properties.smb_protocol_settings.channel_encryption
                     ):
                         report.status = "PASS"
-                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) only allows secure algorithms for SMB channel encryption on file shares since it supports {pretty_current_algorithms}."
+                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) has a secure algorithm for SMB channel encryption ({', '.join(SECURE_ENCRYPTION_ALGORITHMS)}) enabled for file shares since it supports {pretty_current_algorithms}."
                     else:
                         report.status = "FAIL"
-                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) allows insecure algorithms for SMB channel encryption on file shares since it supports {pretty_current_algorithms} and only {', '.join(secure_encryption_algorithms)} is recommended."
+                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) does not have SMB channel encryption with a secure algorithm for file shares since it supports {pretty_current_algorithms}."
 
                     findings.append(report)
         return findings

prowler/providers/gcp/services/compute/compute_service.py

@@ -87,15 +87,9 @@ class Compute(GCPService):
                     .execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
                 )
                 for item in response["commonInstanceMetadata"].get("items", []):
-                    if (
-                        item["key"] == "enable-oslogin"
-                        and item["value"].lower() == "true"
-                    ):
+                    if item["key"] == "enable-oslogin" and item["value"] == "TRUE":
                         enable_oslogin = True
-                    if (
-                        item["key"] == "enable-oslogin-2fa"
-                        and item["value"].lower() == "true"
-                    ):
+                    if item["key"] == "enable-oslogin-2fa" and item["value"] == "TRUE":
                         enable_oslogin_2fa = True
                 self.compute_projects.append(
                     Project(

prowler/providers/googleworkspace/services/additionalservices/additionalservices_client.py

@@ -1,6 +0,0 @@
-from prowler.providers.common.provider import Provider
-from prowler.providers.googleworkspace.services.additionalservices.additionalservices_service import (
-    AdditionalServices,
-)
-
-additionalservices_client = AdditionalServices(Provider.get_global_provider())

prowler/providers/googleworkspace/services/additionalservices/additionalservices_external_groups_disabled/additionalservices_external_groups_disabled.metadata.json

@@ -1,37 +0,0 @@
-{
-  "Provider": "googleworkspace",
-  "CheckID": "additionalservices_external_groups_disabled",
-  "CheckTitle": "Access to external Google Groups is off for everyone",
-  "CheckType": [],
-  "ServiceName": "additionalservices",
-  "SubServiceName": "",
-  "ResourceIdTemplate": "",
-  "Severity": "medium",
-  "ResourceType": "NotDefined",
-  "ResourceGroup": "collaboration",
-  "Description": "The Additional Google services configuration **disables access to external Google Groups** for all users. This setting controls whether users can access groups created outside the organization from their Google Workspace account.",
-  "Risk": "When external Google Groups access is enabled, users can access and participate in groups created **outside the organization**, potentially exposing them to **phishing, social engineering, or data leakage** through unmanaged external group communications.",
-  "RelatedUrl": "",
-  "AdditionalURLs": [
-    "https://support.google.com/a/answer/181865",
-    "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings"
-  ],
-  "Remediation": {
-    "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "1. Sign in to the Google **Admin console** at https://admin.google.com\n2. Navigate to **Apps** > **Google Workspace** > **Additional Google services**\n3. Scroll down to **Google Groups**\n4. Set it to **OFF for everyone**\n5. Click **Save**",
-      "Terraform": ""
-    },
-    "Recommendation": {
-      "Text": "Disable access to **external Google Groups** for all users. If specific users require access to external groups, enable it by exception for those users or groups only.",
-      "Url": "https://hub.prowler.com/check/additionalservices_external_groups_disabled"
-    }
-  },
-  "Categories": [
-    "trust-boundaries"
-  ],
-  "DependsOn": [],
-  "RelatedTo": [],
-  "Notes": "This check covers the 'Additional Google services > Google Groups' toggle, which is distinct from the 'Groups for Business' sharing settings covered by the groups service checks."
-}

prowler/providers/googleworkspace/services/additionalservices/additionalservices_external_groups_disabled/additionalservices_external_groups_disabled.py

@@ -1,55 +0,0 @@
-from typing import List
-
-from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
-from prowler.providers.googleworkspace.services.additionalservices.additionalservices_client import (
-    additionalservices_client,
-)
-
-
-class additionalservices_external_groups_disabled(Check):
-    """Check that access to external Google Groups is disabled for all users.
-
-    This check verifies that the domain-level Additional Google services policy
-    disables external Google Groups access, preventing users from accessing
-    groups created outside the organization.
-    """
-
-    def execute(self) -> List[CheckReportGoogleWorkspace]:
-        findings = []
-
-        if additionalservices_client.policies_fetched:
-            report = CheckReportGoogleWorkspace(
-                metadata=self.metadata(),
-                resource=additionalservices_client.policies,
-                resource_id="additionalServicesPolicies",
-                resource_name="Additional Services Policies",
-                customer_id=additionalservices_client.provider.identity.customer_id,
-            )
-
-            groups_state = additionalservices_client.policies.groups_service_state
-
-            if groups_state == "DISABLED":
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Access to external Google Groups is disabled "
-                    f"in domain {additionalservices_client.provider.identity.domain}."
-                )
-            else:
-                report.status = "FAIL"
-                if groups_state is None:
-                    report.status_extended = (
-                        f"Access to external Google Groups is not explicitly configured "
-                        f"in domain {additionalservices_client.provider.identity.domain}. "
-                        f"The default is ON for everyone. "
-                        f"External Google Groups access should be disabled."
-                    )
-                else:
-                    report.status_extended = (
-                        f"Access to external Google Groups is enabled "
-                        f"in domain {additionalservices_client.provider.identity.domain}. "
-                        f"External Google Groups access should be disabled."
-                    )
-
-            findings.append(report)
-
-        return findings

prowler/providers/googleworkspace/services/additionalservices/additionalservices_service.py

@@ -1,92 +0,0 @@
-from typing import Optional
-
-from pydantic import BaseModel
-
-from prowler.lib.logger import logger
-from prowler.providers.googleworkspace.lib.service.service import GoogleWorkspaceService
-
-
-class AdditionalServices(GoogleWorkspaceService):
-    """Google Workspace Additional Services for auditing domain-level service toggles.
-
-    Uses the Cloud Identity Policy API v1 to read the service status of
-    additional Google services configured in the Admin Console, such as
-    the external Google Groups access toggle.
-    """
-
-    def __init__(self, provider):
-        super().__init__(provider)
-        self.policies = AdditionalServicesPolicies()
-        self.policies_fetched = False
-        self._fetch_additional_services_policies()
-
-    def _fetch_additional_services_policies(self):
-        """Fetch Additional Services policies from the Cloud Identity Policy API v1."""
-        logger.info("Additional Services - Fetching policies...")
-
-        try:
-            service = self._build_service("cloudidentity", "v1")
-
-            if not service:
-                logger.error("Failed to build Cloud Identity service")
-                return
-
-            request = service.policies().list(
-                pageSize=100,
-                filter='setting.type.matches("groups.service_status")',
-            )
-            fetch_succeeded = True
-
-            while request is not None:
-                try:
-                    response = request.execute()
-
-                    for policy in response.get("policies", []):
-                        if not self._is_customer_level_policy(policy):
-                            continue
-
-                        setting = policy.get("setting", {})
-                        setting_type = setting.get("type", "").removeprefix("settings/")
-                        value = setting.get("value", {})
-
-                        if setting_type == "groups.service_status":
-                            self.policies.groups_service_state = value.get(
-                                "serviceState"
-                            )
-                            logger.debug(
-                                "Additional Services - Groups service state: "
-                                f"{self.policies.groups_service_state}"
-                            )
-
-                    request = service.policies().list_next(request, response)
-
-                except Exception as error:
-                    self._handle_api_error(
-                        error,
-                        "fetching Additional Services policies",
-                        self.provider.identity.customer_id,
-                    )
-                    fetch_succeeded = False
-                    break
-
-            self.policies_fetched = fetch_succeeded
-
-            logger.info(
-                f"Additional Services policies fetched - "
-                f"Groups service state: {self.policies.groups_service_state}"
-            )
-
-        except Exception as error:
-            self._handle_api_error(
-                error,
-                "fetching Additional Services policies",
-                self.provider.identity.customer_id,
-            )
-            self.policies_fetched = False
-
-
-class AdditionalServicesPolicies(BaseModel):
-    """Model for domain-level Additional Google Services policy settings."""
-
-    # groups.service_status
-    groups_service_state: Optional[str] = None

prowler/providers/googleworkspace/services/marketplace/marketplace_apps_access_restricted/marketplace_apps_access_restricted.metadata.json

@@ -1,37 +0,0 @@
-{
-  "Provider": "googleworkspace",
-  "CheckID": "marketplace_apps_access_restricted",
-  "CheckTitle": "Users access to Google Workspace Marketplace apps is restricted",
-  "CheckType": [],
-  "ServiceName": "marketplace",
-  "SubServiceName": "",
-  "ResourceIdTemplate": "",
-  "Severity": "medium",
-  "ResourceType": "NotDefined",
-  "ResourceGroup": "collaboration",
-  "Description": "The domain-wide Google Workspace Marketplace configuration **restricts which apps users can install**. Only admin-approved apps from the Marketplace allowlist are permitted, preventing users from installing unvetted third-party applications.",
-  "Risk": "Allowing unrestricted Marketplace app installation exposes the organization to **unvetted third-party applications** that may request broad OAuth scopes, potentially gaining access to **sensitive organizational data** including emails, documents, and calendar events without proper security review.",
-  "RelatedUrl": "",
-  "AdditionalURLs": [
-    "https://support.google.com/a/answer/6089179",
-    "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings"
-  ],
-  "Remediation": {
-    "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "1. Sign in to the Google **Admin console** at https://admin.google.com\n2. Navigate to **Apps** > **Google Workspace Marketplace apps**\n3. Click **Settings**\n4. Under **Manage Google Workspace Marketplace allowlist access**, select **Allow users to install and run only selected apps from the Marketplace**\n5. Click **Save**",
-      "Terraform": ""
-    },
-    "Recommendation": {
-      "Text": "Restrict **Marketplace app installation** to only **admin-approved apps** to prevent users from installing unvetted third-party applications that could access sensitive organizational data.",
-      "Url": "https://hub.prowler.com/check/marketplace_apps_access_restricted"
-    }
-  },
-  "Categories": [
-    "trust-boundaries"
-  ],
-  "DependsOn": [],
-  "RelatedTo": [],
-  "Notes": ""
-}

prowler/providers/googleworkspace/services/marketplace/marketplace_apps_access_restricted/marketplace_apps_access_restricted.py

@@ -1,61 +0,0 @@
-from typing import List
-
-from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
-from prowler.providers.googleworkspace.services.marketplace.marketplace_client import (
-    marketplace_client,
-)
-
-
-class marketplace_apps_access_restricted(Check):
-    """Check that Google Workspace Marketplace app installation is restricted.
-
-    This check verifies that the domain-level Marketplace policy restricts
-    which apps users can install, preventing unvetted third-party applications
-    from accessing organizational data.
-    """
-
-    def execute(self) -> List[CheckReportGoogleWorkspace]:
-        findings = []
-
-        if marketplace_client.policies_fetched:
-            report = CheckReportGoogleWorkspace(
-                metadata=self.metadata(),
-                resource=marketplace_client.policies,
-                resource_id="marketplacePolicies",
-                resource_name="Marketplace Policies",
-                customer_id=marketplace_client.provider.identity.customer_id,
-            )
-
-            access_level = marketplace_client.policies.access_level
-
-            if access_level == "ALLOW_LISTED_APPS":
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Marketplace app installation is restricted to admin-approved apps "
-                    f"in domain {marketplace_client.provider.identity.domain}."
-                )
-            elif access_level == "ALLOW_NONE":
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Marketplace app installation is fully blocked "
-                    f"in domain {marketplace_client.provider.identity.domain}."
-                )
-            else:
-                report.status = "FAIL"
-                if access_level is None:
-                    report.status_extended = (
-                        f"Marketplace app access is not explicitly configured "
-                        f"in domain {marketplace_client.provider.identity.domain}. "
-                        f"The default allows all apps. "
-                        f"App installation should be restricted to approved apps only."
-                    )
-                else:
-                    report.status_extended = (
-                        f"Marketplace allows users to install any app "
-                        f"in domain {marketplace_client.provider.identity.domain}. "
-                        f"App installation should be restricted to approved apps only."
-                    )
-
-            findings.append(report)
-
-        return findings

prowler/providers/googleworkspace/services/marketplace/marketplace_client.py

@@ -1,6 +0,0 @@
-from prowler.providers.common.provider import Provider
-from prowler.providers.googleworkspace.services.marketplace.marketplace_service import (
-    Marketplace,
-)
-
-marketplace_client = Marketplace(Provider.get_global_provider())

prowler/providers/googleworkspace/services/marketplace/marketplace_service.py

@@ -1,89 +0,0 @@
-from typing import Optional
-
-from pydantic import BaseModel
-
-from prowler.lib.logger import logger
-from prowler.providers.googleworkspace.lib.service.service import GoogleWorkspaceService
-
-
-class Marketplace(GoogleWorkspaceService):
-    """Google Workspace Marketplace service for auditing domain-level Marketplace policies.
-
-    Uses the Cloud Identity Policy API v1 to read the Marketplace app access
-    settings configured in the Admin Console.
-    """
-
-    def __init__(self, provider):
-        super().__init__(provider)
-        self.policies = MarketplacePolicies()
-        self.policies_fetched = False
-        self._fetch_marketplace_policies()
-
-    def _fetch_marketplace_policies(self):
-        """Fetch Marketplace policies from the Cloud Identity Policy API v1."""
-        logger.info("Marketplace - Fetching marketplace policies...")
-
-        try:
-            service = self._build_service("cloudidentity", "v1")
-
-            if not service:
-                logger.error("Failed to build Cloud Identity service")
-                return
-
-            request = service.policies().list(
-                pageSize=100,
-                filter='setting.type.matches("workspace_marketplace.*")',
-            )
-            fetch_succeeded = True
-
-            while request is not None:
-                try:
-                    response = request.execute()
-
-                    for policy in response.get("policies", []):
-                        if not self._is_customer_level_policy(policy):
-                            continue
-
-                        setting = policy.get("setting", {})
-                        setting_type = setting.get("type", "").removeprefix("settings/")
-                        value = setting.get("value", {})
-
-                        if setting_type == "workspace_marketplace.apps_access_options":
-                            self.policies.access_level = value.get("accessLevel")
-                            logger.debug(
-                                "Marketplace access level: "
-                                f"{self.policies.access_level}"
-                            )
-
-                    request = service.policies().list_next(request, response)
-
-                except Exception as error:
-                    self._handle_api_error(
-                        error,
-                        "fetching Marketplace policies",
-                        self.provider.identity.customer_id,
-                    )
-                    fetch_succeeded = False
-                    break
-
-            self.policies_fetched = fetch_succeeded
-
-            logger.info(
-                f"Marketplace policies fetched - "
-                f"Access level: {self.policies.access_level}"
-            )
-
-        except Exception as error:
-            self._handle_api_error(
-                error,
-                "fetching Marketplace policies",
-                self.provider.identity.customer_id,
-            )
-            self.policies_fetched = False
-
-
-class MarketplacePolicies(BaseModel):
-    """Model for domain-level Marketplace policy settings."""
-
-    # workspace_marketplace.apps_access_options
-    access_level: Optional[str] = None

prowler/providers/googleworkspace/services/sites/sites_client.py

@@ -1,6 +0,0 @@
-from prowler.providers.common.provider import Provider
-from prowler.providers.googleworkspace.services.sites.sites_service import (
-    Sites,
-)
-
-sites_client = Sites(Provider.get_global_provider())

prowler/providers/googleworkspace/services/sites/sites_service.py

@@ -1,88 +0,0 @@
-from typing import Optional
-
-from pydantic import BaseModel
-
-from prowler.lib.logger import logger
-from prowler.providers.googleworkspace.lib.service.service import GoogleWorkspaceService
-
-
-class Sites(GoogleWorkspaceService):
-    """Google Workspace Sites service for auditing domain-level Sites policies.
-
-    Uses the Cloud Identity Policy API v1 to read the Sites service status
-    configured in the Admin Console.
-    """
-
-    def __init__(self, provider):
-        super().__init__(provider)
-        self.policies = SitesPolicies()
-        self.policies_fetched = False
-        self._fetch_sites_policies()
-
-    def _fetch_sites_policies(self):
-        """Fetch Sites policies from the Cloud Identity Policy API v1."""
-        logger.info("Sites - Fetching sites policies...")
-
-        try:
-            service = self._build_service("cloudidentity", "v1")
-
-            if not service:
-                logger.error("Failed to build Cloud Identity service")
-                return
-
-            request = service.policies().list(
-                pageSize=100,
-                filter='setting.type.matches("sites.*")',
-            )
-            fetch_succeeded = True
-
-            while request is not None:
-                try:
-                    response = request.execute()
-
-                    for policy in response.get("policies", []):
-                        if not self._is_customer_level_policy(policy):
-                            continue
-
-                        setting = policy.get("setting", {})
-                        setting_type = setting.get("type", "").removeprefix("settings/")
-                        value = setting.get("value", {})
-
-                        if setting_type == "sites.service_status":
-                            self.policies.service_state = value.get("serviceState")
-                            logger.debug(
-                                "Sites service state: " f"{self.policies.service_state}"
-                            )
-
-                    request = service.policies().list_next(request, response)
-
-                except Exception as error:
-                    self._handle_api_error(
-                        error,
-                        "fetching Sites policies",
-                        self.provider.identity.customer_id,
-                    )
-                    fetch_succeeded = False
-                    break
-
-            self.policies_fetched = fetch_succeeded
-
-            logger.info(
-                f"Sites policies fetched - "
-                f"Service state: {self.policies.service_state}"
-            )
-
-        except Exception as error:
-            self._handle_api_error(
-                error,
-                "fetching Sites policies",
-                self.provider.identity.customer_id,
-            )
-            self.policies_fetched = False
-
-
-class SitesPolicies(BaseModel):
-    """Model for domain-level Sites policy settings."""
-
-    # sites.service_status
-    service_state: Optional[str] = None