mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 04:51:51 +00:00
Hugo Pereira Brito
807 lines
33 KiB
Python
807 lines
33 KiB
Python
from unittest.mock import MagicMock, patch
|
|
|
|
import pytest
|
|
|
|
from prowler.providers.oraclecloud.exceptions.exceptions import (
|
|
OCIAuthenticationError,
|
|
OCIInvalidConfigError,
|
|
OCISetUpSessionError,
|
|
)
|
|
from prowler.providers.oraclecloud.models import OCIIdentityInfo, OCIRegion, OCISession
|
|
from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider
|
|
|
|
|
|
class TestSetIdentityAuthenticationErrors:
|
|
"""Tests for authentication error handling in set_identity()"""
|
|
|
|
@pytest.fixture
|
|
def mock_session(self):
|
|
"""Create a mock OCI session."""
|
|
session = OCISession(
|
|
config={
|
|
"tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
|
|
"user": "ocid1.user.oc1..aaaaaaaexample",
|
|
"region": "us-ashburn-1",
|
|
"fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
|
|
},
|
|
signer=None,
|
|
profile="DEFAULT",
|
|
)
|
|
return session
|
|
|
|
def test_authentication_error_401_raises_exception(self, mock_session):
|
|
"""Test 401 error raises OCIAuthenticationError."""
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.side_effect = self._create_service_error(
|
|
401, "Authentication failed"
|
|
)
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
with pytest.raises(OCIAuthenticationError) as exc_info:
|
|
OraclecloudProvider.set_identity(mock_session)
|
|
|
|
assert "OCI credential validation failed" in str(exc_info.value)
|
|
|
|
def test_authentication_error_403_raises_exception(self, mock_session):
|
|
"""Test 403 error raises OCIAuthenticationError."""
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.side_effect = self._create_service_error(
|
|
403, "Forbidden access"
|
|
)
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
with pytest.raises(OCIAuthenticationError) as exc_info:
|
|
OraclecloudProvider.set_identity(mock_session)
|
|
|
|
assert "OCI credential validation failed" in str(exc_info.value)
|
|
|
|
def test_authentication_error_404_raises_exception(self, mock_session):
|
|
"""Test 404 error raises OCIAuthenticationError."""
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.side_effect = self._create_service_error(
|
|
404, "Resource not found"
|
|
)
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
with pytest.raises(OCIAuthenticationError) as exc_info:
|
|
OraclecloudProvider.set_identity(mock_session)
|
|
|
|
assert "OCI credential validation failed" in str(exc_info.value)
|
|
|
|
def test_service_error_500_raises_exception(self, mock_session):
|
|
"""Test 500 error raises OCIAuthenticationError (can't validate credentials)."""
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.side_effect = self._create_service_error(
|
|
500, "Internal server error"
|
|
)
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
with pytest.raises(OCIAuthenticationError) as exc_info:
|
|
OraclecloudProvider.set_identity(mock_session)
|
|
|
|
assert "OCI credential validation failed" in str(exc_info.value)
|
|
|
|
def test_invalid_private_key_raises_exception(self, mock_session):
|
|
"""Test InvalidPrivateKey exception raises OCIAuthenticationError."""
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
import oci
|
|
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.side_effect = (
|
|
oci.exceptions.InvalidPrivateKey("Invalid private key")
|
|
)
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
with pytest.raises(OCIAuthenticationError) as exc_info:
|
|
OraclecloudProvider.set_identity(mock_session)
|
|
|
|
assert "Invalid OCI private key format" in str(exc_info.value)
|
|
|
|
def test_generic_exception_raises_authentication_error(self, mock_session):
|
|
"""Test generic exception raises OCIAuthenticationError."""
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.side_effect = Exception("Unexpected error")
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
with pytest.raises(OCIAuthenticationError) as exc_info:
|
|
OraclecloudProvider.set_identity(mock_session)
|
|
|
|
assert "Failed to authenticate with OCI" in str(exc_info.value)
|
|
|
|
def test_successful_authentication(self, mock_session):
|
|
"""Test successful authentication returns identity info."""
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_tenancy = MagicMock()
|
|
mock_tenancy.name = "test-tenancy"
|
|
mock_response = MagicMock()
|
|
mock_response.data = mock_tenancy
|
|
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.return_value = mock_response
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
identity = OraclecloudProvider.set_identity(mock_session)
|
|
|
|
assert identity.tenancy_name == "test-tenancy"
|
|
assert identity.tenancy_id == "ocid1.tenancy.oc1..aaaaaaaexample"
|
|
assert identity.user_id == "ocid1.user.oc1..aaaaaaaexample"
|
|
assert identity.region == "us-ashburn-1"
|
|
|
|
@staticmethod
|
|
def _create_service_error(status, message):
|
|
"""Helper to create an OCI ServiceError."""
|
|
import oci
|
|
|
|
error = oci.exceptions.ServiceError(
|
|
status=status,
|
|
code="TestError",
|
|
headers={},
|
|
message=message,
|
|
)
|
|
return error
|
|
|
|
|
|
class TestTestConnectionKeyValidation:
|
|
"""Tests for key_content validation in test_connection()"""
|
|
|
|
def test_test_connection_invalid_base64_key_raises_error(self):
|
|
"""Test invalid base64 key content raises OCIInvalidConfigError."""
|
|
with pytest.raises(OCIInvalidConfigError) as exc_info:
|
|
OraclecloudProvider.test_connection(
|
|
oci_config_file=None,
|
|
profile=None,
|
|
key_content="not-valid-base64!!!",
|
|
user="ocid1.user.oc1..aaaaaaaexample",
|
|
fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
|
|
tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
region="us-ashburn-1",
|
|
)
|
|
|
|
assert "Failed to decode key_content" in str(exc_info.value)
|
|
|
|
def test_test_connection_valid_key_content_proceeds(self):
|
|
"""Test valid base64 key content proceeds to authentication."""
|
|
import base64
|
|
|
|
# The SDK will validate the actual key format during authentication
|
|
valid_key = """-----BEGIN RSA PRIVATE KEY-----
|
|
MIIEpQIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8n0sMcD/QHWCJ7yGSEtLN2T
|
|
...key content...
|
|
-----END RSA PRIVATE KEY-----"""
|
|
encoded_key = base64.b64encode(valid_key.encode("utf-8")).decode("utf-8")
|
|
|
|
with (
|
|
patch("oci.config.validate_config"),
|
|
patch("oci.identity.IdentityClient") as mock_identity_client,
|
|
):
|
|
mock_tenancy = MagicMock()
|
|
mock_tenancy.name = "test-tenancy"
|
|
mock_response = MagicMock()
|
|
mock_response.data = mock_tenancy
|
|
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.return_value = mock_response
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
connection = OraclecloudProvider.test_connection(
|
|
oci_config_file=None,
|
|
profile=None,
|
|
key_content=encoded_key,
|
|
user="ocid1.user.oc1..aaaaaaaexample",
|
|
fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
|
|
tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
region="us-ashburn-1",
|
|
raise_on_exception=False,
|
|
)
|
|
|
|
assert connection.is_connected is True
|
|
|
|
def test_test_connection_direct_credentials_without_region_uses_bootstrap_region(
|
|
self,
|
|
):
|
|
"""Direct API key auth should not fall back to config-file auth without a region."""
|
|
import base64
|
|
|
|
valid_key = (
|
|
"-----BEGIN RSA PRIVATE KEY-----\nfake\n-----END RSA PRIVATE KEY-----"
|
|
)
|
|
encoded_key = base64.b64encode(valid_key.encode("utf-8")).decode("utf-8")
|
|
|
|
with (
|
|
patch("oci.config.validate_config") as mock_validate_config,
|
|
patch("oci.identity.IdentityClient") as mock_identity_client,
|
|
):
|
|
mock_tenancy = MagicMock()
|
|
mock_tenancy.name = "test-tenancy"
|
|
mock_response = MagicMock()
|
|
mock_response.data = mock_tenancy
|
|
mock_client_instance = MagicMock()
|
|
mock_client_instance.get_tenancy.return_value = mock_response
|
|
mock_identity_client.return_value = mock_client_instance
|
|
|
|
connection = OraclecloudProvider.test_connection(
|
|
key_content=encoded_key,
|
|
user="ocid1.user.oc1..aaaaaaaexample",
|
|
fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
|
|
tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
raise_on_exception=False,
|
|
)
|
|
|
|
assert connection.is_connected is True
|
|
assert (
|
|
mock_validate_config.call_args.args[0]["region"]
|
|
== OraclecloudProvider._bootstrap_region
|
|
)
|
|
|
|
|
|
class TestTestConnectionRegionHandling:
|
|
"""Tests for region handling in test_connection()."""
|
|
|
|
def test_config_file_auth_without_region_preserves_session_region_for_identity(
|
|
self,
|
|
):
|
|
mock_session = OCISession(
|
|
config={
|
|
"tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
|
|
"user": "ocid1.user.oc1..aaaaaaaexample",
|
|
"region": "eu-frankfurt-1",
|
|
},
|
|
signer=None,
|
|
profile="DEFAULT",
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="eu-frankfurt-1",
|
|
profile="DEFAULT",
|
|
audited_regions={"eu-frankfurt-1"},
|
|
audited_compartments=[],
|
|
)
|
|
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
) as mock_set_identity,
|
|
):
|
|
connection = OraclecloudProvider.test_connection(
|
|
oci_config_file="/tmp/config",
|
|
profile="DEFAULT",
|
|
raise_on_exception=False,
|
|
)
|
|
|
|
assert connection.is_connected is True
|
|
mock_set_identity.assert_called_once_with(session=mock_session, region=None)
|
|
|
|
def test_instance_principal_auth_without_region_preserves_session_region_for_identity(
|
|
self,
|
|
):
|
|
mock_signer = MagicMock()
|
|
mock_session = OCISession(
|
|
config={
|
|
"tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
|
|
"region": "uk-london-1",
|
|
},
|
|
signer=mock_signer,
|
|
profile=None,
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="instance-principal",
|
|
region="uk-london-1",
|
|
profile=None,
|
|
audited_regions={"uk-london-1"},
|
|
audited_compartments=[],
|
|
)
|
|
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
) as mock_set_identity,
|
|
):
|
|
connection = OraclecloudProvider.test_connection(
|
|
use_instance_principal=True,
|
|
raise_on_exception=False,
|
|
)
|
|
|
|
assert connection.is_connected is True
|
|
mock_set_identity.assert_called_once_with(session=mock_session, region=None)
|
|
|
|
|
|
class TestOraclecloudProviderInit:
|
|
"""Tests for OraclecloudProvider initialization"""
|
|
|
|
def test_init_with_region_set_populates_provider_state(self):
|
|
mock_session = OCISession(
|
|
config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="us-ashburn-1",
|
|
profile="DEFAULT",
|
|
audited_regions=set(),
|
|
audited_compartments=[],
|
|
)
|
|
mock_regions = [
|
|
OCIRegion(key="us-phoenix-1", name="us-phoenix-1", is_home_region=False),
|
|
OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
|
|
]
|
|
mock_compartments = ["ocid1.compartment.oc1..aaaaaaaexample"]
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
) as mock_setup_session,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
|
|
return_value=mock_regions,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=mock_compartments,
|
|
),
|
|
patch(
|
|
"prowler.providers.common.provider.Provider.set_global_provider"
|
|
) as mock_set_global,
|
|
):
|
|
provider = OraclecloudProvider(
|
|
region={"us-ashburn-1"},
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
assert mock_setup_session.call_args.kwargs["region"] == "us-ashburn-1"
|
|
assert provider.session == mock_session
|
|
assert provider.identity == mock_identity
|
|
assert provider.regions == mock_regions
|
|
assert provider.compartments == mock_compartments
|
|
assert provider.home_region == "us-ashburn-1"
|
|
mock_set_global.assert_called_once_with(provider)
|
|
|
|
def test_init_with_multiple_regions_does_not_use_legacy_single_region_fallback(
|
|
self,
|
|
):
|
|
mock_session = OCISession(
|
|
config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="us-ashburn-1",
|
|
profile="DEFAULT",
|
|
audited_regions=set(),
|
|
audited_compartments=[],
|
|
)
|
|
audited_regions = [
|
|
OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
|
|
OCIRegion(key="us-phoenix-1", name="us-phoenix-1", is_home_region=False),
|
|
]
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
) as mock_setup_session,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
) as mock_set_identity,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
|
|
return_value=audited_regions,
|
|
) as mock_get_regions_to_audit,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
|
|
),
|
|
patch("prowler.providers.common.provider.Provider.set_global_provider"),
|
|
):
|
|
provider = OraclecloudProvider(
|
|
region={"us-phoenix-1", "us-ashburn-1"},
|
|
user="ocid1.user.oc1..aaaaaaaexample",
|
|
fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
|
|
key_content="fake-base64-key-content",
|
|
tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
|
|
assert (
|
|
mock_setup_session.call_args.kwargs["region"]
|
|
== OraclecloudProvider._bootstrap_region
|
|
)
|
|
assert mock_set_identity.call_args.kwargs["region"] is None
|
|
assert mock_get_regions_to_audit.call_args_list[0].args == (
|
|
{"us-phoenix-1", "us-ashburn-1"},
|
|
)
|
|
assert provider.regions == audited_regions
|
|
|
|
def test_init_with_legacy_region_string_uses_full_region_for_identity(self):
|
|
mock_session = OCISession(
|
|
config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="us-ashburn-1",
|
|
profile="DEFAULT",
|
|
audited_regions=set(),
|
|
audited_compartments=[],
|
|
)
|
|
audited_regions = [
|
|
OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
|
|
]
|
|
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
) as mock_setup_session,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
) as mock_set_identity,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
|
|
return_value=audited_regions,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
|
|
),
|
|
patch("prowler.providers.common.provider.Provider.set_global_provider"),
|
|
):
|
|
OraclecloudProvider(
|
|
region="us-ashburn-1",
|
|
user="ocid1.user.oc1..aaaaaaaexample",
|
|
fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
|
|
key_content="fake-base64-key-content",
|
|
tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
|
|
assert mock_setup_session.call_args.kwargs["region"] == "us-ashburn-1"
|
|
assert mock_set_identity.call_args.kwargs["region"] == "us-ashburn-1"
|
|
|
|
def test_init_without_region_uses_direct_credentials_bootstrap_without_scan_filter(
|
|
self,
|
|
):
|
|
mock_session = OCISession(
|
|
config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="us-ashburn-1",
|
|
profile="DEFAULT",
|
|
audited_regions=set(),
|
|
audited_compartments=[],
|
|
)
|
|
all_subscribed_regions = [
|
|
OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
|
|
OCIRegion(key="us-phoenix-1", name="us-phoenix-1", is_home_region=False),
|
|
]
|
|
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
) as mock_setup_session,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
) as mock_set_identity,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
|
|
return_value=all_subscribed_regions,
|
|
) as mock_get_regions_to_audit,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
|
|
),
|
|
patch("prowler.providers.common.provider.Provider.set_global_provider"),
|
|
):
|
|
provider = OraclecloudProvider(
|
|
user="ocid1.user.oc1..aaaaaaaexample",
|
|
fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
|
|
key_content="fake-base64-key-content",
|
|
tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
|
|
assert (
|
|
mock_setup_session.call_args.kwargs["region"]
|
|
== OraclecloudProvider._bootstrap_region
|
|
)
|
|
assert mock_set_identity.call_args.kwargs["region"] is None
|
|
assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
|
|
assert provider.regions == all_subscribed_regions
|
|
|
|
def test_init_with_config_file_auth_without_region_uses_session_config_region_for_identity(
|
|
self,
|
|
):
|
|
mock_session = OCISession(
|
|
config={
|
|
"tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
|
|
"user": "ocid1.user.oc1..aaaaaaaexample",
|
|
"region": "eu-frankfurt-1",
|
|
},
|
|
signer=None,
|
|
profile="DEFAULT",
|
|
)
|
|
all_subscribed_regions = [
|
|
OCIRegion(key="eu-frankfurt-1", name="eu-frankfurt-1", is_home_region=True),
|
|
OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=False),
|
|
]
|
|
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
) as mock_setup_session,
|
|
patch("oci.identity.IdentityClient") as mock_identity_client,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
|
|
return_value=all_subscribed_regions,
|
|
) as mock_get_regions_to_audit,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
|
|
),
|
|
patch("prowler.providers.common.provider.Provider.set_global_provider"),
|
|
):
|
|
mock_tenancy = MagicMock()
|
|
mock_tenancy.name = "test-tenancy"
|
|
mock_identity_client.return_value.get_tenancy.return_value.data = (
|
|
mock_tenancy
|
|
)
|
|
|
|
provider = OraclecloudProvider(
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
|
|
assert mock_setup_session.call_args.kwargs["region"] is None
|
|
assert provider.identity.region == "eu-frankfurt-1"
|
|
assert provider.identity.audited_regions == {"eu-frankfurt-1"}
|
|
assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
|
|
assert provider.regions == all_subscribed_regions
|
|
|
|
def test_init_with_instance_principal_without_region_uses_session_config_region_for_identity(
|
|
self,
|
|
):
|
|
mock_signer = MagicMock()
|
|
mock_session = OCISession(
|
|
config={
|
|
"tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
|
|
"region": "uk-london-1",
|
|
},
|
|
signer=mock_signer,
|
|
profile=None,
|
|
)
|
|
all_subscribed_regions = [
|
|
OCIRegion(key="uk-london-1", name="uk-london-1", is_home_region=True),
|
|
OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=False),
|
|
]
|
|
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
) as mock_setup_session,
|
|
patch("oci.identity.IdentityClient") as mock_identity_client,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
|
|
return_value=all_subscribed_regions,
|
|
) as mock_get_regions_to_audit,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
|
|
),
|
|
patch("prowler.providers.common.provider.Provider.set_global_provider"),
|
|
):
|
|
mock_tenancy = MagicMock()
|
|
mock_tenancy.name = "test-tenancy"
|
|
mock_identity_client.return_value.get_tenancy.return_value.data = (
|
|
mock_tenancy
|
|
)
|
|
|
|
provider = OraclecloudProvider(
|
|
use_instance_principal=True,
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
|
|
assert mock_setup_session.call_args.kwargs["region"] is None
|
|
assert provider.identity.region == "uk-london-1"
|
|
assert provider.identity.user_id == "instance-principal"
|
|
assert provider.identity.audited_regions == {"uk-london-1"}
|
|
assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
|
|
assert provider.regions == all_subscribed_regions
|
|
|
|
def test_home_region_uses_full_subscription_list_not_region_filter(self):
|
|
"""Home region must come from the full subscription list, not the --region filter.
|
|
|
|
When auditing a single non-home region, the tenancy home region must still be
|
|
resolved correctly so tenancy-level APIs (e.g. the Audit configuration) target it.
|
|
"""
|
|
mock_session = OCISession(
|
|
config={"region": "eu-frankfurt-1"}, signer=None, profile="DEFAULT"
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="eu-frankfurt-1",
|
|
profile="DEFAULT",
|
|
audited_regions=set(),
|
|
audited_compartments=[],
|
|
)
|
|
# The audited set is the non-home region; the full subscription list includes home
|
|
audited_regions = [
|
|
OCIRegion(
|
|
key="eu-frankfurt-1", name="eu-frankfurt-1", is_home_region=False
|
|
),
|
|
]
|
|
all_subscribed_regions = [
|
|
OCIRegion(
|
|
key="eu-frankfurt-1", name="eu-frankfurt-1", is_home_region=False
|
|
),
|
|
OCIRegion(key="us-ashburn-1", name="us-ashburn-1", is_home_region=True),
|
|
]
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
|
|
side_effect=[audited_regions, all_subscribed_regions],
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
|
|
),
|
|
patch("prowler.providers.common.provider.Provider.set_global_provider"),
|
|
):
|
|
provider = OraclecloudProvider(
|
|
region={"eu-frankfurt-1"},
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
|
|
assert provider.regions == audited_regions
|
|
assert provider.home_region == "us-ashburn-1"
|
|
|
|
def test_init_with_legacy_single_region_preserves_fallback_for_home_region(self):
|
|
mock_session = OCISession(
|
|
config={"region": "us-phoenix-1"}, signer=None, profile="DEFAULT"
|
|
)
|
|
mock_identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="us-phoenix-1",
|
|
profile="DEFAULT",
|
|
audited_regions=set(),
|
|
audited_compartments=[],
|
|
)
|
|
|
|
with (
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
|
|
return_value=mock_session,
|
|
),
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
|
|
return_value=mock_identity,
|
|
),
|
|
patch("oci.identity.IdentityClient") as mock_identity_client,
|
|
patch(
|
|
"prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
|
|
return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
|
|
),
|
|
patch("prowler.providers.common.provider.Provider.set_global_provider"),
|
|
):
|
|
mock_identity_client.return_value.list_region_subscriptions.side_effect = (
|
|
Exception("discovery failed")
|
|
)
|
|
|
|
provider = OraclecloudProvider(
|
|
region="us-phoenix-1",
|
|
config_content={"dummy": True},
|
|
mutelist_content={"Accounts": {}},
|
|
)
|
|
|
|
assert [region.key for region in provider.regions] == ["us-phoenix-1"]
|
|
assert provider.home_region == "us-phoenix-1"
|
|
|
|
|
|
class TestGetRegionsToAudit:
|
|
def _provider_with_identity(self):
|
|
provider = OraclecloudProvider.__new__(OraclecloudProvider)
|
|
provider._session = OCISession(
|
|
config={"region": "us-ashburn-1"}, signer=None, profile="DEFAULT"
|
|
)
|
|
provider._identity = OCIIdentityInfo(
|
|
tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
|
|
tenancy_name="test-tenancy",
|
|
user_id="ocid1.user.oc1..aaaaaaaexample",
|
|
region="us-ashburn-1",
|
|
profile="DEFAULT",
|
|
audited_regions=set(),
|
|
audited_compartments=[],
|
|
)
|
|
return provider
|
|
|
|
def test_regionless_scan_raises_when_region_subscription_discovery_fails(self):
|
|
provider = self._provider_with_identity()
|
|
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_identity_client.return_value.list_region_subscriptions.side_effect = (
|
|
Exception("discovery failed")
|
|
)
|
|
|
|
with pytest.raises(OCISetUpSessionError) as exc_info:
|
|
provider.get_regions_to_audit()
|
|
|
|
assert "Could not retrieve OCI subscribed regions" in str(exc_info.value)
|
|
|
|
def test_single_explicit_region_falls_back_when_region_subscription_discovery_fails(
|
|
self,
|
|
):
|
|
provider = self._provider_with_identity()
|
|
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_identity_client.return_value.list_region_subscriptions.side_effect = (
|
|
Exception("discovery failed")
|
|
)
|
|
|
|
regions = provider.get_regions_to_audit("us-phoenix-1")
|
|
|
|
assert len(regions) == 1
|
|
assert regions[0].key == "us-phoenix-1"
|
|
|
|
def test_multiple_explicit_regions_raise_when_region_subscription_discovery_fails(
|
|
self,
|
|
):
|
|
provider = self._provider_with_identity()
|
|
|
|
with patch("oci.identity.IdentityClient") as mock_identity_client:
|
|
mock_identity_client.return_value.list_region_subscriptions.side_effect = (
|
|
Exception("discovery failed")
|
|
)
|
|
|
|
with pytest.raises(OCISetUpSessionError):
|
|
provider.get_regions_to_audit({"us-ashburn-1", "us-phoenix-1"})
|