Prowler 3.2.0__tar.gz → 3.2.2__tar.gz

{prowler-3.2.0 → prowler-3.2.2}/PKG-INFO

@@ -1,20 +1,45 @@
 Metadata-Version: 2.1
 Name: prowler
-Version: 3.2.0
+Version: 3.2.2
 Summary: Prowler is an Open Source security tool to perform Cloud Security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 240 controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.
-Author-email: Toni de la Fuente <toni@blyx.com>
-Maintainer-email: Sergio Garcia <sergio@verica.io>, Nacho Rivera <nacho@verica.io>, Pepe Fagoaga <pepe@verica.io>
 License: Apache-2.0
-Project-URL: Homepage, https://github.com/prowler-cloud/prowler
-Project-URL: Documentation, https://docs.prowler.cloud
-Project-URL: Issue tracker, https://github.com/prowler-cloud/prowler/issues
-Project-URL: Changelog, https://github.com/prowler-cloud/prowler/releases
+Author: Toni de la Fuente
+Author-email: toni@blyx.com
+Maintainer: Sergio Garcia
+Maintainer-email: sergio@verica.io
+Requires-Python: >=3.9,<4.0
+Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.9
-Classifier: License :: OSI Approved :: Apache Software License
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Provides-Extra: docs
+Requires-Dist: alive-progress (==2.4.1)
+Requires-Dist: arnparse (==0.0.2)
+Requires-Dist: azure-identity (==1.12.0)
+Requires-Dist: azure-mgmt-authorization (==3.0.0)
+Requires-Dist: azure-mgmt-security (==3.0.0)
+Requires-Dist: azure-mgmt-storage (==21.0.0)
+Requires-Dist: azure-mgmt-subscription (==3.1.1)
+Requires-Dist: azure-storage-blob (==12.14.1)
+Requires-Dist: boto3 (==1.26.74)
+Requires-Dist: botocore (==1.29.74)
+Requires-Dist: colorama (==0.4.5)
+Requires-Dist: detect-secrets (==1.4.0)
+Requires-Dist: mkdocs (==1.4.2) ; extra == "docs"
+Requires-Dist: mkdocs-material (==8.2.1) ; extra == "docs"
+Requires-Dist: msgraph-core (==0.2.2)
+Requires-Dist: pydantic (==1.10.5)
+Requires-Dist: schema (==0.7.5)
+Requires-Dist: shodan (==1.28.0)
+Requires-Dist: tabulate (==0.9.0)
+Project-URL: Changelog, https://github.com/prowler-cloud/prowler/releases
+Project-URL: Documentation, https://docs.prowler.cloud
+Project-URL: Homepage, https://github.com/prowler-cloud/prowler
+Project-URL: Issue tracker, https://github.com/prowler-cloud/prowler/issues
 Description-Content-Type: text/markdown
-License-File: LICENSE
 
 <p align="center">
   <img align="center" src="https://github.com/prowler-cloud/prowler/blob/62c1ce73bbcdd6b9e5ba03dfcae26dfd165defd9/docs/img/prowler-pro-dark.png?raw=True#gh-dark-mode-only" width="150" height="36">
@@ -82,13 +107,13 @@ The container images are available here:
 
 ## From Github
 
-Python >= 3.9 is required with pip and pipenv:
+Python >= 3.9 is required with pip and poetry:
 
 ```
 git clone https://github.com/prowler-cloud/prowler
 cd prowler
-pipenv shell
-pipenv install
+poetry shell
+poetry install
 python prowler.py -v
 ```
 
@@ -265,3 +290,4 @@ prowler azure [--sp-env-auth, --az-cli-auth, --browser-auth, --managed-identity-
 
 Prowler is licensed as Apache License 2.0 as specified in each file. You may obtain a copy of the License at
 <http://www.apache.org/licenses/LICENSE-2.0>
+

{prowler-3.2.0 → prowler-3.2.2}/README.md

@@ -64,13 +64,13 @@ The container images are available here:
 
 ## From Github
 
-Python >= 3.9 is required with pip and pipenv:
+Python >= 3.9 is required with pip and poetry:
 
 ```
 git clone https://github.com/prowler-cloud/prowler
 cd prowler
-pipenv shell
-pipenv install
+poetry shell
+poetry install
 python prowler.py -v
 ```
 

{prowler-3.2.0 → prowler-3.2.2}/prowler/__main__.py

@@ -11,6 +11,7 @@ from prowler.lib.check.check import (
     exclude_services_to_run,
     execute_checks,
     get_checks_from_input_arn,
+    get_regions_from_audit_resources,
     list_categories,
     list_services,
     print_categories,
@@ -136,6 +137,9 @@ def prowler():
 
     # Once the audit_info is set and we have the eventual checks from arn, it is time to exclude the others
     if audit_info.audit_resources:
+        audit_info.audited_regions = get_regions_from_audit_resources(
+            audit_info.audit_resources
+        )
         checks_to_execute = get_checks_from_input_arn(
             audit_info.audit_resources, provider
         )
@@ -203,7 +207,7 @@ def prowler():
                 )
 
     # Resolve previous fails of Security Hub
-    if provider == "aws" and args.security_hub:
+    if provider == "aws" and args.security_hub and not args.skip_sh_update:
         resolve_security_hub_previous_findings(args.output_directory, audit_info)
 
     # Display summary table
@@ -216,14 +220,15 @@ def prowler():
         )
 
         if compliance_framework and findings:
-            # Display compliance table
-            display_compliance_table(
-                findings,
-                bulk_checks_metadata,
-                compliance_framework,
-                audit_output_options.output_filename,
-                audit_output_options.output_directory,
-            )
+            for compliance in compliance_framework:
+                # Display compliance table
+                display_compliance_table(
+                    findings,
+                    bulk_checks_metadata,
+                    compliance,
+                    audit_output_options.output_filename,
+                    audit_output_options.output_directory,
+                )
 
     # If there are failed findings exit code 3, except if -z is input
     if not args.ignore_exit_code_3 and stats["total_fail"] > 0:

{prowler-3.2.0 → prowler-3.2.2}/prowler/config/config.py

@@ -9,7 +9,7 @@ from prowler.lib.logger import logger
 
 timestamp = datetime.today()
 timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc)
-prowler_version = "3.2.0"
+prowler_version = "3.2.2"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 html_logo_img = "https://user-images.githubusercontent.com/3985464/113734260-7ba06900-96fb-11eb-82bc-d4f68a1e2710.png"
 

{prowler-3.2.0 → prowler-3.2.2}/prowler/lib/check/check.py

@@ -179,17 +179,18 @@ def print_compliance_requirements(
     bulk_compliance_frameworks: dict, compliance_frameworks: list
 ):
     for compliance_framework in compliance_frameworks:
-        for compliance in bulk_compliance_frameworks.values():
-            # Workaround until we have more Compliance Frameworks
-            split_compliance = compliance_framework.split("_")
-            framework = split_compliance[0].upper()
-            version = split_compliance[1].upper()
-            provider = split_compliance[2].upper()
-            if framework in compliance.Framework and compliance.Version == version:
+        for key in bulk_compliance_frameworks.keys():
+            framework = bulk_compliance_frameworks[key].Framework
+            provider = bulk_compliance_frameworks[key].Provider
+            version = bulk_compliance_frameworks[key].Version
+            requirements = bulk_compliance_frameworks[key].Requirements
+            # We can list the compliance requirements for a given framework using the
+            # bulk_compliance_frameworks keys since they are the compliance specification file name
+            if compliance_framework == key:
                 print(
                     f"Listing {framework} {version} {provider} Compliance Requirements:\n"
                 )
-                for requirement in compliance.Requirements:
+                for requirement in requirements:
                     checks = ""
                     for check in requirement.Checks:
                         checks += f" {Fore.YELLOW}\t\t{check}\n{Style.RESET_ALL}"
@@ -510,19 +511,61 @@ def get_checks_from_input_arn(audit_resources: list, provider: str) -> set:
     checks_from_arn = set()
     # Handle if there are audit resources so only their services are executed
     if audit_resources:
-        service_list = []
+        services_without_subservices = ["guardduty", "kms", "s3", "elb"]
+        service_list = set()
+        sub_service_list = set()
         for resource in audit_resources:
             service = resource.split(":")[2]
-            # Parse services when they are different in the ARNs
-            if service == "lambda":
-                service = "awslambda"
-            if service == "elasticloadbalancing":
-                service = "elb"
-            elif service == "logs":
-                service = "cloudwatch"
-            service_list.append(service)
-
-        checks_from_arn = recover_checks_from_service(service_list, provider)
+            sub_service = resource.split(":")[5].split("/")[0].replace("-", "_")
+
+            if (
+                service != "wafv2" and service != "waf"
+            ):  # WAF Services does not have checks
+                # Parse services when they are different in the ARNs
+                if service == "lambda":
+                    service = "awslambda"
+                if service == "elasticloadbalancing":
+                    service = "elb"
+                elif service == "logs":
+                    service = "cloudwatch"
+                service_list.add(service)
+
+                # Get subservices to execute only applicable checks
+                if service not in services_without_subservices:
+                    # Parse some specific subservices
+                    if service == "ec2":
+                        if sub_service == "security_group":
+                            sub_service = "securitygroup"
+                        if sub_service == "network_acl":
+                            sub_service = "networkacl"
+                        if sub_service == "image":
+                            sub_service = "ami"
+                    if service == "rds":
+                        if sub_service == "cluster_snapshot":
+                            sub_service = "snapshot"
+                    sub_service_list.add(sub_service)
+                else:
+                    sub_service_list.add(service)
+
+        checks = recover_checks_from_service(service_list, provider)
+
+        # Filter only checks with audited subservices
+        for check in checks:
+            if any(sub_service in check for sub_service in sub_service_list):
+                if not (sub_service == "policy" and "password_policy" in check):
+                    checks_from_arn.add(check)
 
     # Return final checks list
-    return checks_from_arn
+    return sorted(checks_from_arn)
+
+
+def get_regions_from_audit_resources(audit_resources: list) -> list:
+    """get_regions_from_audit_resources gets the regions from the audit resources arns"""
+    audited_regions = []
+    for resource in audit_resources:
+        region = resource.split(":")[3]
+        if region and region not in audited_regions:  # Check if arn has a region
+            audited_regions.append(region)
+    if audited_regions:
+        return audited_regions
+    return None

{prowler-3.2.0 → prowler-3.2.2}/prowler/lib/check/compliance_models.py

@@ -2,7 +2,7 @@ import sys
 from enum import Enum
 from typing import Optional, Union
 
-from pydantic import BaseModel, ValidationError
+from pydantic import BaseModel, ValidationError, root_validator
 
 from prowler.lib.logger import logger
 
@@ -107,10 +107,21 @@ class Compliance_Base_Model(BaseModel):
 
     Framework: str
     Provider: str
-    Version: str
+    Version: Optional[str]
     Description: str
     Requirements: list[Compliance_Requirement]
 
+    @root_validator(pre=True)
+    # noqa: F841 - since vulture raises unused variable 'cls'
+    def framework_and_provider_must_not_be_empty(cls, values):  # noqa: F841
+        framework, provider = (
+            values.get("Framework"),
+            values.get("Provider"),
+        )
+        if framework == "" or provider == "":
+            raise ValueError("Framework or Provider must not be empty")
+        return values
+
 
 # Testing Pending
 def load_compliance_framework(

{prowler-3.2.0 → prowler-3.2.2}/prowler/lib/cli/parser.py

@@ -316,6 +316,11 @@ Detailed documentation at https://docs.prowler.cloud
             action="store_true",
             help="Send check output to AWS Security Hub",
         )
+        aws_security_hub_subparser.add_argument(
+            "--skip-sh-update",
+            action="store_true",
+            help="Skip updating previous findings of Prowler in Security Hub",
+        )
         # AWS Quick Inventory
         aws_quick_inventory_subparser = aws_parser.add_argument_group("Quick Inventory")
         aws_quick_inventory_subparser.add_argument(

{prowler-3.2.0 → prowler-3.2.2}/prowler/lib/outputs/compliance.py

@@ -4,7 +4,7 @@ from csv import DictWriter
 from colorama import Fore, Style
 from tabulate import tabulate
 
-from prowler.config.config import timestamp, orange_color
+from prowler.config.config import orange_color, timestamp
 from prowler.lib.logger import logger
 from prowler.lib.outputs.models import (
     Check_Output_CSV_CIS,
@@ -167,7 +167,7 @@ def display_compliance_table(
     output_directory: str,
 ):
     try:
-        if "ens_rd2022_aws" in compliance_framework:
+        if "ens_rd2022_aws" == compliance_framework:
             marcos = {}
             ens_compliance_table = {
                 "Proveedor": [],
@@ -266,9 +266,9 @@ def display_compliance_table(
                 )
                 print(f"\nResultados detallados de {compliance_fm} en:")
                 print(
-                    f" - CSV: {output_directory}/{output_filename}_{compliance_framework[0]}.csv\n"
+                    f" - CSV: {output_directory}/{output_filename}_{compliance_framework}.csv\n"
                 )
-        elif "cis_1." in str(compliance_framework):
+        elif "cis_1." in compliance_framework:
             sections = {}
             cis_compliance_table = {
                 "Provider": [],
@@ -281,8 +281,9 @@ def display_compliance_table(
                 check = bulk_checks_metadata[finding.check_metadata.CheckID]
                 check_compliances = check.Compliance
                 for compliance in check_compliances:
-                    if compliance.Framework == "CIS" and compliance.Version in str(
-                        compliance_framework
+                    if (
+                        compliance.Framework == "CIS"
+                        and compliance.Version in compliance_framework
                     ):
                         compliance_version = compliance.Version
                         compliance_fm = compliance.Framework
@@ -360,12 +361,12 @@ def display_compliance_table(
                 )
                 print(f"\nDetailed results of {compliance_fm} are in:")
                 print(
-                    f" - CSV: {output_directory}/{output_filename}_{compliance_framework[0]}.csv\n"
+                    f" - CSV: {output_directory}/{output_filename}_{compliance_framework}.csv\n"
                 )
         else:
-            print(f"\nDetailed results of {compliance_framework[0].upper()} are in:")
+            print(f"\nDetailed results of {compliance_framework.upper()} are in:")
             print(
-                f" - CSV: {output_directory}/{output_filename}_{compliance_framework[0]}.csv\n"
+                f" - CSV: {output_directory}/{output_filename}_{compliance_framework}.csv\n"
             )
     except Exception as error:
         logger.critical(

{prowler-3.2.0 → prowler-3.2.2}/prowler/lib/outputs/json.py

@@ -31,7 +31,7 @@ def fill_json_asff(finding_output, audit_info, finding):
     ) = finding_output.CreatedAt = timestamp_utc.strftime("%Y-%m-%dT%H:%M:%SZ")
     finding_output.Severity = Severity(Label=finding.check_metadata.Severity.upper())
     finding_output.Title = finding.check_metadata.CheckTitle
-    finding_output.Description = finding.check_metadata.Description
+    finding_output.Description = finding.status_extended
     finding_output.Resources = [
         Resource(
             Id=finding.resource_arn,

{prowler-3.2.0 → prowler-3.2.2}/prowler/providers/aws/aws_regions_by_service.json

@@ -1630,6 +1630,13 @@
         ]
       }
     },
+    "cloudtrail-data": {
+      "regions": {
+        "aws": [],
+        "aws-cn": [],
+        "aws-us-gov": []
+      }
+    },
     "cloudwatch": {
       "regions": {
         "aws": [
@@ -2196,6 +2203,11 @@
     "connectcases": {
       "regions": {
         "aws": [
+          "ap-southeast-1",
+          "ap-southeast-2",
+          "ca-central-1",
+          "eu-central-1",
+          "eu-west-2",
           "us-east-1",
           "us-west-2"
         ],
@@ -2572,17 +2584,17 @@
           "af-south-1",
           "ap-east-1",
           "ap-northeast-1",
-          "ap-northeast-3",
           "ap-southeast-1",
           "ca-central-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-3",
           "us-east-1",
           "ap-northeast-2",
+          "ap-northeast-3",
           "ap-south-1",
           "ap-southeast-4",
-          "eu-west-2",
-          "me-south-1",
+          "eu-central-2",
           "sa-east-1",
           "us-east-2",
           "us-west-2",
@@ -2591,7 +2603,9 @@
           "eu-central-1",
           "eu-north-1",
           "eu-south-1",
+          "eu-west-2",
           "me-central-1",
+          "me-south-1",
           "us-west-1"
         ],
         "aws-cn": [
@@ -3003,6 +3017,7 @@
       "regions": {
         "aws": [
           "ap-south-1",
+          "ap-south-2",
           "ca-central-1",
           "eu-west-1",
           "eu-west-2",
@@ -3012,7 +3027,6 @@
           "af-south-1",
           "ap-northeast-1",
           "ap-northeast-2",
-          "ap-northeast-3",
           "eu-central-2",
           "eu-south-1",
           "eu-south-2",
@@ -3020,6 +3034,7 @@
           "me-central-1",
           "sa-east-1",
           "ap-east-1",
+          "ap-northeast-3",
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
@@ -3029,8 +3044,8 @@
           "us-west-2"
         ],
         "aws-cn": [
-          "cn-north-1",
-          "cn-northwest-1"
+          "cn-northwest-1",
+          "cn-north-1"
         ],
         "aws-us-gov": [
           "us-gov-east-1",
@@ -3319,20 +3334,23 @@
           "sa-east-1",
           "us-east-1",
           "us-east-2",
-          "us-west-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-southeast-2",
           "ca-central-1",
           "eu-central-1",
           "eu-west-2",
-          "us-west-1"
+          "us-west-1",
+          "us-west-2"
         ],
         "aws-cn": [
           "cn-northwest-1",
           "cn-north-1"
         ],
-        "aws-us-gov": []
+        "aws-us-gov": [
+          "us-gov-east-1",
+          "us-gov-west-1"
+        ]
       }
     },
     "emr-serverless": {
@@ -4155,12 +4173,12 @@
           "us-west-2",
           "ap-east-1",
           "ap-northeast-1",
+          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ca-central-1",
           "eu-south-1",
           "eu-west-1",
-          "me-central-1",
           "me-south-1",
           "us-east-2",
           "ap-northeast-2",
@@ -4168,6 +4186,7 @@
           "eu-central-2",
           "eu-north-1",
           "eu-west-3",
+          "me-central-1",
           "us-west-1"
         ],
         "aws-cn": [
@@ -4883,6 +4902,8 @@
     "kendra-ranking": {
       "regions": {
         "aws": [
+          "ap-northeast-1",
+          "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
           "ca-central-1",
@@ -4953,14 +4974,15 @@
           "eu-north-1",
           "eu-south-1",
           "eu-west-1",
-          "eu-west-3",
+          "me-central-1",
           "us-east-1",
           "us-west-1",
           "af-south-1",
           "ap-northeast-3",
           "ap-south-1",
           "eu-central-1",
-          "eu-west-2"
+          "eu-west-2",
+          "eu-west-3"
         ],
         "aws-cn": [
           "cn-north-1",
@@ -5043,8 +5065,8 @@
       "regions": {
         "aws": [
           "af-south-1",
-          "ap-northeast-2",
           "ap-southeast-1",
+          "ap-southeast-3",
           "ca-central-1",
           "eu-central-1",
           "eu-north-1",
@@ -5053,14 +5075,15 @@
           "us-west-1",
           "ap-east-1",
           "ap-northeast-1",
+          "ap-northeast-2",
           "ap-northeast-3",
           "eu-west-1",
-          "eu-west-2",
           "eu-west-3",
           "me-south-1",
           "us-west-2",
           "ap-south-1",
           "ap-southeast-2",
+          "eu-west-2",
           "sa-east-1",
           "us-east-2"
         ],
@@ -6823,13 +6846,14 @@
           "us-west-1",
           "ap-east-1",
           "ap-northeast-1",
+          "ap-southeast-4",
           "ca-central-1",
-          "eu-central-1",
           "eu-west-2",
           "me-central-1",
           "me-south-1",
           "sa-east-1",
-          "us-west-2"
+          "us-west-2",
+          "eu-central-1"
         ],
         "aws-cn": [
           "cn-north-1",
@@ -7010,13 +7034,15 @@
           "ap-east-1",
           "ap-southeast-2",
           "ca-central-1",
-          "eu-central-1",
           "eu-north-1",
           "eu-west-3",
+          "me-central-1",
           "sa-east-1",
           "us-west-1",
           "ap-northeast-1",
           "ap-south-1",
+          "eu-central-1",
+          "eu-south-2",
           "eu-west-2",
           "us-east-1",
           "us-east-2"
@@ -8046,6 +8072,22 @@
         "aws-us-gov": []
       }
     },
+    "simpledb": {
+      "regions": {
+        "aws": [
+          "ap-northeast-1",
+          "ap-southeast-1",
+          "ap-southeast-2",
+          "eu-west-1",
+          "sa-east-1",
+          "us-east-1",
+          "us-west-1",
+          "us-west-2"
+        ],
+        "aws-cn": [],
+        "aws-us-gov": []
+      }
+    },
     "simspaceweaver": {
       "regions": {
         "aws": [

{prowler-3.2.0 → prowler-3.2.2}/prowler/providers/aws/lib/quick_inventory/quick_inventory.py

@@ -50,7 +50,6 @@ def quick_inventory(audit_info: AWS_Audit_Info, output_directory: str):
                     or region == "us-gov-west-1"
                     or region == "cn-north-1"
                 ):
-
                     get_roles_paginator = iam_client.get_paginator("list_roles")
                     for page in get_roles_paginator.paginate():
                         for role in page["Roles"]:
@@ -117,7 +116,6 @@ def quick_inventory(audit_info: AWS_Audit_Info, output_directory: str):
 
 
 def create_inventory_table(resources: list) -> dict:
-
     services = {}
     # { "S3":
     #       123,
@@ -143,6 +141,14 @@ def create_inventory_table(resources: list) -> dict:
             resource_type = "topic"
         elif service == "sqs":
             resource_type = "queue"
+        elif service == "apigateway":
+            split_parts = resource.split(":")[5].split("/")
+            if "integration" in split_parts and "responses" in split_parts:
+                resource_type = "restapis-resources-methods-integration-response"
+            elif "documentation" in split_parts and "parts" in split_parts:
+                resource_type = "restapis-documentation-parts"
+            else:
+                resource_type = resource.split(":")[5].split("/")[1]
         else:
             resource_type = resource.split(":")[5].split("/")[0]
         if service not in resources_type:
@@ -171,7 +177,6 @@ def create_inventory_table(resources: list) -> dict:
 
 
 def create_output(resources: list, audit_info: AWS_Audit_Info, output_directory: str):
-
     json_output = []
     output_file = f"{output_directory}/prowler-inventory-{audit_info.audited_account}-{output_file_timestamp}"
 

prowler-3.2.2/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture

@@ -0,0 +1,4 @@
+DB_PASSWORD=foobar123
+DB_USER=foo
+API_KEY=12345abcd
+SERVICE_PASSWORD=bbaabb45