Prowler 3.2.1__tar.gz → 3.2.2__tar.gz

{prowler-3.2.1 → prowler-3.2.2}/PKG-INFO

@@ -1,20 +1,45 @@
 Metadata-Version: 2.1
 Name: prowler
-Version: 3.2.1
+Version: 3.2.2
 Summary: Prowler is an Open Source security tool to perform Cloud Security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 240 controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.
-Author-email: Toni de la Fuente <toni@blyx.com>
-Maintainer-email: Sergio Garcia <sergio@verica.io>, Nacho Rivera <nacho@verica.io>, Pepe Fagoaga <pepe@verica.io>
 License: Apache-2.0
-Project-URL: Homepage, https://github.com/prowler-cloud/prowler
-Project-URL: Documentation, https://docs.prowler.cloud
-Project-URL: Issue tracker, https://github.com/prowler-cloud/prowler/issues
-Project-URL: Changelog, https://github.com/prowler-cloud/prowler/releases
+Author: Toni de la Fuente
+Author-email: toni@blyx.com
+Maintainer: Sergio Garcia
+Maintainer-email: sergio@verica.io
+Requires-Python: >=3.9,<4.0
+Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.9
-Classifier: License :: OSI Approved :: Apache Software License
-Requires-Python: >=3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Provides-Extra: docs
+Requires-Dist: alive-progress (==2.4.1)
+Requires-Dist: arnparse (==0.0.2)
+Requires-Dist: azure-identity (==1.12.0)
+Requires-Dist: azure-mgmt-authorization (==3.0.0)
+Requires-Dist: azure-mgmt-security (==3.0.0)
+Requires-Dist: azure-mgmt-storage (==21.0.0)
+Requires-Dist: azure-mgmt-subscription (==3.1.1)
+Requires-Dist: azure-storage-blob (==12.14.1)
+Requires-Dist: boto3 (==1.26.74)
+Requires-Dist: botocore (==1.29.74)
+Requires-Dist: colorama (==0.4.5)
+Requires-Dist: detect-secrets (==1.4.0)
+Requires-Dist: mkdocs (==1.4.2) ; extra == "docs"
+Requires-Dist: mkdocs-material (==8.2.1) ; extra == "docs"
+Requires-Dist: msgraph-core (==0.2.2)
+Requires-Dist: pydantic (==1.10.5)
+Requires-Dist: schema (==0.7.5)
+Requires-Dist: shodan (==1.28.0)
+Requires-Dist: tabulate (==0.9.0)
+Project-URL: Changelog, https://github.com/prowler-cloud/prowler/releases
+Project-URL: Documentation, https://docs.prowler.cloud
+Project-URL: Homepage, https://github.com/prowler-cloud/prowler
+Project-URL: Issue tracker, https://github.com/prowler-cloud/prowler/issues
 Description-Content-Type: text/markdown
-License-File: LICENSE
 
 <p align="center">
   <img align="center" src="https://github.com/prowler-cloud/prowler/blob/62c1ce73bbcdd6b9e5ba03dfcae26dfd165defd9/docs/img/prowler-pro-dark.png?raw=True#gh-dark-mode-only" width="150" height="36">
@@ -82,13 +107,13 @@ The container images are available here:
 
 ## From Github
 
-Python >= 3.9 is required with pip and pipenv:
+Python >= 3.9 is required with pip and poetry:
 
 ```
 git clone https://github.com/prowler-cloud/prowler
 cd prowler
-pipenv shell
-pipenv install
+poetry shell
+poetry install
 python prowler.py -v
 ```
 
@@ -265,3 +290,4 @@ prowler azure [--sp-env-auth, --az-cli-auth, --browser-auth, --managed-identity-
 
 Prowler is licensed as Apache License 2.0 as specified in each file. You may obtain a copy of the License at
 <http://www.apache.org/licenses/LICENSE-2.0>
+

{prowler-3.2.1 → prowler-3.2.2}/README.md

@@ -64,13 +64,13 @@ The container images are available here:
 
 ## From Github
 
-Python >= 3.9 is required with pip and pipenv:
+Python >= 3.9 is required with pip and poetry:
 
 ```
 git clone https://github.com/prowler-cloud/prowler
 cd prowler
-pipenv shell
-pipenv install
+poetry shell
+poetry install
 python prowler.py -v
 ```
 

{prowler-3.2.1 → prowler-3.2.2}/prowler/__main__.py

@@ -11,6 +11,7 @@ from prowler.lib.check.check import (
     exclude_services_to_run,
     execute_checks,
     get_checks_from_input_arn,
+    get_regions_from_audit_resources,
     list_categories,
     list_services,
     print_categories,
@@ -136,6 +137,9 @@ def prowler():
 
     # Once the audit_info is set and we have the eventual checks from arn, it is time to exclude the others
     if audit_info.audit_resources:
+        audit_info.audited_regions = get_regions_from_audit_resources(
+            audit_info.audit_resources
+        )
         checks_to_execute = get_checks_from_input_arn(
             audit_info.audit_resources, provider
         )

{prowler-3.2.1 → prowler-3.2.2}/prowler/config/config.py

@@ -9,7 +9,7 @@ from prowler.lib.logger import logger
 
 timestamp = datetime.today()
 timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc)
-prowler_version = "3.2.1"
+prowler_version = "3.2.2"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 html_logo_img = "https://user-images.githubusercontent.com/3985464/113734260-7ba06900-96fb-11eb-82bc-d4f68a1e2710.png"
 

{prowler-3.2.1 → prowler-3.2.2}/prowler/lib/check/check.py

@@ -511,19 +511,61 @@ def get_checks_from_input_arn(audit_resources: list, provider: str) -> set:
     checks_from_arn = set()
     # Handle if there are audit resources so only their services are executed
     if audit_resources:
-        service_list = []
+        services_without_subservices = ["guardduty", "kms", "s3", "elb"]
+        service_list = set()
+        sub_service_list = set()
         for resource in audit_resources:
             service = resource.split(":")[2]
-            # Parse services when they are different in the ARNs
-            if service == "lambda":
-                service = "awslambda"
-            if service == "elasticloadbalancing":
-                service = "elb"
-            elif service == "logs":
-                service = "cloudwatch"
-            service_list.append(service)
-
-        checks_from_arn = recover_checks_from_service(service_list, provider)
+            sub_service = resource.split(":")[5].split("/")[0].replace("-", "_")
+
+            if (
+                service != "wafv2" and service != "waf"
+            ):  # WAF Services does not have checks
+                # Parse services when they are different in the ARNs
+                if service == "lambda":
+                    service = "awslambda"
+                if service == "elasticloadbalancing":
+                    service = "elb"
+                elif service == "logs":
+                    service = "cloudwatch"
+                service_list.add(service)
+
+                # Get subservices to execute only applicable checks
+                if service not in services_without_subservices:
+                    # Parse some specific subservices
+                    if service == "ec2":
+                        if sub_service == "security_group":
+                            sub_service = "securitygroup"
+                        if sub_service == "network_acl":
+                            sub_service = "networkacl"
+                        if sub_service == "image":
+                            sub_service = "ami"
+                    if service == "rds":
+                        if sub_service == "cluster_snapshot":
+                            sub_service = "snapshot"
+                    sub_service_list.add(sub_service)
+                else:
+                    sub_service_list.add(service)
+
+        checks = recover_checks_from_service(service_list, provider)
+
+        # Filter only checks with audited subservices
+        for check in checks:
+            if any(sub_service in check for sub_service in sub_service_list):
+                if not (sub_service == "policy" and "password_policy" in check):
+                    checks_from_arn.add(check)
 
     # Return final checks list
-    return checks_from_arn
+    return sorted(checks_from_arn)
+
+
+def get_regions_from_audit_resources(audit_resources: list) -> list:
+    """get_regions_from_audit_resources gets the regions from the audit resources arns"""
+    audited_regions = []
+    for resource in audit_resources:
+        region = resource.split(":")[3]
+        if region and region not in audited_regions:  # Check if arn has a region
+            audited_regions.append(region)
+    if audited_regions:
+        return audited_regions
+    return None

{prowler-3.2.1 → prowler-3.2.2}/prowler/providers/aws/aws_regions_by_service.json

@@ -1630,6 +1630,13 @@
         ]
       }
     },
+    "cloudtrail-data": {
+      "regions": {
+        "aws": [],
+        "aws-cn": [],
+        "aws-us-gov": []
+      }
+    },
     "cloudwatch": {
       "regions": {
         "aws": [
@@ -2577,17 +2584,17 @@
           "af-south-1",
           "ap-east-1",
           "ap-northeast-1",
-          "ap-northeast-3",
           "ap-southeast-1",
           "ca-central-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-3",
           "us-east-1",
           "ap-northeast-2",
+          "ap-northeast-3",
           "ap-south-1",
           "ap-southeast-4",
-          "eu-west-2",
-          "me-south-1",
+          "eu-central-2",
           "sa-east-1",
           "us-east-2",
           "us-west-2",
@@ -2596,7 +2603,9 @@
           "eu-central-1",
           "eu-north-1",
           "eu-south-1",
+          "eu-west-2",
           "me-central-1",
+          "me-south-1",
           "us-west-1"
         ],
         "aws-cn": [
@@ -3325,20 +3334,23 @@
           "sa-east-1",
           "us-east-1",
           "us-east-2",
-          "us-west-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-southeast-2",
           "ca-central-1",
           "eu-central-1",
           "eu-west-2",
-          "us-west-1"
+          "us-west-1",
+          "us-west-2"
         ],
         "aws-cn": [
           "cn-northwest-1",
           "cn-north-1"
         ],
-        "aws-us-gov": []
+        "aws-us-gov": [
+          "us-gov-east-1",
+          "us-gov-west-1"
+        ]
       }
     },
     "emr-serverless": {
@@ -5053,8 +5065,8 @@
       "regions": {
         "aws": [
           "af-south-1",
-          "ap-northeast-2",
           "ap-southeast-1",
+          "ap-southeast-3",
           "ca-central-1",
           "eu-central-1",
           "eu-north-1",
@@ -5063,14 +5075,15 @@
           "us-west-1",
           "ap-east-1",
           "ap-northeast-1",
+          "ap-northeast-2",
           "ap-northeast-3",
           "eu-west-1",
-          "eu-west-2",
           "eu-west-3",
           "me-south-1",
           "us-west-2",
           "ap-south-1",
           "ap-southeast-2",
+          "eu-west-2",
           "sa-east-1",
           "us-east-2"
         ],
@@ -8059,6 +8072,22 @@
         "aws-us-gov": []
       }
     },
+    "simpledb": {
+      "regions": {
+        "aws": [
+          "ap-northeast-1",
+          "ap-southeast-1",
+          "ap-southeast-2",
+          "eu-west-1",
+          "sa-east-1",
+          "us-east-1",
+          "us-west-1",
+          "us-west-2"
+        ],
+        "aws-cn": [],
+        "aws-us-gov": []
+      }
+    },
     "simspaceweaver": {
       "regions": {
         "aws": [

prowler-3.2.2/prowler/providers/aws/services/autoscaling/autoscaling_find_secrets_ec2_launch_configuration/fixtures/fixture

@@ -0,0 +1,4 @@
+DB_PASSWORD=foobar123
+DB_USER=foo
+API_KEY=12345abcd
+SERVICE_PASSWORD=bbaabb45

{prowler-3.2.1 → prowler-3.2.2}/prowler/providers/aws/services/cloudformation/cloudformation_stacks_termination_protection_enabled/cloudformation_stacks_termination_protection_enabled.metadata.json

@@ -13,7 +13,7 @@
   "RelatedUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-protect-stacks.html",
   "Remediation": {
     "Code": {
-      "CLI": "aws cloudformation update-termination-protection --region us-east-1 --stack-name <STACK_NAME> --enable-termination-protection",
+      "CLI": "aws cloudformation update-termination-protection --region <REGION_NAME> --stack-name <STACK_NAME> --enable-termination-protection",
       "NativeIaC": "",
       "Other": "",
       "Terraform": ""

{prowler-3.2.1 → prowler-3.2.2}/prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_is_not_publicly_accessible/cloudtrail_logs_s3_bucket_is_not_publicly_accessible.py

@@ -10,6 +10,7 @@ class cloudtrail_logs_s3_bucket_is_not_publicly_accessible(Check):
         findings = []
         for trail in cloudtrail_client.trails:
             if trail.name:
+                trail_bucket_is_in_account = False
                 trail_bucket = trail.s3_bucket
                 report = Check_Report_AWS(self.metadata())
                 report.region = trail.region
@@ -23,19 +24,23 @@ class cloudtrail_logs_s3_bucket_is_not_publicly_accessible(Check):
                 for bucket in s3_client.buckets:
                     # Here we need to ensure that acl_grantee is filled since if we don't have permissions to query the api for a concrete region
                     # (for example due to a SCP) we are going to try access an attribute from a None type
-                    if trail_bucket == bucket.name and bucket.acl_grantees:
-                        for grant in bucket.acl_grantees:
-                            if (
-                                grant.URI
-                                == "http://acs.amazonaws.com/groups/global/AllUsers"
-                            ):
-                                report.status = "FAIL"
-                                if trail.is_multiregion:
-                                    report.status_extended = f"S3 Bucket {trail_bucket} from multiregion trail {trail.name} is publicly accessible"
-                                else:
-                                    report.status_extended = f"S3 Bucket {trail_bucket} from single region trail {trail.name} is publicly accessible"
-                                break
-
+                    if trail_bucket == bucket.name:
+                        trail_bucket_is_in_account = True
+                        if bucket.acl_grantees:
+                            for grant in bucket.acl_grantees:
+                                if (
+                                    grant.URI
+                                    == "http://acs.amazonaws.com/groups/global/AllUsers"
+                                ):
+                                    report.status = "FAIL"
+                                    if trail.is_multiregion:
+                                        report.status_extended = f"S3 Bucket {trail_bucket} from multiregion trail {trail.name} is publicly accessible"
+                                    else:
+                                        report.status_extended = f"S3 Bucket {trail_bucket} from single region trail {trail.name} is publicly accessible"
+                                    break
+                # check if trail bucket is a cross account bucket
+                if not trail_bucket_is_in_account:
+                    report.status_extended = f"Trail {trail.name} bucket ({trail_bucket}) is a cross-account bucket in another account out of Prowler's permissions scope, please check it manually"
                 findings.append(report)
 
         return findings

prowler-3.2.2/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/fixtures/fixture

@@ -0,0 +1,4 @@
+DB_PASSWORD=foobar123
+DB_USER=foo
+API_KEY=12345abcd
+SERVICE_PASSWORD=bbaabb45

{prowler-3.2.1 → prowler-3.2.2}/prowler/providers/aws/services/emr/emr_service.py

@@ -97,6 +97,7 @@ class EMR:
                     slave_node_security_group = cluster_info["Cluster"][
                         "Ec2InstanceAttributes"
                     ]["EmrManagedSlaveSecurityGroup"]
+                    slave_node_additional_security_groups = []
                     if (
                         "AdditionalSlaveSecurityGroups"
                         in cluster_info["Cluster"]["Ec2InstanceAttributes"]

{prowler-3.2.1 → prowler-3.2.2}/prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py

@@ -21,6 +21,7 @@ class iam_no_custom_policy_permissive_role_assumption(Check):
                     if (
                         statement["Effect"] == "Allow"
                         and "Action" in statement
+                        and "Resource" in statement
                         and "*" in statement["Resource"]
                     ):
                         if type(statement["Action"]) == list:

prowler-3.2.2/pyproject.toml

@@ -0,0 +1,87 @@
+[build-system]
+build-backend = "poetry.core.masonry.api"
+requires = ["poetry-core"]
+
+# https://peps.python.org/pep-0621/
+[tool.poetry]
+authors = ["Toni de la Fuente <toni@blyx.com>"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.9",
+  "License :: OSI Approved :: Apache Software License"
+]
+description = "Prowler is an Open Source security tool to perform Cloud Security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 240 controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks."
+license = "Apache-2.0"
+maintainers = [
+  "Sergio Garcia <sergio@verica.io>",
+  "Nacho Rivera <nacho@verica.io>",
+  "Pepe Fagoaga <pepe@verica.io>"
+]
+name = "prowler"
+packages = [
+  {include = "prowler"}
+]
+readme = "README.md"
+version = "3.2.2"
+
+[tool.poetry.dependencies]
+alive-progress = "2.4.1"
+arnparse = "0.0.2"
+azure-identity = "1.12.0"
+azure-mgmt-authorization = "3.0.0"
+azure-mgmt-security = "3.0.0"
+azure-mgmt-storage = "21.0.0"
+azure-mgmt-subscription = "3.1.1"
+azure-storage-blob = "12.14.1"
+boto3 = "1.26.74"
+botocore = "1.29.74"
+colorama = "0.4.5"
+detect-secrets = "1.4.0"
+mkdocs = {version = "1.4.2", optional = true}
+mkdocs-material = {version = "8.2.1", optional = true}
+msgraph-core = "0.2.2"
+pydantic = "1.10.5"
+python = "^3.9"
+schema = "0.7.5"
+shodan = "1.28.0"
+tabulate = "0.9.0"
+
+[tool.poetry.extras]
+docs = ["mkdocs", "mkdocs-material"]
+
+[tool.poetry.group.dev.dependencies]
+bandit = "1.7.4"
+black = "22.10.0"
+coverage = "7.1.0"
+docker = "6.0.0"
+flake8 = "5.0.4"
+freezegun = "1.2.1"
+moto = "4.1.2"
+openapi-spec-validator = "0.5.5"
+pylint = "2.16.2"
+pytest = "7.2.1"
+pytest-xdist = "3.2.0"
+safety = "2.3.5"
+sure = "2.0.1"
+vulture = "2.7"
+
+[tool.poetry.scripts]
+prowler = "prowler.__main__:prowler"
+
+[tool.poetry.urls]
+"Changelog" = "https://github.com/prowler-cloud/prowler/releases"
+"Documentation" = "https://docs.prowler.cloud"
+"Homepage" = "https://github.com/prowler-cloud/prowler"
+"Issue tracker" = "https://github.com/prowler-cloud/prowler/issues"
+
+[tool.poetry-version-plugin]
+source = "init"
+
+[tool.poetry_bumpversion.file."prowler/config/config.py"]
+replace = 'prowler_version = "{new_version}"'
+search = 'prowler_version = "{current_version}"'
+
+[tool.pytest.ini_options]
+pythonpath = [
+  "."
+]