Prowler 3.3.0__tar.gz → 3.3.2__tar.gz

{prowler-3.3.0 → prowler-3.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: prowler
-Version: 3.3.0
+Version: 3.3.2
 Summary: Prowler is an Open Source security tool to perform Cloud Security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 240 controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.
 License: Apache-2.0
 Author: Toni de la Fuente
@@ -16,7 +16,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.9
 Provides-Extra: docs
-Requires-Dist: alive-progress (==3.0.1)
+Requires-Dist: alive-progress (==3.1.0)
 Requires-Dist: arnparse (==0.0.2)
 Requires-Dist: azure-identity (==1.12.0)
 Requires-Dist: azure-mgmt-authorization (==3.0.0)
@@ -24,14 +24,14 @@ Requires-Dist: azure-mgmt-security (==3.0.0)
 Requires-Dist: azure-mgmt-storage (==21.0.0)
 Requires-Dist: azure-mgmt-subscription (==3.1.1)
 Requires-Dist: azure-storage-blob (==12.15.0)
-Requires-Dist: boto3 (==1.26.86)
-Requires-Dist: botocore (==1.29.90)
+Requires-Dist: boto3 (==1.26.90)
+Requires-Dist: botocore (==1.29.100)
 Requires-Dist: colorama (==0.4.6)
 Requires-Dist: detect-secrets (==1.4.0)
 Requires-Dist: mkdocs (==1.4.2) ; extra == "docs"
-Requires-Dist: mkdocs-material (==9.1.2) ; extra == "docs"
+Requires-Dist: mkdocs-material (==9.1.4) ; extra == "docs"
 Requires-Dist: msgraph-core (==0.2.2)
-Requires-Dist: pydantic (==1.10.6)
+Requires-Dist: pydantic (==1.10.7)
 Requires-Dist: schema (==0.7.5)
 Requires-Dist: shodan (==1.28.0)
 Requires-Dist: tabulate (==0.9.0)

{prowler-3.3.0 → prowler-3.3.2}/prowler/compliance/aws/ens_rd2022_aws.json

@@ -1626,7 +1626,7 @@
         }
       ],
       "Checks": [
-        "ec2_securitygroup_in_use_without_ingress_filtering"
+        "ec2_securitygroup_allow_ingress_from_internet_to_any_port"
       ]
     },
     {

{prowler-3.3.0 → prowler-3.3.2}/prowler/config/config.py

@@ -1,15 +1,17 @@
+import json
 import os
 import pathlib
 from datetime import datetime, timezone
 from os import getcwd
 
+import requests
 import yaml
 
 from prowler.lib.logger import logger
 
 timestamp = datetime.today()
 timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc)
-prowler_version = "3.3.0"
+prowler_version = "3.3.2"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 html_logo_img = "https://user-images.githubusercontent.com/3985464/113734260-7ba06900-96fb-11eb-82bc-d4f68a1e2710.png"
 
@@ -43,6 +45,20 @@ html_file_suffix = ".html"
 config_yaml = f"{pathlib.Path(os.path.dirname(os.path.realpath(__file__)))}/config.yaml"
 
 
+def check_current_version(prowler_version):
+    try:
+        release_response = requests.get(
+            "https://api.github.com/repos/prowler-cloud/prowler/tags"
+        )
+        latest_version = json.loads(release_response)[0]["name"]
+        if latest_version != prowler_version:
+            return f"(latest is {latest_version}, upgrade for the latest features)"
+        else:
+            return "(it is the latest version, yay!)"
+    except Exception:
+        return ""
+
+
 def change_config_var(variable, value):
     try:
         with open(config_yaml) as f:

{prowler-3.3.0 → prowler-3.3.2}/prowler/lib/cli/parser.py

@@ -4,6 +4,7 @@ from argparse import RawTextHelpFormatter
 
 from prowler.config.config import (
     available_compliance_frameworks,
+    check_current_version,
     default_output_directory,
     prowler_version,
 )
@@ -36,7 +37,7 @@ Detailed documentation at https://docs.prowler.cloud
             "-v",
             "--version",
             action="version",
-            version=f"Prowler {prowler_version}",
+            version=f"Prowler {prowler_version} {check_current_version(prowler_version)}",
             help="show Prowler version",
         )
         # Common arguments parser

{prowler-3.3.0 → prowler-3.3.2}/prowler/lib/outputs/outputs.py

@@ -208,6 +208,8 @@ def send_to_s3_bucket(
             filename = f"{output_filename}{json_asff_file_suffix}"
         elif output_mode == "html":
             filename = f"{output_filename}{html_file_suffix}"
+        else:  # Compliance output mode
+            filename = f"{output_filename}_{output_mode}{csv_file_suffix}"
         logger.info(f"Sending outputs to S3 bucket {output_bucket}")
         bucket_remote_dir = output_directory
         while "prowler/" in bucket_remote_dir:  # Check if it is not a custom directory

{prowler-3.3.0 → prowler-3.3.2}/prowler/providers/aws/aws_provider.py

@@ -85,7 +85,7 @@ def assume_role(session: session.Session, assumed_role_info: AWS_Assume_Role) ->
         if assumed_role_info.external_id:
             assumed_credentials = sts_client.assume_role(
                 RoleArn=assumed_role_info.role_arn,
-                RoleSessionName="ProwlerProAsessmentSession",
+                RoleSessionName="ProwlerAsessmentSession",
                 DurationSeconds=assumed_role_info.session_duration,
                 ExternalId=assumed_role_info.external_id,
             )

{prowler-3.3.0 → prowler-3.3.2}/prowler/providers/aws/aws_regions_by_service.json

@@ -457,23 +457,29 @@
           "ap-east-1",
           "ap-northeast-1",
           "ap-south-1",
+          "ap-south-2",
           "ap-southeast-1",
           "eu-west-1",
           "eu-west-2",
           "me-south-1",
           "us-east-2",
-          "us-west-2",
-          "af-south-1",
           "ap-northeast-2",
           "ap-northeast-3",
+          "ap-southeast-4",
           "ca-central-1",
-          "eu-south-1",
+          "eu-central-2",
+          "me-central-1",
           "sa-east-1",
-          "us-east-1",
           "us-west-1",
+          "us-west-2",
+          "af-south-1",
           "ap-southeast-2",
+          "ap-southeast-3",
           "eu-central-1",
           "eu-north-1",
+          "eu-south-1",
+          "eu-south-2",
+          "us-east-1",
           "eu-west-3"
         ],
         "aws-cn": [
@@ -481,8 +487,8 @@
           "cn-northwest-1"
         ],
         "aws-us-gov": [
-          "us-gov-west-1",
-          "us-gov-east-1"
+          "us-gov-east-1",
+          "us-gov-west-1"
         ]
       }
     },
@@ -736,15 +742,17 @@
       "regions": {
         "aws": [
           "ap-northeast-1",
+          "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
-          "ap-southeast-3",
           "eu-central-1",
           "eu-north-1",
           "eu-west-1",
           "us-east-1",
           "us-east-2",
-          "us-west-2"
+          "us-west-2",
+          "ap-southeast-3",
+          "eu-west-2"
         ],
         "aws-cn": [],
         "aws-us-gov": []
@@ -4809,7 +4817,9 @@
           "us-west-2"
         ],
         "aws-cn": [],
-        "aws-us-gov": []
+        "aws-us-gov": [
+          "us-gov-west-1"
+        ]
       }
     },
     "iotwireless": {
@@ -5176,6 +5186,38 @@
         ]
       }
     },
+    "launchwizard": {
+      "regions": {
+        "aws": [
+          "af-south-1",
+          "ap-east-1",
+          "ap-northeast-1",
+          "ap-northeast-3",
+          "eu-central-1",
+          "eu-north-1",
+          "eu-west-2",
+          "us-east-2",
+          "us-west-1",
+          "ap-south-1",
+          "ap-southeast-1",
+          "ap-southeast-2",
+          "eu-south-1",
+          "eu-west-1",
+          "eu-west-3",
+          "me-south-1",
+          "sa-east-1",
+          "us-west-2",
+          "ap-northeast-2",
+          "ca-central-1",
+          "us-east-1"
+        ],
+        "aws-cn": [],
+        "aws-us-gov": [
+          "us-gov-west-1",
+          "us-gov-east-1"
+        ]
+      }
+    },
     "lex-models": {
       "regions": {
         "aws": [
@@ -5970,6 +6012,7 @@
           "sa-east-1",
           "us-east-1",
           "eu-central-1",
+          "me-central-1",
           "us-west-2"
         ],
         "aws-cn": [],
@@ -6237,7 +6280,6 @@
           "eu-central-2",
           "eu-south-1",
           "me-south-1",
-          "sa-east-1",
           "us-east-2",
           "ap-northeast-1",
           "ap-south-2",
@@ -6245,9 +6287,13 @@
           "ap-southeast-4",
           "eu-north-1",
           "eu-west-3",
-          "me-central-1"
+          "me-central-1",
+          "sa-east-1"
+        ],
+        "aws-cn": [
+          "cn-north-1",
+          "cn-northwest-1"
         ],
-        "aws-cn": [],
         "aws-us-gov": []
       }
     },
@@ -7080,7 +7126,9 @@
           "us-west-1",
           "ap-northeast-1",
           "ap-south-1",
+          "ap-south-2",
           "eu-central-1",
+          "eu-central-2",
           "eu-south-2",
           "eu-west-2",
           "us-east-1",
@@ -7563,9 +7611,9 @@
           "us-west-1",
           "us-west-2",
           "af-south-1",
-          "ap-northeast-2",
           "ap-southeast-3",
           "eu-central-1",
+          "eu-central-2",
           "eu-south-1",
           "eu-west-1",
           "eu-west-3",
@@ -7573,6 +7621,7 @@
           "me-south-1",
           "us-east-2",
           "ap-east-1",
+          "ap-northeast-2",
           "ap-south-1",
           "ap-southeast-1",
           "ca-central-1",
@@ -7637,21 +7686,23 @@
           "ap-northeast-3",
           "ap-southeast-1",
           "ap-southeast-2",
-          "ap-southeast-3",
+          "eu-south-2",
           "sa-east-1",
           "us-west-1",
           "ap-northeast-1",
           "ap-south-1",
+          "ap-southeast-3",
           "ca-central-1",
           "eu-central-1",
-          "eu-south-1",
+          "eu-central-2",
           "eu-west-1",
-          "me-central-1",
           "me-south-1",
           "us-east-1",
           "ap-northeast-2",
           "eu-north-1",
+          "eu-south-1",
           "eu-west-2",
+          "me-central-1",
           "us-east-2",
           "us-west-2"
         ],
@@ -7678,15 +7729,17 @@
           "us-east-2",
           "af-south-1",
           "ap-northeast-1",
-          "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-3",
           "ca-central-1",
+          "eu-south-2",
           "eu-west-2",
           "me-central-1",
           "ap-northeast-2",
           "ap-northeast-3",
+          "ap-south-1",
           "ap-southeast-2",
+          "eu-central-2",
           "eu-north-1",
           "sa-east-1",
           "us-west-1",
@@ -7834,26 +7887,29 @@
         "aws": [
           "ap-east-1",
           "ap-northeast-2",
+          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ca-central-1",
-          "eu-north-1",
           "eu-west-2",
           "us-east-2",
           "us-west-2",
           "af-south-1",
           "ap-northeast-3",
           "ap-southeast-3",
+          "eu-north-1",
           "eu-south-1",
           "eu-west-1",
           "eu-west-3",
           "me-central-1",
-          "me-south-1",
           "sa-east-1",
           "us-east-1",
           "ap-northeast-1",
           "ap-south-1",
           "eu-central-1",
+          "eu-central-2",
+          "eu-south-2",
+          "me-south-1",
           "us-west-1"
         ],
         "aws-cn": [
@@ -7870,9 +7926,12 @@
       "regions": {
         "aws": [
           "ap-northeast-1",
+          "ap-southeast-1",
           "ap-southeast-2",
           "eu-central-1",
           "eu-west-1",
+          "eu-west-2",
+          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -7963,16 +8022,20 @@
           "af-south-1",
           "ap-east-1",
           "ap-northeast-3",
-          "ap-southeast-1",
+          "ap-south-2",
           "ap-southeast-2",
           "ap-southeast-3",
-          "eu-central-1",
+          "me-central-1",
           "me-south-1",
           "sa-east-1",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-south-1",
+          "ap-southeast-1",
+          "eu-central-1",
+          "eu-central-2",
           "eu-south-1",
+          "eu-south-2",
           "eu-west-1",
           "us-west-1"
         ],
@@ -8026,9 +8089,9 @@
           "ap-northeast-1",
           "ap-southeast-1",
           "ap-southeast-2",
+          "ap-southeast-4",
           "eu-south-1",
           "eu-south-2",
-          "eu-west-2",
           "eu-west-3",
           "us-west-1",
           "af-south-1",
@@ -8036,7 +8099,7 @@
           "ap-southeast-3",
           "ca-central-1",
           "eu-central-1",
-          "eu-north-1",
+          "eu-west-2",
           "us-east-2",
           "us-west-2",
           "ap-east-1",
@@ -8044,11 +8107,12 @@
           "ap-south-1",
           "ap-south-2",
           "eu-central-2",
+          "eu-north-1",
           "eu-west-1",
-          "me-central-1",
           "me-south-1",
           "sa-east-1",
-          "us-east-1"
+          "us-east-1",
+          "me-central-1"
         ],
         "aws-cn": [
           "cn-north-1",
@@ -8938,8 +9002,7 @@
           "eu-west-2",
           "me-south-1",
           "us-east-1",
-          "us-east-2",
-          "us-west-2"
+          "us-east-2"
         ],
         "aws-cn": [],
         "aws-us-gov": []
@@ -8960,14 +9023,15 @@
           "us-west-1",
           "ap-northeast-2",
           "ap-northeast-3",
-          "eu-north-1",
           "eu-west-2",
           "eu-west-3",
+          "me-central-1",
           "me-south-1",
           "us-east-1",
           "us-west-2",
           "ap-northeast-1",
           "ca-central-1",
+          "eu-north-1",
           "eu-south-1",
           "eu-west-1"
         ],

{prowler-3.3.0 → prowler-3.3.2}/prowler/providers/aws/lib/quick_inventory/quick_inventory.py

@@ -166,7 +166,7 @@ def create_inventory_table(resources: list, resources_in_region: dict) -> dict:
             elif "documentation" in split_parts and "parts" in split_parts:
                 resource_type = "restapis-documentation-parts"
             else:
-                resource_type = resource.split(":")[5].split("/")[1]
+                resource_type = resource["arn"].split(":")[5].split("/")[1]
         else:
             resource_type = resource["arn"].split(":")[5].split("/")[0]
         if service not in resources_type:

{prowler-3.3.0 → prowler-3.3.2}/prowler/providers/aws/services/codeartifact/codeartifact_service.py

@@ -2,6 +2,7 @@ import threading
 from enum import Enum
 from typing import Optional
 
+from botocore.exceptions import ClientError
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
@@ -68,8 +69,8 @@ class CodeArtifact:
 
     def __list_packages__(self, regional_client):
         logger.info("CodeArtifact - Listing Packages and retrieving information...")
-        try:
-            for repository in self.repositories:
+        for repository in self.repositories:
+            try:
                 if self.repositories[repository].region == regional_client.region:
                     list_packages_paginator = regional_client.get_paginator(
                         "list_packages"
@@ -142,12 +143,21 @@ class CodeArtifact:
                     # Save all the packages information
                     self.repositories[repository].packages = packages
 
-        except Exception as error:
-            logger.error(
-                f"{regional_client.region} --"
-                f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
-                f" {error}"
-            )
+            except ClientError as error:
+                if error.response["Error"]["Code"] == "ResourceNotFoundException":
+                    logger.warning(
+                        f"{regional_client.region} --"
+                        f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+                        f" {error}"
+                    )
+                    continue
+
+            except Exception as error:
+                logger.error(
+                    f"{regional_client.region} --"
+                    f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+                    f" {error}"
+                )
 
     def __list_tags_for_resource__(self):
         logger.info("CodeArtifact - List Tags...")

{prowler-3.3.0 → prowler-3.3.2}/prowler/providers/aws/services/ec2/ec2_service.py

@@ -195,8 +195,8 @@ class EC2:
 
     def __get_snapshot_public__(self):
         logger.info("EC2 - Gettting snapshots encryption...")
-        try:
-            for snapshot in self.snapshots:
+        for snapshot in self.snapshots:
+            try:
                 regional_client = self.regional_clients[snapshot.region]
                 snapshot_public = regional_client.describe_snapshot_attribute(
                     Attribute="createVolumePermission", SnapshotId=snapshot.id
@@ -205,10 +205,20 @@ class EC2:
                     if "Group" in permission:
                         if permission["Group"] == "all":
                             snapshot.public = True
-        except Exception as error:
-            logger.error(
-                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-            )
+
+            except ClientError as error:
+                if error.response["Error"]["Code"] == "InvalidSnapshot.NotFound":
+                    logger.warning(
+                        f"{snapshot.region} --"
+                        f" {error.__class__.__name__}[{error.__traceback__.tb_lineno}]:"
+                        f" {error}"
+                    )
+                    continue
+
+            except Exception as error:
+                logger.error(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
 
     def __describe_network_interfaces__(self, regional_client):
         logger.info("EC2 - Describing Network Interfaces...")
@@ -239,23 +249,25 @@ class EC2:
 
     def __get_instance_user_data__(self):
         logger.info("EC2 - Gettting instance user data...")
-        try:
-            for instance in self.instances:
+        for instance in self.instances:
+            try:
                 regional_client = self.regional_clients[instance.region]
                 user_data = regional_client.describe_instance_attribute(
                     Attribute="userData", InstanceId=instance.id
                 )["UserData"]
                 if "Value" in user_data:
                     instance.user_data = user_data["Value"]
-        except ClientError as error:
-            if error.response["Error"]["Code"] == "InvalidInstanceID.NotFound":
-                logger.warning(
+
+            except ClientError as error:
+                if error.response["Error"]["Code"] == "InvalidInstanceID.NotFound":
+                    logger.warning(
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+                    continue
+            except Exception as error:
+                logger.error(
                     f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                 )
-        except Exception as error:
-            logger.error(
-                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-            )
 
     def __describe_images__(self, regional_client):
         logger.info("EC2 - Describing Images...")

prowler-3.3.2/prowler/providers/aws/services/s3/s3_bucket_level_public_access_block/s3_bucket_level_public_access_block.py

@@ -0,0 +1,24 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.s3.s3_client import s3_client
+
+
+class s3_bucket_level_public_access_block(Check):
+    def execute(self):
+        findings = []
+        for bucket in s3_client.buckets:
+            if bucket.public_access_block:
+                report = Check_Report_AWS(self.metadata())
+                report.region = bucket.region
+                report.resource_id = bucket.name
+                report.resource_arn = bucket.arn
+                report.resource_tags = bucket.tags
+                report.status = "PASS"
+                report.status_extended = f"Block Public Access is configured for the S3 Bucket {bucket.name}."
+                if not (
+                    bucket.public_access_block.ignore_public_acls
+                    and bucket.public_access_block.restrict_public_buckets
+                ):
+                    report.status = "FAIL"
+                    report.status_extended = f"Block Public Access is not configured for the S3 Bucket {bucket.name}."
+                findings.append(report)
+        return findings