Prowler 3.3.2__tar.gz → 3.3.4__tar.gz

{prowler-3.3.2 → prowler-3.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: prowler
-Version: 3.3.2
+Version: 3.3.4
 Summary: Prowler is an Open Source security tool to perform Cloud Security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 240 controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.
 License: Apache-2.0
 Author: Toni de la Fuente
@@ -25,11 +25,11 @@ Requires-Dist: azure-mgmt-storage (==21.0.0)
 Requires-Dist: azure-mgmt-subscription (==3.1.1)
 Requires-Dist: azure-storage-blob (==12.15.0)
 Requires-Dist: boto3 (==1.26.90)
-Requires-Dist: botocore (==1.29.100)
+Requires-Dist: botocore (==1.29.105)
 Requires-Dist: colorama (==0.4.6)
 Requires-Dist: detect-secrets (==1.4.0)
 Requires-Dist: mkdocs (==1.4.2) ; extra == "docs"
-Requires-Dist: mkdocs-material (==9.1.4) ; extra == "docs"
+Requires-Dist: mkdocs-material (==9.1.5) ; extra == "docs"
 Requires-Dist: msgraph-core (==0.2.2)
 Requires-Dist: pydantic (==1.10.7)
 Requires-Dist: schema (==0.7.5)

{prowler-3.3.2 → prowler-3.3.4}/prowler/config/config.py

@@ -11,7 +11,7 @@ from prowler.lib.logger import logger
 
 timestamp = datetime.today()
 timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc)
-prowler_version = "3.3.2"
+prowler_version = "3.3.4"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 html_logo_img = "https://user-images.githubusercontent.com/3985464/113734260-7ba06900-96fb-11eb-82bc-d4f68a1e2710.png"
 

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/aws_regions_by_service.json

@@ -123,9 +123,9 @@
     "acm-pca": {
       "regions": {
         "aws": [
-          "ap-east-1",
           "ap-northeast-3",
           "ap-south-1",
+          "ap-south-2",
           "ap-southeast-1",
           "eu-south-1",
           "eu-west-2",
@@ -133,15 +133,18 @@
           "me-south-1",
           "us-east-2",
           "us-west-1",
-          "af-south-1",
+          "ap-east-1",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-southeast-2",
           "ap-southeast-3",
           "ca-central-1",
           "eu-central-1",
+          "eu-south-2",
           "eu-west-1",
           "us-east-1",
+          "af-south-1",
+          "eu-central-2",
           "eu-north-1",
           "eu-west-3",
           "sa-east-1",
@@ -149,14 +152,15 @@
         ],
         "aws-cn": [],
         "aws-us-gov": [
-          "us-gov-west-1",
-          "us-gov-east-1"
+          "us-gov-east-1",
+          "us-gov-west-1"
         ]
       }
     },
     "ahl": {
       "regions": {
         "aws": [
+          "ap-south-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -667,7 +671,6 @@
     "appstream": {
       "regions": {
         "aws": [
-          "ap-northeast-1",
           "ap-northeast-2",
           "ap-south-1",
           "ap-southeast-1",
@@ -677,12 +680,14 @@
           "eu-west-2",
           "sa-east-1",
           "us-west-2",
+          "ap-northeast-1",
           "ap-southeast-2",
           "us-east-1",
           "us-east-2"
         ],
         "aws-cn": [],
         "aws-us-gov": [
+          "us-gov-east-1",
           "us-gov-west-1"
         ]
       }
@@ -741,18 +746,22 @@
     "arc-zonal-shift": {
       "regions": {
         "aws": [
-          "ap-northeast-1",
+          "af-south-1",
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
           "eu-central-1",
           "eu-north-1",
           "eu-west-1",
+          "sa-east-1",
           "us-east-1",
-          "us-east-2",
           "us-west-2",
+          "ap-northeast-1",
+          "ap-northeast-2",
           "ap-southeast-3",
-          "eu-west-2"
+          "eu-west-2",
+          "eu-west-3",
+          "us-east-2"
         ],
         "aws-cn": [],
         "aws-us-gov": []
@@ -1713,26 +1722,29 @@
     "codebuild": {
       "regions": {
         "aws": [
-          "ap-northeast-1",
           "ap-northeast-2",
           "ap-south-1",
           "ap-southeast-1",
           "eu-central-1",
           "eu-south-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-3",
           "me-south-1",
           "us-west-1",
           "af-south-1",
           "ap-east-1",
+          "ap-northeast-1",
           "ap-northeast-3",
           "ap-southeast-2",
-          "eu-north-1",
           "eu-west-2",
           "us-east-1",
           "us-west-2",
+          "ap-south-2",
           "ap-southeast-3",
           "ca-central-1",
+          "eu-central-2",
+          "eu-north-1",
           "me-central-1",
           "sa-east-1",
           "us-east-2"
@@ -1881,21 +1893,24 @@
           "eu-north-1",
           "eu-south-1",
           "eu-west-1",
+          "me-south-1",
           "us-west-2",
+          "af-south-1",
           "ap-northeast-1",
-          "ca-central-1",
           "eu-central-1",
+          "eu-central-2",
           "eu-west-2",
           "eu-west-3",
           "sa-east-1",
           "us-east-1",
-          "us-east-2",
           "us-west-1",
-          "ap-southeast-1"
+          "ap-southeast-1",
+          "ca-central-1",
+          "us-east-2"
         ],
         "aws-cn": [
-          "cn-north-1",
-          "cn-northwest-1"
+          "cn-northwest-1",
+          "cn-north-1"
         ],
         "aws-us-gov": [
           "us-gov-west-1"
@@ -7729,18 +7744,19 @@
           "us-east-2",
           "af-south-1",
           "ap-northeast-1",
+          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-3",
           "ca-central-1",
           "eu-south-2",
           "eu-west-2",
-          "me-central-1",
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
           "ap-southeast-2",
           "eu-central-2",
           "eu-north-1",
+          "me-central-1",
           "sa-east-1",
           "us-west-1",
           "us-west-2"
@@ -7980,24 +7996,28 @@
           "ap-south-1",
           "ap-southeast-2",
           "ap-southeast-3",
-          "ca-central-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "us-east-2",
           "ap-east-1",
           "ap-northeast-3",
+          "ap-southeast-4",
+          "ca-central-1",
           "eu-central-1",
           "eu-north-1",
-          "me-south-1",
           "sa-east-1",
           "us-west-1",
           "us-west-2",
           "af-south-1",
+          "ap-south-2",
           "ap-southeast-1",
+          "eu-central-2",
           "eu-south-1",
           "eu-west-3",
-          "me-central-1",
-          "us-east-1"
+          "me-south-1",
+          "us-east-1",
+          "me-central-1"
         ],
         "aws-cn": [
           "cn-northwest-1",
@@ -9436,7 +9456,9 @@
           "us-east-1"
         ],
         "aws-cn": [],
-        "aws-us-gov": []
+        "aws-us-gov": [
+          "us-gov-west-1"
+        ]
       }
     },
     "wisdom": {

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/services/cloudformation/cloudformation_service.py

@@ -1,6 +1,7 @@
 import threading
 from typing import Optional
 
+from botocore.client import ClientError
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
@@ -65,8 +66,8 @@ class CloudFormation:
     def __describe_stack__(self):
         """Get Details for a CloudFormation Stack"""
         logger.info("CloudFormation - Describing Stack to get specific details...")
-        try:
-            for stack in self.stacks:
+        for stack in self.stacks:
+            try:
                 stack_details = self.regional_clients[stack.region].describe_stacks(
                     StackName=stack.name
                 )
@@ -79,10 +80,16 @@ class CloudFormation:
                     stack.root_nested_stack = stack_details["Stacks"][0]["RootId"]
                 stack.is_nested_stack = True if stack.root_nested_stack != "" else False
 
-        except Exception as error:
-            logger.error(
-                f"{stack.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-            )
+            except ClientError as error:
+                if error.response["Error"]["Code"] != "ValidationError":
+                    logger.warning(
+                        f"{stack.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+                    continue
+            except Exception as error:
+                logger.error(
+                    f"{stack.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
 
 
 class Stack(BaseModel):

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/services/dynamodb/dynamodb_service.py

@@ -1,6 +1,7 @@
 import threading
 from typing import Optional
 
+from botocore.client import ClientError
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
@@ -168,15 +169,24 @@ class DAX:
 
     def __list_tags_for_resource__(self):
         logger.info("DAX - List Tags...")
-        try:
-            for cluster in self.clusters:
+        for cluster in self.clusters:
+            try:
                 regional_client = self.regional_clients[cluster.region]
-                response = regional_client.list_tags(ResourceName=cluster.name)["Tags"]
+                # In the DAX service to call list_tags we need to pass the cluster ARN as the resource name
+                response = regional_client.list_tags(ResourceName=cluster.arn)["Tags"]
                 cluster.tags = response
-        except Exception as error:
-            logger.error(
-                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-            )
+
+            except ClientError as error:
+                if error.response["Error"]["Code"] != "InvalidARNFault":
+                    logger.warning(
+                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+                    continue
+
+            except Exception as error:
+                logger.error(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
 
 
 class Table(BaseModel):

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.metadata.json

@@ -1,7 +1,7 @@
 {
   "Provider": "aws",
   "CheckID": "elbv2_desync_mitigation_mode",
-  "CheckTitle": "Check whether the Application Load Balancer is configured with defensive or strictest desync mitigation mode.",
+  "CheckTitle": "Check whether the Application Load Balancer is configured with defensive or strictest desync mitigation mode, if not check if at least is configured with the drop_invalid_header_fields attribute",
   "CheckType": [
     "Data Protection"
   ],
@@ -10,7 +10,7 @@
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
   "Severity": "medium",
   "ResourceType": "AwsElasticLoadBalancingV2LoadBalancer",
-  "Description": "Check whether the Application Load Balancer is configured with defensive or strictest desync mitigation mode.",
+  "Description": "Check whether the Application Load Balancer is configured with defensive or strictest desync mitigation mode, if not check if at least is configured with the drop_invalid_header_fields attribute",
   "Risk": "HTTP Desync issues can lead to request smuggling and make your applications vulnerable to request queue or cache poisoning; which could lead to credential hijacking or execution of unauthorized commands.",
   "RelatedUrl": "",
   "Remediation": {
@@ -21,7 +21,7 @@
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Ensure Application Load Balancer is configured with defensive or strictest desync mitigation mode.",
+      "Text": "Ensure Application Load Balancer is configured with defensive or strictest desync mitigation mode or with the drop_invalid_header_fields attribute enabled",
       "Url": "https://aws.amazon.com/about-aws/whats-new/2020/08/application-and-classic-load-balancers-adding-defense-in-depth-with-introduction-of-desync-mitigation-mode/"
     }
   },

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/services/elbv2/elbv2_desync_mitigation_mode/elbv2_desync_mitigation_mode.py

@@ -15,9 +15,11 @@ class elbv2_desync_mitigation_mode(Check):
                 report.status = "PASS"
                 report.status_extended = f"ELBv2 ALB {lb.name} is configured with correct desync mitigation mode."
                 if lb.desync_mitigation_mode == "monitor":
-                    report.status = "FAIL"
-                    report.status_extended = f"ELBv2 ALB {lb.name} does not have desync mitigation mode set as defensive or strictest."
-
+                    if lb.drop_invalid_header_fields == "false":
+                        report.status = "FAIL"
+                        report.status_extended = f"ELBv2 ALB {lb.name} does not have desync mitigation mode set as defensive or strictest and is not dropping invalid header fields"
+                    elif lb.drop_invalid_header_fields == "true":
+                        report.status_extended = f"ELBv2 ALB {lb.name} does not have desync mitigation mode set as defensive or strictest but is dropping invalid header fields"
                 findings.append(report)
 
         return findings

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/services/iam/iam_service.py

@@ -2,6 +2,7 @@ import csv
 from datetime import datetime
 from typing import Optional
 
+from botocore.client import ClientError
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
@@ -104,6 +105,13 @@ class IAM:
             credential_lines = credential.split("\n")
             csv_reader = csv.DictReader(credential_lines, delimiter=",")
             credential_list = list(csv_reader)
+
+        except ClientError as error:
+            if error.response["Error"]["Code"] != "LimitExceededException":
+                logger.warning(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
         except Exception as error:
             logger.error(
                 f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/services/rds/rds_service.py

@@ -1,6 +1,7 @@
 import threading
 from typing import Optional
 
+from botocore.client import ClientError
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
@@ -136,8 +137,8 @@ class RDS:
 
     def __describe_db_snapshot_attributes__(self, regional_client):
         logger.info("RDS - Describe Snapshot Attributes...")
-        try:
-            for snapshot in self.db_snapshots:
+        for snapshot in self.db_snapshots:
+            try:
                 if snapshot.region == regional_client.region:
                     response = regional_client.describe_db_snapshot_attributes(
                         DBSnapshotIdentifier=snapshot.id
@@ -145,11 +146,16 @@ class RDS:
                     for att in response["DBSnapshotAttributes"]:
                         if "all" in att["AttributeValues"]:
                             snapshot.public = True
-
-        except Exception as error:
-            logger.error(
-                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-            )
+            except ClientError as error:
+                if error.response["Error"]["Code"] != "DBSnapshotNotFound":
+                    logger.warning(
+                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+                    continue
+            except Exception as error:
+                logger.error(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
 
     def __describe_db_cluster_snapshots__(self, regional_client):
         logger.info("RDS - Describe Cluster Snapshots...")

{prowler-3.3.2 → prowler-3.3.4}/prowler/providers/aws/services/secretsmanager/secretsmanager_automatic_rotation_enabled/secretsmanager_automatic_rotation_enabled.metadata.json

@@ -1,15 +1,15 @@
 {
   "Provider": "aws",
   "CheckID": "secretsmanager_automatic_rotation_enabled",
-  "CheckTitle": "Check if Secrets Manager key rotation is enabled.",
+  "CheckTitle": "Check if Secrets Manager secret rotation is enabled.",
   "CheckType": [],
   "ServiceName": "secretsmanager",
   "SubServiceName": "",
   "ResourceIdTemplate": "arn:aws:secretsmanager:region:account-id:secret:secret-name",
   "Severity": "medium",
   "ResourceType": "AwsSecretsManagerSecret",
-  "Description": "Check if Secrets Manager key rotation is enabled.",
-  "Risk": "Rotating secrets minimizes exposure to attacks using stolen keys.",
+  "Description": "Check if Secrets Manager secret rotation is enabled.",
+  "Risk": "Rotating secrets minimizes exposure to attacks using stolen secrets.",
   "RelatedUrl": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html",
   "Remediation": {
     "Code": {

{prowler-3.3.2 → prowler-3.3.4}/pyproject.toml

@@ -22,7 +22,7 @@ packages = [
   {include = "prowler"}
 ]
 readme = "README.md"
-version = "3.3.2"
+version = "3.3.4"
 
 [tool.poetry.dependencies]
 alive-progress = "3.1.0"
@@ -34,11 +34,11 @@ azure-mgmt-storage = "21.0.0"
 azure-mgmt-subscription = "3.1.1"
 azure-storage-blob = "12.15.0"
 boto3 = "1.26.90"
-botocore = "1.29.100"
+botocore = "1.29.105"
 colorama = "0.4.6"
 detect-secrets = "1.4.0"
 mkdocs = {version = "1.4.2", optional = true}
-mkdocs-material = {version = "9.1.4", optional = true}
+mkdocs-material = {version = "9.1.5", optional = true}
 msgraph-core = "0.2.2"
 pydantic = "1.10.7"
 python = "^3.9"
@@ -56,9 +56,9 @@ coverage = "7.2.2"
 docker = "6.0.1"
 flake8 = "6.0.0"
 freezegun = "1.2.2"
-moto = "4.1.5"
+moto = "4.1.6"
 openapi-spec-validator = "0.5.6"
-pylint = "2.17.0"
+pylint = "2.17.2"
 pytest = "7.2.2"
 pytest-xdist = "3.2.1"
 safety = "2.3.5"

prowler-3.3.2/prowler/providers/aws/services/elbv2/elbv2_request_smugling/elbv2_request_smugling.metadata.json

@@ -1,32 +0,0 @@
-{
-  "Provider": "aws",
-  "CheckID": "elbv2_request_smugling",
-  "CheckTitle": "Check if Application Load Balancer is dropping invalid packets to prevent header based HTTP request smuggling.",
-  "CheckType": [
-    "Data Protection"
-  ],
-  "ServiceName": "elbv2",
-  "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
-  "Severity": "medium",
-  "ResourceType": "AwsElasticLoadBalancingV2LoadBalancer",
-  "Description": "Check if Application Load Balancer is dropping invalid packets to prevent header based HTTP request smuggling.",
-  "Risk": "ALB can be target of actors sending bad HTTP headers.",
-  "RelatedUrl": "",
-  "Remediation": {
-    "Code": {
-      "CLI": "aws elbv2 modify-load-balancer-attributes --load-balancer-arn <lb_arn> --attributes Key=routing.http.drop_invalid_header_fields.enabled,Value=true",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELBv2/drop-invalid-header-fields-enabled.html",
-      "Terraform": "https://docs.bridgecrew.io/docs/ensure-that-alb-drops-http-headers#terraform"
-    },
-    "Recommendation": {
-      "Text": "Ensure Application Load Balancer is configured for HTTP headers with header fields that are not valid are removed by the load balancer (true).",
-      "Url": "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#deletion-protection"
-    }
-  },
-  "Categories": [],
-  "DependsOn": [],
-  "RelatedTo": [],
-  "Notes": ""
-}

prowler-3.3.2/prowler/providers/aws/services/elbv2/elbv2_request_smugling/elbv2_request_smugling.py

@@ -1,27 +0,0 @@
-from prowler.lib.check.models import Check, Check_Report_AWS
-from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client
-
-
-class elbv2_request_smugling(Check):
-    def execute(self):
-        findings = []
-        for lb in elbv2_client.loadbalancersv2:
-            if lb.type == "application":
-                report = Check_Report_AWS(self.metadata())
-                report.region = lb.region
-                report.resource_id = lb.name
-                report.resource_arn = lb.arn
-                report.resource_tags = lb.tags
-                report.status = "FAIL"
-                report.status_extended = (
-                    f"ELBv2 ALB {lb.name} is not dropping invalid header fields."
-                )
-                if lb.drop_invalid_header_fields == "true":
-                    report.status = "PASS"
-                    report.status_extended = (
-                        f"ELBv2 ALB {lb.name} is dropping invalid header fields."
-                    )
-
-                findings.append(report)
-
-        return findings