Prowler 3.3.3__tar.gz → 3.3.4__tar.gz

{prowler-3.3.3 → prowler-3.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: prowler
-Version: 3.3.3
+Version: 3.3.4
 Summary: Prowler is an Open Source security tool to perform Cloud Security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 240 controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.
 License: Apache-2.0
 Author: Toni de la Fuente
@@ -28,7 +28,6 @@ Requires-Dist: boto3 (==1.26.90)
 Requires-Dist: botocore (==1.29.105)
 Requires-Dist: colorama (==0.4.6)
 Requires-Dist: detect-secrets (==1.4.0)
-Requires-Dist: google-api-python-client (==2.81.0)
 Requires-Dist: mkdocs (==1.4.2) ; extra == "docs"
 Requires-Dist: mkdocs-material (==9.1.5) ; extra == "docs"
 Requires-Dist: msgraph-core (==0.2.2)
@@ -78,14 +77,14 @@ Description-Content-Type: text/markdown
 
 # Description
 
-`Prowler` is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness.
+`Prowler` is an Open Source security tool to perform AWS and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness.
 
 It contains hundreds of controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.
 
 # 📖 Documentation
 
 The full documentation can now be found at [https://docs.prowler.cloud](https://docs.prowler.cloud)
-
+    
 ## Looking for Prowler v2 documentation?
 For Prowler v2 Documentation, please go to https://github.com/prowler-cloud/prowler/tree/2.12.1.
 
@@ -98,7 +97,7 @@ Prowler is available as a project in [PyPI](https://pypi.org/project/prowler-clo
 pip install prowler
 prowler -v
 ```
-More details at https://docs.prowler.cloud
+More details at https://docs.prowler.cloud 
 
 ## Containers
 
@@ -107,7 +106,7 @@ The available versions of Prowler are the following:
 - `latest`: in sync with master branch (bear in mind that it is not a stable version)
 - `<x.y.z>` (release): you can find the releases [here](https://github.com/prowler-cloud/prowler/releases), those are stable releases.
 - `stable`: this tag always point to the latest release.
-
+    
 The container images are available here:
 
 - [DockerHub](https://hub.docker.com/r/toniblyx/prowler/tags)
@@ -160,22 +159,6 @@ Those credentials must be associated to a user or role with proper permissions t
 
   > If you want Prowler to send findings to [AWS Security Hub](https://aws.amazon.com/security-hub), make sure you also attach the custom policy [prowler-security-hub.json](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-security-hub.json).
 
-## Google Cloud Platform
-
-Prowler will follow the same credentials search as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order):
-
-1. [GOOGLE_APPLICATION_CREDENTIALS environment variable](https://cloud.google.com/docs/authentication/application-default-credentials#GAC)
-2. [User credentials set up by using the Google Cloud CLI](https://cloud.google.com/docs/authentication/application-default-credentials#personal)
-3. [The attached service account, returned by the metadata server](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa)
-
-Those credentials must be associated to a user or service account with proper permissions to do all checks. To make sure, add the following roles to the member associated with the credentials:
-
-  - Viewer
-  - Security Reviewer
-  - Stackdriver Account Viewer
-
-> `prowler` will scan the project associated with the credentials.
-
   ## Azure
 
   Prowler for Azure supports the following authentication types:
@@ -289,14 +272,6 @@ prowler aws --profile custom-profile -f us-east-1 eu-south-2
 ```
 > By default, `prowler` will scan all AWS regions.
 
-## Google Cloud Platform
-
-Optionally, you can provide the location of an application credential JSON file with the following argument:
-
-```console
-prowler gcp --credentials-file path
-```
-
 ## Azure
 
 With Azure you need to specify which auth method is going to be used:

{prowler-3.3.3 → prowler-3.3.4}/README.md

@@ -34,14 +34,14 @@
 
 # Description
 
-`Prowler` is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness.
+`Prowler` is an Open Source security tool to perform AWS and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness.
 
 It contains hundreds of controls covering CIS, PCI-DSS, ISO27001, GDPR, HIPAA, FFIEC, SOC2, AWS FTR, ENS and custom security frameworks.
 
 # 📖 Documentation
 
 The full documentation can now be found at [https://docs.prowler.cloud](https://docs.prowler.cloud)
-
+    
 ## Looking for Prowler v2 documentation?
 For Prowler v2 Documentation, please go to https://github.com/prowler-cloud/prowler/tree/2.12.1.
 
@@ -54,7 +54,7 @@ Prowler is available as a project in [PyPI](https://pypi.org/project/prowler-clo
 pip install prowler
 prowler -v
 ```
-More details at https://docs.prowler.cloud
+More details at https://docs.prowler.cloud 
 
 ## Containers
 
@@ -63,7 +63,7 @@ The available versions of Prowler are the following:
 - `latest`: in sync with master branch (bear in mind that it is not a stable version)
 - `<x.y.z>` (release): you can find the releases [here](https://github.com/prowler-cloud/prowler/releases), those are stable releases.
 - `stable`: this tag always point to the latest release.
-
+    
 The container images are available here:
 
 - [DockerHub](https://hub.docker.com/r/toniblyx/prowler/tags)
@@ -116,22 +116,6 @@ Those credentials must be associated to a user or role with proper permissions t
 
   > If you want Prowler to send findings to [AWS Security Hub](https://aws.amazon.com/security-hub), make sure you also attach the custom policy [prowler-security-hub.json](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-security-hub.json).
 
-## Google Cloud Platform
-
-Prowler will follow the same credentials search as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order):
-
-1. [GOOGLE_APPLICATION_CREDENTIALS environment variable](https://cloud.google.com/docs/authentication/application-default-credentials#GAC)
-2. [User credentials set up by using the Google Cloud CLI](https://cloud.google.com/docs/authentication/application-default-credentials#personal)
-3. [The attached service account, returned by the metadata server](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa)
-
-Those credentials must be associated to a user or service account with proper permissions to do all checks. To make sure, add the following roles to the member associated with the credentials:
-
-  - Viewer
-  - Security Reviewer
-  - Stackdriver Account Viewer
-
-> `prowler` will scan the project associated with the credentials.
-
   ## Azure
 
   Prowler for Azure supports the following authentication types:
@@ -245,14 +229,6 @@ prowler aws --profile custom-profile -f us-east-1 eu-south-2
 ```
 > By default, `prowler` will scan all AWS regions.
 
-## Google Cloud Platform
-
-Optionally, you can provide the location of an application credential JSON file with the following argument:
-
-```console
-prowler gcp --credentials-file path
-```
-
 ## Azure
 
 With Azure you need to specify which auth method is going to be used:

{prowler-3.3.3 → prowler-3.3.4}/prowler/config/allowlist.yaml

@@ -1,6 +1,5 @@
 ### Account, Check and/or Region can be * to apply for all the cases
-### Resources is a list that can have either Regex or Keywords
-### Tags is an optional list containing tuples of 'key=value'
+### Resources is a list that can have either Regex or Keywords:
 ###########################  ALLOWLIST EXAMPLE  ###########################
 Allowlist:
   Accounts:
@@ -16,10 +15,7 @@ Allowlist:
           Regions:
             - "*"
           Resources:
-            - "test"             # Will ignore every resource containing the string "test" and the tags 'test=test' and 'project=test' in account 123456789012 and every region
-          Tags:
-            - "test=test"        # Will ignore every resource containing the string "test" and the tags 'test=test' and 'project=test' in account 123456789012 and every region
-            - "project=test"
+            - "test"             # Will ignore every resource containing the string "test" in every account and region
 
     "*":
       Checks:
@@ -31,14 +27,6 @@ Allowlist:
             - "ci-logs"           # Will ignore bucket "ci-logs" AND ALSO bucket "ci-logs-replica" in specified check and regions
             - "logs"              # Will ignore EVERY BUCKET containing the string "logs" in specified check and regions
             - "[[:alnum:]]+-logs" # Will ignore all buckets containing the terms ci-logs, qa-logs, etc. in specified check and regions
-        "*":
-          Regions:
-            - "*"
-          Resources:
-            - "*"
-          Tags:
-            - "environment=dev"    # Will ignore every resource containing the tag 'environment=dev' in every account and region
-
 
 # EXAMPLE: CONTROL TOWER (to migrate)
 # When using Control Tower, guardrails prevent access to certain protected resources. The allowlist

{prowler-3.3.3 → prowler-3.3.4}/prowler/config/config.py

@@ -11,7 +11,7 @@ from prowler.lib.logger import logger
 
 timestamp = datetime.today()
 timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc)
-prowler_version = "3.3.3"
+prowler_version = "3.3.4"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 html_logo_img = "https://user-images.githubusercontent.com/3985464/113734260-7ba06900-96fb-11eb-82bc-d4f68a1e2710.png"
 
@@ -34,8 +34,6 @@ with os.scandir(compliance_aws_dir) as files:
 # AWS services-regions matrix json
 aws_services_json_file = "aws_regions_by_service.json"
 
-# gcp_zones_json_file = "gcp_zones.json"
-
 default_output_directory = getcwd() + "/output"
 
 output_file_timestamp = timestamp.strftime("%Y%m%d%H%M%S")

{prowler-3.3.3 → prowler-3.3.4}/prowler/config/config.yaml

@@ -41,17 +41,3 @@ obsolete_lambda_runtimes:
     "dotnetcore2.1",
     "ruby2.5",
   ]
-
-# AWS Organizations
-# organizations_scp_check_deny_regions
-# organizations_enabled_regions: [
-#   'eu-central-1',
-#   'eu-west-1',
-#   "us-east-1"
-# ]
-organizations_enabled_regions: []
-# organizations_delegated_administrators
-# organizations_trusted_delegated_administrators: [
-#   "12345678901"
-# ]
-organizations_trusted_delegated_administrators: []

{prowler-3.3.3 → prowler-3.3.4}/prowler/lib/check/models.py

@@ -128,23 +128,6 @@ class Check_Report_Azure(Check_Report):
         self.subscription = ""
 
 
-@dataclass
-class Check_Report_GCP(Check_Report):
-    """Contains the GCP Check's finding information."""
-
-    resource_name: str
-    resource_id: str
-    project_id: str
-    location: str
-
-    def __init__(self, metadata):
-        super().__init__(metadata)
-        self.resource_name = ""
-        self.resource_id = ""
-        self.project_id = ""
-        self.location = ""
-
-
 # Testing Pending
 def load_check_metadata(metadata_file: str) -> Check_Metadata_Model:
     """load_check_metadata loads and parse a Check's metadata file"""

{prowler-3.3.3 → prowler-3.3.4}/prowler/lib/cli/parser.py

@@ -58,7 +58,6 @@ Detailed documentation at https://docs.prowler.cloud
         # Init Providers Arguments
         self.__init_aws_parser__()
         self.__init_azure_parser__()
-        self.__init_gcp_parser__()
 
     def parse(self, args=None) -> argparse.Namespace:
         """
@@ -432,18 +431,3 @@ Detailed documentation at https://docs.prowler.cloud
             default=[],
             help="Azure subscription ids to be scanned by prowler",
         )
-
-    def __init_gcp_parser__(self):
-        """Init the GCP Provider CLI parser"""
-        gcp_parser = self.subparsers.add_parser(
-            "gcp", parents=[self.common_providers_parser], help="GCP Provider"
-        )
-        # Authentication Modes
-        gcp_auth_subparser = gcp_parser.add_argument_group("Authentication Modes")
-        gcp_auth_modes_group = gcp_auth_subparser.add_mutually_exclusive_group()
-        gcp_auth_modes_group.add_argument(
-            "--credentials-file",
-            nargs="?",
-            metavar="FILE_PATH",
-            help="Authenticate using a Google Service Account Application Credentials JSON file",
-        )

{prowler-3.3.3 → prowler-3.3.4}/prowler/lib/outputs/file_descriptors.py

@@ -16,13 +16,11 @@ from prowler.lib.outputs.models import (
     Check_Output_CSV_CIS,
     Check_Output_CSV_ENS_RD2022,
     Check_Output_CSV_Generic_Compliance,
-    Gcp_Check_Output_CSV,
     generate_csv_fields,
 )
 from prowler.lib.utils.utils import file_exists, open_file
 from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
 from prowler.providers.azure.lib.audit_info.models import Azure_Audit_Info
-from prowler.providers.gcp.lib.audit_info.models import GCP_Audit_Info
 
 
 def initialize_file_descriptor(
@@ -84,13 +82,6 @@ def fill_file_descriptors(output_modes, output_directory, output_filename, audit
                             audit_info,
                             Azure_Check_Output_CSV,
                         )
-                    if isinstance(audit_info, GCP_Audit_Info):
-                        file_descriptor = initialize_file_descriptor(
-                            filename,
-                            output_mode,
-                            audit_info,
-                            Gcp_Check_Output_CSV,
-                        )
                     file_descriptors.update({output_mode: file_descriptor})
 
                 elif output_mode == "json":

{prowler-3.3.3 → prowler-3.3.4}/prowler/lib/outputs/models.py

@@ -56,19 +56,6 @@ def generate_provider_output_csv(
             )
             finding_output = output_model(**data)
 
-        if provider == "gcp":
-            data["resource_id"] = finding.resource_id
-            data["resource_name"] = finding.resource_name
-            data["project_id"] = finding.project_id
-            data["location"] = finding.location
-            data[
-                "finding_unique_id"
-            ] = f"prowler-{provider}-{finding.check_metadata.CheckID}-{finding.project_id}-{finding.resource_id}"
-            data["compliance"] = unroll_dict(
-                get_check_compliance(finding, provider, output_options)
-            )
-            finding_output = output_model(**data)
-
         if provider == "aws":
             data["profile"] = audit_info.profile
             data["account_id"] = audit_info.audited_account
@@ -175,7 +162,7 @@ def unroll_list(listed_items: list):
 def unroll_tags(tags: list):
     unrolled_items = ""
     separator = "|"
-    if tags and tags != [{}] and tags != [None]:
+    if tags:
         for item in tags:
             # Check if there are tags in list
             if type(item) == dict:
@@ -318,17 +305,6 @@ class Azure_Check_Output_CSV(Check_Output_CSV):
     resource_name: str = ""
 
 
-class Gcp_Check_Output_CSV(Check_Output_CSV):
-    """
-    Gcp_Check_Output_CSV generates a finding's output in CSV format for the GCP provider.
-    """
-
-    project_id: str = ""
-    location: str = ""
-    resource_id: str = ""
-    resource_name: str = ""
-
-
 def generate_provider_output_json(
     provider: str, finding, audit_info, mode: str, output_options
 ):
@@ -357,16 +333,6 @@ def generate_provider_output_json(
                 finding, provider, output_options
             )
 
-        if provider == "gcp":
-            finding_output.ProjectId = audit_info.project_id
-            finding_output.Location = finding.location
-            finding_output.ResourceId = finding.resource_id
-            finding_output.ResourceName = finding.resource_name
-            finding_output.FindingUniqueId = f"prowler-{provider}-{finding.check_metadata.CheckID}-{finding.project_id}-{finding.resource_id}"
-            finding_output.Compliance = get_check_compliance(
-                finding, provider, output_options
-            )
-
         if provider == "aws":
             finding_output.Profile = audit_info.profile
             finding_output.AccountId = audit_info.audited_account
@@ -455,20 +421,6 @@ class Azure_Check_Output_JSON(Check_Output_JSON):
         super().__init__(**metadata)
 
 
-class Gcp_Check_Output_JSON(Check_Output_JSON):
-    """
-    Gcp_Check_Output_JSON generates a finding's output in JSON format for the AWS provider.
-    """
-
-    ProjectId: str = ""
-    ResourceId: str = ""
-    ResourceName: str = ""
-    Location: str = ""
-
-    def __init__(self, **metadata):
-        super().__init__(**metadata)
-
-
 class Check_Output_CSV_ENS_RD2022(BaseModel):
     """
     Check_Output_CSV_ENS_RD2022 generates a finding's output in CSV ENS RD2022 format.

{prowler-3.3.3 → prowler-3.3.4}/prowler/lib/outputs/outputs.py

@@ -20,7 +20,6 @@ from prowler.lib.outputs.models import (
     Check_Output_JSON_ASFF,
     generate_provider_output_csv,
     generate_provider_output_json,
-    unroll_tags,
 )
 from prowler.providers.aws.lib.allowlist.allowlist import is_allowlisted
 from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
@@ -33,8 +32,6 @@ def stdout_report(finding, color, verbose, is_quiet):
         details = finding.region
     if finding.check_metadata.Provider == "azure":
         details = finding.check_metadata.ServiceName
-    if finding.check_metadata.Provider == "gcp":
-        details = finding.location
 
     if verbose and not (is_quiet and finding.status != "FAIL"):
         print(
@@ -73,7 +70,6 @@ def report(check_findings, output_options, audit_info):
                         finding.check_metadata.CheckID,
                         finding.region,
                         finding.resource_id,
-                        unroll_tags(finding.resource_tags),
                     ):
                         finding.status = "WARNING"
                 # Print findings by stdout

{prowler-3.3.3 → prowler-3.3.4}/prowler/lib/outputs/summary_table.py

@@ -26,9 +26,6 @@ def display_summary_table(
             else:
                 entity_type = "Tenant ID/s"
                 audited_entities = " ".join(audit_info.identity.tenant_ids)
-        elif provider == "gcp":
-            entity_type = "Project ID"
-            audited_entities = audit_info.project_id
 
         if findings:
             current = {
@@ -56,6 +53,7 @@ def display_summary_table(
                     current["Service"] != finding.check_metadata.ServiceName
                     and current["Service"]
                 ):
+
                     add_service_to_table(findings_table, current)
 
                     current["Total"] = current["Critical"] = current["High"] = current[

{prowler-3.3.3 → prowler-3.3.4}/prowler/providers/aws/aws_regions_by_service.json

@@ -5147,7 +5147,6 @@
           "ap-south-1",
           "ap-southeast-2",
           "eu-west-2",
-          "me-central-1",
           "sa-east-1",
           "us-east-2"
         ],
@@ -6093,16 +6092,6 @@
         "aws-us-gov": []
       }
     },
-    "monitron": {
-      "regions": {
-        "aws": [
-          "eu-west-1",
-          "us-east-1"
-        ],
-        "aws-cn": [],
-        "aws-us-gov": []
-      }
-    },
     "mq": {
       "regions": {
         "aws": [
@@ -7651,7 +7640,6 @@
           "ap-south-1",
           "ap-southeast-1",
           "ca-central-1",
-          "eu-south-2",
           "sa-east-1"
         ],
         "aws-cn": [
@@ -7814,33 +7802,15 @@
     "scheduler": {
       "regions": {
         "aws": [
-          "ap-east-1",
           "ap-northeast-1",
-          "ap-northeast-2",
-          "ap-south-2",
-          "ap-southeast-3",
-          "ap-southeast-4",
+          "ap-southeast-1",
+          "ap-southeast-2",
           "eu-central-1",
           "eu-north-1",
+          "eu-west-1",
           "us-east-1",
           "us-east-2",
-          "ap-northeast-3",
-          "ap-south-1",
-          "ca-central-1",
-          "eu-central-2",
-          "eu-west-1",
-          "eu-west-2",
-          "eu-west-3",
-          "me-central-1",
-          "sa-east-1",
-          "us-west-2",
-          "af-south-1",
-          "ap-southeast-1",
-          "ap-southeast-2",
-          "eu-south-1",
-          "eu-south-2",
-          "me-south-1",
-          "us-west-1"
+          "us-west-2"
         ],
         "aws-cn": [],
         "aws-us-gov": []
@@ -8071,15 +8041,15 @@
           "us-west-2",
           "af-south-1",
           "ap-east-1",
+          "ap-northeast-3",
           "ap-south-2",
           "ap-southeast-2",
           "ap-southeast-3",
-          "ap-southeast-4",
           "me-central-1",
           "me-south-1",
           "sa-east-1",
+          "ap-northeast-1",
           "ap-northeast-2",
-          "ap-northeast-3",
           "ap-south-1",
           "ap-southeast-1",
           "eu-central-1",
@@ -8087,8 +8057,7 @@
           "eu-south-1",
           "eu-south-2",
           "eu-west-1",
-          "us-west-1",
-          "ap-northeast-1"
+          "us-west-1"
         ],
         "aws-cn": [
           "cn-north-1",
@@ -9331,33 +9300,29 @@
     "waf": {
       "regions": {
         "aws": [
+          "af-south-1",
           "ap-east-1",
-          "ap-south-2",
           "ap-southeast-3",
+          "eu-central-1",
           "eu-north-1",
-          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "me-south-1",
           "us-west-1",
-          "af-south-1",
+          "ap-northeast-1",
+          "ap-northeast-2",
           "ap-northeast-3",
           "ap-southeast-1",
-          "ap-southeast-4",
-          "eu-central-1",
-          "eu-central-2",
           "me-central-1",
+          "sa-east-1",
           "us-east-1",
           "us-west-2",
-          "ap-northeast-1",
-          "ap-northeast-2",
           "ap-south-1",
           "ap-southeast-2",
           "ca-central-1",
+          "eu-south-1",
           "eu-west-3",
-          "sa-east-1",
-          "us-east-2",
-          "eu-south-1"
+          "us-east-2"
         ],
         "aws-cn": [
           "cn-north-1",
@@ -9373,7 +9338,6 @@
       "regions": {
         "aws": [
           "ap-south-1",
-          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "eu-central-1",
@@ -9382,23 +9346,20 @@
           "me-central-1",
           "me-south-1",
           "sa-east-1",
+          "af-south-1",
           "ap-northeast-1",
           "ap-northeast-3",
-          "ap-southeast-4",
+          "ap-southeast-3",
           "ca-central-1",
           "eu-north-1",
           "eu-south-1",
           "eu-west-2",
           "us-east-1",
           "us-west-1",
-          "af-south-1",
           "ap-east-1",
           "ap-northeast-2",
-          "ap-southeast-3",
-          "eu-central-2",
-          "eu-south-2",
-          "us-west-2",
-          "us-east-2"
+          "us-east-2",
+          "us-west-2"
         ],
         "aws-cn": [
           "cn-northwest-1",
@@ -9413,33 +9374,29 @@
     "wafv2": {
       "regions": {
         "aws": [
+          "af-south-1",
           "ap-east-1",
-          "ap-south-2",
           "ap-southeast-3",
+          "eu-central-1",
           "eu-north-1",
-          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "me-south-1",
           "us-west-1",
-          "af-south-1",
+          "ap-northeast-1",
+          "ap-northeast-2",
           "ap-northeast-3",
           "ap-southeast-1",
-          "ap-southeast-4",
-          "eu-central-1",
-          "eu-central-2",
           "me-central-1",
+          "sa-east-1",
           "us-east-1",
           "us-west-2",
-          "ap-northeast-1",
-          "ap-northeast-2",
           "ap-south-1",
           "ap-southeast-2",
           "ca-central-1",
+          "eu-south-1",
           "eu-west-3",
-          "sa-east-1",
-          "us-east-2",
-          "eu-south-1"
+          "us-east-2"
         ],
         "aws-cn": [
           "cn-north-1",