prowler-cloud 5.12.3__py3-none-any.whl → 5.13.0__py3-none-any.whl

prowler/config/oraclecloud_mutelist_example.yaml

@@ -0,0 +1,61 @@
+### Tenancy, Check and/or Region can be * to apply for all the cases.
+### Tenancy == OCI Tenancy OCID and Region == OCI Region
+### Resources and tags are lists that can have either Regex or Keywords.
+### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
+### Use an alternation Regex to match one of multiple tags with "ORed" logic.
+### For each check you can except Tenancies, Regions, Resources and/or Tags.
+###########################  MUTELIST EXAMPLE  ###########################
+Mutelist:
+  Tenancies:
+    "ocid1.tenancy.oc1..aaaaaaaexample":
+      Checks:
+        "iam_user_mfa_enabled":
+          Regions:
+            - "us-phoenix-1"
+          Resources:
+            - "ocid1.user.oc1..aaaaaaaexample1"           # Will ignore user1 in check iam_user_mfa_enabled
+            - "ocid1.user.oc1..aaaaaaaexample2"           # Will ignore user2 in check iam_user_mfa_enabled
+          Description: "Check iam_user_mfa_enabled muted for region us-phoenix-1 and specific user resources"
+        "objectstorage_*":
+          Regions:
+            - "*"
+          Resources:
+            - "*"                 # Will ignore every Object Storage check in every region
+        "*":
+          Regions:
+            - "*"
+          Resources:
+            - "test"
+          Tags:
+            - "test=test"         # Will ignore every resource containing the string "test" and the tags 'test=test' and
+            - "project=test|project=stage" # either of ('project=test' OR project=stage) in tenancy ocid1.tenancy.oc1..aaaaaaaexample and every region
+            - "environment=prod"   # Will ignore every resource containing the string "test" and tag environment=prod
+
+    "*":
+      Checks:
+        "objectstorage_bucket_public_access":
+          Regions:
+            - "us-ashburn-1"
+            - "us-phoenix-1"
+          Resources:
+            - "ci-logs"           # Will ignore bucket "ci-logs" AND ALSO bucket "ci-logs-replica" in specified check and regions
+            - "logs"              # Will ignore EVERY BUCKET containing the string "logs" in specified check and regions
+            - ".+-logs"           # Will ignore all buckets containing the terms ci-logs, qa-logs, etc. in specified check and regions
+        "*":
+          Regions:
+            - "*"
+          Resources:
+            - "*"
+          Tags:
+            - "environment=dev"    # Will ignore every resource containing the tag 'environment=dev' in every tenancy and region
+        "compute_instance_monitoring_enabled":
+          Regions:
+            - "*"
+          Resources:
+            - "*"
+          Exceptions:
+            Tenancies:
+              - "ocid1.tenancy.oc1..aaaaaaaexample2"
+            Regions:
+              - "eu-frankfurt-1"
+              - "eu-amsterdam-1"        # Will ignore every resource in check compute_instance_monitoring_enabled except the ones in tenancy ocid1.tenancy.oc1..aaaaaaaexample2 located in eu-frankfurt-1 or eu-amsterdam-1

prowler/lib/check/check.py

@@ -518,8 +518,16 @@ def execute_checks(
                 )
                 try:
                     try:
+                        # Map CLI provider names to directory names (for cases where they differ)
+                        provider_directory_map = {
+                            "oci": "oraclecloud",  # oci SDK conflict avoidance
+                        }
+                        provider_directory = provider_directory_map.get(
+                            global_provider.type, global_provider.type
+                        )
+
                         # Import check module
-                        check_module_path = f"prowler.providers.{global_provider.type}.services.{service}.{check_name}.{check_name}"
+                        check_module_path = f"prowler.providers.{provider_directory}.services.{service}.{check_name}.{check_name}"
                         lib = import_check(check_module_path)
                         # Recover functions from check
                         check_to_execute = getattr(lib, check_name)

prowler/lib/check/compliance.py

@@ -29,6 +29,7 @@ def update_checks_metadata_with_compliance(
                         # Create the Compliance
                         compliance = Compliance(
                             Framework=framework.Framework,
+                            Name=framework.Name,
                             Provider=framework.Provider,
                             Version=framework.Version,
                             Description=framework.Description,

prowler/lib/check/compliance_models.py

@@ -200,6 +200,32 @@ class Prowler_ThreatScore_Requirement_Attribute(BaseModel):
     Weight: int
 
 
+# CCC Requirement Attribute
+class CCC_Requirement_Attribute(BaseModel):
+    """CCC Requirement Attribute"""
+
+    FamilyName: str
+    FamilyDescription: str
+    Section: str
+    SubSection: str
+    SubSectionObjective: str
+    Applicability: list[str]
+    Recommendation: str
+    SectionThreatMappings: list[dict]
+    SectionGuidelineMappings: list[dict]
+
+
+# C5 Germany Requirement Attribute
+class C5Germany_Requirement_Attribute(BaseModel):
+    """C5 Germany Requirement Attribute"""
+
+    Section: str
+    SubSection: str
+    Type: str
+    AboutCriteria: str
+    ComplementaryCriteria: str
+
+
 # Base Compliance Model
 # TODO: move this to compliance folder
 class Compliance_Requirement(BaseModel):
@@ -216,6 +242,8 @@ class Compliance_Requirement(BaseModel):
             AWS_Well_Architected_Requirement_Attribute,
             KISA_ISMSP_Requirement_Attribute,
             Prowler_ThreatScore_Requirement_Attribute,
+            CCC_Requirement_Attribute,
+            C5Germany_Requirement_Attribute,
             # Generic_Compliance_Requirement_Attribute must be the last one since it is the fallback for generic compliance framework
             Generic_Compliance_Requirement_Attribute,
         ]
@@ -227,6 +255,7 @@ class Compliance(BaseModel):
     """Compliance holds the base model for every compliance framework"""
 
     Framework: str
+    Name: str
     Provider: str
     Version: Optional[str] = None
     Description: str
@@ -240,12 +269,13 @@ class Compliance(BaseModel):
     @root_validator(pre=True)
     # noqa: F841 - since vulture raises unused variable 'cls'
     def framework_and_provider_must_not_be_empty(cls, values):  # noqa: F841
-        framework, provider = (
+        framework, provider, name = (
             values.get("Framework"),
             values.get("Provider"),
+            values.get("Name"),
         )
-        if framework == "" or provider == "":
-            raise ValueError("Framework or Provider must not be empty")
+        if framework == "" or provider == "" or name == "":
+            raise ValueError("Framework, Provider or Name must not be empty")
         return values
 
     @staticmethod

prowler/lib/check/models.py

@@ -8,6 +8,7 @@ from enum import Enum
 from typing import Any, Dict, Optional, Set
 
 from pydantic.v1 import BaseModel, Field, ValidationError, validator
+from pydantic.v1.error_wrappers import ErrorWrapper
 
 from prowler.config.config import Provider
 from prowler.lib.check.compliance_models import Compliance
@@ -157,7 +158,11 @@ class CheckMetadata(BaseModel):
             raise ValueError("ServiceName must be a non-empty string")
 
         check_id = values.get("CheckID")
-        if check_id and values.get("Provider") != "iac":
+        if (
+            check_id
+            and values.get("Provider") != "iac"
+            and values.get("Provider") != "llm"
+        ):
             service_from_check_id = check_id.split("_")[0]
             if service_name != service_from_check_id:
                 raise ValueError(
@@ -173,7 +178,11 @@ class CheckMetadata(BaseModel):
         if not check_id:
             raise ValueError("CheckID must be a non-empty string")
 
-        if check_id and values.get("Provider") != "iac":
+        if (
+            check_id
+            and values.get("Provider") != "iac"
+            and values.get("Provider") != "llm"
+        ):
             if "-" in check_id:
                 raise ValueError(
                     f"CheckID {check_id} contains a hyphen, which is not allowed"
@@ -436,17 +445,31 @@ class Check(ABC, CheckMetadata):
 
     def __init__(self, **data):
         """Check's init function. Calls the CheckMetadataModel init."""
+        file_path = os.path.abspath(sys.modules[self.__module__].__file__)[:-3]
+
         # Parse the Check's metadata file
-        metadata_file = (
-            os.path.abspath(sys.modules[self.__module__].__file__)[:-3]
-            + ".metadata.json"
-        )
+        metadata_file = file_path + ".metadata.json"
         # Store it to validate them with Pydantic
         data = CheckMetadata.parse_file(metadata_file).dict()
         # Calls parents init function
         super().__init__(**data)
-        # TODO: verify that the CheckID is the same as the filename and classname
-        # to mimic the test done at test_<provider>_checks_metadata_is_valid
+
+        # Verify names consistency
+        check_id = self.CheckID
+        class_name = self.__class__.__name__
+        file_name = file_path.split(sep="/")[-1]
+
+        errors = []
+        if check_id != class_name:
+            errors.append(f"CheckID '{check_id}' != class name '{class_name}'")
+        if check_id != file_name:
+            errors.append(f"CheckID '{check_id}' != file name '{file_name}'")
+
+        if errors:
+            formatted_errors = [
+                ErrorWrapper(ValueError(err), loc=("CheckID",)) for err in errors
+            ]
+            raise ValidationError(formatted_errors, model=CheckMetadata)
 
     def metadata(self) -> dict:
         """Return the JSON representation of the check's metadata"""
@@ -576,6 +599,46 @@ class Check_Report_GCP(Check_Report):
         )
 
 
+@dataclass
+class Check_Report_OCI(Check_Report):
+    """Contains the OCI Check's finding information."""
+
+    resource_name: str
+    resource_id: str
+    compartment_id: str
+    region: str
+
+    def __init__(
+        self,
+        metadata: Dict,
+        resource: Any,
+        region: str = None,
+        resource_name: str = None,
+        resource_id: str = None,
+        compartment_id: str = None,
+    ) -> None:
+        """Initialize the OCI Check's finding information.
+
+        Args:
+            metadata: The metadata of the check.
+            resource: Basic information about the resource. Defaults to None.
+            region: The region of the resource.
+            resource_name: The name of the resource related with the finding.
+            resource_id: The OCID of the resource related with the finding.
+            compartment_id: The compartment OCID of the resource.
+        """
+        super().__init__(metadata, resource)
+        self.resource_id = (
+            resource_id
+            or getattr(resource, "id", None)
+            or getattr(resource, "name", None)
+            or ""
+        )
+        self.resource_name = resource_name or getattr(resource, "name", "")
+        self.compartment_id = compartment_id or getattr(resource, "compartment_id", "")
+        self.region = region or getattr(resource, "region", "")
+
+
 @dataclass
 class Check_Report_Kubernetes(Check_Report):
     # TODO change class name to CheckReportKubernetes
@@ -694,6 +757,31 @@ class CheckReportIAC(Check_Report):
         )
 
 
+@dataclass
+class CheckReportLLM(Check_Report):
+    """Contains the LLM Check's finding information."""
+
+    prompt: str
+    response: str
+    model: str
+
+    def __init__(self, metadata: dict = {}, finding: dict = {}) -> None:
+        """
+        Initialize the LLM Check's finding information from a promptfoo finding dict.
+
+        Args:
+            metadata (Dict): Optional check metadata (can be None).
+            finding (dict): A single finding result from promptfoo's JSON output.
+        """
+        super().__init__(metadata, finding)
+
+        self.prompt = finding.get("prompt", {}).get("raw", "No prompt available.")
+        self.response = finding.get("response", {}).get(
+            "output", "No output available."
+        )
+        self.model = finding.get("provider", {}).get("id", "No model available.")
+
+
 @dataclass
 class CheckReportNHN(Check_Report):
     """Contains the NHN Check's finding information."""

prowler/lib/check/utils.py

@@ -15,7 +15,7 @@ def recover_checks_from_provider(
     """
     try:
         # Bypass check loading for IAC provider since it uses Trivy directly
-        if provider == "iac":
+        if provider == "iac" or provider == "llm":
             return []
 
         checks = []
@@ -46,8 +46,14 @@ def recover_checks_from_provider(
 
 # List all available modules in the selected provider and service
 def list_modules(provider: str, service: str):
+    # Map CLI provider names to directory names (for cases where they differ)
+    provider_directory_map = {
+        "oci": "oraclecloud",  # OCI SDK conflict avoidance
+    }
+    provider_directory = provider_directory_map.get(provider, provider)
+
     # This module path requires the full path including "prowler."
-    module_path = f"prowler.providers.{provider}.services"
+    module_path = f"prowler.providers.{provider_directory}.services"
     if service:
         module_path += f".{service}"
     return walk_packages(

prowler/lib/cli/parser.py

@@ -26,19 +26,21 @@ class ProwlerArgumentParser:
         self.parser = argparse.ArgumentParser(
             prog="prowler",
             formatter_class=RawTextHelpFormatter,
-            usage="prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,nhn,mongodbatlas,dashboard,iac} ...",
+            usage="prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,nhn,mongodbatlas,oci,dashboard,iac} ...",
             epilog="""
 Available Cloud Providers:
-  {aws,azure,gcp,kubernetes,m365,github,iac,nhn,mongodbatlas}
+  {aws,azure,gcp,kubernetes,m365,github,iac,llm,nhn,mongodbatlas,oci}
     aws                 AWS Provider
     azure               Azure Provider
     gcp                 GCP Provider
     kubernetes          Kubernetes Provider
     m365                Microsoft 365 Provider
     github              GitHub Provider
-    iac                 IaC Provider (Preview)
+    oci                 Oracle Cloud Infrastructure Provider
+    iac                 IaC Provider (Beta)
+    llm                 LLM Provider (Beta)
     nhn                 NHN Provider (Unofficial)
-    mongodbatlas        MongoDB Atlas Provider
+    mongodbatlas        MongoDB Atlas Provider (Beta)
 
 Available components:
     dashboard           Local dashboard

prowler/lib/outputs/compliance/aws_well_architected/aws_well_architected.py

@@ -65,6 +65,8 @@ class AWSWellArchitected(ComplianceOutput):
                             ResourceName=finding.resource_name,
                             CheckId=finding.check_id,
                             Muted=finding.muted,
+                            Framework=compliance.Framework,
+                            Name=compliance.Name,
                         )
                         self._data.append(compliance_row)
         # Add manual requirements to the compliance output
@@ -94,5 +96,7 @@ class AWSWellArchitected(ComplianceOutput):
                         ResourceName="Manual check",
                         CheckId="manual",
                         Muted=False,
+                        Framework=compliance.Framework,
+                        Name=compliance.Name,
                     )
                     self._data.append(compliance_row)

prowler/lib/outputs/compliance/aws_well_architected/models.py

@@ -30,3 +30,5 @@ class AWSWellArchitectedModel(BaseModel):
     CheckId: str
     Muted: bool
     ResourceName: str
+    Framework: str
+    Name: str

prowler/lib/outputs/compliance/c5/c5.py

@@ -0,0 +1,98 @@
+from colorama import Fore, Style
+from tabulate import tabulate
+
+from prowler.config.config import orange_color
+
+
+def get_c5_table(
+    findings: list,
+    bulk_checks_metadata: dict,
+    compliance_framework: str,
+    output_filename: str,
+    output_directory: str,
+    compliance_overview: bool,
+):
+    section_table = {
+        "Provider": [],
+        "Section": [],
+        "Status": [],
+        "Muted": [],
+    }
+    pass_count = []
+    fail_count = []
+    muted_count = []
+    sections = {}
+    for index, finding in enumerate(findings):
+        check = bulk_checks_metadata[finding.check_metadata.CheckID]
+        check_compliances = check.Compliance
+        for compliance in check_compliances:
+            if compliance.Framework == "C5":
+                for requirement in compliance.Requirements:
+                    for attribute in requirement.Attributes:
+                        section = attribute.Section
+
+                        if section not in sections:
+                            sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+
+                        if finding.muted:
+                            if index not in muted_count:
+                                muted_count.append(index)
+                                sections[section]["Muted"] += 1
+                        else:
+                            if finding.status == "FAIL" and index not in fail_count:
+                                fail_count.append(index)
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS" and index not in pass_count:
+                                pass_count.append(index)
+                                sections[section]["PASS"] += 1
+
+    sections = dict(sorted(sections.items()))
+    for section in sections:
+        section_table["Provider"].append(compliance.Provider)
+        section_table["Section"].append(section)
+        if sections[section]["FAIL"] > 0:
+            section_table["Status"].append(
+                f"{Fore.RED}FAIL({sections[section]['FAIL']}){Style.RESET_ALL}"
+            )
+        else:
+            if sections[section]["PASS"] > 0:
+                section_table["Status"].append(
+                    f"{Fore.GREEN}PASS({sections[section]['PASS']}){Style.RESET_ALL}"
+                )
+            else:
+                section_table["Status"].append(f"{Fore.GREEN}PASS{Style.RESET_ALL}")
+        section_table["Muted"].append(
+            f"{orange_color}{sections[section]['Muted']}{Style.RESET_ALL}"
+        )
+
+    if (
+        len(fail_count) + len(pass_count) + len(muted_count) > 1
+    ):  # If there are no resources, don't print the compliance table
+        print(
+            f"\nCompliance Status of {Fore.YELLOW}{compliance_framework.upper()}{Style.RESET_ALL} Framework:"
+        )
+        total_findings_count = len(fail_count) + len(pass_count) + len(muted_count)
+        overview_table = [
+            [
+                f"{Fore.RED}{round(len(fail_count) / total_findings_count * 100, 2)}% ({len(fail_count)}) FAIL{Style.RESET_ALL}",
+                f"{Fore.GREEN}{round(len(pass_count) / total_findings_count * 100, 2)}% ({len(pass_count)}) PASS{Style.RESET_ALL}",
+                f"{orange_color}{round(len(muted_count) / total_findings_count * 100, 2)}% ({len(muted_count)}) MUTED{Style.RESET_ALL}",
+            ]
+        ]
+        print(tabulate(overview_table, tablefmt="rounded_grid"))
+        if not compliance_overview:
+            if len(fail_count) > 0 and len(section_table["Section"]) > 0:
+                print(
+                    f"\nFramework {Fore.YELLOW}{compliance_framework.upper()}{Style.RESET_ALL} Results:"
+                )
+                print(
+                    tabulate(
+                        section_table,
+                        tablefmt="rounded_grid",
+                        headers="keys",
+                    )
+                )
+                print(f"\nDetailed results of {compliance_framework.upper()} are in:")
+                print(
+                    f" - CSV: {output_directory}/compliance/{output_filename}_{compliance_framework}.csv\n"
+                )

prowler/lib/outputs/compliance/c5/c5_aws.py

@@ -0,0 +1,92 @@
+from prowler.config.config import timestamp
+from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.c5.models import AWSC5Model
+from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
+from prowler.lib.outputs.finding import Finding
+
+
+class AWSC5(ComplianceOutput):
+    """
+    This class represents the AWS C5 compliance output.
+
+    Attributes:
+        - _data (list): A list to store transformed data from findings.
+        - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
+
+    Methods:
+        - transform: Transforms findings into AWS C5 compliance format.
+    """
+
+    def transform(
+        self,
+        findings: list[Finding],
+        compliance: Compliance,
+        compliance_name: str,
+    ) -> None:
+        """
+        Transforms a list of findings into AWS C5 compliance format.
+
+        Parameters:
+            - findings (list): A list of findings.
+            - compliance (Compliance): A compliance model.
+            - compliance_name (str): The name of the compliance model.
+
+        Returns:
+            - None
+        """
+        for finding in findings:
+            # Get the compliance requirements for the finding
+            finding_requirements = finding.compliance.get(compliance_name, [])
+            for requirement in compliance.Requirements:
+                if requirement.Id in finding_requirements:
+                    for attribute in requirement.Attributes:
+                        compliance_row = AWSC5Model(
+                            Provider=finding.provider,
+                            Description=compliance.Description,
+                            AccountId=finding.account_uid,
+                            Region=finding.region,
+                            AssessmentDate=str(timestamp),
+                            Requirements_Id=requirement.Id,
+                            Requirements_Description=requirement.Description,
+                            Requirements_Attributes_Section=attribute.Section,
+                            Requirements_Attributes_SubSection=attribute.SubSection,
+                            Requirements_Attributes_Type=attribute.Type,
+                            Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
+                            Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
+                            Status=finding.status,
+                            StatusExtended=finding.status_extended,
+                            ResourceId=finding.resource_uid,
+                            ResourceName=finding.resource_name,
+                            CheckId=finding.check_id,
+                            Muted=finding.muted,
+                            Framework=compliance.Framework,
+                            Name=compliance.Name,
+                        )
+                        self._data.append(compliance_row)
+        # Add manual requirements to the compliance output
+        for requirement in compliance.Requirements:
+            if not requirement.Checks:
+                for attribute in requirement.Attributes:
+                    compliance_row = AWSC5Model(
+                        Provider=compliance.Provider.lower(),
+                        Description=compliance.Description,
+                        AccountId="",
+                        Region="",
+                        AssessmentDate=str(timestamp),
+                        Requirements_Id=requirement.Id,
+                        Requirements_Description=requirement.Description,
+                        Requirements_Attributes_Section=attribute.Section,
+                        Requirements_Attributes_SubSection=attribute.SubSection,
+                        Requirements_Attributes_Type=attribute.Type,
+                        Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
+                        Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
+                        Status="MANUAL",
+                        StatusExtended="Manual check",
+                        ResourceId="manual_check",
+                        ResourceName="Manual check",
+                        CheckId="manual",
+                        Muted=False,
+                        Framework=compliance.Framework,
+                        Name=compliance.Name,
+                    )
+                    self._data.append(compliance_row)

prowler/lib/outputs/compliance/c5/models.py

@@ -0,0 +1,30 @@
+from typing import Optional
+
+from pydantic.v1 import BaseModel
+
+
+class AWSC5Model(BaseModel):
+    """
+    AWSC5Model generates a finding's output in AWS C5 Compliance format.
+    """
+
+    Provider: str
+    Description: str
+    AccountId: str
+    Region: str
+    AssessmentDate: str
+    Requirements_Id: str
+    Requirements_Description: str
+    Requirements_Attributes_Section: str
+    Requirements_Attributes_SubSection: str = None
+    Requirements_Attributes_Type: str = None
+    Requirements_Attributes_AboutCriteria: Optional[str] = None
+    Requirements_Attributes_ComplementaryCriteria: Optional[str] = None
+    Status: str
+    StatusExtended: str
+    ResourceId: str
+    ResourceName: str
+    CheckId: str
+    Muted: bool
+    Framework: str
+    Name: str