prowler-cloud 5.12.3__py3-none-any.whl → 5.13.0__py3-none-any.whl

prowler/providers/oraclecloud/lib/mutelist/mutelist.py

@@ -0,0 +1,176 @@
+from prowler.lib.logger import logger
+from prowler.lib.mutelist.mutelist import Mutelist
+from prowler.lib.outputs.utils import unroll_dict, unroll_tags
+
+
+class OCIMutelist(Mutelist):
+    """
+    OCIMutelist class manages the mutelist functionality for OCI provider.
+
+    This class extends the base Mutelist class to provide OCI-specific functionality
+    for muting findings based on tenancy, check, region, resource, and tags.
+    """
+
+    def __init__(
+        self,
+        mutelist_content: dict = {},
+        mutelist_path: str = None,
+        tenancy_id: str = "",
+    ) -> "OCIMutelist":
+        """
+        Initialize the OCIMutelist.
+
+        Args:
+            mutelist_content (dict): The mutelist content as a dictionary.
+            mutelist_path (str): The path to the mutelist file.
+            tenancy_id (str): The OCI tenancy ID.
+        """
+        self._mutelist = mutelist_content
+        self._mutelist_file_path = mutelist_path
+        self._tenancy_id = tenancy_id
+
+        if mutelist_path:
+            # Load mutelist from local file
+            self.get_mutelist_file_from_local_file(mutelist_path)
+
+        if self._mutelist:
+            self._mutelist = self.validate_mutelist(self._mutelist)
+
+    def is_finding_muted(
+        self,
+        finding,
+        tenancy_id: str,
+    ) -> bool:
+        """
+        Check if a finding is muted based on the mutelist.
+
+        Args:
+            finding: The finding object to check (should have check_metadata, region, resource_id, resource_tags).
+            tenancy_id (str): The OCI tenancy ID.
+
+        Returns:
+            bool: True if the finding is muted, False otherwise.
+        """
+        try:
+            check_id = finding.check_metadata.CheckID
+            region = finding.region if hasattr(finding, "region") else ""
+            resource_id = finding.resource_id if hasattr(finding, "resource_id") else ""
+            resource_tags = {}
+
+            # Handle resource tags
+            if hasattr(finding, "resource_tags") and finding.resource_tags:
+                resource_tags = unroll_dict(unroll_tags(finding.resource_tags))
+
+            return self.is_muted(
+                tenancy_id,
+                check_id,
+                region,
+                resource_id,
+                resource_tags,
+            )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return False
+
+    def is_muted(
+        self,
+        tenancy_id: str,
+        check_id: str,
+        region: str,
+        resource_id: str,
+        resource_tags: dict,
+    ) -> bool:
+        """
+        Check if a specific combination is muted.
+
+        Args:
+            tenancy_id (str): The OCI tenancy ID.
+            check_id (str): The check ID.
+            region (str): The OCI region.
+            resource_id (str): The resource ID (OCID).
+            resource_tags (dict): The resource tags.
+
+        Returns:
+            bool: True if muted, False otherwise.
+        """
+        try:
+            if not self._mutelist:
+                return False
+
+            # Check if mutelist has Accounts/Tenancies section
+            tenancies = self._mutelist.get("Accounts", {})
+            if not tenancies:
+                # Try with "Tenancies" key for OCI-specific mutelist
+                tenancies = self._mutelist.get("Tenancies", {})
+
+            # Check for wildcard or specific tenancy
+            tenancy_mutelist = tenancies.get("*", {})
+            if tenancy_id in tenancies:
+                # Merge with specific tenancy rules
+                specific_tenancy = tenancies.get(tenancy_id, {})
+                tenancy_mutelist = {**tenancy_mutelist, **specific_tenancy}
+
+            if not tenancy_mutelist:
+                return False
+
+            # Get checks for this tenancy
+            checks = tenancy_mutelist.get("Checks", {})
+
+            # Check for wildcard or specific check
+            check_mutelist = checks.get("*", {})
+            if check_id in checks:
+                specific_check = checks.get(check_id, {})
+                check_mutelist = {**check_mutelist, **specific_check}
+
+            if not check_mutelist:
+                return False
+
+            # Check regions
+            regions = check_mutelist.get("Regions", [])
+            if regions and "*" not in regions and region not in regions:
+                return False
+
+            # Check resources
+            resources = check_mutelist.get("Resources", [])
+            if resources:
+                if "*" not in resources and resource_id not in resources:
+                    return False
+
+            # Check tags
+            tags = check_mutelist.get("Tags", [])
+            if tags and resource_tags:
+                # Check if any tag matches
+                tag_match = False
+                for tag_filter in tags:
+                    # Tag filter format: "key=value" or "key=*"
+                    if "=" in tag_filter:
+                        key, value = tag_filter.split("=", 1)
+                        if key in resource_tags:
+                            if value == "*" or resource_tags[key] == value:
+                                tag_match = True
+                                break
+
+                if not tag_match:
+                    return False
+
+            # Check exceptions (resources that should NOT be muted)
+            exceptions = check_mutelist.get("Exceptions", {})
+            if exceptions:
+                exception_resources = exceptions.get("Resources", [])
+                if resource_id in exception_resources:
+                    return False
+
+                exception_regions = exceptions.get("Regions", [])
+                if region in exception_regions:
+                    return False
+
+            # If we passed all checks, the finding is muted
+            return True
+
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return False

prowler/providers/oraclecloud/lib/service/service.py

@@ -0,0 +1,213 @@
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from prowler.lib.logger import logger
+from prowler.providers.oraclecloud.oci_provider import OciProvider
+
+MAX_WORKERS = 10
+
+
+class OCIService:
+    """
+    The OCIService class offers a parent class for each OCI Service to generate:
+    - OCI Regional Clients
+    - Shared information like the tenancy ID, user ID, and the checks audited
+    - OCI Session configuration
+    - Thread pool for the __threading_call__
+    - Handles compartment traversal
+    """
+
+    def __init__(self, service: str, provider: OciProvider):
+        """
+        Initialize the OCIService base class.
+
+        Args:
+            service (str): The OCI service name (e.g., 'compute', 'object_storage').
+            provider (OciProvider): The OCI provider instance.
+        """
+        # Audit Information
+        self.provider = provider
+        self.audited_tenancy = provider.identity.tenancy_id
+        self.audited_user = provider.identity.user_id
+        self.audited_regions = provider.regions
+        self.audited_compartments = provider.compartments
+        self.audited_checks = provider.audit_metadata.expected_checks
+        self.audit_config = provider.audit_config
+        self.fixer_config = provider.fixer_config
+
+        # OCI Session
+        self.session_config = provider.session.config
+        self.session_signer = provider.session.signer
+
+        # Service name
+        self.service = service.lower() if not service.islower() else service
+
+        # Generate Regional Clients
+        self.regional_clients = provider.generate_regional_clients(self.service)
+
+        # Thread pool for __threading_call__
+        self.thread_pool = ThreadPoolExecutor(max_workers=MAX_WORKERS)
+
+    def __get_session_config__(self):
+        """Get the OCI session configuration."""
+        return self.session_config
+
+    def __get_session_signer__(self):
+        """Get the OCI session signer."""
+        return self.session_signer
+
+    def __threading_call__(self, call, iterator=None):
+        """
+        Execute a function across multiple items using threading.
+
+        Args:
+            call (callable): The function to call for each item.
+            iterator (list, optional): A list of items to process. Defaults to regional clients.
+        """
+        # Use the provided iterator, or default to self.regional_clients
+        items = (
+            iterator if iterator is not None else list(self.regional_clients.values())
+        )
+        # Determine the total count for logging
+        item_count = len(items)
+
+        # Trim leading and trailing underscores from the call's name
+        call_name = call.__name__.strip("_")
+        # Add Capitalization
+        call_name = " ".join([x.capitalize() for x in call_name.split("_")])
+
+        # Print a message based on the call's name, and if its regional or processing a list of items
+        if iterator is None:
+            logger.info(
+                f"{self.service.upper()} - Starting threads for '{call_name}' function across {item_count} regions..."
+            )
+        else:
+            logger.info(
+                f"{self.service.upper()} - Starting threads for '{call_name}' function to process {item_count} items..."
+            )
+
+        # Submit tasks to the thread pool
+        futures = [self.thread_pool.submit(call, item) for item in items]
+
+        # Wait for all tasks to complete
+        for future in as_completed(futures):
+            try:
+                future.result()  # Raises exceptions from the thread, if any
+            except Exception as error:
+                logger.error(
+                    f"{self.service.upper()} - Error in threaded execution: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def __threading_call_by_compartment__(self, call):
+        """
+        Execute a function for each compartment using threading.
+
+        Args:
+            call (callable): The function to call for each compartment.
+                            The function should accept a compartment object.
+        """
+        # Use compartments as the iterator
+        compartments = self.audited_compartments
+        compartment_count = len(compartments)
+
+        # Trim leading and trailing underscores from the call's name
+        call_name = call.__name__.strip("_")
+        # Add Capitalization
+        call_name = " ".join([x.capitalize() for x in call_name.split("_")])
+
+        logger.info(
+            f"{self.service.upper()} - Starting threads for '{call_name}' function across {compartment_count} compartments..."
+        )
+
+        # Submit tasks to the thread pool
+        futures = [
+            self.thread_pool.submit(call, compartment) for compartment in compartments
+        ]
+
+        # Wait for all tasks to complete
+        for future in as_completed(futures):
+            try:
+                future.result()  # Raises exceptions from the thread, if any
+            except Exception as error:
+                logger.error(
+                    f"{self.service.upper()} - Error in compartment threaded execution: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def __threading_call_by_region_and_compartment__(self, call):
+        """
+        Execute a function for each region and compartment combination using threading.
+
+        Args:
+            call (callable): The function to call for each (region, compartment) pair.
+                            The function should accept region and compartment as parameters.
+        """
+        # Create combinations of regions and compartments
+        region_compartment_pairs = [
+            (region, compartment)
+            for region in self.audited_regions
+            for compartment in self.audited_compartments
+        ]
+
+        pair_count = len(region_compartment_pairs)
+
+        # Trim leading and trailing underscores from the call's name
+        call_name = call.__name__.strip("_")
+        # Add Capitalization
+        call_name = " ".join([x.capitalize() for x in call_name.split("_")])
+
+        logger.info(
+            f"{self.service.upper()} - Starting threads for '{call_name}' function across {pair_count} region-compartment pairs..."
+        )
+
+        # Submit tasks to the thread pool
+        futures = [
+            self.thread_pool.submit(call, region, compartment)
+            for region, compartment in region_compartment_pairs
+        ]
+
+        # Wait for all tasks to complete
+        for future in as_completed(futures):
+            try:
+                future.result()  # Raises exceptions from the thread, if any
+            except Exception as error:
+                logger.error(
+                    f"{self.service.upper()} - Error in region-compartment threaded execution: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def get_client_for_region(self, region_key: str):
+        """
+        Get the OCI service client for a specific region.
+
+        Args:
+            region_key (str): The region key (e.g., 'us-ashburn-1').
+
+        Returns:
+            The OCI service client for the region, or None if not found.
+        """
+        return self.regional_clients.get(region_key)
+
+    def _create_oci_client(self, client_class, config_overrides=None, **kwargs):
+        """
+        Create an OCI SDK client with proper authentication handling.
+
+        Args:
+            client_class: The OCI SDK client class to instantiate
+            config_overrides: Optional dict to merge with session_config (e.g., {"region": "us-ashburn-1"})
+            **kwargs: Additional arguments to pass to the client constructor
+
+        Returns:
+            An instance of the OCI SDK client
+
+        This helper method handles the different authentication methods:
+        - API Key: signer is None, SDK uses key_file from config
+        - Session Token: signer is SecurityTokenSigner
+        - Instance Principal: signer is InstancePrincipalsSecurityTokenSigner
+        """
+        # Merge config overrides if provided
+        config = {**self.session_config, **(config_overrides or {})}
+
+        # Only pass signer if it's not None
+        # For API key auth, signer is None and the SDK uses the key from config
+        if self.session_signer:
+            return client_class(config=config, signer=self.session_signer, **kwargs)
+        else:
+            return client_class(config=config, **kwargs)

prowler/providers/oraclecloud/models.py

@@ -0,0 +1,96 @@
+from dataclasses import dataclass
+from datetime import datetime
+from typing import Optional
+
+from prowler.config.config import output_file_timestamp
+from prowler.providers.common.models import ProviderOutputOptions
+
+
+@dataclass
+class OCICredentials:
+    """OCI Credentials model"""
+
+    user: str
+    fingerprint: str
+    key_file: Optional[str]
+    key_content: Optional[str]
+    tenancy: str
+    region: str
+    pass_phrase: Optional[str] = None
+
+
+@dataclass
+class OCIIdentityInfo:
+    """OCI Identity Information model"""
+
+    tenancy_id: str
+    tenancy_name: str
+    user_id: str
+    region: str
+    profile: Optional[str]
+    audited_regions: set
+    audited_compartments: list
+
+
+@dataclass
+class OCICompartment:
+    """OCI Compartment model"""
+
+    id: str
+    name: str
+    lifecycle_state: str
+    time_created: datetime
+    description: Optional[str] = None
+    freeform_tags: Optional[dict] = None
+    defined_tags: Optional[dict] = None
+
+
+@dataclass
+class OCISession:
+    """OCI Session model to store configuration and signer"""
+
+    config: dict
+    signer: object
+    profile: Optional[str] = None
+
+
+@dataclass
+class OCIRegion:
+    """OCI Region model"""
+
+    key: str
+    name: str
+    is_home_region: bool = False
+
+
+@dataclass
+class OCIRegionalClient:
+    """OCI Regional Client wrapper model"""
+
+    client: object
+    region: str
+
+
+class OCIOutputOptions(ProviderOutputOptions):
+    """OCI Output Options model"""
+
+    def __init__(self, arguments, bulk_checks_metadata, identity):
+        # First call Provider_Output_Options init
+        super().__init__(arguments, bulk_checks_metadata)
+
+        # Check if custom output filename was input, if not, set the default
+        if (
+            not hasattr(arguments, "output_filename")
+            or arguments.output_filename is None
+        ):
+            # Use tenancy name if available, otherwise fall back to tenancy ID
+            tenancy_identifier = (
+                identity.tenancy_name
+                if identity.tenancy_name and identity.tenancy_name != "unknown"
+                else identity.tenancy_id
+            )
+            self.output_filename = (
+                f"prowler-output-{tenancy_identifier}-{output_file_timestamp}"
+            )
+        else:
+            self.output_filename = arguments.output_filename