prowler-cloud 5.12.3__py3-none-any.whl → 5.13.0__py3-none-any.whl

prowler/providers/oraclecloud/services/identity/identity_user_db_passwords_rotated_90_days/identity_user_db_passwords_rotated_90_days.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "identity_user_db_passwords_rotated_90_days",
+  "CheckTitle": "Ensure user IAM Database Passwords rotate within 90 days",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "identity",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:identity:user",
+  "Severity": "medium",
+  "ResourceType": "OciIamUser",
+  "Description": "Database passwords should be rotated within 90 days.",
+  "Risk": "Not meeting this IAM requirement increases security risk.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure user IAM Database Passwords rotate within 90 days",
+      "Url": "https://hub.prowler.com/check/oci/identity_user_db_passwords_rotated_90_days"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/identity/identity_user_db_passwords_rotated_90_days/identity_user_db_passwords_rotated_90_days.py

@@ -0,0 +1,49 @@
+"""Check Ensure user IAM Database Passwords rotate within 90 days."""
+
+from datetime import datetime, timedelta, timezone
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.identity.identity_client import (
+    identity_client,
+)
+
+
+class identity_user_db_passwords_rotated_90_days(Check):
+    """Check Ensure user IAM Database Passwords rotate within 90 days."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the identity_user_db_passwords_rotated_90_days check."""
+        findings = []
+
+        # Calculate 90 days ago from now
+        current_time = datetime.now(timezone.utc)
+        max_age = current_time - timedelta(days=90)
+
+        # Check each user's database passwords
+        for user in identity_client.users:
+            if not user.db_passwords:
+                continue
+
+            for password in user.db_passwords:
+                report = Check_Report_OCI(
+                    metadata=self.metadata(),
+                    resource=password,
+                    region=user.region,
+                    resource_name=f"{user.name} - DB Password",
+                    resource_id=password.id,
+                    compartment_id=user.compartment_id,
+                )
+
+                # Check if password is older than 90 days
+                password_age_days = (current_time - password.time_created).days
+
+                if password.time_created < max_age:
+                    report.status = "FAIL"
+                    report.status_extended = f"User '{user.name}' has a database password created {password_age_days} days ago (on {password.time_created.strftime('%Y-%m-%d')}), which exceeds the 90-day rotation period."
+                else:
+                    report.status = "PASS"
+                    report.status_extended = f"User '{user.name}' has a database password created {password_age_days} days ago, which is within the 90-day rotation period."
+
+                findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/identity/identity_user_mfa_enabled_console_access/identity_user_mfa_enabled_console_access.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "identity_user_mfa_enabled_console_access",
+  "CheckTitle": "Ensure MFA is enabled for all users with a console password",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "identity",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:identity:user",
+  "Severity": "high",
+  "ResourceType": "OciIamUser",
+  "Description": "Ensure MFA is enabled for all users with a console password. Multi-factor authentication is a method of authentication that requires the use of more than one factor to verify a user's identity.",
+  "Risk": "Enabling MFA provides increased security by requiring two methods of verification at sign-in. With MFA enabled, a user must possess a device that emits a time-sensitive key and have knowledge of a username and password.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/usingmfa.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-IAM/enable-mfa-for-user-accounts.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable MFA for all users with console password access.",
+      "Url": "https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/usingmfa.htm"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/identity/identity_user_mfa_enabled_console_access/identity_user_mfa_enabled_console_access.py

@@ -0,0 +1,43 @@
+"""Check if MFA is enabled for all users with console password."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.identity.identity_client import (
+    identity_client,
+)
+
+
+class identity_user_mfa_enabled_console_access(Check):
+    """Check if MFA is enabled for all users with console password."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the identity_user_mfa_enabled_console_access check.
+
+        Returns:
+            List of Check_Report_OCI objects with findings
+        """
+        findings = []
+
+        for user in identity_client.users:
+            # Only check users with console access
+            if user.can_use_console_password:
+                report = Check_Report_OCI(
+                    metadata=self.metadata(),
+                    resource=user,
+                    region=user.region,
+                    resource_name=user.name,
+                    resource_id=user.id,
+                    compartment_id=user.compartment_id,
+                )
+
+                if user.is_mfa_activated:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"User {user.name} has MFA enabled for console access."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"User {user.name} has console password enabled but MFA is not activated."
+
+                findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/identity/identity_user_valid_email_address/identity_user_valid_email_address.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "identity_user_valid_email_address",
+  "CheckTitle": "Ensure all OCI IAM user accounts have a valid and current email address",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "identity",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:identity:user",
+  "Severity": "low",
+  "ResourceType": "OciIamUser",
+  "Description": "All user accounts should have valid email addresses.",
+  "Risk": "Not meeting this IAM requirement increases security risk.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure all OCI IAM user accounts have a valid and current email address",
+      "Url": "https://hub.prowler.com/check/oci/identity_user_valid_email_address"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/identity/identity_user_valid_email_address/identity_user_valid_email_address.py

@@ -0,0 +1,38 @@
+"""Check Ensure all OCI IAM user accounts have a valid and current email address."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.identity.identity_client import (
+    identity_client,
+)
+
+
+class identity_user_valid_email_address(Check):
+    """Check Ensure all OCI IAM user accounts have a valid and current email address."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the identity_user_valid_email_address check."""
+        findings = []
+
+        # Check users have valid email
+        for user in identity_client.users:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=user,
+                region=user.region,
+                resource_name=user.name,
+                resource_id=user.id,
+                compartment_id=user.compartment_id,
+            )
+
+            if user.email and "@" in user.email:
+                report.status = "PASS"
+                report.status_extended = f"User {user.name} has a valid email address."
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"User {user.name} does not have a valid email address."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/integration/integration_client.py

@@ -0,0 +1,8 @@
+"""OCI Integration client."""
+
+from prowler.providers.common.provider import Provider
+from prowler.providers.oraclecloud.services.integration.integration_service import (
+    Integration,
+)
+
+integration_client = Integration(Provider.get_global_provider())

prowler/providers/oraclecloud/services/integration/integration_instance_access_restricted/integration_instance_access_restricted.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "integration_instance_access_restricted",
+  "CheckTitle": "Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "integration",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:integration:instance",
+  "Severity": "high",
+  "ResourceType": "IntegrationInstance",
+  "Description": "Oracle Integration Cloud access should be restricted to allowed sources.",
+  "Risk": "Not meeting this network security requirement increases risk of unauthorized access.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources",
+      "Url": "https://hub.prowler.com/check/oci/integration_instance_access_restricted"
+    }
+  },
+  "Categories": [
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/integration/integration_instance_access_restricted/integration_instance_access_restricted.py

@@ -0,0 +1,48 @@
+"""Check Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.integration.integration_client import (
+    integration_client,
+)
+
+
+class integration_instance_access_restricted(Check):
+    """Check Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the integration_instance_access_restricted check."""
+        findings = []
+
+        for instance in integration_client.integration_instances:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=instance,
+                region=instance.region,
+                resource_name=instance.display_name,
+                resource_id=instance.id,
+                compartment_id=instance.compartment_id,
+            )
+            # Check if instance has no network endpoint details (unrestricted access)
+            if not instance.network_endpoint_details:
+                report.status = "FAIL"
+                report.status_extended = f"Integration instance {instance.display_name} has no network endpoint details configured (unrestricted access)."
+            # Check if 0.0.0.0/0 is in network endpoint details
+            elif "0.0.0.0/0" in str(instance.network_endpoint_details):
+                report.status = "FAIL"
+                report.status_extended = f"Integration instance {instance.display_name} has unrestricted access with 0.0.0.0/0 in network endpoint details."
+            # Check if PUBLIC endpoint with no allowlists
+            elif (
+                instance.network_endpoint_details.get("network_endpoint_type")
+                == "PUBLIC"
+                and not instance.network_endpoint_details.get("allowlisted_http_ips")
+                and not instance.network_endpoint_details.get("allowlisted_http_vcns")
+            ):
+                report.status = "FAIL"
+                report.status_extended = f"Integration instance {instance.display_name} has public access with no IP or VCN allowlists configured."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Integration instance {instance.display_name} has restricted network access configured."
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/integration/integration_service.py

@@ -0,0 +1,92 @@
+"""OCI Integration service."""
+
+from typing import Optional
+
+import oci
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.oraclecloud.lib.service.service import OCIService
+
+
+class Integration(OCIService):
+    """OCI Integration service class."""
+
+    def __init__(self, provider):
+        """Initialize Integration service."""
+        super().__init__("integration", provider)
+        self.integration_instances = []
+        self.__threading_call_by_region_and_compartment__(
+            self.__list_integration_instances__
+        )
+
+    def __get_client__(self, region: str) -> oci.integration.IntegrationInstanceClient:
+        """Get OCI Integration client for a region."""
+        return self._create_oci_client(
+            oci.integration.IntegrationInstanceClient,
+            config_overrides={"region": region},
+        )
+
+    def __list_integration_instances__(self, region, compartment):
+        """List all integration instances in a compartment."""
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            integration_client = self.__get_client__(region_key)
+
+            instances = oci.pagination.list_call_get_all_results(
+                integration_client.list_integration_instances,
+                compartment_id=compartment.id,
+            ).data
+
+            for instance in instances:
+                # Only include ACTIVE or INACTIVE or UPDATING instances
+                if instance.lifecycle_state in ["ACTIVE", "INACTIVE", "UPDATING"]:
+                    # Extract network endpoint details and convert to dict
+                    network_endpoint_details = None
+                    if (
+                        hasattr(instance, "network_endpoint_details")
+                        and instance.network_endpoint_details
+                    ):
+                        network_endpoint_details = oci.util.to_dict(
+                            instance.network_endpoint_details
+                        )
+
+                    self.integration_instances.append(
+                        IntegrationInstance(
+                            id=instance.id,
+                            display_name=instance.display_name,
+                            compartment_id=instance.compartment_id,
+                            region=region_key,
+                            lifecycle_state=instance.lifecycle_state,
+                            network_endpoint_details=network_endpoint_details,
+                            instance_url=getattr(instance, "instance_url", None),
+                            integration_instance_type=getattr(
+                                instance, "integration_instance_type", None
+                            ),
+                            is_byol=getattr(instance, "is_byol", None),
+                            message_packs=getattr(instance, "message_packs", None),
+                        )
+                    )
+
+        except Exception as error:
+            logger.error(
+                f"{region_key if 'region_key' in locals() else region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class IntegrationInstance(BaseModel):
+    """OCI Integration Instance model."""
+
+    id: str
+    display_name: str
+    compartment_id: str
+    region: str
+    lifecycle_state: str
+    network_endpoint_details: Optional[dict]
+    instance_url: Optional[str] = None
+    integration_instance_type: Optional[str] = None
+    is_byol: Optional[bool] = None
+    message_packs: Optional[int] = None
+
+    class Config:
+        arbitrary_types_allowed = True

prowler/providers/oraclecloud/services/kms/kms_client.py

@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.oraclecloud.services.kms.kms_service import Kms
+
+kms_client = Kms(Provider.get_global_provider())

prowler/providers/oraclecloud/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "kms_key_rotation_enabled",
+  "CheckTitle": "Ensure customer created Customer Managed Key (CMK) is rotated at least annually",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "kms",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:kms:resource",
+  "Severity": "medium",
+  "ResourceType": "OciKmsResource",
+  "Description": "Customer Managed Keys should be rotated at least annually to reduce the risk of key compromise.",
+  "Risk": "Not meeting this requirement increases security risk.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-KMS/rotate-customer-managed-keys.html",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure customer created Customer Managed Key (CMK) is rotated at least annually",
+      "Url": "https://hub.prowler.com/check/oci/kms_key_rotation_enabled"
+    }
+  },
+  "Categories": [
+    "security-configuration"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.py

@@ -0,0 +1,37 @@
+"""Check Ensure customer created Customer Managed Key (CMK) is rotated at least annually."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.kms.kms_client import kms_client
+
+
+class kms_key_rotation_enabled(Check):
+    """Check Ensure customer created Customer Managed Key (CMK) is rotated at least annually."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the kms_key_rotation_enabled check."""
+        findings = []
+
+        for key in kms_client.keys:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=key,
+                region=key.region,
+                resource_name=key.name,
+                resource_id=key.id,
+                compartment_id=key.compartment_id,
+            )
+
+            # Check if auto-rotation is enabled OR if rotation interval is set and <= 365 days
+            if key.is_auto_rotation_enabled or (
+                key.rotation_interval_in_days is not None
+                and key.rotation_interval_in_days <= 365
+            ):
+                report.status = "PASS"
+                report.status_extended = f"KMS key '{key.name}' has rotation enabled (auto-rotation: {key.is_auto_rotation_enabled}, interval: {key.rotation_interval_in_days} days)."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"KMS key '{key.name}' does not have rotation enabled or rotation interval exceeds 365 days."
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/kms/kms_service.py

@@ -0,0 +1,136 @@
+"""OCI Kms Service Module."""
+
+from typing import Optional
+
+import oci
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.oraclecloud.lib.service.service import OCIService
+
+
+class Kms(OCIService):
+    """OCI Kms Service class."""
+
+    def __init__(self, provider):
+        """Initialize the Kms service."""
+        super().__init__("kms", provider)
+        self.keys = []
+        self.__threading_call__(self.__list_keys__)
+
+    def __get_client__(self, region):
+        """Get the Kms client for a region."""
+        client_region = self.regional_clients.get(region)
+        if client_region:
+            return self._create_oci_client(oci.key_management.KmsVaultClient)
+        return None
+
+    def __list_keys__(self, regional_client):
+        """List all keys."""
+        try:
+            vault_client = self.__get_client__(regional_client.region)
+            if not vault_client:
+                return
+
+            logger.info(f"Kms - Listing keys in {regional_client.region}...")
+
+            for compartment in self.audited_compartments:
+                try:
+                    # First, list all vaults in this compartment
+                    vaults = oci.pagination.list_call_get_all_results(
+                        vault_client.list_vaults, compartment_id=compartment.id
+                    ).data
+
+                    for vault in vaults:
+                        # Only process vaults in ACTIVE state
+                        if vault.lifecycle_state == "ACTIVE":
+                            # Get the management endpoint for this vault
+                            management_endpoint = vault.management_endpoint
+
+                            # Create KMS management client for this vault's endpoint
+                            # KmsManagementClient requires service_endpoint, so create it directly
+                            if self.session_signer:
+                                kms_management_client = (
+                                    oci.key_management.KmsManagementClient(
+                                        config=self.session_config,
+                                        signer=self.session_signer,
+                                        service_endpoint=management_endpoint,
+                                    )
+                                )
+                            else:
+                                kms_management_client = (
+                                    oci.key_management.KmsManagementClient(
+                                        config=self.session_config,
+                                        service_endpoint=management_endpoint,
+                                    )
+                                )
+
+                            # List keys in this vault
+                            keys = oci.pagination.list_call_get_all_results(
+                                kms_management_client.list_keys,
+                                compartment_id=compartment.id,
+                            ).data
+
+                            for key_summary in keys:
+                                if key_summary.lifecycle_state == "ENABLED":
+                                    # Get full key details to get rotation info
+                                    key_details = kms_management_client.get_key(
+                                        key_id=key_summary.id
+                                    ).data
+
+                                    self.keys.append(
+                                        Key(
+                                            id=key_details.id,
+                                            name=(
+                                                key_details.display_name
+                                                if hasattr(key_details, "display_name")
+                                                else key_details.id
+                                            ),
+                                            compartment_id=compartment.id,
+                                            region=regional_client.region,
+                                            lifecycle_state=key_details.lifecycle_state,
+                                            is_auto_rotation_enabled=(
+                                                key_details.is_auto_rotation_enabled
+                                                if hasattr(
+                                                    key_details,
+                                                    "is_auto_rotation_enabled",
+                                                )
+                                                else False
+                                            ),
+                                            rotation_interval_in_days=(
+                                                key_details.auto_key_rotation_details.rotation_interval_in_days
+                                                if hasattr(
+                                                    key_details,
+                                                    "auto_key_rotation_details",
+                                                )
+                                                and key_details.auto_key_rotation_details
+                                                and hasattr(
+                                                    key_details.auto_key_rotation_details,
+                                                    "rotation_interval_in_days",
+                                                )
+                                                else None
+                                            ),
+                                        )
+                                    )
+                except Exception as error:
+                    logger.error(
+                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+                    continue
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+# Service Models
+class Key(BaseModel):
+    """Key model."""
+
+    id: str
+    name: str
+    compartment_id: str
+    region: str
+    lifecycle_state: str
+    is_auto_rotation_enabled: bool = False
+    rotation_interval_in_days: Optional[int] = None