prowler-cloud 5.12.3__py3-none-any.whl → 5.13.0__py3-none-any.whl

prowler/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_ssh_port/network_security_list_ingress_from_internet_to_ssh_port.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "oci",
+  "CheckID": "network_security_list_ingress_from_internet_to_ssh_port",
+  "CheckTitle": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 22",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:network:securitylist",
+  "Severity": "high",
+  "ResourceType": "OciNetworkSecurityList",
+  "Description": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 22. Security lists provide stateful or stateless filtering of ingress and egress network traffic to OCI resources.",
+  "Risk": "Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-ssh-access.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Update security lists to remove ingress rules allowing access from 0.0.0.0/0 to port 22. Restrict SSH access to known IP addresses.",
+      "Url": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm"
+    }
+  },
+  "Categories": [
+    "internet-exposed",
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_ssh_port/network_security_list_ingress_from_internet_to_ssh_port.py

@@ -0,0 +1,67 @@
+"""Check if security lists allow ingress from 0.0.0.0/0 to port 22."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.network.network_client import network_client
+
+
+class network_security_list_ingress_from_internet_to_ssh_port(Check):
+    """Check if security lists allow ingress from 0.0.0.0/0 to port 22."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the network_security_list_ingress_from_internet_to_ssh_port check.
+
+        Returns:
+            List of Check_Report_OCI objects with findings
+        """
+        findings = []
+
+        for security_list in network_client.security_lists:
+            has_public_ssh_access = False
+
+            # Check ingress rules for public SSH access
+            for rule in security_list.ingress_security_rules:
+                if rule.get("source") == "0.0.0.0/0":
+                    protocol = rule.get("protocol")
+                    # Protocol 6 is TCP
+                    if protocol == "6":
+                        tcp_options = rule.get("tcp_options")
+                        # If tcp_options is None, all TCP ports are allowed
+                        if not tcp_options:
+                            has_public_ssh_access = True
+                            break
+                        # If tcp_options exists, check destination port range
+                        dst_port = tcp_options.get("destination_port_range")
+                        if dst_port:
+                            port_min = dst_port.get("min", 0)
+                            port_max = dst_port.get("max", 0)
+                            if port_min <= 22 <= port_max:
+                                has_public_ssh_access = True
+                                break
+                        # If no destination port range specified, all ports are allowed
+                        else:
+                            has_public_ssh_access = True
+                            break
+                    # Protocol "all" or if protocol is not specified
+                    elif protocol == "all" or not protocol:
+                        has_public_ssh_access = True
+                        break
+
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=security_list,
+                region=security_list.region,
+                resource_name=security_list.display_name,
+                resource_id=security_list.id,
+                compartment_id=security_list.compartment_id,
+            )
+
+            if has_public_ssh_access:
+                report.status = "FAIL"
+                report.status_extended = f"Security list {security_list.display_name} allows ingress from 0.0.0.0/0 to port 22 (SSH)."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Security list {security_list.display_name} does not allow ingress from 0.0.0.0/0 to port 22 (SSH)."
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/network/network_service.py

@@ -0,0 +1,321 @@
+"""OCI Network Service Module."""
+
+from datetime import datetime
+from typing import Optional
+
+import oci
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.oraclecloud.lib.service.service import OCIService
+
+
+class Network(OCIService):
+    """OCI Network Service class to retrieve VCNs, security lists, and network security groups."""
+
+    def __init__(self, provider):
+        """
+        Initialize the Network service.
+
+        Args:
+            provider: The OCI provider instance
+        """
+        super().__init__("network", provider)
+        self.vcns = []
+        self.security_lists = []
+        self.network_security_groups = []
+        self.subnets = []
+        self.__threading_call_by_region_and_compartment__(self.__list_vcns__)
+        self.__threading_call_by_region_and_compartment__(self.__list_security_lists__)
+        self.__threading_call_by_region_and_compartment__(
+            self.__list_network_security_groups__
+        )
+        self.__threading_call_by_region_and_compartment__(self.__list_subnets__)
+
+    def __get_client__(self, region):
+        """
+        Get the VirtualNetwork client for a region.
+
+        Args:
+            region: Region key
+
+        Returns:
+            VirtualNetwork client instance
+        """
+        return self._create_oci_client(
+            oci.core.VirtualNetworkClient, config_overrides={"region": region}
+        )
+
+    def __list_vcns__(self, region, compartment):
+        """
+        List all VCNs in a compartment and region.
+
+        Args:
+            region: OCIRegion object
+            compartment: Compartment object
+        """
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            vcn_client = self.__get_client__(region_key)
+
+            logger.info(
+                f"Network - Listing VCNs in {region_key} - {compartment.name}..."
+            )
+
+            vcns_data = oci.pagination.list_call_get_all_results(
+                vcn_client.list_vcns, compartment_id=compartment.id
+            ).data
+
+            for vcn in vcns_data:
+                if vcn.lifecycle_state != "TERMINATED":
+                    # Get default security list
+                    default_security_list_id = vcn.default_security_list_id
+
+                    self.vcns.append(
+                        VCN(
+                            id=vcn.id,
+                            display_name=(
+                                vcn.display_name if hasattr(vcn, "display_name") else ""
+                            ),
+                            compartment_id=compartment.id,
+                            cidr_blocks=(
+                                vcn.cidr_blocks if hasattr(vcn, "cidr_blocks") else []
+                            ),
+                            lifecycle_state=vcn.lifecycle_state,
+                            default_security_list_id=default_security_list_id,
+                            region=region_key,
+                            time_created=vcn.time_created,
+                        )
+                    )
+        except Exception as error:
+            logger.error(
+                f"{region_key} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def __list_security_lists__(self, region, compartment):
+        """
+        List all security lists in a compartment and region.
+
+        Args:
+            region: OCIRegion object
+            compartment: Compartment object
+        """
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            vcn_client = self.__get_client__(region_key)
+
+            logger.info(
+                f"Network - Listing Security Lists in {region_key} - {compartment.name}..."
+            )
+
+            security_lists_data = oci.pagination.list_call_get_all_results(
+                vcn_client.list_security_lists, compartment_id=compartment.id
+            ).data
+
+            for sec_list in security_lists_data:
+                if sec_list.lifecycle_state != "TERMINATED":
+                    # Check if this is a default security list
+                    is_default = False
+                    vcn_id = sec_list.vcn_id
+                    for vcn in self.vcns:
+                        if (
+                            vcn.id == vcn_id
+                            and vcn.default_security_list_id == sec_list.id
+                        ):
+                            is_default = True
+                            break
+
+                    # Convert OCI SDK objects to dict for JSON serialization
+                    ingress_rules = [
+                        oci.util.to_dict(rule)
+                        for rule in (sec_list.ingress_security_rules or [])
+                    ]
+                    egress_rules = [
+                        oci.util.to_dict(rule)
+                        for rule in (sec_list.egress_security_rules or [])
+                    ]
+
+                    self.security_lists.append(
+                        SecurityList(
+                            id=sec_list.id,
+                            display_name=(
+                                sec_list.display_name
+                                if hasattr(sec_list, "display_name")
+                                else ""
+                            ),
+                            compartment_id=compartment.id,
+                            vcn_id=sec_list.vcn_id,
+                            ingress_security_rules=ingress_rules,
+                            egress_security_rules=egress_rules,
+                            lifecycle_state=sec_list.lifecycle_state,
+                            is_default=is_default,
+                            region=region_key,
+                            time_created=sec_list.time_created,
+                        )
+                    )
+        except Exception as error:
+            logger.error(
+                f"{region_key} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def __list_network_security_groups__(self, region, compartment):
+        """
+        List all network security groups in a compartment and region.
+
+        Args:
+            region: OCIRegion object
+            compartment: Compartment object
+        """
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            vcn_client = self.__get_client__(region_key)
+
+            logger.info(
+                f"Network - Listing Network Security Groups in {region_key} - {compartment.name}..."
+            )
+
+            nsgs_data = oci.pagination.list_call_get_all_results(
+                vcn_client.list_network_security_groups, compartment_id=compartment.id
+            ).data
+
+            for nsg in nsgs_data:
+                if nsg.lifecycle_state != "TERMINATED":
+                    # Get NSG rules
+                    try:
+                        nsg_rules_data = oci.pagination.list_call_get_all_results(
+                            vcn_client.list_network_security_group_security_rules,
+                            network_security_group_id=nsg.id,
+                        ).data
+                        # Convert OCI SDK objects to dict for JSON serialization
+                        nsg_rules = [oci.util.to_dict(rule) for rule in nsg_rules_data]
+                    except Exception:
+                        nsg_rules = []
+
+                    self.network_security_groups.append(
+                        NetworkSecurityGroup(
+                            id=nsg.id,
+                            display_name=(
+                                nsg.display_name if hasattr(nsg, "display_name") else ""
+                            ),
+                            compartment_id=compartment.id,
+                            vcn_id=nsg.vcn_id,
+                            security_rules=nsg_rules,
+                            lifecycle_state=nsg.lifecycle_state,
+                            region=region_key,
+                            time_created=nsg.time_created,
+                        )
+                    )
+        except Exception as error:
+            logger.error(
+                f"{region_key} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def __list_subnets__(self, region, compartment):
+        """
+        List all subnets in a compartment and region.
+
+        Args:
+            region: OCIRegion object
+            compartment: Compartment object
+        """
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            vcn_client = self.__get_client__(region_key)
+
+            logger.info(
+                f"Network - Listing Subnets in {region_key} - {compartment.name}..."
+            )
+
+            subnets_data = oci.pagination.list_call_get_all_results(
+                vcn_client.list_subnets, compartment_id=compartment.id
+            ).data
+
+            for subnet in subnets_data:
+                if subnet.lifecycle_state != "TERMINATED":
+                    self.subnets.append(
+                        Subnet(
+                            id=subnet.id,
+                            display_name=(
+                                subnet.display_name
+                                if hasattr(subnet, "display_name")
+                                else ""
+                            ),
+                            compartment_id=compartment.id,
+                            vcn_id=subnet.vcn_id,
+                            cidr_block=(
+                                subnet.cidr_block
+                                if hasattr(subnet, "cidr_block")
+                                else ""
+                            ),
+                            lifecycle_state=subnet.lifecycle_state,
+                            region=region_key,
+                            time_created=subnet.time_created,
+                        )
+                    )
+        except Exception as error:
+            logger.error(
+                f"{region_key} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+# Service Models
+class VCN(BaseModel):
+    """OCI VCN model."""
+
+    id: str
+    display_name: str
+    compartment_id: str
+    cidr_blocks: list[str]
+    lifecycle_state: str
+    default_security_list_id: Optional[str]
+    region: str
+    time_created: datetime
+
+
+class SecurityList(BaseModel):
+    """OCI Security List model."""
+
+    id: str
+    display_name: str
+    compartment_id: str
+    vcn_id: str
+    ingress_security_rules: list
+    egress_security_rules: list
+    lifecycle_state: str
+    is_default: bool = False
+    region: str
+    time_created: datetime
+
+    class Config:
+        arbitrary_types_allowed = True
+        json_encoders = {object: lambda v: str(v)}
+
+
+class NetworkSecurityGroup(BaseModel):
+    """OCI Network Security Group model."""
+
+    id: str
+    display_name: str
+    compartment_id: str
+    vcn_id: str
+    security_rules: list
+    lifecycle_state: str
+    region: str
+    time_created: datetime
+
+    class Config:
+        arbitrary_types_allowed = True
+        json_encoders = {object: lambda v: str(v)}
+
+
+class Subnet(BaseModel):
+    """OCI Subnet model."""
+
+    id: str
+    display_name: str
+    compartment_id: str
+    vcn_id: str
+    cidr_block: str
+    lifecycle_state: str
+    region: str
+    time_created: datetime

prowler/providers/oraclecloud/services/network/network_vcn_subnet_flow_logs_enabled/network_vcn_subnet_flow_logs_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "network_vcn_subnet_flow_logs_enabled",
+  "CheckTitle": "Ensure VCN flow logging is enabled for all subnets",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:network:subnet",
+  "Severity": "medium",
+  "ResourceType": "OciSubnet",
+  "Description": "VCN flow logging should be enabled for all subnets.",
+  "Risk": "Not meeting this network security requirement increases risk of unauthorized access.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/enable-flow-logging.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure VCN flow logging is enabled for all subnets",
+      "Url": "https://hub.prowler.com/check/oci/network_vcn_subnet_flow_logs_enabled"
+    }
+  },
+  "Categories": [
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/network/network_vcn_subnet_flow_logs_enabled/network_vcn_subnet_flow_logs_enabled.py

@@ -0,0 +1,66 @@
+"""Check Ensure VCN flow logging is enabled for all subnets."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.logging.logging_client import logging_client
+from prowler.providers.oraclecloud.services.network.network_client import network_client
+
+
+class network_vcn_subnet_flow_logs_enabled(Check):
+    """Check Ensure VCN flow logging is enabled for all subnets."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the network_vcn_subnet_flow_logs_enabled check."""
+        findings = []
+
+        for subnet in network_client.subnets:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=subnet,
+                region=subnet.region,
+                resource_name=subnet.display_name,
+                resource_id=subnet.id,
+                compartment_id=subnet.compartment_id,
+            )
+
+            # Check if subnet has flow logs enabled (either at VCN or subnet level)
+            has_flow_logs = False
+
+            # Check for VCN-level flow logs
+            for log in logging_client.logs:
+                if (
+                    log.source_service == "flowlogs"
+                    and log.source_resource
+                    and subnet.vcn_id in log.source_resource
+                    and log.region == subnet.region
+                    and log.is_enabled
+                ):
+                    has_flow_logs = True
+                    break
+
+            # If no VCN-level logs, check for subnet-level flow logs
+            if not has_flow_logs:
+                for log in logging_client.logs:
+                    if (
+                        log.source_service == "flowlogs"
+                        and log.source_resource
+                        and subnet.id in log.source_resource
+                        and log.region == subnet.region
+                        and log.is_enabled
+                    ):
+                        has_flow_logs = True
+                        break
+
+            if has_flow_logs:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Subnet {subnet.display_name} has flow logging enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Subnet {subnet.display_name} does not have flow logging enabled."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/objectstorage/objectstorage_bucket_encrypted_with_cmk/objectstorage_bucket_encrypted_with_cmk.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "oci",
+  "CheckID": "objectstorage_bucket_encrypted_with_cmk",
+  "CheckTitle": "Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK)",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:objectstorage:bucket",
+  "Severity": "medium",
+  "ResourceType": "OciBucket",
+  "Description": "Object Storage buckets should be encrypted with Customer Managed Keys.",
+  "Risk": "Not meeting this storage security requirement increases data security risk.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Object/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-ObjectStorage/buckets-encrypted-with-cmks.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK)",
+      "Url": "https://hub.prowler.com/check/oci/objectstorage_bucket_encrypted_with_cmk"
+    }
+  },
+  "Categories": [
+    "storage",
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/objectstorage/objectstorage_bucket_encrypted_with_cmk/objectstorage_bucket_encrypted_with_cmk.py

@@ -0,0 +1,40 @@
+"""Check Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK)."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.objectstorage.objectstorage_client import (
+    objectstorage_client,
+)
+
+
+class objectstorage_bucket_encrypted_with_cmk(Check):
+    """Check Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK)."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the objectstorage_bucket_encrypted_with_cmk check."""
+        findings = []
+
+        # Check buckets are encrypted with CMK
+        for bucket in objectstorage_client.buckets:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=bucket,
+                region=bucket.region,
+                resource_name=bucket.name,
+                resource_id=bucket.id,
+                compartment_id=bucket.compartment_id,
+            )
+
+            if bucket.kms_key_id:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Bucket {bucket.name} is encrypted with Customer Managed Key."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bucket {bucket.name} is not encrypted with Customer Managed Key."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/objectstorage/objectstorage_bucket_logging_enabled/objectstorage_bucket_logging_enabled.metadata.json

@@ -0,0 +1,32 @@
+{
+  "Provider": "oci",
+  "CheckID": "objectstorage_bucket_logging_enabled",
+  "CheckTitle": "Ensure write level Object Storage logging is enabled for all buckets",
+  "CheckType": [],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "OciObjectStorageBucket",
+  "Description": "Write-level logging for Object Storage buckets provides an audit trail of all write operations (PUT, POST, DELETE) performed on buckets, enabling security monitoring and compliance requirements.",
+  "Risk": "Without write-level logging, unauthorized or malicious modifications to Object Storage data cannot be detected or investigated.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Logging/Concepts/loggingoverview.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "oci logging log create --log-group-id <log-group-ocid> --display-name 'ObjectStorage-Write-Logs' --log-type SERVICE --configuration '{\"compartmentId\":\"<compartment-ocid>\",\"source\":{\"service\":\"objectstorage\",\"resource\":\"<bucket-name>\",\"category\":\"write\",\"sourceType\":\"OCISERVICE\"}}'",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-ObjectStorage/enable-write-level-logging.html",
+      "Terraform": "resource \"oci_logging_log\" \"objectstorage_write_log\" {\n  display_name = \"ObjectStorage-Write-Logs\"\n  log_group_id = oci_logging_log_group.log_group.id\n  log_type = \"SERVICE\"\n  configuration {\n    source {\n      category = \"write\"\n      resource = oci_objectstorage_bucket.bucket.name\n      service = \"objectstorage\"\n      source_type = \"OCISERVICE\"\n    }\n    compartment_id = var.compartment_id\n  }\n  is_enabled = true\n}"
+    },
+    "Recommendation": {
+      "Text": "Enable write-level logging for all Object Storage buckets to maintain audit trails of data modifications.",
+      "Url": "https://docs.prowler.com/checks/oci/oci-logging/objectstorage_bucket_logging_enabled"
+    }
+  },
+  "Categories": [
+    "logging"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}