prowler-cloud 5.13.1__py3-none-any.whl → 5.14.0__py3-none-any.whl

prowler/CHANGELOG.md

@@ -2,6 +2,83 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+## [v5.14.0] (Prowler v5.14.0)
+
+### Added
+- GitHub provider check `organization_default_repository_permission_strict` [(#8785)](https://github.com/prowler-cloud/prowler/pull/8785)
+- Add OCI mapping to scan and check classes [(#8927)](https://github.com/prowler-cloud/prowler/pull/8927)
+- `codepipeline_project_repo_private` check for AWS provider [(#5915)](https://github.com/prowler-cloud/prowler/pull/5915)
+- `cloudstorage_bucket_versioning_enabled` check for GCP provider [(#9014)](https://github.com/prowler-cloud/prowler/pull/9014)
+- `cloudstorage_bucket_soft_delete_enabled` check for GCP provider [(#9028)](https://github.com/prowler-cloud/prowler/pull/9028)
+- `cloudstorage_bucket_logging_enabled` check for GCP provider [(#9091)](https://github.com/prowler-cloud/prowler/pull/9091)
+- `cloudstorage_audit_logs_enabled` check for GCP provider [(#9220)](https://github.com/prowler-cloud/prowler/pull/9220)
+- `cloudstorage_bucket_sufficient_retention_period` check for GCP provider [(#9149)](https://github.com/prowler-cloud/prowler/pull/9149)
+- C5 compliance framework for Azure provider [(#9081)](https://github.com/prowler-cloud/prowler/pull/9081)
+- C5 compliance framework for the GCP provider [(#9097)](https://github.com/prowler-cloud/prowler/pull/9097)
+- `organization_repository_creation_limited` check for GitHub provider [(#8844)](https://github.com/prowler-cloud/prowler/pull/8844)
+- HIPAA compliance framework for the GCP provider [(#8955)](https://github.com/prowler-cloud/prowler/pull/8955)
+- Support PDF reporting for ENS compliance framework [(#9158)](https://github.com/prowler-cloud/prowler/pull/9158)
+- PDF reporting for NIS2 compliance framework [(#9170)](https://github.com/prowler-cloud/prowler/pull/9170)
+- Add organization ID parameter for MongoDB Atlas provider [(#9167)](https://github.com/prowler-cloud/prowler/pull/9167)
+- Add multiple compliance improvements [(#9145)](https://github.com/prowler-cloud/prowler/pull/9145)
+- Added validation for invalid checks, services, and categories in `load_checks_to_execute` function [(#8971)](https://github.com/prowler-cloud/prowler/pull/8971)
+- NIST CSF 2.0 compliance framework for the AWS provider [(#9185)](https://github.com/prowler-cloud/prowler/pull/9185)
+- Add FedRAMP 20x KSI Low for AWS, Azure and GCP [(#9198)](https://github.com/prowler-cloud/prowler/pull/9198)
+- Add verification for provider ID in MongoDB Atlas provider [(#9211)](https://github.com/prowler-cloud/prowler/pull/9211)
+- Add Prowler ThreatScore for the K8S provider [(#9235)](https://github.com/prowler-cloud/prowler/pull/9235)
+- Add `postgresql_flexible_server_entra_id_authentication_enabled` check for Azure provider [(#8764)](https://github.com/prowler-cloud/prowler/pull/8764)
+- Add branch name to IaC provider region [(#9296)](https://github.com/prowler-cloud/prowler/pull/9295)
+
+### Changed
+- Update AWS Direct Connect service metadata to new format [(#8855)](https://github.com/prowler-cloud/prowler/pull/8855)
+- Update AWS DRS service metadata to new format [(#8870)](https://github.com/prowler-cloud/prowler/pull/8870)
+- Update AWS DynamoDB service metadata to new format [(#8871)](https://github.com/prowler-cloud/prowler/pull/8871)
+- Update AWS CloudWatch service metadata to new format [(#8848)](https://github.com/prowler-cloud/prowler/pull/8848)
+- Update AWS EMR service metadata to new format [(#9002)](https://github.com/prowler-cloud/prowler/pull/9002)
+- Update AWS EKS service metadata to new format [(#8890)](https://github.com/prowler-cloud/prowler/pull/8890)
+- Update AWS Elastic Beanstalk service metadata to new format [(#8934)](https://github.com/prowler-cloud/prowler/pull/8934)
+- Update AWS ElastiCache service metadata to new format [(#8933)](https://github.com/prowler-cloud/prowler/pull/8933)
+- Update Kubernetes etcd service metadata to new format [(#9096)](https://github.com/prowler-cloud/prowler/pull/9096)
+- Update MongoDB Atlas projects service metadata to new format [(#9093)](https://github.com/prowler-cloud/prowler/pull/9093)
+- Update GitHub Organization service metadata to new format [(#9094)](https://github.com/prowler-cloud/prowler/pull/9094)
+- Update AWS CodeBuild service metadata to new format [(#8851)](https://github.com/prowler-cloud/prowler/pull/8851)
+- Update GCP Artifact Registry service metadata to new format [(#9088)](https://github.com/prowler-cloud/prowler/pull/9088)
+- Update AWS EFS service metadata to new format [(#8889)](https://github.com/prowler-cloud/prowler/pull/8889)
+- Update AWS EventBridge service metadata to new format [(#9003)](https://github.com/prowler-cloud/prowler/pull/9003)
+- Update AWS Firehose service metadata to new format [(#9004)](https://github.com/prowler-cloud/prowler/pull/9004)
+- Update AWS FMS service metadata to new format [(#9005)](https://github.com/prowler-cloud/prowler/pull/9005)
+- Update AWS FSx service metadata to new format [(#9006)](https://github.com/prowler-cloud/prowler/pull/9006)
+- Update AWS Glacier service metadata to new format [(#9007)](https://github.com/prowler-cloud/prowler/pull/9007)
+- Update oraclecloud analytics service metadata to new format [(#9114)](https://github.com/prowler-cloud/prowler/pull/9114)
+- Update AWS ELB service metadata to new format [(#8935)](https://github.com/prowler-cloud/prowler/pull/8935)
+- Update AWS CodeArtifact service metadata to new format [(#8850)](https://github.com/prowler-cloud/prowler/pull/8850)
+- Rename OCI provider to oraclecloud with oci alias [(#9126)](https://github.com/prowler-cloud/prowler/pull/9126)
+- Remove unnecessary tests for M365_PowerShell module [(#9204)](https://github.com/prowler-cloud/prowler/pull/9204)
+- Update AWS ELB v2 service metadata to new format [(#9001)](https://github.com/prowler-cloud/prowler/pull/9001)
+- Update oraclecloud cloudguard service metadata to new format [(#9223)](https://github.com/prowler-cloud/prowler/pull/9223)
+- Update oraclecloud blockstorage service metadata to new format [(#9222)](https://github.com/prowler-cloud/prowler/pull/9222)
+- Update oraclecloud audit service metadata to new format [(#9221)](https://github.com/prowler-cloud/prowler/pull/9221)
+- Raise ASFF output error for non-AWS providers [(#9225)](https://github.com/prowler-cloud/prowler/pull/9225)
+- Update AWS ECR service metadata to new format [(#8872)](https://github.com/prowler-cloud/prowler/pull/8872)
+- Update AWS ECS service metadata to new format [(#8888)](https://github.com/prowler-cloud/prowler/pull/8888)
+- Update AWS Kinesis service metadata to new format [(#9262)](https://github.com/prowler-cloud/prowler/pull/9262)
+- Update AWS DocumentDB service metadata to new format [(#8862)](https://github.com/prowler-cloud/prowler/pull/8862)
+
+### Fixed
+- Check `check_name` has no `resource_name` error for GCP provider [(#9169)](https://github.com/prowler-cloud/prowler/pull/9169)
+- Depth Truncation and parsing error in PowerShell queries [(#9181)](https://github.com/prowler-cloud/prowler/pull/9181)
+- False negative in `iam_role_cross_service_confused_deputy_prevention` check [(#9213)](https://github.com/prowler-cloud/prowler/pull/9213)
+- Fix M365 Teams `--sp-env-auth` connection error and enhanced timeout logging [(#9191)](https://github.com/prowler-cloud/prowler/pull/9191)
+- Rename `get_oci_assessment_summary` to `get_oraclecloud_assessment_summary` in HTML output [(#9200)](https://github.com/prowler-cloud/prowler/pull/9200)
+- Fix Validation and other errors in Azure provider [(#8915)](https://github.com/prowler-cloud/prowler/pull/8915)
+- Update documentation URLs from docs.prowler.cloud to docs.prowler.com [(#9240)](https://github.com/prowler-cloud/prowler/pull/9240)
+- Refresh output report timestamps for each scan [(#9272)](https://github.com/prowler-cloud/prowler/pull/9272)
+- Fix file name parsing for checks on Windows [(#9268)](https://github.com/prowler-cloud/prowler/pull/9268)
+- Remove typo for Prowler ThreatScore - M365 [(#9274)](https://github.com/prowler-cloud/prowler/pull/9274)
+- Point HTML logo to the one present in the Github repository [(#9282)](https://github.com/prowler-cloud/prowler/pull/9282)
+
+---
+
 ## [v5.13.1] (Prowler v5.13.1)
 
 ### Fixed
@@ -9,6 +86,12 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Fix `ec2_instance_with_outdated_ami` check to handle None AMIs [(#9046)](https://github.com/prowler-cloud/prowler/pull/9046)
 - Handle timestamp when transforming compliance findings in CCC [(#9042)](https://github.com/prowler-cloud/prowler/pull/9042)
 - Update `resource_id` for admincenter service and avoid unnecessary msgraph requests [(#9019)](https://github.com/prowler-cloud/prowler/pull/9019)
+- Fix `firehose_stream_encrypted_at_rest` description and findings clarity [(#9142)](https://github.com/prowler-cloud/prowler/pull/9142)
+
+---
+
+### Changed
+- Adapt IaC provider to be used in the Prowler App [(#8751)](https://github.com/prowler-cloud/prowler/pull/8751)
 
 ---
 
@@ -54,7 +137,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Update AWS Directory Service service metadata to new format [(#8859)](https://github.com/prowler-cloud/prowler/pull/8859)
 - Update AWS CloudFront service metadata to new format [(#8829)](https://github.com/prowler-cloud/prowler/pull/8829)
 - Deprecate user authentication for M365 provider [(#8865)](https://github.com/prowler-cloud/prowler/pull/8865)
-- Update AWS EFS service metadata to new format [(#8889)](https://github.com/prowler-cloud/prowler/pull/8889)
+
 
 ### Fixed
 - Fix SNS topics showing empty AWS_ResourceID in Quick Inventory output [(#8762)](https://github.com/prowler-cloud/prowler/issues/8762)
@@ -320,7 +403,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ---
 
-## [v5.7.5] (Prowler 5.7.5)
+## [v5.7.5] (Prowler v5.7.5)
 
 ### Fixed
 - Use unified timestamp for all requirements [(#8059)](https://github.com/prowler-cloud/prowler/pull/8059)

prowler/__main__.py

@@ -49,17 +49,19 @@ from prowler.lib.outputs.asff.asff import ASFF
 from prowler.lib.outputs.compliance.aws_well_architected.aws_well_architected import (
     AWSWellArchitected,
 )
+from prowler.lib.outputs.compliance.c5.c5_aws import AWSC5
+from prowler.lib.outputs.compliance.c5.c5_azure import AzureC5
+from prowler.lib.outputs.compliance.c5.c5_gcp import GCPC5
 from prowler.lib.outputs.compliance.ccc.ccc_aws import CCC_AWS
 from prowler.lib.outputs.compliance.ccc.ccc_azure import CCC_Azure
 from prowler.lib.outputs.compliance.ccc.ccc_gcp import CCC_GCP
-from prowler.lib.outputs.compliance.c5.c5_aws import AWSC5
 from prowler.lib.outputs.compliance.cis.cis_aws import AWSCIS
 from prowler.lib.outputs.compliance.cis.cis_azure import AzureCIS
 from prowler.lib.outputs.compliance.cis.cis_gcp import GCPCIS
 from prowler.lib.outputs.compliance.cis.cis_github import GithubCIS
 from prowler.lib.outputs.compliance.cis.cis_kubernetes import KubernetesCIS
 from prowler.lib.outputs.compliance.cis.cis_m365 import M365CIS
-from prowler.lib.outputs.compliance.cis.cis_oci import OCICIS
+from prowler.lib.outputs.compliance.cis.cis_oraclecloud import OracleCloudCIS
 from prowler.lib.outputs.compliance.compliance import display_compliance_table
 from prowler.lib.outputs.compliance.ens.ens_aws import AWSENS
 from prowler.lib.outputs.compliance.ens.ens_azure import AzureENS
@@ -88,6 +90,9 @@ from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_azur
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_gcp import (
     ProwlerThreatScoreGCP,
 )
+from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_kubernetes import (
+    ProwlerThreatScoreKubernetes,
+)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_m365 import (
     ProwlerThreatScoreM365,
 )
@@ -332,7 +337,7 @@ def prowler():
         output_options = IACOutputOptions(args, bulk_checks_metadata)
     elif provider == "llm":
         output_options = LLMOutputOptions(args, bulk_checks_metadata)
-    elif provider == "oci":
+    elif provider == "oraclecloud":
         output_options = OCIOutputOptions(
             args, bulk_checks_metadata, global_provider.identity
         )
@@ -357,6 +362,12 @@ def prowler():
         else:
             # Original behavior for IAC or non-verbose LLM
             findings = global_provider.run()
+            # Note: IaC doesn't support granular progress tracking since Trivy runs as a black box
+            # and returns all findings at once. Progress tracking would just be 0% → 100%.
+
+            # Filter findings by status if specified
+            if hasattr(args, "status") and args.status:
+                findings = [f for f in findings if f.status in args.status]
             # Report findings for verbose output
             report(findings, global_provider, output_options)
     elif len(checks_to_execute):
@@ -422,7 +433,7 @@ def prowler():
         else:
             # Refactor(CLI)
             logger.critical(
-                "Slack integration needs SLACK_API_TOKEN and SLACK_CHANNEL_NAME environment variables (see more in https://docs.prowler.cloud/en/latest/tutorials/integrations/#slack)."
+                "Slack integration needs SLACK_API_TOKEN and SLACK_CHANNEL_NAME environment variables (see more in https://docs.prowler.com/user-guide/cli/tutorials/integrations#configuration-of-the-integration-with-slack)."
             )
             sys.exit(1)
 
@@ -565,7 +576,6 @@ def prowler():
                 generated_outputs["compliance"].append(prowler_threatscore)
                 prowler_threatscore.batch_write_data_to_file()
             elif compliance_name.startswith("ccc_"):
-
                 filename = (
                     f"{output_options.output_directory}/compliance/"
                     f"{output_options.output_filename}_{compliance_name}.csv"
@@ -682,6 +692,18 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(ccc_azure)
                 ccc_azure.batch_write_data_to_file()
+            elif compliance_name == "c5_azure":
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                c5_azure = AzureC5(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(c5_azure)
+                c5_azure.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -773,6 +795,18 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(ccc_gcp)
                 ccc_gcp.batch_write_data_to_file()
+            elif compliance_name == "c5_gcp":
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                c5_gcp = GCPC5(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(c5_gcp)
+                c5_gcp.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -814,6 +848,19 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(iso27001)
                 iso27001.batch_write_data_to_file()
+            elif compliance_name == "prowler_threatscore_kubernetes":
+                # Generate Prowler ThreatScore Finding Object
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                prowler_threatscore = ProwlerThreatScoreKubernetes(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(prowler_threatscore)
+                prowler_threatscore.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -937,7 +984,7 @@ def prowler():
                 generated_outputs["compliance"].append(generic_compliance)
                 generic_compliance.batch_write_data_to_file()
 
-    elif provider == "oci":
+    elif provider == "oraclecloud":
         for compliance_name in input_compliance_frameworks:
             if compliance_name.startswith("cis_"):
                 # Generate CIS Finding Object
@@ -945,7 +992,7 @@ def prowler():
                     f"{output_options.output_directory}/compliance/"
                     f"{output_options.output_filename}_{compliance_name}.csv"
                 )
-                cis = OCICIS(
+                cis = OracleCloudCIS(
                     findings=finding_outputs,
                     compliance=bulk_compliance_frameworks[compliance_name],
                     file_path=filename,

prowler/compliance/aws/ens_rd2022_aws.json

@@ -1,6 +1,6 @@
 {
   "Framework": "ENS",
-  "Name": "ENS RD 311/2022",
+  "Name": "ENS RD 311/2022 - Categoría Alta",
   "Version": "RD2022",
   "Provider": "AWS",
   "Description": "The accreditation scheme of the ENS (National Security Scheme) has been developed by the Ministry of Finance and Public Administrations and the CCN (National Cryptological Center). This includes the basic principles and minimum requirements necessary for the adequate protection of information.",

prowler/compliance/aws/fedramp_20x_ksi_low_aws.json

@@ -0,0 +1,347 @@
+{
+  "Framework": "FedRAMP-20x-KSI-Low",
+  "Name": "FedRAMP 20x Key Security Indicators (KSIs) - Low Impact Level v25.05C",
+  "Version": "25.05C",
+  "Provider": "AWS",
+  "Description": "FedRAMP 20x Key Security Indicators (KSIs) Low Impact Level represent core security indicators for cloud service providers, focusing on automation, continuous monitoring, and cloud-native security principles per FedRAMP 20x Phase One pilot requirements for Low impact systems.",
+  "Requirements": [
+    {
+      "Id": "ksi-cmt",
+      "Name": "KSI-CMT: Change Management",
+      "Description": "A secure cloud service provider will ensure that all system changes are properly documented and configuration baselines are updated accordingly",
+      "Attributes": [
+        {
+          "ItemId": "ksi-cmt",
+          "Section": "Change Management",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "cloudtrail_multi_region_enabled",
+        "cloudtrail_log_file_validation_enabled",
+        "cloudtrail_s3_dataevents_read_enabled",
+        "cloudtrail_s3_dataevents_write_enabled",
+        "cloudwatch_changes_to_network_acls_alarm_configured",
+        "cloudwatch_changes_to_network_gateways_alarm_configured",
+        "cloudwatch_changes_to_network_route_tables_alarm_configured",
+        "cloudwatch_changes_to_vpcs_alarm_configured",
+        "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
+        "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
+        "cloudwatch_log_metric_filter_aws_organizations_changes",
+        "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes",
+        "cloudwatch_log_metric_filter_policy_changes",
+        "cloudwatch_log_metric_filter_security_group_changes",
+        "config_recorder_all_regions_enabled",
+        "ec2_instance_managed_by_ssm",
+        "ec2_instance_older_than_specific_days",
+        "ssm_managed_compliant_patching",
+        "ssm_managed_instance_compliance_association_compliant",
+        "ssm_managed_instance_compliance_patch_compliant"
+      ]
+    },
+    {
+      "Id": "ksi-cna",
+      "Name": "KSI-CNA: Cloud Native Architecture",
+      "Description": "A secure cloud service offering will use cloud native architecture and design principles to enforce and enhance the Confidentiality, Integrity and Availability of the system",
+      "Attributes": [
+        {
+          "ItemId": "ksi-cna",
+          "Section": "Cloud Native Architecture",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "autoscaling_group_multiple_az",
+        "autoscaling_group_multiple_instance_types",
+        "autoscaling_group_capacity_rebalance_enabled",
+        "dynamodb_tables_pitr_enabled",
+        "dynamodb_tables_deletion_protection_enabled",
+        "ec2_instance_imdsv2_enabled",
+        "ec2_networkacl_allow_ingress_any_port",
+        "ec2_securitygroup_default_restrict_traffic",
+        "ec2_securitygroup_allow_ingress_from_internet_to_any_port",
+        "eks_cluster_network_policy_enabled",
+        "eks_cluster_not_publicly_accessible",
+        "eks_cluster_private_nodes_enabled",
+        "eks_cluster_uses_a_supported_version",
+        "elb_cross_zone_load_balancing_enabled",
+        "elbv2_alb_multi_az_scheme",
+        "elbv2_waf_acl_attached",
+        "rds_instance_multi_az",
+        "rds_cluster_multi_az",
+        "vpc_subnet_auto_assign_public_ip_disabled",
+        "vpc_default_security_group_restricts_traffic",
+        "vpc_peering_connection_routing_tables_with_least_privilege"
+      ]
+    },
+    {
+      "Id": "ksi-iam",
+      "Name": "KSI-IAM: Identity and Access Management",
+      "Description": "A secure cloud service offering will protect user data, control access, and apply zero trust principles",
+      "Attributes": [
+        {
+          "ItemId": "ksi-iam",
+          "Section": "Identity and Access Management",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "iam_administrator_access_with_mfa",
+        "iam_aws_attached_policy_no_administrative_privileges",
+        "iam_customer_attached_policy_no_administrative_privileges",
+        "iam_inline_policy_no_administrative_privileges",
+        "iam_no_custom_policy_permissive_role_assumption",
+        "iam_no_root_access_key",
+        "iam_password_policy_expires_passwords_within_90_days_or_less",
+        "iam_password_policy_lowercase",
+        "iam_password_policy_minimum_length_14",
+        "iam_password_policy_number",
+        "iam_password_policy_reuse_24",
+        "iam_password_policy_symbol",
+        "iam_password_policy_uppercase",
+        "iam_policy_attached_only_to_group_or_roles",
+        "iam_policy_no_full_access_to_cloudtrail",
+        "iam_policy_no_full_access_to_kms",
+        "iam_root_hardware_mfa_enabled",
+        "iam_root_mfa_enabled",
+        "iam_rotate_access_key_90_days",
+        "iam_user_accesskey_unused",
+        "iam_user_console_access_unused",
+        "iam_user_hardware_mfa_enabled",
+        "iam_user_mfa_enabled_console_access",
+        "iam_user_two_active_access_key",
+        "organizations_scp_check_deny_regions",
+        "organizations_opt_out_ai_services_policy"
+      ]
+    },
+    {
+      "Id": "ksi-inr",
+      "Name": "KSI-INR: Incident Response",
+      "Description": "A secure cloud service offering will respond to incidents according to FedRAMP requirements and cloud service provider policies",
+      "Attributes": [
+        {
+          "ItemId": "ksi-inr",
+          "Section": "Incident Response",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "guardduty_centrally_managed",
+        "guardduty_ec2_malware_protection_enabled",
+        "guardduty_eks_audit_log_enabled",
+        "guardduty_eks_protection_enabled",
+        "guardduty_eks_runtime_monitoring_enabled",
+        "guardduty_is_enabled",
+        "guardduty_lambda_protection_enabled",
+        "guardduty_malware_protection_enabled",
+        "guardduty_no_high_severity_findings",
+        "guardduty_rds_protection_enabled",
+        "guardduty_s3_protection_enabled",
+        "inspector2_is_enabled",
+        "inspector2_active_findings_exist",
+        "securityhub_enabled",
+        "sns_topics_kms_encryption_at_rest_enabled"
+      ]
+    },
+    {
+      "Id": "ksi-mla",
+      "Name": "KSI-MLA: Monitoring, Logging, and Auditing",
+      "Description": "A secure cloud service offering will monitor, log, and audit all important events, activity, and changes",
+      "Attributes": [
+        {
+          "ItemId": "ksi-mla",
+          "Section": "Monitoring, Logging, and Auditing",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "apigateway_restapi_logging_enabled",
+        "cloudtrail_cloudwatch_logging_enabled",
+        "cloudtrail_kms_encryption_enabled",
+        "cloudtrail_log_file_validation_enabled",
+        "cloudtrail_multi_region_enabled",
+        "cloudtrail_s3_dataevents_read_enabled",
+        "cloudtrail_s3_dataevents_write_enabled",
+        "cloudwatch_log_group_kms_encryption_enabled",
+        "cloudwatch_log_group_retention_policy_specific_days_enabled",
+        "ecs_cluster_container_insights_enabled",
+        "eks_cluster_control_plane_audit_logging_enabled",
+        "elb_logging_enabled",
+        "elbv2_logging_enabled",
+        "inspector2_is_enabled",
+        "opensearch_service_domains_cloudwatch_logging_enabled",
+        "rds_instance_enhanced_monitoring_enabled",
+        "rds_instance_integration_cloudwatch_logs",
+        "redshift_cluster_audit_logging",
+        "s3_bucket_server_access_logging_enabled",
+        "vpc_flow_logs_enabled",
+        "wafv2_webacl_logging_enabled"
+      ]
+    },
+    {
+      "Id": "ksi-piy",
+      "Name": "KSI-PIY: Policy and Inventory",
+      "Description": "A secure cloud service offering will have intentional, organized, universal guidance for how every information resource, including personnel, is secured",
+      "Attributes": [
+        {
+          "ItemId": "ksi-piy",
+          "Section": "Policy and Inventory",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "config_recorder_all_regions_enabled",
+        "config_recorder_using_aws_service_role",
+        "ec2_instance_managed_by_ssm",
+        "organizations_account_part_of_organizations",
+        "organizations_delegated_administrators",
+        "organizations_scp_check_deny_regions",
+        "organizations_tags_policies_enabled_and_attached",
+        "resourceexplorer_indexes_found",
+        "ssm_managed_instance_compliance_association_compliant",
+        "trustedadvisor_premium_support_plan_subscribed"
+      ]
+    },
+    {
+      "Id": "ksi-rpl",
+      "Name": "KSI-RPL: Recovery Planning",
+      "Description": "A secure cloud service offering will define, maintain, and test incident response plan(s) and recovery capabilities to ensure minimal service disruption and data loss",
+      "Attributes": [
+        {
+          "ItemId": "ksi-rpl",
+          "Section": "Recovery Planning",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "backup_plans_exist",
+        "backup_reportplans_exist",
+        "backup_vaults_exist",
+        "backup_vaults_encrypted",
+        "backup_recovery_point_encrypted",
+        "backup_recovery_point_manual_deletion_disabled",
+        "backup_recovery_point_minimum_retention_days",
+        "dlm_ebs_snapshot_lifecycle_policy_exists",
+        "dynamodb_tables_pitr_enabled",
+        "dynamodb_tables_deletion_protection_enabled",
+        "efs_have_backup_enabled",
+        "fsx_file_system_copy_tags_to_backups",
+        "rds_instance_backup_enabled",
+        "rds_instance_backup_retention_policy",
+        "rds_instance_deletion_protection",
+        "rds_cluster_deletion_protection",
+        "rds_snapshots_encrypted",
+        "redshift_cluster_automated_snapshot"
+      ]
+    },
+    {
+      "Id": "ksi-svc",
+      "Name": "KSI-SVC: Service Configuration",
+      "Description": "A secure cloud service offering will follow FedRAMP encryption policies, continuously verify information resource integrity, and restrict access to third-party information resources",
+      "Attributes": [
+        {
+          "ItemId": "ksi-svc",
+          "Section": "Service Configuration",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "acm_certificates_expiration_check",
+        "apigateway_restapi_cache_encrypted",
+        "cloudtrail_kms_encryption_enabled",
+        "dax_cluster_encryption_enabled",
+        "dynamodb_table_encryption_enabled",
+        "dynamodb_table_encryption_uses_cmks",
+        "ebs_volume_encryption_enabled",
+        "ec2_ebs_default_encryption",
+        "ec2_instance_ebs_optimized",
+        "efs_encryption_at_rest_enabled",
+        "eks_cluster_envelope_encryption_enabled",
+        "elasticache_redis_cluster_encryption_at_rest_enabled",
+        "elasticache_redis_cluster_encryption_at_transit_enabled",
+        "elbv2_ssl_listeners",
+        "fsx_file_system_encryption_at_rest_enabled",
+        "kinesis_stream_encrypted_at_rest",
+        "kms_cmk_rotation_enabled",
+        "kms_cmk_not_scheduled_for_deletion",
+        "kms_key_not_publicly_accessible",
+        "rds_instance_storage_encrypted",
+        "rds_instance_storage_encrypted_with_cmk",
+        "rds_cluster_storage_encrypted",
+        "redshift_cluster_encryption_at_rest",
+        "redshift_cluster_encryption_in_transit",
+        "s3_bucket_server_side_encryption_enabled",
+        "s3_bucket_default_encryption",
+        "s3_bucket_secure_transport_policy",
+        "sagemaker_notebook_instance_encryption_enabled",
+        "sns_topics_kms_encryption_at_rest_enabled",
+        "sqs_queue_server_side_encryption_enabled"
+      ]
+    },
+    {
+      "Id": "ksi-tpr",
+      "Name": "KSI-TPR: Third-Party Information Resources",
+      "Description": "A secure cloud service offering will understand, monitor, and manage supply chain risks from third-party information resources",
+      "Attributes": [
+        {
+          "ItemId": "ksi-tpr",
+          "Section": "Third-Party Information Resources",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "ecr_registry_scan_images_on_push_enabled",
+        "ecr_repositories_lifecycle_policy_enabled",
+        "ecr_repositories_not_publicly_accessible",
+        "ecr_repositories_scan_on_push_enabled",
+        "ecr_repositories_scan_vulnerabilities_in_latest_image",
+        "ecr_repositories_tag_immutability",
+        "inspector2_active_findings_exist",
+        "inspector2_is_enabled",
+        "awslambda_function_using_supported_runtimes",
+        "ssm_managed_compliant_patching",
+        "trustedadvisor_premium_support_plan_subscribed",
+        "guardduty_no_high_severity_findings"
+      ]
+    },
+    {
+      "Id": "ksi-iam-07",
+      "Name": "KSI-IAM-07: Account Lifecycle Management",
+      "Description": "Securely manage the lifecycle and privileges of all accounts, roles, and groups",
+      "Attributes": [
+        {
+          "ItemId": "ksi-iam-07",
+          "Section": "Identity and Access Management",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "iam_no_root_access_key",
+        "iam_policy_attached_only_to_group_or_roles",
+        "iam_rotate_access_key_90_days",
+        "iam_user_accesskey_unused",
+        "iam_user_console_access_unused",
+        "organizations_delegated_administrators"
+      ]
+    },
+    {
+      "Id": "ksi-mla-07",
+      "Name": "KSI-MLA-07: Monitoring and Logging Inventory",
+      "Description": "Maintain a list of information resources and event types that will be monitored, logged, and audited",
+      "Attributes": [
+        {
+          "ItemId": "ksi-mla-07",
+          "Section": "Monitoring, Logging, and Auditing",
+          "Service": "aws"
+        }
+      ],
+      "Checks": [
+        "cloudtrail_multi_region_enabled",
+        "cloudwatch_log_group_retention_policy_specific_days_enabled",
+        "config_recorder_all_regions_enabled",
+        "inspector2_is_enabled",
+        "resourceexplorer_indexes_found"
+      ]
+    }
+  ]
+}

prowler/compliance/aws/nis2_aws.json

@@ -1,6 +1,6 @@
 {
   "Framework": "NIS2",
-  "Name": "Network and Information Security Directive (Directive (EU) 2022/2555)",
+  "Name": "NIS2 - Network and Information Security Directive (Directive (EU) 2022/2555)",
   "Version": "",
   "Provider": "AWS",
   "Description": "ANNEX to the Commission Implementing Regulation laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and further specification of the cases in which an incident is considered to be significant with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers",