prowler-cloud 5.13.1__py3-none-any.whl → 5.14.0__py3-none-any.whl

prowler/providers/m365/lib/powershell/m365_powershell.py

@@ -2,11 +2,8 @@ import os
 
 from prowler.lib.logger import logger
 from prowler.lib.powershell.powershell import PowerShellSession
-from prowler.providers.m365.exceptions.exceptions import (
-    M365CertificateCreationError,
-    M365GraphConnectionError,
-)
-from prowler.providers.m365.lib.jwt.jwt_decoder import decode_jwt, decode_msal_token
+from prowler.providers.m365.exceptions.exceptions import M365CertificateCreationError
+from prowler.providers.m365.lib.jwt.jwt_decoder import decode_msal_token
 from prowler.providers.m365.models import M365Credentials, M365IdentityInfo
 
 
@@ -123,60 +120,20 @@ class M365PowerShell(PowerShellSession):
                 '$graphToken = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantID/oauth2/v2.0/token" -Method POST -Body $graphtokenBody | Select-Object -ExpandProperty Access_Token'
             )
 
-    def test_credentials(self, credentials: M365Credentials) -> bool:
+    def execute_connect(self, command: str) -> str:
         """
-        Test Microsoft 365 credentials by attempting to authenticate against Entra ID.
-
-        Supports testing two authentication methods:
-        1. Application authentication (client_id/client_secret)
-        2. Certificate authentication (certificate_content in base64/client_id)
+        Execute a PowerShell connect command ensuring empty responses surface as timeouts.
 
         Args:
-            credentials (M365Credentials): The credentials object containing
-                authentication information to test.
+            command (str): PowerShell connect command to run.
+            timeout (Optional[int]): Timeout in seconds for the command execution.
 
         Returns:
-            bool: True if credentials are valid and authentication succeeds, False otherwise.
+            str: Command output or 'Timeout' if the command produced no output.
         """
-        # Test Certificate Auth
-        if credentials.certificate_content and credentials.client_id:
-            try:
-                self.test_teams_certificate_connection() or self.test_exchange_certificate_connection()
-                return True
-            except Exception as e:
-                logger.error(f"Exchange Online Certificate connection failed: {e}")
-
-        else:
-            # Test Microsoft Graph connection
-            try:
-                logger.info("Testing Microsoft Graph connection...")
-                self.test_graph_connection()
-                logger.info("Microsoft Graph connection successful")
-                return True
-            except Exception as e:
-                logger.error(f"Microsoft Graph connection failed: {e}")
-                raise M365GraphConnectionError(
-                    file=os.path.basename(__file__),
-                    original_exception=e,
-                    message="Check your Microsoft Application credentials and ensure the app has proper permissions",
-                )
-
-    def test_graph_connection(self) -> bool:
-        """Test Microsoft Graph API connection and raise exception if it fails."""
-        try:
-            if self.execute("Write-Output $graphToken") == "":
-                raise M365GraphConnectionError(
-                    file=os.path.basename(__file__),
-                    message="Microsoft Graph token is empty or invalid.",
-                )
-            return True
-        except Exception as e:
-            logger.error(f"Microsoft Graph connection failed: {e}")
-            raise M365GraphConnectionError(
-                file=os.path.basename(__file__),
-                original_exception=e,
-                message=f"Failed to connect to Microsoft Graph API: {str(e)}",
-            )
+        connect_timeout = 15
+        result = self.execute(command, timeout=connect_timeout)
+        return result or "'execute_connect' command timeout reached"
 
     def test_teams_connection(self) -> bool:
         """Test Microsoft Teams API connection and raise exception if it fails."""
@@ -184,18 +141,13 @@ class M365PowerShell(PowerShellSession):
             self.execute(
                 '$teamstokenBody = @{ Grant_Type = "client_credentials"; Scope = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239/.default"; Client_Id = $clientID; Client_Secret = $clientSecret }'
             )
-            self.execute(
+            result = self.execute(
                 '$teamsToken = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantID/oauth2/v2.0/token" -Method POST -Body $teamstokenBody | Select-Object -ExpandProperty Access_Token'
             )
-            permissions = decode_jwt(self.execute("Write-Output $teamsToken")).get(
-                "roles", []
-            )
-            if "application_access" not in permissions:
-                logger.error(
-                    "Microsoft Teams connection failed: Please check your permissions and try again."
-                )
+            if result != "":
+                logger.error(f"Microsoft Teams connection failed: {result}")
                 return False
-            self.execute(
+            self.execute_connect(
                 'Connect-MicrosoftTeams -AccessTokens @("$graphToken","$teamsToken")'
             )
             return True
@@ -207,7 +159,7 @@ class M365PowerShell(PowerShellSession):
 
     def test_teams_certificate_connection(self) -> bool:
         """Test Microsoft Teams API connection using certificate and raise exception if it fails."""
-        result = self.execute(
+        result = self.execute_connect(
             "Connect-MicrosoftTeams -Certificate $certificate -ApplicationId $clientID -TenantId $tenantID"
         )
         if self.tenant_identity.identity_id not in result:
@@ -231,7 +183,7 @@ class M365PowerShell(PowerShellSession):
                     "Exchange Online connection failed: Please check your permissions and try again."
                 )
                 return False
-            self.execute(
+            self.execute_connect(
                 'Connect-ExchangeOnline -AccessToken $exchangeToken.AccessToken -Organization "$tenantID"'
             )
             return True
@@ -243,7 +195,7 @@ class M365PowerShell(PowerShellSession):
 
     def test_exchange_certificate_connection(self) -> bool:
         """Test Exchange Online API connection using certificate and raise exception if it fails."""
-        result = self.execute(
+        result = self.execute_connect(
             "Connect-ExchangeOnline -Certificate $certificate -AppId $clientID -Organization $tenantDomain"
         )
         if "https://aka.ms/exov3-module" not in result:
@@ -290,7 +242,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-CsTeamsClientConfiguration | ConvertTo-Json", json_parse=True
+            "Get-CsTeamsClientConfiguration | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_global_meeting_policy(self) -> dict:
@@ -309,7 +262,7 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-CsTeamsMeetingPolicy -Identity Global | ConvertTo-Json",
+            "Get-CsTeamsMeetingPolicy -Identity Global | ConvertTo-Json -Depth 10",
             json_parse=True,
         )
 
@@ -329,7 +282,7 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-CsTeamsMessagingPolicy -Identity Global | ConvertTo-Json",
+            "Get-CsTeamsMessagingPolicy -Identity Global | ConvertTo-Json -Depth 10",
             json_parse=True,
         )
 
@@ -349,7 +302,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-CsTenantFederationConfiguration | ConvertTo-Json", json_parse=True
+            "Get-CsTenantFederationConfiguration | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def connect_exchange_online(self) -> dict:
@@ -389,7 +343,7 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled | ConvertTo-Json",
+            "Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled | ConvertTo-Json -Depth 10",
             json_parse=True,
         )
 
@@ -409,7 +363,9 @@ class M365PowerShell(PowerShellSession):
                 "Identity": "Default"
             }
         """
-        return self.execute("Get-MalwareFilterPolicy | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-MalwareFilterPolicy | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_malware_filter_rule(self) -> dict:
         """
@@ -427,7 +383,9 @@ class M365PowerShell(PowerShellSession):
                 "State": "Enabled"
             }
         """
-        return self.execute("Get-MalwareFilterRule | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-MalwareFilterRule | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_outbound_spam_filter_policy(self) -> dict:
         """
@@ -448,7 +406,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-HostedOutboundSpamFilterPolicy | ConvertTo-Json", json_parse=True
+            "Get-HostedOutboundSpamFilterPolicy | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_outbound_spam_filter_rule(self) -> dict:
@@ -467,7 +426,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-HostedOutboundSpamFilterRule | ConvertTo-Json", json_parse=True
+            "Get-HostedOutboundSpamFilterRule | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_antiphishing_policy(self) -> dict:
@@ -493,7 +453,9 @@ class M365PowerShell(PowerShellSession):
                 "IsDefault": false
             }
         """
-        return self.execute("Get-AntiPhishPolicy | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-AntiPhishPolicy | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_antiphishing_rules(self) -> dict:
         """
@@ -511,7 +473,9 @@ class M365PowerShell(PowerShellSession):
                 "State": Enabled,
             }
         """
-        return self.execute("Get-AntiPhishRule | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-AntiPhishRule | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_organization_config(self) -> dict:
         """
@@ -530,7 +494,9 @@ class M365PowerShell(PowerShellSession):
                 "AuditDisabled": false
             }
         """
-        return self.execute("Get-OrganizationConfig | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-OrganizationConfig | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_mailbox_audit_config(self) -> dict:
         """
@@ -550,7 +516,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-MailboxAuditBypassAssociation | ConvertTo-Json", json_parse=True
+            "Get-MailboxAuditBypassAssociation | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_mailbox_policy(self) -> dict:
@@ -569,7 +536,9 @@ class M365PowerShell(PowerShellSession):
                 "AdditionalStorageProvidersAvailable": True
             }
         """
-        return self.execute("Get-OwaMailboxPolicy | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-OwaMailboxPolicy | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_external_mail_config(self) -> dict:
         """
@@ -587,7 +556,9 @@ class M365PowerShell(PowerShellSession):
                 "ExternalMailTagEnabled": true
             }
         """
-        return self.execute("Get-ExternalInOutlook | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-ExternalInOutlook | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_transport_rules(self) -> dict:
         """
@@ -606,7 +577,9 @@ class M365PowerShell(PowerShellSession):
                 "SenderDomainIs": ["example.com"]
             }
         """
-        return self.execute("Get-TransportRule | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-TransportRule | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_connection_filter_policy(self) -> dict:
         """
@@ -625,7 +598,7 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-HostedConnectionFilterPolicy -Identity Default | ConvertTo-Json",
+            "Get-HostedConnectionFilterPolicy -Identity Default | ConvertTo-Json -Depth 10",
             json_parse=True,
         )
 
@@ -645,7 +618,9 @@ class M365PowerShell(PowerShellSession):
                 "Enabled": true
             }
         """
-        return self.execute("Get-DkimSigningConfig | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-DkimSigningConfig | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_inbound_spam_filter_policy(self) -> dict:
         """
@@ -664,7 +639,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-HostedContentFilterPolicy | ConvertTo-Json", json_parse=True
+            "Get-HostedContentFilterPolicy | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_inbound_spam_filter_rule(self) -> dict:
@@ -684,7 +660,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-HostedContentFilterRule | ConvertTo-Json", json_parse=True
+            "Get-HostedContentFilterRule | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_report_submission_policy(self) -> dict:
@@ -715,7 +692,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-ReportSubmissionPolicy | ConvertTo-Json", json_parse=True
+            "Get-ReportSubmissionPolicy | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_role_assignment_policies(self) -> dict:
@@ -736,7 +714,8 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-RoleAssignmentPolicy | ConvertTo-Json", json_parse=True
+            "Get-RoleAssignmentPolicy | ConvertTo-Json -Depth 10",
+            json_parse=True,
         )
 
     def get_mailbox_audit_properties(self) -> dict:
@@ -801,7 +780,7 @@ class M365PowerShell(PowerShellSession):
             }
         """
         return self.execute(
-            "Get-EXOMailbox -PropertySets Audit -ResultSize Unlimited | ConvertTo-Json",
+            "Get-EXOMailbox -PropertySets Audit -ResultSize Unlimited | ConvertTo-Json -Depth 10",
             json_parse=True,
         )
 
@@ -820,7 +799,9 @@ class M365PowerShell(PowerShellSession):
                 "SmtpClientAuthenticationDisabled": True,
             }
         """
-        return self.execute("Get-TransportConfig | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-TransportConfig | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_sharing_policy(self) -> dict:
         """
@@ -838,7 +819,9 @@ class M365PowerShell(PowerShellSession):
                 "Enabled": true
             }
         """
-        return self.execute("Get-SharingPolicy | ConvertTo-Json", json_parse=True)
+        return self.execute(
+            "Get-SharingPolicy | ConvertTo-Json -Depth 10", json_parse=True
+        )
 
     def get_user_account_status(self) -> dict:
         """
@@ -850,7 +833,7 @@ class M365PowerShell(PowerShellSession):
             dict: User account status settings in JSON format.
         """
         return self.execute(
-            "$dict=@{}; Get-User -ResultSize Unlimited | ForEach-Object { $dict[$_.Id] = @{ AccountDisabled = $_.AccountDisabled } }; $dict | ConvertTo-Json",
+            "$dict=@{}; Get-User -ResultSize Unlimited | ForEach-Object { $dict[$_.Id] = @{ AccountDisabled = $_.AccountDisabled } }; $dict | ConvertTo-Json -Depth 10",
             json_parse=True,
         )
 
@@ -867,7 +850,11 @@ def initialize_m365_powershell_modules():
         bool: True if all modules were successfully initialized, False otherwise
     """
 
-    REQUIRED_MODULES = ["ExchangeOnlineManagement", "MicrosoftTeams", "MSAL.PS"]
+    REQUIRED_MODULES = [
+        "ExchangeOnlineManagement",
+        "MicrosoftTeams",
+        "MSAL.PS",
+    ]
 
     pwsh = PowerShellSession()
     try:
@@ -879,7 +866,7 @@ def initialize_m365_powershell_modules():
                 # Install module if not installed
                 if not result:
                     install_result = pwsh.execute(
-                        f'Install-Module "{module}" -Force -AllowClobber -Scope CurrentUser',
+                        f"Install-Module {module} -Force -AllowClobber -Scope CurrentUser",
                         timeout=60,
                     )
                     if install_result:

prowler/providers/m365/m365_provider.py

@@ -444,12 +444,7 @@ class M365Provider(Provider):
             try:
                 if init_modules:
                     initialize_m365_powershell_modules()
-                if test_session.test_credentials(credentials):
-                    return credentials
-                raise M365ConfigCredentialsError(
-                    file=os.path.basename(__file__),
-                    message="The provided credentials are not valid.",
-                )
+                return credentials
             finally:
                 test_session.close()
 

prowler/providers/mongodbatlas/exceptions/exceptions.py

@@ -30,6 +30,10 @@ class MongoDBAtlasBaseException(ProwlerException):
             "message": "MongoDB Atlas API rate limit exceeded",
             "remediation": "Reduce the number of API requests or wait before making more requests.",
         },
+        (8006, "MongoDBAtlasInvalidOrganizationIdError"): {
+            "message": "The provided credentials do not have access to the organization with the provided ID",
+            "remediation": "Check the organization ID and ensure it is a valid organization ID and that the credentials have access to it.",
+        },
     }
 
     def __init__(self, code, file=None, original_exception=None, message=None):
@@ -116,3 +120,15 @@ class MongoDBAtlasRateLimitError(MongoDBAtlasBaseException):
             original_exception=original_exception,
             message=message,
         )
+
+
+class MongoDBAtlasInvalidOrganizationIdError(MongoDBAtlasBaseException):
+    """Exception for MongoDB Atlas invalid organization ID errors"""
+
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            code=8006,
+            file=file,
+            original_exception=original_exception,
+            message=message,
+        )

prowler/providers/mongodbatlas/mongodbatlas_provider.py

@@ -17,6 +17,7 @@ from prowler.providers.mongodbatlas.exceptions.exceptions import (
     MongoDBAtlasAuthenticationError,
     MongoDBAtlasCredentialsError,
     MongoDBAtlasIdentityError,
+    MongoDBAtlasInvalidOrganizationIdError,
     MongoDBAtlasSessionError,
 )
 from prowler.providers.mongodbatlas.lib.mutelist.mutelist import MongoDBAtlasMutelist
@@ -54,6 +55,7 @@ class MongodbatlasProvider(Provider):
         mutelist_content: dict = None,
         # Optional filters
         atlas_project_id: str = None,
+        atlas_organization_id: str = None,
     ):
         """
         MongoDB Atlas Provider constructor
@@ -67,6 +69,7 @@ class MongodbatlasProvider(Provider):
             mutelist_path: Path to the mutelist file
             mutelist_content: Mutelist content
             atlas_project_id: Project ID to filter
+            atlas_organization_id: Organization ID
         """
         logger.info("Instantiating MongoDB Atlas Provider...")
 
@@ -79,6 +82,7 @@ class MongodbatlasProvider(Provider):
 
         # Store filter options
         self._project_id = atlas_project_id
+        self._organization_id = atlas_organization_id
 
         # Audit Config
         if config_content:
@@ -292,6 +296,7 @@ class MongodbatlasProvider(Provider):
         atlas_public_key: str = "",
         atlas_private_key: str = "",
         raise_on_exception: bool = True,
+        provider_id: str = None,
     ) -> Connection:
         """
         Test connection to MongoDB Atlas
@@ -300,7 +305,7 @@ class MongodbatlasProvider(Provider):
             atlas_public_key: MongoDB Atlas API public key
             atlas_private_key: MongoDB Atlas API private key
             raise_on_exception: Whether to raise exceptions
-
+            provider_id: MongoDB Atlas project ID to validate access (added for API compatibility)
         Returns:
             Connection: Connection status
         """
@@ -310,10 +315,17 @@ class MongodbatlasProvider(Provider):
                 atlas_private_key=atlas_private_key,
             )
 
-            MongodbatlasProvider.setup_identity(session)
+            identity = MongodbatlasProvider.setup_identity(session)
 
-            return Connection(is_connected=True)
+            if provider_id and identity.organization_id != provider_id:
+                raise MongoDBAtlasInvalidOrganizationIdError(
+                    file=os.path.basename(__file__),
+                    message=f"The provided credentials do not have access to the organization with the provided ID: {provider_id}",
+                )
 
+            return Connection(is_connected=True)
+        except MongoDBAtlasInvalidOrganizationIdError:
+            raise
         except Exception as error:
             logger.critical(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"

prowler/providers/mongodbatlas/services/projects/projects_auditing_enabled/projects_auditing_enabled.metadata.json

@@ -1,29 +1,40 @@
 {
   "Provider": "mongodbatlas",
   "CheckID": "projects_auditing_enabled",
-  "CheckTitle": "Ensure database auditing is enabled",
+  "CheckTitle": "MongoDB Atlas project has database auditing enabled",
   "CheckType": [],
   "ServiceName": "projects",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "MongoDBAtlasProject",
-  "Description": "Ensure database auditing is enabled to track database operations and security events",
-  "Risk": "Without auditing enabled, security events and database operations are not logged, making it difficult to detect unauthorized access or troubleshoot issues",
+  "Description": "**MongoDB Atlas projects** with **database auditing** capture database operations and administrative events. The evaluation looks for an active audit configuration and, *when present*, notes any configured `audit_filter` that scopes which events are recorded.",
+  "Risk": "Without auditing, critical actions lack traceability, reducing **detectability** and impeding **forensics**. Attackers can mask unauthorized reads/writes and privilege changes, threatening data **confidentiality** and **integrity**, and weakening non-repudiation and incident response.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.mongodb.com/docs/manual/tutorial/configure-auditing/",
+    "https://www.mongodb.com/docs/atlas/architecture/current/auditing/",
+    "https://www.mongodb.com/docs/atlas/architecture/current/auditing-logging/?msockid=0878cc3dfa4e66a707beda0efb5a67b5",
+    "https://www.mongodb.com/docs/atlas/operator/current/ak8so-configure-audit-logs/",
+    "https://www.mongodb.com/docs/manual/core/auditing/",
+    "https://www.mongodb.com/docs/atlas/database-auditing/"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
+      "CLI": "atlas auditing update --projectId <example_resource_id> --enabled",
       "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "Other": "1. Sign in to MongoDB Atlas and open the target project\n2. In the left sidebar, click Security > Database & Network Access, then click Advanced\n3. Toggle Database Auditing to On\n4. Click Save",
+      "Terraform": "```hcl\nresource \"mongodbatlas_auditing\" \"example\" {\n  project_id = \"<example_resource_id>\"\n  enabled    = true  # Critical: turns on project-level database auditing to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable database auditing for the MongoDB Atlas project by configuring audit filters and destinations.",
-      "Url": "https://www.mongodb.com/docs/atlas/database-auditing/"
+      "Text": "Enable **auditing** and apply least-privilege filters to capture high-risk events:\n- authentication and session activity\n- DDL/config changes\n- user/role modifications and privilege grants\n\nCentralize logs in a SIEM, enforce retention/immutability with separation of duties, restrict access, and tune `auditAuthorizationSuccess` to balance coverage vs performance.",
+      "Url": "https://hub.prowler.com/check/projects_auditing_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging",
+    "forensics-ready"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/mongodbatlas/services/projects/projects_network_access_list_exposed_to_internet/projects_network_access_list_exposed_to_internet.metadata.json

@@ -1,29 +1,34 @@
 {
   "Provider": "mongodbatlas",
   "CheckID": "projects_network_access_list_exposed_to_internet",
-  "CheckTitle": "Ensure MongoDB Atlas project network access list is not exposed to the internet",
+  "CheckTitle": "MongoDB Atlas project network access list has entries and excludes 0.0.0.0/0, ::/0, 0.0.0.0, and ::",
   "CheckType": [],
   "ServiceName": "projects",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "MongoDBAtlasProject",
-  "Description": "Ensure that MongoDB Atlas projects have properly configured network access lists that don't allow unrestricted access from anywhere on the internet. Network access lists should be configured to allow access only from specific IP addresses, CIDR blocks, or AWS security groups to minimize the attack surface.",
-  "Risk": "If a MongoDB Atlas project has network access entries that allow unrestricted access (0.0.0.0/0 or ::/0), it exposes the database to potential attacks from anywhere on the internet. This significantly increases the risk of unauthorized access, data breaches, and malicious activities.",
-  "RelatedUrl": "https://docs.atlas.mongodb.com/security/ip-access-list/",
+  "Description": "**MongoDB Atlas project network access list** configuration is evaluated for entries that allow access from anywhere (`0.0.0.0/0`, `::/0`, `0.0.0.0`, `::`) or for missing access lists, instead of restricting connections to specific IPs or CIDRs.",
+  "Risk": "Internet-wide access enables scanning, brute force, and credential stuffing against database endpoints. A successful compromise can cause data exfiltration (**confidentiality**), unauthorized writes or drops (**integrity**), and service disruption or lockout (**availability**).",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.atlas.mongodb.com/security/ip-access-list/"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
       "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "Other": "1. In MongoDB Atlas, open your project and go to Security > Database & Network Access > IP Access List\n2. Delete any entries equal to 0.0.0.0/0, ::/0, 0.0.0.0, or ::\n3. If the list becomes empty, click Add IP Address and add a specific IP/CIDR or an AWS Security Group (for a peered VPC)\n4. Click Save",
+      "Terraform": "```hcl\nresource \"mongodbatlas_project_ip_access_list\" \"<example_resource_name>\" {\n  project_id = \"<example_resource_id>\"\n  cidr_block = \"<ALLOWED_CIDR>\" # Critical: add a restricted CIDR (not 0.0.0.0/0 or ::/0) to ensure the list isn't empty and not open to the world\n}\n```"
     },
     "Recommendation": {
-      "Text": "Configure network access lists to allow access only from specific IP addresses, CIDR blocks, or AWS security groups. Remove any entries that allow unrestricted access (0.0.0.0/0 or ::/0) and replace them with more restrictive rules based on your application's requirements.",
-      "Url": "https://docs.atlas.mongodb.com/security/ip-access-list/"
+      "Text": "Apply **least privilege**: permit only required IPs/CIDRs or approved security groups; avoid `0.0.0.0/0` and `::/0`. Prefer **private connectivity** (VPC peering or private endpoints) over public access. Use temporary entries for short-lived admin needs and review lists regularly.",
+      "Url": "https://hub.prowler.com/check/projects_network_access_list_exposed_to_internet"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "internet-exposed"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/oraclecloud/lib/arguments/arguments.py

@@ -5,9 +5,11 @@ from prowler.providers.oraclecloud.config import OCI_DEFAULT_CONFIG_FILE, OCI_RE
 
 
 def init_parser(self):
-    """Init the OCI Provider CLI parser"""
+    """Init the Oracle Cloud Infrastructure Provider CLI parser"""
     oci_parser = self.subparsers.add_parser(
-        "oci", parents=[self.common_providers_parser], help="OCI Provider"
+        "oraclecloud",
+        parents=[self.common_providers_parser],
+        help="Oracle Cloud Infrastructure Provider",
     )
 
     # Config File Authentication Options
@@ -109,15 +111,4 @@ def validate_arguments(arguments: Namespace) -> tuple[bool, str]:
             "Cannot use --use-instance-principal with --oci-config-file or --profile options",
         )
 
-    # # Validate compartment OCIDs if provided
-    # if arguments.compartment_id:
-    #     for compartment_id in arguments.compartment_id:
-    #         if not OciProvider.validate_ocid(compartment_id, "compartment"):
-    #             # Check if it's a tenancy OCID (root compartment)
-    #             if not OciProvider.validate_ocid(compartment_id, "tenancy"):
-    #                 return (
-    #                     False,
-    #                     f"Invalid compartment OCID: {compartment_id}",
-    #                 )
-
     return (True, "")