prowler-cloud 5.14.1__py3-none-any.whl → 5.15.0__py3-none-any.whl

prowler/providers/aws/services/networkfirewall/networkfirewall_logging_enabled/networkfirewall_logging_enabled.metadata.json

@@ -1,28 +1,35 @@
 {
   "Provider": "aws",
   "CheckID": "networkfirewall_logging_enabled",
-  "CheckTitle": "Ensure Network Firewall Logging is Enabled",
+  "CheckTitle": "Network Firewall has logging enabled",
   "CheckType": [
-    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)"
   ],
   "ServiceName": "networkfirewall",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:network-firewall::account-id:firewall/firewall-name",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsNetworkFirewallFirewall",
-  "Description": "This control checks whether logging is enabled for an AWS Network Firewall firewall. The control fails if logging isn't enabled for at least one log type or if the logging destination doesn't exist.",
-  "Risk": "Failing to enable logging on an AWS Network Firewall can lead to a lack of visibility into network traffic, making it difficult to monitor and respond to security incidents effectively, which could jeopardize the security and integrity of your infrastructure.",
-  "RelatedUrl": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html",
+  "Description": "**AWS Network Firewall** has stateful engine logging configured with at least one log type (`FLOW`, `ALERT`, or `TLS`) and an active log destination",
+  "Risk": "Absent Network Firewall logs reduce **visibility** and **forensics**. Malicious flows, C2 traffic, and data exfiltration can go **undetected**, impacting:\n- Confidentiality (leakage)\n- Integrity (unauthorized traffic allowed)\n- Availability (DDoS patterns unnoticed)",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html",
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-update-logging-configuration.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-2"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws network-firewall update-logging-configuration --firewall-arn <firewall-arn> --logging-configuration <configuration>",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-2",
-      "Terraform": ""
+      "CLI": "aws network-firewall update-logging-configuration --firewall-arn <FIREWALL_ARN> --logging-configuration 'LogDestinationConfigs=[{LogType=FLOW,LogDestinationType=CLOUDWATCH_LOGS,LogDestination={LogGroup=<LOG_GROUP_NAME>}}]'",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::NetworkFirewall::LoggingConfiguration\n    Properties:\n      FirewallArn: <example_resource_id>  # CRITICAL: Targets the firewall to enable logging\n      LoggingConfiguration:\n        LogDestinationConfigs:\n          - LogType: FLOW                  # CRITICAL: Enables at least one log type\n            LogDestinationType: CloudWatchLogs  # CRITICAL: Selects a valid destination type\n            LogDestination:\n              logGroup: <example_log_group_name>  # CRITICAL: Existing CloudWatch Logs group to receive logs\n```",
+      "Other": "1. Open the AWS console and go to VPC > Network Firewall > Firewalls\n2. Select your firewall and open the Firewall details tab\n3. In the Logging section, click Edit\n4. Enable at least one Log type (e.g., Flow)\n5. Choose Destination type: CloudWatch Logs and select an existing log group\n6. Click Save",
+      "Terraform": "```hcl\nresource \"aws_networkfirewall_logging_configuration\" \"<example_resource_name>\" {\n  firewall_arn = \"<example_resource_id>\"  # CRITICAL: Targets the firewall to enable logging\n\n  logging_configuration {\n    log_destination_config {\n      log_type             = \"FLOW\"              # CRITICAL: Enables at least one log type\n      log_destination_type = \"CloudWatchLogs\"   # CRITICAL: Selects a valid destination type\n      log_destination = {\n        logGroup = \"<example_log_group_name>\"   # CRITICAL: Existing CloudWatch Logs group to receive logs\n      }\n    }\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable logging for your AWS Network Firewall by updating its logging configuration to ensure comprehensive tracking of network traffic and facilitate better incident response and auditing capabilities.",
-      "Url": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-update-logging-configuration.html"
+      "Text": "Enable comprehensive firewall logging and send `FLOW`, `ALERT`, and *when applicable* `TLS` events to a centralized, tamper-resistant destination. Apply **least privilege** to writers/readers, enforce **encryption** and **retention**, and integrate alerts with monitoring for **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/networkfirewall_logging_enabled"
     }
   },
   "Categories": [

prowler/providers/aws/services/networkfirewall/networkfirewall_multi_az/networkfirewall_multi_az.metadata.json

@@ -1,32 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "networkfirewall_multi_az",
-  "CheckTitle": "Ensure all Network Firewall Firewalls are deployed across multiple AZ.",
+  "CheckTitle": "Network Firewall firewall is deployed across multiple Availability Zones",
   "CheckType": [
-    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls",
+    "Effects/Denial of Service"
   ],
   "ServiceName": "networkfirewall",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:network-firewall::account-id:firewall/firewall-name",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsNetworkFirewallFirewall",
-  "Description": "Ensure all Network Firewall Firewalls are deployed in at least 2 Availability Zones.",
-  "Risk": "Deploying a Network Firewall in a single Availability Zone increases the risk of service disruption if that AZ experiences an outage, potentially leaving your network vulnerable to attacks or downtime.",
-  "RelatedUrl": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/arch-two-zone-igw.html",
+  "Description": "**AWS Network Firewall firewalls** are assessed for **multi-AZ deployment**, expecting subnet mappings in more than one Availability Zone.\n\nA configuration with only one subnet mapping indicates a single-AZ firewall.",
+  "Risk": "Single-AZ firewalls are a single point of failure. An AZ outage can drop or blackhole traffic, degrading **availability**, or prompt route changes that bypass inspection, exposing **confidentiality** and **integrity** to unfiltered access, data exfiltration, and lateral movement.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/id_id/network-firewall/latest/developerguide/arch-two-zone-igw.html",
+    "https://aws.amazon.com/es/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/",
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/arch-two-zone-igw.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-1"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws network-firewall update-firewall-delete-protection --firewall-arn <your-firewall-arn> --firewall-name <your-firewall-name> --subnet-mappings SubnetId=<subnet-id-1>,SubnetId=<subnet-id-2>",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-1",
-      "Terraform": ""
+      "CLI": "aws network-firewall associate-subnets --firewall-arn <FIREWALL_ARN> --subnet-mappings SubnetId=<SUBNET_ID_IN_DIFFERENT_AZ>",
+      "NativeIaC": "```yaml\n# CloudFormation: Ensure the firewall spans multiple AZs by adding a second subnet mapping\nResources:\n  <example_resource_name>:\n    Type: AWS::NetworkFirewall::Firewall\n    Properties:\n      FirewallName: <example_resource_name>\n      FirewallPolicyArn: <example_firewall_policy_arn>\n      VpcId: <example_vpc_id>\n      SubnetMappings:\n        - SubnetId: <subnet-id-1>\n        - SubnetId: <subnet-id-2>  # CRITICAL: second subnet in a different AZ to achieve multi-AZ\n```",
+      "Other": "1. Open the AWS Console and go to VPC > Network Firewall > Firewalls\n2. Select your firewall and open the Firewall details tab\n3. In Associated policy and VPC, click Edit\n4. Click Add new subnet, choose an additional Availability Zone and its subnet in the same VPC\n5. Ensure at least two AZs are selected, then click Save",
+      "Terraform": "```hcl\n# Terraform: Add a second subnet_mapping to deploy the firewall across multiple AZs\nresource \"aws_networkfirewall_firewall\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  firewall_policy_arn = \"<example_firewall_policy_arn>\"\n  vpc_id              = \"<example_vpc_id>\"\n\n  subnet_mapping {\n    subnet_id = \"<subnet-id-1>\"\n  }\n\n  subnet_mapping {\n    subnet_id = \"<subnet-id-2>\"  # CRITICAL: second subnet in a different AZ for multi-AZ\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Deploy your AWS Network Firewall across multiple Availability Zones to enhance availability, ensure traffic load balancing, and minimize the impact of any AZ-specific failures.",
-      "Url": "https://aws.amazon.com/es/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/"
+      "Text": "Deploy firewalls across `>=2` AZs with a dedicated subnet in each used AZ. Maintain per-AZ, symmetric routing to the local endpoint to preserve stateful inspection. Apply **defense in depth** and automate drift controls and AZ failover tests to sustain resilience.",
+      "Url": "https://hub.prowler.com/check/networkfirewall_multi_az"
     }
   },
   "Categories": [
-    "redundancy"
+    "resilience"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_fragmented_packets/networkfirewall_policy_default_action_fragmented_packets.metadata.json

@@ -1,31 +1,43 @@
 {
   "Provider": "aws",
   "CheckID": "networkfirewall_policy_default_action_fragmented_packets",
-  "CheckTitle": "Default action for fragmented packets is set to drop or forward.",
+  "CheckTitle": "Network Firewall policy drops or forwards fragmented packets by default",
   "CheckType": [
-    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
+    "TTPs/Defense Evasion"
   ],
   "ServiceName": "networkfirewall",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:network-firewall::account-id:firewall/firewall-name",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsNetworkFirewallFirewall",
-  "Description": "NetorwFirewall firewall policy default action for fragmented packets is set to drop or forward.",
-  "Risk": "If the default action for fragmented packets is set to 'Pass', unintended or potentially malicious traffic may bypass filtering, exposing the network to security threats.",
-  "RelatedUrl": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/stateless-default-actions.html",
+  "Description": "**Network Firewall policies** are assessed for the `StatelessFragmentDefaultActions` setting to confirm **fragmented UDP packets** use `aws:drop` or `aws:forward_to_sfe`.",
+  "Risk": "Using `aws:pass` for **fragmented UDP** lets uninspected traffic traverse the firewall. Attackers can evade filters via fragmentation, enabling **data exfiltration** (confidentiality), payload smuggling and lateral movement (integrity), and fragment floods that strain services (availability).",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_FirewallPolicy.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-5",
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-policy-updating.html",
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/stateless-default-actions.html",
+    "https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-fragment-packets.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws network-firewall update-firewall-policy --firewall-policy-arn <your-firewall-policy-arn> --stateless-default-actions aws:drop",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-5",
-      "Terraform": ""
+      "CLI": "",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::NetworkFirewall::FirewallPolicy\n    Properties:\n      FirewallPolicyName: <example_resource_name>\n      FirewallPolicy:\n        StatelessDefaultActions:\n          - aws:drop\n        StatelessFragmentDefaultActions:\n          - aws:drop  # Critical: ensures fragmented UDP packets are dropped by default to pass the check\n```",
+      "Other": "1. Open the Amazon VPC console and go to Network Firewall > Firewall policies\n2. Select the policy to edit and choose Edit\n3. Under Stateless default actions, find Fragmented packets\n4. Set the action to Drop (or Forward to stateful rule groups)\n5. Save changes",
+      "Terraform": "```hcl\nresource \"aws_networkfirewall_firewall_policy\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  firewall_policy {\n    stateless_default_actions          = [\"aws:drop\"]\n    stateless_fragment_default_actions = [\"aws:drop\"]  # Critical: drop fragmented UDP packets by default to pass the check\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Update the firewall policy to ensure fragmented packets are either dropped or forwarded to stateful rule groups for additional filtering, reducing the risk of unwanted traffic entering the network.",
-      "Url": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-policy-updating.html"
+      "Text": "Set `StatelessFragmentDefaultActions` to `aws:drop` or `aws:forward_to_sfe` so fragments are blocked or sent for **stateful inspection**. Apply **least privilege** on traffic flows, use **defense in depth** with rule groups, and monitor logs for anomalous fragmentation.",
+      "Url": "https://hub.prowler.com/check/networkfirewall_policy_default_action_fragmented_packets"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "trust-boundaries"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/networkfirewall/networkfirewall_policy_default_action_full_packets/networkfirewall_policy_default_action_full_packets.metadata.json

@@ -1,31 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "networkfirewall_policy_default_action_full_packets",
-  "CheckTitle": "NetworkFirewall firewall policy default action for full packets is set to drop or forward.",
+  "CheckTitle": "Network Firewall firewall policy default stateless action for full packets is drop or forward",
   "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls"
   ],
   "ServiceName": "networkfirewall",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:network-firewall::account-id:firewall/firewall-name",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsNetworkFirewallFirewall",
-  "Description": "Default stateless action for full packets must be set to drop or forward in AWS Network Firewall policy.",
-  "Risk": "If the default stateless action for full packets is set to 'Pass', unintended traffic may bypass network filtering, leading to potential security vulnerabilities by allowing unauthorized or harmful packets.",
-  "RelatedUrl": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/stateless-default-actions.html",
+  "Description": "**AWS Network Firewall policies** define a **stateless default action** for full packets. This evaluates whether unmatched packets are handled by `aws:drop` or `aws:forward_to_sfe`, meaning they are either discarded or sent to the stateful engine rather than allowed to pass.",
+  "Risk": "Using `Pass` as the default allows unmatched full packets to bypass stateless filtering and stateful inspection, enabling reconnaissance, malware delivery, and covert data exfiltration. This undermines **confidentiality** and **integrity**, and can threaten **availability** through unfiltered attacks.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-4",
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/stateless-default-actions.html",
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-policy-updating.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws network-firewall update-firewall-policy --firewall-policy-arn <your-firewall-policy-arn> --stateless-default-actions aws:drop",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-4",
-      "Terraform": ""
+      "CLI": "",
+      "NativeIaC": "```yaml\n# CloudFormation: set default stateless action for full packets to Drop\nResources:\n  <example_resource_name>:\n    Type: AWS::NetworkFirewall::FirewallPolicy\n    Properties:\n      FirewallPolicyName: <example_resource_name>\n      FirewallPolicy:\n        StatelessDefaultActions:\n          - aws:drop  # CRITICAL: full packets default to Drop (fixes the check)\n        StatelessFragmentDefaultActions:\n          - aws:drop  # Required for a valid policy\n```",
+      "Other": "1. In the AWS console, open Amazon VPC\n2. Under Network Firewall, select Firewall policies\n3. Open the target firewall policy and choose Edit\n4. In Stateless default actions (full packets), select Drop (or Forward to stateful rule groups)\n5. Choose Save",
+      "Terraform": "```hcl\n# Terraform: set default stateless action for full packets to Drop\nresource \"aws_networkfirewall_firewall_policy\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  firewall_policy {\n    stateless_default_actions          = [\"aws:drop\"]  # CRITICAL: full packets default to Drop (fixes the check)\n    stateless_fragment_default_actions = [\"aws:drop\"]  # Required for a valid policy\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Modify the firewall policy to ensure that full packets are either dropped or forwarded to stateful rule groups for further inspection, mitigating the risk of unauthorized traffic entering the network.",
-      "Url": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-policy-updating.html"
+      "Text": "Enforce a **deny-by-default** posture: set the stateless default for full packets to `aws:drop` or `aws:forward_to_sfe`. Use explicit allow rules, layer **stateful inspection**, and maintain logging and reviews to support **defense in depth** and **least privilege**.",
+      "Url": "https://hub.prowler.com/check/networkfirewall_policy_default_action_full_packets"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "trust-boundaries"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/networkfirewall/networkfirewall_policy_rule_group_associated/networkfirewall_policy_rule_group_associated.metadata.json

@@ -1,31 +1,42 @@
 {
   "Provider": "aws",
   "CheckID": "networkfirewall_policy_rule_group_associated",
-  "CheckTitle": "Ensure Network Firewall Policies Have at Least One Rule Group Associated",
+  "CheckTitle": "Network Firewall policy has at least one rule group associated",
   "CheckType": [
-    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)"
   ],
   "ServiceName": "networkfirewall",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:network-firewall::account-id:firewall-policy/policy-name",
-  "Severity": "medium",
-  "ResourceType": "AwsNetworkFirewallFirewallPolicy",
-  "Description": "This control checks whether a Network Firewall policy has any stateful or stateless rule groups associated. The control fails if stateless or stateful rule groups are not assigned.",
-  "Risk": "If a Network Firewall policy does not have at least one rule group associated, it may fail to properly filter and handle traffic, leaving the network vulnerable to unauthorized access and attacks.",
-  "RelatedUrl": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-groups.html",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsNetworkFirewallFirewall",
+  "Description": "Network Firewall policies have one or more **stateful** or **stateless rule groups** associated to define packet inspection and handling.\n\nPolicies with no rule groups are identified.",
+  "Risk": "Without rule groups, traffic isn't meaningfully inspected, allowing unauthorized flows across VPC boundaries.\n\nImpacts:\n- Confidentiality: data exfiltration\n- Integrity: unauthorized changes via exposed services\n- Availability: C2, scanning, or DoS traffic passes; enables lateral movement",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-groups.html",
+    "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-policy-updating.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-3",
+    "https://medium.com/slalom-blog/secure-internet-access-egress-filtering-with-aws-network-firewall-ddf52ae121f9",
+    "https://docs.aws.amazon.com/de_de/network-firewall/latest/developerguide/nwfw-using-managed-rule-groups-add-to-policy.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-3",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: Attach at least one rule group to a Network Firewall policy\nResources:\n  FirewallPolicy:\n    Type: AWS::NetworkFirewall::FirewallPolicy\n    Properties:\n      FirewallPolicyName: <example_resource_name>\n      FirewallPolicy:\n        StatelessDefaultActions:\n          - aws:forward_to_sfe\n        StatelessFragmentDefaultActions:\n          - aws:forward_to_sfe\n        # Critical: Associate at least one rule group with the policy to pass the check\n        StatefulRuleGroupReferences:\n          - ResourceArn: <example_resource_arn>  # Critical line: references an existing rule group ARN\n```",
+      "Other": "1. Open the AWS Console and go to VPC > Network Firewall > Firewall policies\n2. Select the target firewall policy\n3. In Stateful rule groups (or Stateless rule groups), choose Add rule groups (or Add managed stateful/stateless rule groups)\n4. Select at least one existing rule group and choose Add to policy\n5. Click Save",
+      "Terraform": "```hcl\n# Attach at least one rule group to a Network Firewall policy\nresource \"aws_networkfirewall_firewall_policy\" \"<example_resource_name>\" {\n  name = \"<example_resource_name>\"\n\n  firewall_policy {\n    stateless_default_actions          = [\"aws:forward_to_sfe\"]\n    stateless_fragment_default_actions = [\"aws:forward_to_sfe\"]\n\n    # Critical: Associate at least one rule group with the policy to pass the check\n    stateful_rule_group_reference {\n      resource_arn = \"<example_resource_arn>\"  # Critical line: references an existing rule group ARN\n    }\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Regularly review your Network Firewall policies to ensure they have the necessary rule groups associated. Create and manage rule groups as needed to maintain effective traffic filtering and security.",
-      "Url": "https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-policy-updating.html"
+      "Text": "Associate appropriate **stateful** and **stateless rule groups** with every policy.\n- Enforce a **deny-by-default** posture (least privilege)\n- Use vetted managed rule groups as a baseline, then tailor to workloads\n- Review and test regularly; version rules, monitor logs, and require change control",
+      "Url": "https://hub.prowler.com/check/networkfirewall_policy_rule_group_associated"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "trust-boundaries"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/common/provider.py

@@ -286,6 +286,18 @@ class Provider(ABC):
                         fixer_config=fixer_config,
                         use_instance_principal=arguments.use_instance_principal,
                     )
+                elif "alibabacloud" in provider_class_name.lower():
+                    provider_class(
+                        role_arn=arguments.role_arn,
+                        role_session_name=arguments.role_session_name,
+                        ecs_ram_role=arguments.ecs_ram_role,
+                        oidc_role_arn=arguments.oidc_role_arn,
+                        credentials_uri=arguments.credentials_uri,
+                        regions=arguments.regions,
+                        config_path=arguments.config_file,
+                        mutelist_path=arguments.mutelist_file,
+                        fixer_config=fixer_config,
+                    )
 
         except TypeError as error:
             logger.critical(

prowler/providers/gcp/services/accesscontextmanager/accesscontextmanager_client.py

@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.gcp.services.accesscontextmanager.accesscontextmanager_service import (
+    AccessContextManager,
+)
+
+accesscontextmanager_client = AccessContextManager(Provider.get_global_provider())

prowler/providers/gcp/services/accesscontextmanager/accesscontextmanager_service.py

@@ -0,0 +1,101 @@
+from pydantic.v1 import BaseModel
+
+import prowler.providers.gcp.config as config
+from prowler.lib.logger import logger
+from prowler.providers.gcp.gcp_provider import GcpProvider
+from prowler.providers.gcp.lib.service.service import GCPService
+from prowler.providers.gcp.services.cloudresourcemanager.cloudresourcemanager_client import (
+    cloudresourcemanager_client,
+)
+
+
+class AccessContextManager(GCPService):
+    def __init__(self, provider: GcpProvider):
+        super().__init__("accesscontextmanager", provider, api_version="v1")
+        self.service_perimeters = []
+        self._get_service_perimeters()
+
+    def _get_service_perimeters(self):
+        for org in cloudresourcemanager_client.organizations:
+            try:
+                access_policies = []
+                try:
+                    request = self.client.accessPolicies().list(
+                        parent=f"organizations/{org.id}"
+                    )
+                    while request is not None:
+                        response = request.execute(
+                            num_retries=config.DEFAULT_RETRY_ATTEMPTS
+                        )
+                        access_policies.extend(response.get("accessPolicies", []))
+
+                        request = self.client.accessPolicies().list_next(
+                            previous_request=request, previous_response=response
+                        )
+                except Exception as error:
+                    logger.error(
+                        f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+                    continue
+
+                for policy in access_policies:
+                    try:
+                        request = (
+                            self.client.accessPolicies()
+                            .servicePerimeters()
+                            .list(parent=policy["name"])
+                        )
+                        while request is not None:
+                            response = request.execute(
+                                num_retries=config.DEFAULT_RETRY_ATTEMPTS
+                            )
+
+                            for perimeter in response.get("servicePerimeters", []):
+                                status = perimeter.get("status", {})
+                                spec = perimeter.get("spec", {})
+
+                                perimeter_config = status if status else spec
+
+                                resources = perimeter_config.get("resources", [])
+                                restricted_services = perimeter_config.get(
+                                    "restrictedServices", []
+                                )
+
+                                self.service_perimeters.append(
+                                    ServicePerimeter(
+                                        name=perimeter["name"],
+                                        title=perimeter.get("title", ""),
+                                        perimeter_type=perimeter.get(
+                                            "perimeterType", ""
+                                        ),
+                                        resources=resources,
+                                        restricted_services=restricted_services,
+                                        policy_name=policy["name"],
+                                    )
+                                )
+
+                            request = (
+                                self.client.accessPolicies()
+                                .servicePerimeters()
+                                .list_next(
+                                    previous_request=request, previous_response=response
+                                )
+                            )
+                    except Exception as error:
+                        logger.error(
+                            f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                        )
+
+            except Exception as error:
+                logger.error(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+
+class ServicePerimeter(BaseModel):
+    name: str
+    title: str
+    perimeter_type: str
+    resources: list[str]
+    restricted_services: list[str]
+    policy_name: str

prowler/providers/gcp/services/cloudresourcemanager/cloudresourcemanager_service.py

@@ -19,6 +19,14 @@ class CloudResourceManager(GCPService):
     def _get_iam_policy(self):
         for project_id in self.project_ids:
             try:
+                # Get project details to obtain project number
+                project_details = (
+                    self.client.projects()
+                    .get(projectId=project_id)
+                    .execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                )
+                project_number = project_details.get("projectNumber", "")
+
                 policy = (
                     self.client.projects()
                     .getIamPolicy(resource=project_id)
@@ -41,6 +49,7 @@ class CloudResourceManager(GCPService):
                 self.cloud_resource_manager_projects.append(
                     Project(
                         id=project_id,
+                        number=project_number,
                         audit_logging=audit_logging,
                         audit_configs=audit_configs,
                     )
@@ -96,6 +105,7 @@ class Binding(BaseModel):
 
 class Project(BaseModel):
     id: str
+    number: str = ""
     audit_logging: bool
     audit_configs: list[AuditConfig] = []
 

prowler/providers/gcp/services/cloudstorage/cloudstorage_service.py

@@ -1,5 +1,6 @@
 from typing import Optional
 
+from googleapiclient.errors import HttpError
 from pydantic.v1 import BaseModel
 
 from prowler.lib.logger import logger
@@ -12,6 +13,7 @@ class CloudStorage(GCPService):
     def __init__(self, provider: GcpProvider):
         super().__init__("storage", provider)
         self.buckets = []
+        self.vpc_service_controls_protected_projects = set()
         self._get_buckets()
 
     def _get_buckets(self):
@@ -93,6 +95,17 @@ class CloudStorage(GCPService):
                     request = self.client.buckets().list_next(
                         previous_request=request, previous_response=response
                     )
+            except HttpError as http_error:
+                # Check if the error is due to VPC Service Controls blocking the API
+                if "vpcServiceControlsUniqueIdentifier" in str(http_error):
+                    self.vpc_service_controls_protected_projects.add(project_id)
+                    logger.warning(
+                        f"Project {project_id} is protected by VPC Service Controls for Cloud Storage API."
+                    )
+                else:
+                    logger.error(
+                        f"{http_error.__class__.__name__}[{http_error.__traceback__.tb_lineno}]: {http_error}"
+                    )
             except Exception as error:
                 logger.error(
                     f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"

prowler/providers/gcp/services/cloudstorage/cloudstorage_uses_vpc_service_controls/cloudstorage_uses_vpc_service_controls.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "gcp",
+  "CheckID": "cloudstorage_uses_vpc_service_controls",
+  "CheckTitle": "Cloud Storage services are protected by VPC Service Controls",
+  "CheckType": [],
+  "ServiceName": "cloudstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "cloudresourcemanager.googleapis.com/Project",
+  "Description": "**GCP Projects** are evaluated to ensure they have **VPC Service Controls** enabled for Cloud Storage. VPC Service Controls establish security boundaries by restricting access to Cloud Storage resources to specific networks and trusted clients, preventing unauthorized data access and exfiltration.",
+  "Risk": "Projects without VPC Service Controls protection for Cloud Storage may be vulnerable to unauthorized data access and exfiltration, even with proper IAM policies in place. VPC Service Controls provide an additional layer of network-level security that restricts API access based on the context of the request.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudStorage/use-vpc-service-controls.html",
+    "https://cloud.google.com/vpc-service-controls/docs/create-service-perimeters"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1) Open Google Cloud Console → Security → VPC Service Controls\n2) Create a new service perimeter or select an existing one\n3) Add the relevant GCP projects to the perimeter's protected resources\n4) Add 'storage.googleapis.com' to the list of restricted services\n5) Configure appropriate ingress and egress rules\n6) Save the perimeter configuration",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable VPC Service Controls for all Cloud Storage buckets by adding their projects to a service perimeter with storage.googleapis.com as a restricted service. This prevents data exfiltration and ensures API calls are only allowed from authorized networks.",
+      "Url": "https://hub.prowler.com/check/cloudstorage_uses_vpc_service_controls"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/gcp/services/cloudstorage/cloudstorage_uses_vpc_service_controls/cloudstorage_uses_vpc_service_controls.py

@@ -0,0 +1,67 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.accesscontextmanager.accesscontextmanager_client import (
+    accesscontextmanager_client,
+)
+from prowler.providers.gcp.services.cloudresourcemanager.cloudresourcemanager_client import (
+    cloudresourcemanager_client,
+)
+from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
+    cloudstorage_client,
+)
+
+
+class cloudstorage_uses_vpc_service_controls(Check):
+    """
+    Ensure Cloud Storage is protected by VPC Service Controls at project level.
+
+    Reports PASS if:
+    - A project is in a VPC Service Controls perimeter with storage.googleapis.com
+      as a restricted service, OR
+    - The Cloud Storage API access is blocked by VPC Service Controls
+      (verified by vpcServiceControlsUniqueIdentifier in the error response)
+
+    Otherwise reports FAIL.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        findings = []
+
+        protected_projects = {}
+        for perimeter in accesscontextmanager_client.service_perimeters:
+            if any(
+                service == "storage.googleapis.com"
+                for service in perimeter.restricted_services
+            ):
+                for resource in perimeter.resources:
+                    protected_projects[resource] = perimeter.title
+
+        for project in cloudresourcemanager_client.cloud_resource_manager_projects:
+            report = Check_Report_GCP(
+                metadata=self.metadata(),
+                resource=cloudresourcemanager_client.projects[project.id],
+                project_id=project.id,
+                location=cloudresourcemanager_client.region,
+                resource_name=(
+                    cloudresourcemanager_client.projects[project.id].name
+                    if cloudresourcemanager_client.projects[project.id].name
+                    else "GCP Project"
+                ),
+            )
+            report.status = "FAIL"
+            report.status_extended = f"Project {project.id} does not have VPC Service Controls enabled for Cloud Storage."
+            # GCP stores resources by project number, not project ID
+            project_resource_id = f"projects/{project.number}"
+
+            if project_resource_id in protected_projects:
+                report.status = "PASS"
+                report.status_extended = f"Project {project.id} has VPC Service Controls enabled for Cloud Storage in perimeter {protected_projects[project_resource_id]}."
+            elif (
+                project.id
+                in cloudstorage_client.vpc_service_controls_protected_projects
+            ):
+                report.status = "PASS"
+                report.status_extended = f"Project {project.id} has VPC Service Controls enabled for Cloud Storage in undetermined perimeter (verified by API access restriction)."
+
+            findings.append(report)
+
+        return findings