prowler-cloud 5.14.2__py3-none-any.whl → 5.15.0__py3-none-any.whl

prowler/providers/alibabacloud/config.py

@@ -0,0 +1,41 @@
+"""Alibaba Cloud Provider Configuration Constants"""
+
+ALIBABACLOUD_DEFAULT_REGION = "cn-hangzhou"
+ROLE_SESSION_NAME = "ProwlerAssessmentSession"
+
+# Alibaba Cloud SDK Configuration
+ALIBABACLOUD_SDK_READ_TIMEOUT = 60  # seconds
+ALIBABACLOUD_SDK_CONNECT_TIMEOUT = 10  # seconds
+
+# Alibaba Cloud Regions - Only publicly accessible regions
+# Note: Some regions may require special approval or are not globally available
+ALIBABACLOUD_REGIONS = {
+    # China Regions
+    "cn-qingdao": "China (Qingdao)",
+    "cn-beijing": "China (Beijing)",
+    "cn-zhangjiakou": "China (Zhangjiakou)",
+    "cn-huhehaote": "China (Hohhot)",
+    "cn-wulanchabu": "China (Ulanqab)",
+    "cn-hangzhou": "China (Hangzhou)",
+    "cn-shanghai": "China (Shanghai)",
+    "cn-shenzhen": "China (Shenzhen)",
+    "cn-heyuan": "China (Heyuan)",
+    "cn-guangzhou": "China (Guangzhou)",
+    "cn-chengdu": "China (Chengdu)",
+    "cn-hongkong": "China (Hong Kong)",
+    # Asia-Pacific Regions
+    "ap-northeast-1": "Japan (Tokyo)",
+    "ap-northeast-2": "South Korea (Seoul)",
+    "ap-southeast-1": "Singapore",
+    "ap-southeast-3": "Malaysia (Kuala Lumpur)",
+    "ap-southeast-5": "Indonesia (Jakarta)",
+    "ap-southeast-6": "Philippines (Manila)",
+    "ap-southeast-7": "Thailand (Bangkok)",
+    # US Regions
+    "us-east-1": "US (Virginia)",
+    "us-west-1": "US (Silicon Valley)",
+    # Europe & Middle East Regions
+    "eu-west-1": "UK (London)",
+    "me-east-1": "UAE (Dubai)",
+    "eu-central-1": "Germany (Frankfurt)",
+}

prowler/providers/alibabacloud/exceptions/exceptions.py

@@ -0,0 +1,116 @@
+from prowler.exceptions.exceptions import ProwlerException
+
+
+# Exceptions codes from 10000 to 10999 are reserved for AlibabaCloud exceptions
+class AlibabaCloudBaseException(ProwlerException):
+    """Base class for Alibaba Cloud Provider exceptions"""
+
+    ALIBABACLOUD_ERROR_CODES = {
+        (10000, "AlibabaCloudClientError"): {
+            "message": "Alibaba Cloud ClientError occurred",
+            "remediation": "Check your Alibaba Cloud client configuration and permissions.",
+        },
+        (10001, "AlibabaCloudNoCredentialsError"): {
+            "message": "No credentials found for Alibaba Cloud provider",
+            "remediation": "Verify that Alibaba Cloud credentials are properly set up. Access Key ID and Access Key Secret are required.",
+        },
+        (10002, "AlibabaCloudInvalidCredentialsError"): {
+            "message": "Invalid credentials provided for Alibaba Cloud provider",
+            "remediation": "Check your Alibaba Cloud credentials and ensure they are valid and have proper permissions.",
+        },
+        (10003, "AlibabaCloudSetUpSessionError"): {
+            "message": "Failed to set up session for Alibaba Cloud provider",
+            "remediation": "Check the Alibaba Cloud session setup and ensure it is properly configured.",
+        },
+        (10004, "AlibabaCloudAssumeRoleError"): {
+            "message": "Failed to assume role for Alibaba Cloud provider",
+            "remediation": "Check the Alibaba Cloud assume role configuration and ensure it is properly set up.",
+        },
+        (10005, "AlibabaCloudInvalidRegionError"): {
+            "message": "Invalid region specified for Alibaba Cloud provider",
+            "remediation": "Check the region and ensure it is a valid region for Alibaba Cloud.",
+        },
+        (10006, "AlibabaCloudArgumentTypeValidationError"): {
+            "message": "Alibaba Cloud argument type validation error",
+            "remediation": "Check the provided argument types specific to Alibaba Cloud and ensure they meet the required format.",
+        },
+        (10007, "AlibabaCloudHTTPError"): {
+            "message": "Alibaba Cloud HTTP/API error",
+            "remediation": "Check the Alibaba Cloud API request and response, and ensure the service is accessible.",
+        },
+    }
+
+    def __init__(self, code, file=None, original_exception=None, message=None):
+        error_info = self.ALIBABACLOUD_ERROR_CODES.get((code, self.__class__.__name__))
+        if message:
+            error_info["message"] = message
+        super().__init__(
+            code,
+            source="AlibabaCloud",
+            file=file,
+            original_exception=original_exception,
+            error_info=error_info,
+        )
+
+
+class AlibabaCloudCredentialsError(AlibabaCloudBaseException):
+    """Base class for Alibaba Cloud credentials errors."""
+
+    def __init__(self, code, file=None, original_exception=None, message=None):
+        super().__init__(code, file, original_exception, message)
+
+
+class AlibabaCloudClientError(AlibabaCloudCredentialsError):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10000, file=file, original_exception=original_exception, message=message
+        )
+
+
+class AlibabaCloudNoCredentialsError(AlibabaCloudCredentialsError):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10001, file=file, original_exception=original_exception, message=message
+        )
+
+
+class AlibabaCloudInvalidCredentialsError(AlibabaCloudCredentialsError):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10002, file=file, original_exception=original_exception, message=message
+        )
+
+
+class AlibabaCloudSetUpSessionError(AlibabaCloudBaseException):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10003, file=file, original_exception=original_exception, message=message
+        )
+
+
+class AlibabaCloudAssumeRoleError(AlibabaCloudBaseException):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10004, file=file, original_exception=original_exception, message=message
+        )
+
+
+class AlibabaCloudInvalidRegionError(AlibabaCloudBaseException):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10005, file=file, original_exception=original_exception, message=message
+        )
+
+
+class AlibabaCloudArgumentTypeValidationError(AlibabaCloudBaseException):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10006, file=file, original_exception=original_exception, message=message
+        )
+
+
+class AlibabaCloudHTTPError(AlibabaCloudBaseException):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            10007, file=file, original_exception=original_exception, message=message
+        )

prowler/providers/alibabacloud/lib/arguments/arguments.py

@@ -0,0 +1,58 @@
+def init_parser(self):
+    """Init the Alibaba Cloud Provider CLI parser"""
+    alibabacloud_parser = self.subparsers.add_parser(
+        "alibabacloud",
+        parents=[self.common_providers_parser],
+        help="Alibaba Cloud Provider",
+    )
+
+    # Authentication Methods
+    alibabacloud_auth_subparser = alibabacloud_parser.add_argument_group(
+        "Authentication Modes"
+    )
+    alibabacloud_auth_subparser.add_argument(
+        "--role-arn",
+        nargs="?",
+        default=None,
+        help="ARN of the RAM role to assume (e.g., acs:ram::123456789012:role/ProwlerAuditRole). Requires access keys to be set via environment variables (ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET). The provider will automatically obtain and refresh STS tokens. Can also use ALIBABA_CLOUD_ROLE_ARN environment variable",
+    )
+    alibabacloud_auth_subparser.add_argument(
+        "--role-session-name",
+        nargs="?",
+        default=None,
+        help="Session name when assuming the RAM role. Defaults to ProwlerAssessmentSession. Can also use ALIBABA_CLOUD_ROLE_SESSION_NAME environment variable",
+    )
+    alibabacloud_auth_subparser.add_argument(
+        "--ecs-ram-role",
+        nargs="?",
+        default=None,
+        help="Name of the RAM role attached to an ECS instance. When specified, credentials are obtained from the ECS instance metadata service. Can also use ALIBABA_CLOUD_ECS_METADATA environment variable",
+    )
+    alibabacloud_auth_subparser.add_argument(
+        "--oidc-role-arn",
+        nargs="?",
+        default=None,
+        help="ARN of the RAM role for OIDC authentication. Requires OIDC provider ARN and token file to be set via environment variables (ALIBABA_CLOUD_OIDC_PROVIDER_ARN and ALIBABA_CLOUD_OIDC_TOKEN_FILE). Can also use ALIBABA_CLOUD_ROLE_ARN environment variable",
+    )
+    alibabacloud_auth_subparser.add_argument(
+        "--credentials-uri",
+        nargs="?",
+        default=None,
+        help="URI to retrieve credentials from an external service. The URI must return credentials in the required JSON format. Can also use ALIBABA_CLOUD_CREDENTIALS_URI environment variable",
+    )
+
+    # Alibaba Cloud Regions
+    alibabacloud_regions_subparser = alibabacloud_parser.add_argument_group(
+        "Alibaba Cloud Regions"
+    )
+    alibabacloud_regions_subparser.add_argument(
+        "--region",
+        "--filter-region",
+        "-f",
+        nargs="+",
+        dest="regions",
+        help="Alibaba Cloud region IDs to run Prowler against (e.g., cn-hangzhou, cn-shanghai)",
+    )
+
+    # Set the provider
+    alibabacloud_parser.set_defaults(provider="alibabacloud")

prowler/providers/alibabacloud/lib/mutelist/mutelist.py

@@ -0,0 +1,175 @@
+from prowler.lib.check.models import CheckReportAlibabaCloud
+from prowler.lib.logger import logger
+from prowler.lib.mutelist.mutelist import Mutelist
+from prowler.lib.outputs.utils import unroll_tags
+
+
+class AlibabaCloudMutelist(Mutelist):
+    """
+    AlibabaCloudMutelist class extends the base Mutelist for Alibaba Cloud-specific functionality.
+
+    This class handles muting/filtering of findings for Alibaba Cloud resources.
+
+    Attributes:
+        account_id: The Alibaba Cloud account ID
+        mutelist: The parsed mutelist data
+    """
+
+    def __init__(
+        self,
+        mutelist_path: str = None,
+        mutelist_content: dict = None,
+        account_id: str = "",
+    ):
+        """
+        Initialize the AlibabaCloudMutelist.
+
+        Args:
+            mutelist_path: Path to the mutelist file
+            mutelist_content: Dictionary containing mutelist content
+            account_id: The Alibaba Cloud account ID
+        """
+        self.account_id = account_id
+        super().__init__(
+            mutelist_path=mutelist_path or "",
+            mutelist_content=mutelist_content or {},
+        )
+
+    def is_finding_muted(
+        self,
+        finding: CheckReportAlibabaCloud,
+        account_id: str,
+    ) -> bool:
+        """
+        Check if a finding is muted based on the mutelist.
+
+        Args:
+            finding: The finding object to check (should have check_metadata, region, resource_id, resource_tags).
+            account_id: The Alibaba Cloud account ID to use for mutelist evaluation.
+
+        Returns:
+            bool: True if the finding is muted, False otherwise.
+        """
+        try:
+            check_id = finding.check_metadata.CheckID
+            region = finding.region if hasattr(finding, "region") else ""
+            resource_id = finding.resource_id if hasattr(finding, "resource_id") else ""
+            resource_tags = {}
+
+            # Handle resource tags
+            if hasattr(finding, "resource_tags") and finding.resource_tags:
+                # Keep as dict for tag matching logic; do not unroll to string
+                resource_tags = unroll_tags(finding.resource_tags)
+
+            return self.is_muted(
+                account_id,
+                check_id,
+                region,
+                resource_id,
+                resource_tags,
+            )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return False
+
+    def is_muted(
+        self,
+        account_id: str,
+        check_id: str,
+        region: str,
+        resource_id: str,
+        resource_tags: dict = None,
+    ) -> bool:
+        """
+        Check if a finding should be muted.
+
+        Args:
+            account_id: The Alibaba Cloud account ID
+            check_id: The check ID
+            region: The region ID
+            resource_id: The resource ID
+            resource_tags: Dictionary of resource tags
+
+        Returns:
+            True if the finding should be muted, False otherwise
+        """
+        if not self.mutelist:
+            return False
+
+        try:
+            # Check account-level mutes
+            accounts = self.mutelist.get("Accounts", {})
+            if not accounts:
+                return False
+
+            # Check for wildcard or specific account
+            account_mutelist = accounts.get("*", {})
+            if account_id in accounts:
+                # Merge with specific account rules
+                specific_account = accounts.get(account_id, {})
+                account_mutelist = {**account_mutelist, **specific_account}
+
+            if not account_mutelist:
+                return False
+
+            # Get checks for this account
+            checks = account_mutelist.get("Checks", {})
+
+            # Check for wildcard or specific check
+            check_mutelist = checks.get("*", {})
+            if check_id in checks:
+                specific_check = checks.get(check_id, {})
+                check_mutelist = {**check_mutelist, **specific_check}
+
+            if not check_mutelist:
+                return False
+
+            # Check regions
+            regions = check_mutelist.get("Regions", [])
+            if regions and "*" not in regions and region not in regions:
+                return False
+
+            # Check resources
+            resources = check_mutelist.get("Resources", [])
+            if resources:
+                if "*" not in resources and resource_id not in resources:
+                    return False
+
+            # Check tags
+            tags = check_mutelist.get("Tags", [])
+            if tags and resource_tags:
+                # Check if any tag matches
+                tag_match = False
+                for tag_filter in tags:
+                    # Tag filter format: "key=value" or "key=*"
+                    if "=" in tag_filter:
+                        key, value = tag_filter.split("=", 1)
+                        if key in resource_tags:
+                            if value == "*" or resource_tags[key] == value:
+                                tag_match = True
+                                break
+
+                if not tag_match:
+                    return False
+
+            # Check exceptions (resources that should NOT be muted)
+            exceptions = check_mutelist.get("Exceptions", {})
+            if exceptions:
+                exception_resources = exceptions.get("Resources", [])
+                if resource_id in exception_resources:
+                    return False
+
+                exception_regions = exceptions.get("Regions", [])
+                if region in exception_regions:
+                    return False
+
+            # If we passed all checks, the finding is muted
+            return True
+
+        except Exception as error:
+            logger.error(
+                f"Error checking mutelist: {error.__class__.__name__}: {error}"
+            )
+            return False

prowler/providers/alibabacloud/lib/service/service.py

@@ -0,0 +1,113 @@
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from typing import Any, Dict
+
+from prowler.lib.logger import logger
+
+MAX_WORKERS = 10
+
+
+class AlibabaCloudService:
+    """
+    The AlibabaCloudService class offers a parent class for each Alibaba Cloud Service to generate:
+    - Alibaba Cloud Regional Clients
+    - Shared information like the account ID, the checks audited
+    - Thread pool for the __threading_call__
+    - Handles if the service is Regional or Global
+    """
+
+    def __init__(self, service: str, provider, global_service: bool = False):
+        """
+        Initialize the AlibabaCloudService.
+
+        Args:
+            service: The service name (e.g., 'RAM', 'ECS', 'OSS')
+            provider: The AlibabaCloudProvider instance
+            global_service: Whether this is a global service (default: False)
+        """
+        # Audit Information
+        self.provider = provider
+        self.audited_account = provider.identity.account_id
+        self.audited_account_name = provider.identity.account_name
+        self.audit_resources = provider.audit_resources
+        self.audited_checks = provider.audit_metadata.expected_checks
+        self.audit_config = provider.audit_config
+
+        # Session
+        self.session = provider.session
+
+        # Service name
+        self.service = service.lower() if not service.islower() else service
+
+        # Generate Regional Clients
+        self.regional_clients: Dict[str, Any] = {}
+        if not global_service:
+            self.regional_clients = provider.generate_regional_clients(self.service)
+
+        # Get default region and client
+        self.region = provider.get_default_region(self.service)
+        self.client = self.session.client(self.service, self.region)
+
+        # Thread pool for __threading_call__
+        self.thread_pool = ThreadPoolExecutor(max_workers=MAX_WORKERS)
+
+    def __get_session__(self):
+        """Get the session."""
+        return self.session
+
+    def __get_client__(self, region: str = None):
+        """
+        Get a client for the specified region or the default region.
+
+        Args:
+            region: The region to get the client for (optional)
+
+        Returns:
+            A client instance for the service
+        """
+        if region and region in self.regional_clients:
+            return self.regional_clients[region]
+        return self.client
+
+    def __threading_call__(self, call, iterator=None):
+        """
+        Execute a function across multiple regions or items using threads.
+
+        Args:
+            call: The function to call
+            iterator: The items to iterate over (default: regional clients)
+        """
+        # Use the provided iterator, or default to self.regional_clients
+        items = iterator if iterator is not None else self.regional_clients.values()
+        # Determine the total count for logging
+        item_count = (
+            len(list(items)) if iterator is not None else len(self.regional_clients)
+        )
+
+        # Trim leading and trailing underscores from the call's name
+        call_name = call.__name__.strip("_")
+        # Add Capitalization
+        call_name = " ".join([x.capitalize() for x in call_name.split("_")])
+
+        # Print a message based on the call's name
+        if iterator is None:
+            logger.info(
+                f"{self.service.upper()} - Starting threads for '{call_name}' function across {item_count} regions..."
+            )
+        else:
+            logger.info(
+                f"{self.service.upper()} - Starting threads for '{call_name}' function to process {item_count} items..."
+            )
+
+        # Re-create the iterator for submission if it was a generator
+        items = iterator if iterator is not None else self.regional_clients.values()
+
+        # Submit tasks to the thread pool
+        futures = [self.thread_pool.submit(call, item) for item in items]
+
+        # Wait for all tasks to complete
+        for future in as_completed(futures):
+            try:
+                future.result()  # Raises exceptions from the thread, if any
+            except Exception:
+                # Handle exceptions if necessary
+                pass  # Currently handled within the called function