prowler-cloud 5.17.1__py3-none-any.whl → 5.18.0__py3-none-any.whl

prowler/providers/aws/lib/cloudtrail_timeline/cloudtrail_timeline.py

@@ -0,0 +1,218 @@
+"""CloudTrail timeline service for AWS.
+
+Queries AWS CloudTrail to retrieve timeline events for resources,
+showing who performed actions and when.
+"""
+
+import json
+from datetime import datetime, timedelta, timezone
+from typing import Any, Dict, List, Optional
+
+from botocore.exceptions import ClientError
+
+from prowler.lib.logger import logger
+from prowler.lib.timeline.models import TimelineEvent
+from prowler.lib.timeline.timeline import TimelineService
+
+
+class CloudTrailTimeline(TimelineService):
+    """AWS CloudTrail implementation of TimelineService.
+
+    Args:
+        session: boto3.Session for AWS API calls
+        lookback_days: Number of days to look back (default 90, max 90 for Event History)
+        max_results: Maximum number of events to return
+        write_events_only: If True, filter out read-only events (Describe*, Get*, List*, etc.)
+    """
+
+    MAX_LOOKBACK_DAYS = 90
+
+    DEFAULT_MAX_RESULTS = 50  # Default page size for CloudTrail queries
+
+    # Prefixes for read-only API operations that don't modify resources
+    READ_ONLY_PREFIXES = (
+        "Describe",
+        "Get",
+        "List",
+        "Head",
+        "Check",
+        "Lookup",
+        "Search",
+        "Scan",
+        "Query",
+        "BatchGet",
+        "Select",
+    )
+
+    def __init__(
+        self,
+        session,
+        lookback_days: int = 90,
+        max_results: Optional[int] = None,
+        write_events_only: bool = True,
+    ):
+        self._session = session
+        self._lookback_days = min(lookback_days, self.MAX_LOOKBACK_DAYS)
+        self._max_results = max_results or self.DEFAULT_MAX_RESULTS
+        self._write_events_only = write_events_only
+        self._clients: Dict[str, Any] = {}
+
+    DEFAULT_REGION = "us-east-1"  # Default for global resources in commercial partition
+
+    def get_resource_timeline(
+        self,
+        region: Optional[str] = None,
+        resource_id: Optional[str] = None,
+        resource_uid: Optional[str] = None,
+    ) -> List[Dict[str, Any]]:
+        """Get CloudTrail timeline events for a resource.
+
+        Args:
+            region: AWS region to query. Defaults to us-east-1 for global resources
+                    (IAM, S3, Route53, etc.) in the commercial partition. Caller
+                    should provide the correct region for regional resources.
+            resource_id: AWS resource ID (e.g., sg-1234567890abcdef0)
+            resource_uid: AWS resource ARN (unique identifier)
+
+        Returns:
+            List of timeline event dictionaries
+
+        Raises:
+            ValueError: If neither resource_id nor resource_uid is provided
+            ClientError: If AWS API call fails
+        """
+        resource_identifier = resource_uid or resource_id
+        if not resource_identifier:
+            raise ValueError("Either resource_id or resource_uid must be provided")
+
+        region = region or self.DEFAULT_REGION
+
+        try:
+            raw_events = self._lookup_events(resource_identifier, region)
+
+            events = []
+            for raw_event in raw_events:
+                # Filter read-only events if write_events_only is enabled
+                if self._write_events_only:
+                    event_name = raw_event.get("EventName", "")
+                    if self._is_read_only_event(event_name):
+                        continue
+
+                parsed = self._parse_event(raw_event)
+                if parsed:
+                    events.append(parsed)
+
+            return events
+
+        except ClientError as e:
+            logger.error(
+                f"CloudTrail timeline error for {resource_identifier} in {region}: "
+                f"{e.response['Error']['Code']} - {e.response['Error']['Message']}"
+            )
+            raise
+        except Exception as e:
+            lineno = e.__traceback__.tb_lineno if e.__traceback__ else "?"
+            logger.error(
+                f"CloudTrail timeline unexpected error: "
+                f"{e.__class__.__name__}[{lineno}]: {e}"
+            )
+            return []
+
+    def _is_read_only_event(self, event_name: str) -> bool:
+        """Check if an event is a read-only operation."""
+        return event_name.startswith(self.READ_ONLY_PREFIXES)
+
+    def _get_client(self, region: str):
+        """Get or create a CloudTrail client for the specified region."""
+        if region not in self._clients:
+            self._clients[region] = self._session.client(
+                "cloudtrail", region_name=region
+            )
+        return self._clients[region]
+
+    def _lookup_events(
+        self, resource_identifier: str, region: str
+    ) -> List[Dict[str, Any]]:
+        """Query CloudTrail for events related to a specific resource.
+
+        Uses MaxResults to limit the number of events returned, preparing
+        for API-level pagination. Currently returns up to max_results events
+        from the first page only.
+        """
+        client = self._get_client(region)
+        start_time = datetime.now(timezone.utc) - timedelta(days=self._lookback_days)
+
+        # Use direct API call with MaxResults instead of paginator
+        # This limits CloudTrail to return only max_results events
+        response = client.lookup_events(
+            LookupAttributes=[
+                {"AttributeKey": "ResourceName", "AttributeValue": resource_identifier}
+            ],
+            StartTime=start_time,
+            MaxResults=self._max_results,
+        )
+
+        return response.get("Events", [])
+
+    def _parse_event(self, raw_event: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+        """Parse a raw CloudTrail event into a TimelineEvent dictionary."""
+        try:
+            cloud_trail_event = raw_event.get("CloudTrailEvent", "{}")
+            if isinstance(cloud_trail_event, str):
+                details = json.loads(cloud_trail_event)
+            else:
+                details = cloud_trail_event
+
+            user_identity = details.get("userIdentity", {})
+
+            event = TimelineEvent(
+                event_id=raw_event.get("EventId"),
+                event_time=raw_event["EventTime"],
+                event_name=raw_event.get("EventName", "Unknown"),
+                event_source=raw_event.get("EventSource", "Unknown"),
+                actor=self._extract_actor(user_identity),
+                actor_uid=user_identity.get("arn"),
+                actor_type=user_identity.get("type"),
+                source_ip_address=details.get("sourceIPAddress"),
+                user_agent=details.get("userAgent"),
+                request_data=details.get("requestParameters"),
+                response_data=details.get("responseElements"),
+                error_code=details.get("errorCode"),
+                error_message=details.get("errorMessage"),
+            )
+
+            return event.dict()
+
+        except Exception as e:
+            logger.warning(
+                f"CloudTrail timeline: failed to parse event: "
+                f"{e.__class__.__name__}: {e}"
+            )
+            return None
+
+    @staticmethod
+    def _extract_actor(user_identity: Dict[str, Any]) -> str:
+        """Extract a human-readable actor name from CloudTrail userIdentity."""
+        # Try ARN first - most reliable
+        if arn := user_identity.get("arn"):
+            if "/" in arn:
+                parts = arn.split("/")
+                # For assumed-role, return the role name (second-to-last part)
+                if "assumed-role" in arn and len(parts) >= 2:
+                    return parts[-2]
+                return parts[-1]
+            return arn.split(":")[-1]
+
+        # Fall back to userName
+        if username := user_identity.get("userName"):
+            return username
+
+        # Fall back to principalId
+        if principal_id := user_identity.get("principalId"):
+            return principal_id
+
+        # For service-invoked actions
+        if invoking_service := user_identity.get("invokedBy"):
+            return invoking_service
+
+        return "Unknown"

prowler/providers/aws/services/codebuild/codebuild_project_webhook_filters_use_anchored_patterns/codebuild_project_webhook_filters_use_anchored_patterns.metadata.json

@@ -0,0 +1,40 @@
+{
+  "Provider": "aws",
+  "CheckID": "codebuild_project_webhook_filters_use_anchored_patterns",
+  "CheckTitle": "CodeBuild project webhook filters use anchored regex patterns",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "codebuild",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsCodeBuildProject",
+  "ResourceGroup": "devops",
+  "Description": "AWS CodeBuild webhook filters using `ACTOR_ACCOUNT_ID`, `HEAD_REF`, or `BASE_REF` have regex patterns anchored with `^` (start) and `$` (end) to enforce exact matching and prevent substring bypass attacks.",
+  "Risk": "Unanchored patterns expose CI/CD pipelines to **CodeBreach** attacks. Attackers can bypass `ACTOR_ACCOUNT_ID` filters by creating GitHub accounts with IDs containing trusted values as substrings. **Confidentiality**: Credentials leaked via build logs. **Integrity**: Malicious code injected into builds. **Availability**: Resource exhaustion through unauthorized builds.",
+  "RelatedUrl": "",
+  "Remediation": {
+    "Code": {
+      "CLI": "aws codebuild update-webhook --project-name <PROJECT_NAME> --filter-groups '[[{\"type\":\"ACTOR_ACCOUNT_ID\",\"pattern\":\"^123456$|^234567$\"}]]'",
+      "NativeIaC": "AWSTemplateFormatVersion: '2010-09-09'\nResources:\n  CodeBuildWebhook:\n    Type: AWS::CodeBuild::Project\n    Properties:\n      Triggers:\n        Webhook: true\n        FilterGroups:\n          - - Type: ACTOR_ACCOUNT_ID\n              Pattern: '^123456$|^234567$'  # Anchored pattern",
+      "Other": "1. Open AWS Console and navigate to CodeBuild. 2. Select the project with webhook filters. 3. Click Edit and go to Primary source webhook events. 4. For each filter using ACTOR_ACCOUNT_ID, HEAD_REF, or BASE_REF, update patterns to include ^ at start and $ at end (e.g., change '123456|234567' to '^123456$|^234567$'). 5. Save changes.",
+      "Terraform": "resource \"aws_codebuild_webhook\" \"example\" {\n  project_name = aws_codebuild_project.example.name\n  filter_group {\n    filter {\n      type    = \"ACTOR_ACCOUNT_ID\"\n      pattern = \"^123456$|^234567$\"  # Anchored pattern\n    }\n  }\n}"
+    },
+    "Recommendation": {
+      "Text": "Anchor all webhook filter patterns with `^` (start) and `$` (end) to enforce exact matching. For multiple values use: `^value1$|^value2$`. This prevents attackers from bypassing filters using substring matches.",
+      "Url": "https://hub.prowler.com/check/codebuild_project_webhook_filters_use_anchored_patterns"
+    }
+  },
+  "Categories": [
+    "software-supply-chain",
+    "ci-cd"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check targets the CodeBreach vulnerability disclosed by Wiz Research. The vulnerability allows attackers to bypass ACTOR_ACCOUNT_ID filters by creating GitHub accounts with IDs that contain trusted IDs as substrings.",
+  "AdditionalURLs": [
+    "https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild",
+    "https://docs.aws.amazon.com/codebuild/latest/userguide/github-webhook.html"
+  ]
+}

prowler/providers/aws/services/codebuild/codebuild_project_webhook_filters_use_anchored_patterns/codebuild_project_webhook_filters_use_anchored_patterns.py

@@ -0,0 +1,58 @@
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client
+
+HIGH_RISK_FILTER_TYPES = {"ACTOR_ACCOUNT_ID", "HEAD_REF", "BASE_REF"}
+
+
+def is_pattern_anchored(pattern: str) -> bool:
+    """Check if each alternative in a pipe-separated pattern is anchored with ^ and $."""
+    if not pattern:
+        return True
+
+    for alt in pattern.split("|"):
+        alt = alt.strip()
+        if alt and not (alt.startswith("^") and alt.endswith("$")):
+            return False
+    return True
+
+
+class codebuild_project_webhook_filters_use_anchored_patterns(Check):
+    def execute(self) -> List[Check_Report_AWS]:
+        findings = []
+
+        for project in codebuild_client.projects.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=project)
+            report.status = "PASS"
+            report.status_extended = (
+                f"CodeBuild project {project.name} has no webhook configured or all "
+                "webhook filter patterns are properly anchored."
+            )
+
+            if not project.webhook or not project.webhook.filter_groups:
+                findings.append(report)
+                continue
+
+            unanchored_filters = []
+            for filter_group in project.webhook.filter_groups:
+                for webhook_filter in filter_group.filters:
+                    if webhook_filter.type in HIGH_RISK_FILTER_TYPES:
+                        if not is_pattern_anchored(webhook_filter.pattern):
+                            unanchored_filters.append(
+                                f"{webhook_filter.type}: '{webhook_filter.pattern}'"
+                            )
+
+            if unanchored_filters:
+                report.status = "FAIL"
+                filters_str = ", ".join(unanchored_filters[:3])
+                if len(unanchored_filters) > 3:
+                    filters_str += f" and {len(unanchored_filters) - 3} more"
+                report.status_extended = (
+                    f"CodeBuild project {project.name} has webhook filters with "
+                    f"unanchored patterns that could allow bypass attacks: {filters_str}."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/aws/services/codebuild/codebuild_service.py

@@ -122,6 +122,29 @@ class Codebuild(AWSService):
             project.tags = project_info.get("tags", [])
             project.service_role_arn = project_info.get("serviceRole", "")
             project.project_visibility = project_info.get("projectVisibility", "")
+
+            # Extract webhook configuration
+            webhook_data = project_info.get("webhook")
+            if webhook_data:
+                filter_groups = []
+                for fg in webhook_data.get("filterGroups", []):
+                    filters = []
+                    for f in fg:
+                        filters.append(
+                            WebhookFilter(
+                                type=f.get("type", ""),
+                                pattern=f.get("pattern", ""),
+                                exclude_matched_pattern=f.get(
+                                    "excludeMatchedPattern", False
+                                ),
+                            )
+                        )
+                    filter_groups.append(WebhookFilterGroup(filters=filters))
+
+                project.webhook = Webhook(
+                    filter_groups=filter_groups,
+                    branch_filter=webhook_data.get("branchFilter"),
+                )
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -209,6 +232,27 @@ class CloudWatchLogs(BaseModel):
     stream_name: str
 
 
+class WebhookFilter(BaseModel):
+    """Represents a single filter in a webhook filter group."""
+
+    type: str  # ACTOR_ACCOUNT_ID, HEAD_REF, BASE_REF, EVENT, etc.
+    pattern: str
+    exclude_matched_pattern: bool = False
+
+
+class WebhookFilterGroup(BaseModel):
+    """Represents a group of filters (AND logic within group)."""
+
+    filters: List[WebhookFilter] = []
+
+
+class Webhook(BaseModel):
+    """Represents the webhook configuration for a CodeBuild project."""
+
+    filter_groups: List[WebhookFilterGroup] = []
+    branch_filter: Optional[str] = None
+
+
 class Project(BaseModel):
     name: str
     arn: str
@@ -224,6 +268,7 @@ class Project(BaseModel):
     cloudwatch_logs: Optional[CloudWatchLogs]
     tags: Optional[list]
     project_visibility: Optional[str] = None
+    webhook: Optional[Webhook] = None
 
 
 class ExportConfig(BaseModel):

prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.metadata.json

@@ -38,5 +38,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": ""
+  "Notes": "This check supports the `trusted_account_ids` configuration in config.yaml to allow specific cross-account access without triggering a finding."
 }

prowler/providers/aws/services/dynamodb/dynamodb_table_cross_account_access/dynamodb_table_cross_account_access.py

@@ -6,6 +6,9 @@ from prowler.providers.aws.services.iam.lib.policy import is_policy_public
 class dynamodb_table_cross_account_access(Check):
     def execute(self):
         findings = []
+        trusted_account_ids = dynamodb_client.audit_config.get(
+            "trusted_account_ids", []
+        )
         for table in dynamodb_client.tables.values():
             if table.policy is None:
                 continue
@@ -20,6 +23,7 @@ class dynamodb_table_cross_account_access(Check):
                     table.policy,
                     dynamodb_client.audited_account,
                     is_cross_account_allowed=False,
+                    trusted_account_ids=trusted_account_ids,
                 ):
                     report.status = "FAIL"
                     report.status_extended = f"DynamoDB table {table.name} has a resource-based policy allowing cross account access."

prowler/providers/aws/services/eventbridge/eventbridge_bus_cross_account_access/eventbridge_bus_cross_account_access.metadata.json

@@ -40,5 +40,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": ""
+  "Notes": "This check supports the `trusted_account_ids` configuration in config.yaml to allow specific cross-account access without triggering a finding."
 }

prowler/providers/aws/services/eventbridge/eventbridge_bus_cross_account_access/eventbridge_bus_cross_account_access.py

@@ -8,6 +8,9 @@ from prowler.providers.aws.services.iam.lib.policy import is_policy_public
 class eventbridge_bus_cross_account_access(Check):
     def execute(self):
         findings = []
+        trusted_account_ids = eventbridge_client.audit_config.get(
+            "trusted_account_ids", []
+        )
         for bus in eventbridge_client.buses.values():
             if bus.policy is None:
                 continue
@@ -20,6 +23,7 @@ class eventbridge_bus_cross_account_access(Check):
                 bus.policy,
                 eventbridge_client.audited_account,
                 is_cross_account_allowed=False,
+                trusted_account_ids=trusted_account_ids,
             ):
                 report.status = "FAIL"
                 report.status_extended = (

prowler/providers/aws/services/eventbridge/eventbridge_schema_registry_cross_account_access/eventbridge_schema_registry_cross_account_access.metadata.json

@@ -39,5 +39,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": ""
+  "Notes": "This check supports the `trusted_account_ids` configuration in config.yaml to allow specific cross-account access without triggering a finding."
 }

prowler/providers/aws/services/eventbridge/eventbridge_schema_registry_cross_account_access/eventbridge_schema_registry_cross_account_access.py

@@ -6,6 +6,7 @@ from prowler.providers.aws.services.iam.lib.policy import is_policy_public
 class eventbridge_schema_registry_cross_account_access(Check):
     def execute(self):
         findings = []
+        trusted_account_ids = schema_client.audit_config.get("trusted_account_ids", [])
         for registry in schema_client.registries.values():
             if registry.policy is None:
                 continue
@@ -16,6 +17,7 @@ class eventbridge_schema_registry_cross_account_access(Check):
                 registry.policy,
                 schema_client.audited_account,
                 is_cross_account_allowed=False,
+                trusted_account_ids=trusted_account_ids,
             ):
                 report.status = "FAIL"
                 report.status_extended = f"EventBridge schema registry {registry.name} allows cross-account access."

prowler/providers/aws/services/iam/lib/policy.py

@@ -387,6 +387,7 @@ def is_policy_public(
     is_cross_account_allowed=True,
     not_allowed_actions: list = [],
     check_cross_service_confused_deputy=False,
+    trusted_account_ids: list = None,
 ) -> bool:
     """
     Check if the policy allows public access to the resource.
@@ -397,10 +398,19 @@ def is_policy_public(
         is_cross_account_allowed (bool): If the policy can allow cross-account access, default: True (https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html#cross-service-confused-deputy-prevention)
         not_allowed_actions (list): List of actions that are not allowed, default: []. If not_allowed_actions is empty, the function will not consider the actions in the policy.
         check_cross_service_confused_deputy (bool): If the policy is checked for cross-service confused deputy, default: False
+        trusted_account_ids (list): A list of trusted accound ids to reduce false positives on cross-account checks
     Returns:
         bool: True if the policy allows public access, False otherwise
     """
     is_public = False
+
+    if trusted_account_ids is None:
+        trusted_account_ids = []
+
+    trusted_accounts = set(trusted_account_ids)
+    if source_account:
+        trusted_accounts.add(source_account)
+
     if policy:
         for statement in policy.get("Statement", []):
             # Only check allow statements
@@ -414,13 +424,19 @@ def is_policy_public(
                         isinstance(principal.get("AWS"), str)
                         and source_account
                         and not is_cross_account_allowed
-                        and source_account not in principal.get("AWS", "")
+                        and not any(
+                            trusted_account in principal.get("AWS", "")
+                            for trusted_account in trusted_accounts
+                        )
                     ) or (
                         isinstance(principal.get("AWS"), list)
                         and source_account
                         and not is_cross_account_allowed
-                        and not any(
-                            source_account in principal_aws
+                        and not all(
+                            any(
+                                trusted_account in principal_aws
+                                for trusted_account in trusted_accounts
+                            )
                             for principal_aws in principal["AWS"]
                         )
                     ):

prowler/providers/aws/services/rds/rds_instance_extended_support/rds_instance_extended_support.metadata.json

@@ -0,0 +1,41 @@
+{
+    "Provider": "aws",
+    "CheckID": "rds_instance_extended_support",
+    "CheckTitle": "RDS instance is not enrolled in RDS Extended Support",
+    "CheckType": [
+        "Software and Configuration Checks/Patch Management",
+        "Software and Configuration Checks/AWS Security Best Practices"
+    ],
+    "ServiceName": "rds",
+    "SubServiceName": "",
+    "ResourceIdTemplate": "",
+    "Severity": "medium",
+    "ResourceType": "AwsRdsDbInstance",
+    "ResourceGroup": "database",
+    "Description": "**RDS DB instances** are evaluated for enrollment in Amazon RDS Extended Support. The check fails if `EngineLifecycleSupportis` set to `open-source-rds-extended-support`, indicating the instance will incur additional charges after standard support ends.",
+    "Risk": "DB instances enrolled in RDS Extended Support can incur additional charges after the end of standard support for the running database major version. Remaining on older major versions can also delay necessary upgrades, increasing operational and security risk.",
+    "RelatedUrl": "",
+    "AdditionalURLs": [
+        "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/extended-support-viewing.html",
+        "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/extended-support-charges.html",
+        "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/extended-support-creating-db-instance.html"
+    ],
+    "Remediation": {
+        "Code": {
+            "CLI": "aws rds modify-db-instance --db-instance-identifier <DB_INSTANCE_IDENTIFIER> --engine-version <TARGET_ENGINE_VERSION> --allow-major-version-upgrade --apply-immediately\n# For new DB instances created via automation, prevent enrollment by setting the lifecycle option:\naws rds create-db-instance ... --engine-lifecycle-support open-source-rds-extended-support-disabled",
+            "NativeIaC": "```yaml\n# CloudFormation: upgrade RDS engine version for an existing instance\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBInstance\n    Properties:\n      DBInstanceIdentifier: <example_resource_id>\n      Engine: <engine>\n      DBInstanceClass: db.t3.micro\n      EngineVersion: <SUPPORTED_ENGINE_VERSION>  # CRITICAL: move to a supported engine version\n      AllowMajorVersionUpgrade: true             # CRITICAL: required if upgrading major version\n      ApplyImmediately: true                     # CRITICAL: apply change now to pass the check\n```",
+            "Other": "If your automation (CloudFormation/Terraform/SDK) creates or restores DB instances, set EngineLifecycleSupport/LifeCycleSupport to open-source-rds-extended-support-disabled where supported, and ensure your upgrade process keeps engines within standard support.",
+            "Terraform": "```hcl\n# Upgrade RDS engine version\nresource \"aws_db_instance\" \"<example_resource_name>\" {\n  identifier         = \"<example_resource_id>\"\n  engine             = \"<engine>\"\n  instance_class     = \"db.t3.micro\"\n  allocated_storage  = 20\n\n  engine_version               = \"<SUPPORTED_ENGINE_VERSION>\"  # CRITICAL: use a supported version\n  allow_major_version_upgrade  = true                           # CRITICAL: needed for major upgrades\n  apply_immediately            = true                           # CRITICAL: apply now to pass the check\n}\n```"
+        },
+        "Recommendation": {
+            "Text": "Upgrade enrolled DB instances to an engine version covered under standard support to stop Extended Support charges. For new DB instances and restores created via automation, explicitly set the engine lifecycle support option to avoid unintended enrollment in RDS Extended Support when that is your policy.",
+            "Url": "https://hub.prowler.com/check/rds_instance_extended_support"
+        }
+    },
+    "Categories": [
+        "vulnerabilities"
+    ],
+    "DependsOn": [],
+    "RelatedTo": [],
+    "Notes": ""
+}

prowler/providers/aws/services/rds/rds_instance_extended_support/rds_instance_extended_support.py

@@ -0,0 +1,37 @@
+"""
+Prowler check: rds_instance_extended_support
+
+This check fails when an RDS DB instance is enrolled in Amazon RDS Extended Support.
+Enrollment is exposed via the "EngineLifecycleSupport" attribute returned by DescribeDBInstances.
+"""
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.rds.rds_client import rds_client
+
+
+class rds_instance_extended_support(Check):
+    def execute(self):
+        findings = []
+
+        for db_instance in rds_client.db_instances.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
+
+            # EngineLifecycleSupport can be absent when Extended Support is not applicable.
+            lifecycle_support = getattr(db_instance, "engine_lifecycle_support", None)
+
+            if lifecycle_support == "open-source-rds-extended-support":
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"RDS instance {db_instance.id} ({db_instance.engine} {db_instance.engine_version}) "
+                    f"is enrolled in RDS Extended Support (EngineLifecycleSupport={lifecycle_support})."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"RDS instance {db_instance.id} ({db_instance.engine} {db_instance.engine_version}) "
+                    "is not enrolled in RDS Extended Support."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/aws/services/rds/rds_service.py

@@ -59,6 +59,9 @@ class RDS(AWSService):
                                 endpoint=instance.get("Endpoint", {}),
                                 engine=instance["Engine"],
                                 engine_version=instance["EngineVersion"],
+                                engine_lifecycle_support=instance.get(
+                                    "EngineLifecycleSupport"
+                                ),
                                 status=instance["DBInstanceStatus"],
                                 public=instance.get("PubliclyAccessible", False),
                                 encrypted=instance["StorageEncrypted"],
@@ -531,6 +534,7 @@ class DBInstance(BaseModel):
     endpoint: dict
     engine: str
     engine_version: str
+    engine_lifecycle_support: Optional[str] = None
     status: str
     public: bool
     encrypted: bool

prowler/providers/aws/services/s3/s3_bucket_cross_account_access/s3_bucket_cross_account_access.metadata.json

@@ -39,5 +39,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": ""
+  "Notes": "This check supports the `trusted_account_ids` configuration in config.yaml to allow specific cross-account access without triggering a finding."
 }

prowler/providers/aws/services/s3/s3_bucket_cross_account_access/s3_bucket_cross_account_access.py

@@ -6,6 +6,7 @@ from prowler.providers.aws.services.s3.s3_client import s3_client
 class s3_bucket_cross_account_access(Check):
     def execute(self):
         findings = []
+        trusted_account_ids = s3_client.audit_config.get("trusted_account_ids", [])
         for bucket in s3_client.buckets.values():
             if bucket.policy is None:
                 continue
@@ -19,7 +20,10 @@ class s3_bucket_cross_account_access(Check):
                     f"S3 Bucket {bucket.name} does not have a bucket policy."
                 )
             elif is_policy_public(
-                bucket.policy, s3_client.audited_account, is_cross_account_allowed=False
+                bucket.policy,
+                s3_client.audited_account,
+                is_cross_account_allowed=False,
+                trusted_account_ids=trusted_account_ids,
             ):
                 report.status = "FAIL"
                 report.status_extended = f"S3 Bucket {bucket.name} has a bucket policy allowing cross account access."