prowler-cloud 5.17.1__py3-none-any.whl → 5.18.1__py3-none-any.whl

prowler/providers/cloudflare/cloudflare_provider.py

@@ -14,6 +14,7 @@ from prowler.lib.utils.utils import print_boxes
 from prowler.providers.cloudflare.exceptions.exceptions import (
     CloudflareCredentialsError,
     CloudflareIdentityError,
+    CloudflareInvalidAccountError,
     CloudflareSessionError,
 )
 from prowler.providers.cloudflare.lib.mutelist.mutelist import CloudflareMutelist
@@ -36,16 +37,21 @@ class CloudflareProvider(Provider):
     _fixer_config: dict
     _mutelist: CloudflareMutelist
     _filter_zones: set[str] | None
+    _filter_accounts: set[str] | None
     audit_metadata: Audit_Metadata
 
     def __init__(
         self,
         filter_zones: Iterable[str] | None = None,
+        filter_accounts: Iterable[str] | None = None,
         config_path: str = None,
         config_content: dict | None = None,
         fixer_config: dict = {},
         mutelist_path: str = None,
         mutelist_content: dict = None,
+        api_token: str = None,
+        api_key: str = None,
+        api_email: str = None,
     ):
         logger.info("Instantiating Cloudflare provider...")
 
@@ -58,7 +64,12 @@ class CloudflareProvider(Provider):
 
         max_retries = self._audit_config.get("max_retries", 2)
 
-        self._session = CloudflareProvider.setup_session(max_retries=max_retries)
+        self._session = CloudflareProvider.setup_session(
+            max_retries=max_retries,
+            api_token=api_token,
+            api_key=api_key,
+            api_email=api_email,
+        )
 
         self._identity = CloudflareProvider.setup_identity(self._session)
 
@@ -74,6 +85,23 @@ class CloudflareProvider(Provider):
         # Store zone filter for filtering resources across services
         self._filter_zones = set(filter_zones) if filter_zones else None
 
+        # Store account filter and restrict audited_accounts accordingly
+        self._filter_accounts = set(filter_accounts) if filter_accounts else None
+        if self._filter_accounts:
+            discovered_account_ids = {account.id for account in self._identity.accounts}
+            invalid_accounts = self._filter_accounts - discovered_account_ids
+            if invalid_accounts:
+                invalid_str = ", ".join(sorted(invalid_accounts))
+                raise CloudflareInvalidAccountError(
+                    file=os.path.basename(__file__),
+                    message=f"Account IDs not found: {invalid_str}.",
+                )
+            self._identity.audited_accounts = [
+                account_id
+                for account_id in self._identity.audited_accounts
+                if account_id in self._filter_accounts
+            ]
+
         Provider.set_global_provider(self)
 
     @property
@@ -105,24 +133,38 @@ class CloudflareProvider(Provider):
         """Zone filter from --region argument to filter resources."""
         return self._filter_zones
 
+    @property
+    def filter_accounts(self) -> set[str] | None:
+        """Account filter from --account-id argument to restrict scanned accounts."""
+        return self._filter_accounts
+
     @property
     def accounts(self) -> list[CloudflareAccount]:
         return self._identity.accounts
 
     @staticmethod
-    def setup_session(max_retries: int = 2) -> CloudflareSession:
+    def setup_session(
+        max_retries: int = 2,
+        api_token: str = None,
+        api_key: str = None,
+        api_email: str = None,
+    ) -> CloudflareSession:
         """Initialize Cloudflare SDK client.
 
-        Credentials are read from environment variables:
+        Credentials can be provided as arguments or read from environment variables:
         - CLOUDFLARE_API_TOKEN (recommended)
         - CLOUDFLARE_API_KEY and CLOUDFLARE_API_EMAIL (legacy)
 
         Args:
             max_retries: Maximum number of retries for API requests (default is 2).
+            api_token: Cloudflare API token (optional, falls back to env var).
+            api_key: Cloudflare API key (optional, falls back to env var).
+            api_email: Cloudflare API email (optional, falls back to env var).
         """
-        token = os.environ.get("CLOUDFLARE_API_TOKEN", "")
-        key = os.environ.get("CLOUDFLARE_API_KEY", "")
-        email = os.environ.get("CLOUDFLARE_API_EMAIL", "")
+        # Use provided credentials or fall back to environment variables
+        token = api_token or os.environ.get("CLOUDFLARE_API_TOKEN", "")
+        key = api_key or os.environ.get("CLOUDFLARE_API_KEY", "")
+        email = api_email or os.environ.get("CLOUDFLARE_API_EMAIL", "")
 
         # Warn if both auth methods are set, use API Token (recommended)
         if token and key and email:
@@ -248,21 +290,62 @@ class CloudflareProvider(Provider):
         if email:
             report_lines.append(f"Email: {Fore.YELLOW}{email}{Style.RESET_ALL}")
 
-        # Accounts
-        if self.accounts:
-            accounts = ", ".join([account.id for account in self.accounts])
-            report_lines.append(f"Accounts: {Fore.YELLOW}{accounts}{Style.RESET_ALL}")
+        # Audited accounts (only the ones that will actually be scanned)
+        audited_accounts = self.identity.audited_accounts
+        if audited_accounts:
+            account_names = {
+                account.id: account.name for account in self.identity.accounts
+            }
+            accounts_str = ", ".join(
+                (
+                    f"{account_id} ({account_names[account_id]})"
+                    if account_id in account_names and account_names[account_id]
+                    else account_id
+                )
+                for account_id in audited_accounts
+            )
+            report_lines.append(
+                f"Audited Accounts: {Fore.YELLOW}{accounts_str}{Style.RESET_ALL}"
+            )
 
         print_boxes(report_lines, report_title)
 
-    def test_connection(self) -> Connection:
+    @staticmethod
+    def test_connection(
+        api_token: str = None,
+        api_key: str = None,
+        api_email: str = None,
+        raise_on_exception: bool = True,
+        provider_id: str = None,
+    ) -> Connection:
+        """Test connection to Cloudflare.
+
+        Test the connection to Cloudflare using the provided credentials.
+
+        Args:
+            api_token: Cloudflare API token (optional, falls back to env var).
+            api_key: Cloudflare API key (optional, falls back to env var).
+            api_email: Cloudflare API email (optional, falls back to env var).
+            raise_on_exception: Flag indicating whether to raise an exception if the connection fails.
+            provider_id: The provider ID (Cloudflare account ID).
+
+        Returns:
+            Connection: Connection object with is_connected status.
+        """
         try:
-            _ = self._session.client.user.get()
+            session = CloudflareProvider.setup_session(
+                api_token=api_token,
+                api_key=api_key,
+                api_email=api_email,
+            )
+            _ = session.client.user.get()
             return Connection(is_connected=True)
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
+            if raise_on_exception:
+                raise error
             return Connection(is_connected=False, error=error)
 
     def validate_arguments(self) -> None:

prowler/providers/cloudflare/lib/arguments/arguments.py

@@ -5,6 +5,13 @@ def init_parser(self):
     )
 
     scope_group = cloudflare_parser.add_argument_group("Scope")
+    scope_group.add_argument(
+        "--account-id",
+        nargs="+",
+        default=None,
+        metavar="ACCOUNT_ID",
+        help="Filter scan to specific Cloudflare account IDs. Only zones belonging to these accounts will be scanned.",
+    )
     scope_group.add_argument(
         "--region",
         "--filter-region",

prowler/providers/cloudflare/services/dns/dns_record_cname_target_valid/dns_record_cname_target_valid.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "dns_record_cname_target_valid",
+  "CheckTitle": "DNS records pointing to hostnames have valid targets without takeover risk",
+  "CheckType": [],
+  "ServiceName": "dns",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "DNSRecord",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare DNS records** (CNAME, MX, NS, SRV) that point to hostnames are assessed for **dangling record** vulnerabilities by checking if the target domain resolves to a valid address, preventing **subdomain takeover**, **mail interception**, and **service hijacking** attacks.",
+  "Risk": "Dangling **DNS records** pointing to non-existent targets create multiple vulnerabilities.\n- **Confidentiality**: dangling CNAME/NS allows subdomain takeover; dangling MX allows mail interception\n- **Integrity**: attackers can impersonate your organization, intercept emails, or hijack services\n- **Availability**: legitimate services may be disrupted or redirected to attacker-controlled infrastructure",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. Identify CNAME, MX, NS, or SRV records with dangling targets\n4. Either update the record to point to a valid target or delete the record\n5. If the target service was decommissioned, remove the DNS record",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Remove or update **dangling DNS records** to prevent takeover and interception attacks.\n- Regularly audit DNS records when decommissioning services\n- Remove CNAME, MX, NS, and SRV records pointing to deprovisioned resources\n- Monitor for unauthorized changes to DNS records\n- Consider using DNS monitoring tools to detect dangling records",
+      "Url": "https://hub.prowler.com/checks/cloudflare/dns_record_cname_target_valid"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Subdomain takeover occurs when a CNAME or NS record points to a service that has been deprovisioned, allowing attackers to claim that service and control the subdomain. Similarly, dangling MX records can allow mail interception, and dangling SRV records can expose service discovery vulnerabilities."
+}

prowler/providers/cloudflare/services/dns/dns_record_cname_target_valid/dns_record_cname_target_valid.py

@@ -0,0 +1,109 @@
+import socket
+
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.dns.dns_client import dns_client
+
+# Record types that point to hostnames and can be dangling:
+# - CNAME: Alias to another hostname
+# - MX: Mail server hostname (dangling = potential mail interception)
+# - NS: Nameserver delegation (dangling = subdomain takeover)
+# - SRV: Service location hostname
+DANGLING_RISK_TYPES = {"CNAME", "MX", "NS", "SRV"}
+
+# Risk descriptions for each record type
+RISK_DESCRIPTIONS = {
+    "CNAME": "subdomain takeover risk",
+    "MX": "potential mail interception risk",
+    "NS": "subdomain delegation takeover risk",
+    "SRV": "service discovery vulnerability",
+}
+
+
+class dns_record_cname_target_valid(Check):
+    """Ensure that DNS records pointing to hostnames have valid, resolvable targets.
+
+    Dangling DNS records that point to non-existent or unresolvable targets pose
+    significant security risks. CNAME and NS records can lead to subdomain takeover,
+    MX records can allow mail interception, and SRV records can expose service
+    vulnerabilities. Attackers can claim orphaned target resources and serve
+    malicious content, intercept email, or hijack services under your domain.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the dangling DNS record validation check.
+
+        Iterates through all DNS records that point to hostnames (CNAME, MX, NS, SRV)
+        and attempts to resolve their targets using DNS lookup. Records pointing to
+        unresolvable targets are flagged as potential security risks.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if the
+            target resolves successfully, or FAIL status if the target
+            cannot be resolved (dangling record).
+        """
+        findings = []
+
+        for record in dns_client.records:
+            # Check record types that point to hostnames
+            if record.type not in DANGLING_RISK_TYPES:
+                continue
+
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=record,
+            )
+
+            target = self._extract_target(record.type, record.content)
+            is_valid = self._check_target_resolves(target)
+            risk_desc = RISK_DESCRIPTIONS.get(record.type, "security risk")
+
+            if is_valid:
+                report.status = "PASS"
+                report.status_extended = f"{record.type} record {record.name} points to valid target {target}."
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{record.type} record {record.name} points to potentially dangling "
+                    f"target {target} - {risk_desc}."
+                )
+            findings.append(report)
+
+        return findings
+
+    def _extract_target(self, record_type: str, content: str) -> str:
+        """Extract the target hostname from record content.
+
+        Different record types have different content formats:
+        - CNAME: hostname
+        - MX: priority hostname (e.g., "10 mail.example.com")
+        - NS: hostname
+        - SRV: Cloudflare returns "weight port hostname" (e.g., "5 80 sip.example.com")
+        """
+        if record_type == "MX":
+            # MX format: "priority hostname"
+            parts = content.split(None, 1)
+            return parts[1] if len(parts) > 1 else content
+        elif record_type == "SRV":
+            # SRV format from Cloudflare: "weight port hostname"
+            parts = content.split()
+            # Target is the last part (hostname)
+            return parts[-1] if parts else content
+        else:
+            # CNAME and NS are just hostnames
+            return content
+
+    def _check_target_resolves(self, target: str) -> bool:
+        """Check if target hostname resolves to a valid address."""
+        # Remove trailing dot if present
+        target = target.rstrip(".")
+
+        try:
+            # Attempt DNS resolution
+            socket.getaddrinfo(target, None, socket.AF_UNSPEC)
+            return True
+        except socket.gaierror:
+            # DNS resolution failed - potential dangling record
+            return False
+        except Exception:
+            # On any other error, assume valid to avoid false positives
+            return True

prowler/providers/cloudflare/services/dns/dns_record_no_internal_ip/dns_record_no_internal_ip.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "dns_record_no_internal_ip",
+  "CheckTitle": "DNS records do not expose internal IP addresses",
+  "CheckType": [],
+  "ServiceName": "dns",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "DNSRecord",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare DNS records** are assessed for **internal IP exposure** by checking if A or AAAA records point to private, loopback, or reserved IP addresses which could **leak internal network structure**.",
+  "Risk": "DNS records exposing **internal IP addresses** leak sensitive network information.\n- **Confidentiality**: reveals internal network topology and addressing schemes to attackers\n- **Integrity**: provides reconnaissance data for targeted attacks on internal infrastructure\n- **Availability**: internal IPs in public DNS may indicate misconfiguration affecting service routing",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. Identify A/AAAA records pointing to internal IP addresses\n4. Update records to point to public IP addresses or remove if not needed\n5. Use split-horizon DNS if internal resolution is required",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Remove **internal IP addresses** from public DNS records.\n- Use split-horizon DNS for internal service resolution\n- Ensure DNS records only contain publicly routable IP addresses\n- Review DNS records after network changes or migrations\n- Consider using Cloudflare Access for secure internal service access",
+      "Url": "https://hub.prowler.com/checks/cloudflare/dns_record_no_internal_ip"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Internal IP ranges include: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (IPv4), fc00::/7 (IPv6 ULA), and loopback addresses. These should not appear in public DNS records."
+}

prowler/providers/cloudflare/services/dns/dns_record_no_internal_ip/dns_record_no_internal_ip.py

@@ -0,0 +1,73 @@
+import ipaddress
+
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.dns.dns_client import dns_client
+
+
+class dns_record_no_internal_ip(Check):
+    """Ensure that DNS records do not expose internal or private IP addresses.
+
+    Public DNS records should only contain publicly routable IP addresses.
+    Exposing internal, private, loopback, or link-local addresses in DNS records
+    can leak information about internal network infrastructure, potentially
+    aiding attackers in reconnaissance and targeted attacks against internal
+    systems.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the internal IP address exposure check.
+
+        Iterates through all A and AAAA DNS records and checks if they contain
+        private, loopback, link-local, or reserved IP addresses that should not
+        be exposed publicly.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if the
+            record points to a public IP address, or FAIL status if it exposes
+            an internal IP address.
+        """
+        findings = []
+
+        for record in dns_client.records:
+            # Only check A and AAAA records
+            if record.type not in ("A", "AAAA"):
+                continue
+
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=record,
+            )
+
+            is_internal = self._is_internal_ip(record.content)
+
+            if not is_internal:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"DNS record {record.name} ({record.type}) points to "
+                    f"public IP address {record.content}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"DNS record {record.name} ({record.type}) exposes "
+                    f"internal IP address {record.content} - information disclosure risk."
+                )
+            findings.append(report)
+
+        return findings
+
+    def _is_internal_ip(self, ip_str: str) -> bool:
+        """Check if IP address is internal/private."""
+        try:
+            ip = ipaddress.ip_address(ip_str)
+            # Check for private, loopback, link-local, or reserved addresses
+            return (
+                ip.is_private
+                or ip.is_loopback
+                or ip.is_link_local
+                or ip.is_reserved
+                or ip.is_unspecified
+            )
+        except ValueError:
+            # Invalid IP format, assume not internal
+            return False

prowler/providers/cloudflare/services/dns/dns_record_no_wildcard/dns_record_no_wildcard.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "dns_record_no_wildcard",
+  "CheckTitle": "DNS records do not use wildcard entries",
+  "CheckType": [],
+  "ServiceName": "dns",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "DNSRecord",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare DNS records** are assessed for **wildcard usage** by checking if A, AAAA, CNAME, MX, or SRV records use wildcard entries (*.example.com) which can **increase attack surface**, expose unintended services, or allow mail interception.",
+  "Risk": "**Wildcard DNS records** can expose unintended services and increase attack surface.\n- **Confidentiality**: any subdomain resolves, potentially exposing internal naming conventions; wildcard MX allows mail interception\n- **Integrity**: attackers can access unintended services via arbitrary subdomains\n- **Availability**: wildcard records may route traffic or services not designed for public access",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. Identify wildcard DNS records (starting with *.)\n4. Evaluate if the wildcard is necessary for your use case\n5. Replace wildcard records with specific subdomain records where possible",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Avoid using **wildcard DNS records** unless absolutely necessary.\n- Use specific subdomain records instead of wildcards\n- If wildcards are required, ensure the target service handles unknown subdomains securely\n- Document the business justification for any wildcard records\n- Combine with proper web server configuration to reject unknown hosts",
+      "Url": "https://hub.prowler.com/checks/cloudflare/dns_record_no_wildcard"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Wildcard DNS records (*.example.com) cause any subdomain query to resolve. While useful for some applications, they can expose services unintentionally and make subdomain enumeration easier for attackers. Wildcard MX records can accept mail for any subdomain, and wildcard SRV records can expose services on arbitrary subdomains."
+}

prowler/providers/cloudflare/services/dns/dns_record_no_wildcard/dns_record_no_wildcard.py

@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.dns.dns_client import dns_client
+
+# Record types where wildcards pose security risks:
+# - A, AAAA: Wildcard resolves any subdomain to an IP, exposing services
+# - CNAME: Wildcard aliases any subdomain, potential for subdomain takeover
+# - MX: Wildcard accepts mail for any subdomain, potential mail interception
+# - SRV: Wildcard exposes services on any subdomain
+WILDCARD_RISK_TYPES = {"A", "AAAA", "CNAME", "MX", "SRV"}
+
+
+class dns_record_no_wildcard(Check):
+    """Ensure that wildcard DNS records are not configured for the zone.
+
+    Wildcard DNS records (*.domain.com) match any subdomain that doesn't have
+    an explicit record, which can unintentionally expose services or create
+    security risks. Attackers may discover hidden services, and wildcard
+    certificates combined with wildcard DNS can increase the attack surface
+    for subdomain takeover vulnerabilities. Wildcard MX records can allow
+    mail interception for arbitrary subdomains.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the wildcard DNS record check.
+
+        Iterates through all security-relevant DNS records (A, AAAA, CNAME, MX, SRV)
+        and identifies those configured as wildcard records (starting with *.).
+        Wildcard records may expose unintended services or create security risks.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if the
+            record is not a wildcard, or FAIL status if it is a wildcard record.
+        """
+        findings = []
+
+        for record in dns_client.records:
+            # Check record types where wildcards pose security risks
+            if record.type not in WILDCARD_RISK_TYPES:
+                continue
+
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=record,
+            )
+
+            # Check if record name starts with wildcard
+            is_wildcard = record.name.startswith("*.")
+
+            if not is_wildcard:
+                report.status = "PASS"
+                report.status_extended = f"DNS record {record.name} ({record.type}) is not a wildcard record."
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"DNS record {record.name} ({record.type}) is a wildcard record - "
+                    f"may expose unintended services."
+                )
+            findings.append(report)
+
+        return findings

prowler/providers/cloudflare/services/dns/dns_record_proxied/dns_record_proxied.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "dns_record_proxied",
+  "CheckTitle": "Cloudflare proxy is enabled for applicable DNS records",
+  "CheckType": [],
+  "ServiceName": "dns",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "DNSRecord",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare DNS records** are assessed for **proxy configuration** by checking if A, AAAA, and CNAME records are proxied through Cloudflare to benefit from **DDoS protection**, **WAF**, and **caching** capabilities.",
+  "Risk": "Unproxied **DNS records** expose origin server IP addresses directly to the internet.\n- **Confidentiality**: origin IP exposure enables targeted reconnaissance and attacks\n- **Integrity**: direct access to origin bypasses WAF and security controls\n- **Availability**: origin is exposed to DDoS attacks without Cloudflare protection",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/dns/manage-dns-records/reference/proxied-dns-records/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. For each A, AAAA, or CNAME record that should be protected\n4. Click Edit and toggle Proxy status to Proxied (orange cloud)\n5. Save the changes and verify traffic flows through Cloudflare",
+      "Terraform": "```hcl\n# Enable Cloudflare proxy for DNS records\nresource \"cloudflare_record\" \"proxied_record\" {\n  zone_id = \"<ZONE_ID>\"\n  name    = \"www\"\n  content = \"192.0.2.1\"\n  type    = \"A\"\n  proxied = true # Critical: enables DDoS protection, WAF, and caching\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable the **Cloudflare proxy** (orange cloud) for DNS records that should be protected.\n- Proxied records benefit from DDoS protection, WAF, and caching\n- Origin server IP addresses are hidden from public DNS queries\n- Apply defense in depth by combining proxy protection with origin hardening\n- Some record types (MX, TXT) cannot be proxied by design",
+      "Url": "https://hub.prowler.com/checks/cloudflare/dns_record_proxied"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Only A, AAAA, and CNAME records can be proxied. MX, TXT, and other record types are always DNS-only. Some services may require DNS-only mode for specific use cases."
+}

prowler/providers/cloudflare/services/dns/dns_record_proxied/dns_record_proxied.py

@@ -0,0 +1,49 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.dns.dns_client import dns_client
+
+PROXYABLE_TYPES = {"A", "AAAA", "CNAME"}
+
+
+class dns_record_proxied(Check):
+    """Ensure that DNS records are proxied through Cloudflare.
+
+    Proxying DNS records through Cloudflare hides the origin server's IP address
+    and provides DDoS protection, WAF capabilities, and performance optimizations.
+    Non-proxied (DNS-only) records expose the origin IP directly, bypassing
+    Cloudflare's security features and making the origin vulnerable to direct
+    attacks.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the DNS record proxy status check.
+
+        Iterates through all proxyable DNS records (A, AAAA, CNAME) and verifies
+        that they are configured to be proxied through Cloudflare. Non-proxied
+        records bypass Cloudflare's security and performance features.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if the
+            record is proxied through Cloudflare, or FAIL status if it is
+            DNS-only (not proxied).
+        """
+        findings = []
+
+        for record in dns_client.records:
+            # Only check proxyable record types
+            if record.type not in PROXYABLE_TYPES:
+                continue
+
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=record,
+            )
+
+            if record.proxied:
+                report.status = "PASS"
+                report.status_extended = f"DNS record {record.name} ({record.type}) is proxied through Cloudflare."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"DNS record {record.name} ({record.type}) is not proxied through Cloudflare."
+            findings.append(report)
+
+        return findings