prowler 5.16.0__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/cloudflare/services/zone/zone_hotlink_protection_enabled/zone_hotlink_protection_enabled.py

@@ -0,0 +1,43 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_hotlink_protection_enabled(Check):
+    """Ensure that Hotlink Protection is enabled for Cloudflare zones.
+
+    Hotlink Protection is part of Cloudflare's Scrape Shield suite that prevents
+    other websites from directly linking to images, videos, and other media files,
+    which consumes bandwidth without authorization. It blocks requests where the
+    HTTP referer does not match your domain.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the Hotlink Protection enabled check.
+
+        Iterates through all Cloudflare zones and verifies that Hotlink Protection
+        is enabled. This feature prevents bandwidth theft by blocking unauthorized
+        embedding of your media on external sites.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if Hotlink
+            Protection is enabled, or FAIL status if it is disabled for the zone.
+        """
+        findings = []
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            hotlink_protection = (zone.settings.hotlink_protection or "").lower()
+            if hotlink_protection == "on":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Hotlink Protection is enabled for zone {zone.name}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Hotlink Protection is not enabled for zone {zone.name}."
+                )
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_hsts_enabled/zone_hsts_enabled.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_hsts_enabled",
+  "CheckTitle": "HSTS is enabled with recommended max-age and includes subdomains",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **HTTP Strict Transport Security (HSTS)** by checking if it is enabled with a `max-age` of at least **6 months** (15768000 seconds) and **includes subdomains** to instruct browsers to always use HTTPS across the entire domain.",
+  "Risk": "Without **HSTS**, browsers may initially connect over HTTP before redirecting to HTTPS.\n- **Confidentiality**: creates a window for SSL stripping attacks where attackers downgrade connections to unencrypted HTTP\n- **Integrity**: first request can be intercepted and modified before HTTPS redirect\n- **Session hijacking**: cookies and credentials may be captured during initial HTTP request",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to HTTP Strict Transport Security (HSTS)\n4. Click Enable HSTS\n5. Set Max Age Header to at least 6 months\n6. Enable Include subdomains and Preload if appropriate\n7. Acknowledge the warning and click Save",
+      "Terraform": "```hcl\n# Enable HSTS with recommended settings\nresource \"cloudflare_zone_setting\" \"security_header\" {\n  zone_id    = \"<ZONE_ID>\"\n  setting_id = \"security_header\"\n  value = {\n    strict_transport_security = {\n      enabled            = true\n      max_age            = 31536000  # Critical: 1 year in seconds\n      include_subdomains = true      # Recommended: apply to all subdomains\n      preload            = true      # Recommended: submit to browser preload lists\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **HSTS** with at least a **6-month max-age** (12 months recommended).\n- Verify all resources work over HTTPS before enabling\n- Enable **include_subdomains** to protect all subdomains\n- Consider **HSTS preloading** for maximum protection against SSL stripping attacks\n- Test thoroughly as HSTS cannot be easily disabled once deployed",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_hsts_enabled"
+    }
+  },
+  "Categories": [
+    "encryption",
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "HSTS requires HTTPS to be properly configured. Ensure all resources are accessible via HTTPS before enabling HSTS with a long max-age."
+}

prowler/providers/cloudflare/services/zone/zone_hsts_enabled/zone_hsts_enabled.py

@@ -0,0 +1,58 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_hsts_enabled(Check):
+    """Ensure that HSTS is enabled with secure settings for Cloudflare zones.
+
+    HTTP Strict Transport Security (HSTS) forces browsers to only connect via
+    HTTPS, preventing protocol downgrade attacks and cookie hijacking. This check
+    verifies that HSTS is enabled with a minimum max-age of 6 months (15768000
+    seconds) and includes subdomains for complete protection.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the HSTS enabled check.
+
+        Iterates through all Cloudflare zones and validates HSTS configuration
+        against security best practices. The check verifies three conditions:
+        1. HSTS is enabled for the zone
+        2. The includeSubdomains directive is set to protect all subdomains
+        3. The max-age is at least 6 months (15768000 seconds)
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if all
+            HSTS requirements are met, or FAIL status if HSTS is disabled,
+            missing subdomain inclusion, or has insufficient max-age.
+        """
+        findings = []
+        # Recommended minimum max-age is 6 months (15768000 seconds)
+        recommended_max_age = 15768000
+
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            hsts = zone.settings.strict_transport_security
+            if hsts.enabled:
+                if not hsts.include_subdomains:
+                    report.status = "FAIL"
+                    report.status_extended = f"HSTS is enabled for zone {zone.name} but does not include subdomains."
+                elif hsts.max_age < recommended_max_age:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"HSTS is enabled for zone {zone.name} but max-age is "
+                        f"{hsts.max_age} seconds (recommended: 6 months)."
+                    )
+                else:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"HSTS is enabled for zone {zone.name} with max-age of "
+                        f"{hsts.max_age} seconds and includes subdomains."
+                    )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"HSTS is not enabled for zone {zone.name}."
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_https_redirect_enabled/zone_https_redirect_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_https_redirect_enabled",
+  "CheckTitle": "Always Use HTTPS is enabled",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **Always Use HTTPS** setting by checking if it is enabled to automatically redirect all **HTTP requests to HTTPS**, enforcing encrypted transport for all visitors.",
+  "Risk": "Without **automatic HTTPS redirects**, users may access resources over unencrypted HTTP.\n- **Confidentiality**: traffic can be intercepted and read by attackers on the network path\n- **Integrity**: HTTP responses can be modified in transit (content injection, malware insertion)\n- **Authentication**: session cookies and credentials may be transmitted in plaintext",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to Always Use HTTPS\n4. Toggle the setting to On\n5. Verify that your site works correctly over HTTPS",
+      "Terraform": "```hcl\n# Enable Always Use HTTPS to redirect HTTP to HTTPS\nresource \"cloudflare_zone_setting\" \"always_use_https\" {\n  zone_id    = \"<ZONE_ID>\"\n  setting_id = \"always_use_https\"\n  value      = \"on\" # Critical: forces all traffic to use encrypted HTTPS\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **Always Use HTTPS** to enforce encrypted connections for all visitors.\n- Combine with **HSTS** to prevent SSL stripping attacks\n- Ensure all resources (images, scripts, stylesheets) are served over HTTPS\n- Test for mixed content warnings before enabling",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_https_redirect_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/cloudflare/services/zone/zone_https_redirect_enabled/zone_https_redirect_enabled.py

@@ -0,0 +1,43 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_https_redirect_enabled(Check):
+    """Ensure that Always Use HTTPS redirect is enabled for Cloudflare zones.
+
+    The Always Use HTTPS setting automatically redirects all HTTP requests to
+    HTTPS, ensuring that all traffic to the zone is encrypted. This prevents
+    man-in-the-middle attacks and protects sensitive data transmitted between
+    clients and the origin server.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the HTTPS redirect enabled check.
+
+        Iterates through all Cloudflare zones and verifies that the
+        always_use_https setting is turned on. When enabled, Cloudflare
+        automatically redirects all HTTP requests to their HTTPS equivalents.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if
+            Always Use HTTPS is enabled ('on'), or FAIL status if the
+            setting is disabled for the zone.
+        """
+        findings = []
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            if zone.settings.always_use_https == "on":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Always Use HTTPS is enabled for zone {zone.name}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Always Use HTTPS is not enabled for zone {zone.name}."
+                )
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_ip_geolocation_enabled/zone_ip_geolocation_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_ip_geolocation_enabled",
+  "CheckTitle": "IP Geolocation is enabled",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **IP Geolocation** configuration by checking if it is enabled to add the **CF-IPCountry header** to requests, enabling geographic-based access controls, firewall rules, and analytics.",
+  "Risk": "Without **IP Geolocation**, geographic-based security controls cannot be implemented.\n- **Confidentiality**: unable to restrict access from high-risk regions\n- **Integrity**: cannot enforce geographic data residency requirements\n- **Availability**: limited visibility into traffic origins for threat analysis",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/network/ip-geolocation/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to Network\n3. Scroll to IP Geolocation\n4. Toggle the setting to On\n5. Use the CF-IPCountry header in your firewall rules or application logic",
+      "Terraform": "```hcl\n# Enable IP Geolocation for geographic-based security controls\nresource \"cloudflare_zone_settings_override\" \"ip_geolocation\" {\n  zone_id = \"<ZONE_ID>\"\n  settings {\n    ip_geolocation = \"on\" # Adds CF-IPCountry header for geo-based controls\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **IP Geolocation** to support geographic-based security policies.\n- Adds CF-IPCountry header to all requests\n- Enables geo-blocking rules in firewall configuration\n- Provides visibility into traffic origins for threat analysis\n- Essential for geographic data residency compliance",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_ip_geolocation_enabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "IP Geolocation is essential for implementing geo-blocking or country-specific security rules. The CF-IPCountry header contains ISO 3166-1 Alpha 2 country codes."
+}

prowler/providers/cloudflare/services/zone/zone_ip_geolocation_enabled/zone_ip_geolocation_enabled.py

@@ -0,0 +1,44 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_ip_geolocation_enabled(Check):
+    """Ensure that IP Geolocation is enabled for Cloudflare zones.
+
+    IP Geolocation adds the CF-IPCountry header to all requests, containing the
+    two-letter country code of the visitor's location. This enables geographic-based
+    access controls, firewall rules, content customization, and analytics based on
+    visitor location.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the IP Geolocation enabled check.
+
+        Iterates through all Cloudflare zones and verifies that IP Geolocation
+        is enabled. This feature adds geographic information to requests for
+        enhanced security controls and analytics.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if IP
+            Geolocation is enabled, or FAIL status if it is disabled for the zone.
+        """
+        findings = []
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            ip_geolocation = (zone.settings.ip_geolocation or "").lower()
+
+            if ip_geolocation == "on":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"IP Geolocation is enabled for zone {zone.name}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"IP Geolocation is not enabled for zone {zone.name}."
+                )
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_min_tls_version_secure/zone_min_tls_version_secure.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_min_tls_version_secure",
+  "CheckTitle": "Minimum TLS version is set to 1.2 or higher",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **minimum TLS version** configuration by checking if the version is set to at least `TLS 1.2` to ensure connections use **secure, modern cryptographic protocols**.",
+  "Risk": "Allowing **legacy TLS versions** (1.0, 1.1) exposes connections to known protocol vulnerabilities.\n- **Confidentiality**: BEAST, POODLE, and weak cipher suites can be exploited for traffic decryption\n- **Compliance**: TLS 1.0/1.1 are deprecated by PCI-DSS, NIST, and major browsers\n- **Integrity**: downgrade attacks can force weaker encryption that is susceptible to tampering",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/minimum-tls/",
+    "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to Minimum TLS Version\n4. Select TLS 1.2 or TLS 1.3 from the dropdown\n5. Verify that your clients support the selected TLS version",
+      "Terraform": "```hcl\n# Set minimum TLS version to 1.2 for secure connections\nresource \"cloudflare_zone_setting\" \"min_tls_version\" {\n  zone_id    = \"<ZONE_ID>\"\n  setting_id = \"min_tls_version\"\n  value      = \"1.2\" # Critical: blocks legacy TLS 1.0/1.1 connections\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Set **minimum TLS version** to `1.2` or higher.\n- **TLS 1.0 and 1.1** are deprecated by all major browsers and contain known vulnerabilities\n- Consider setting to `TLS 1.3` for environments with modern client requirements\n- Test client compatibility before upgrading minimum version",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_min_tls_version_secure"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/cloudflare/services/zone/zone_min_tls_version_secure/zone_min_tls_version_secure.py

@@ -0,0 +1,47 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_min_tls_version_secure(Check):
+    """Ensure that minimum TLS version is set to 1.2 or higher for Cloudflare zones.
+
+    TLS 1.0 and 1.1 have known vulnerabilities (BEAST, POODLE) and are deprecated.
+    Setting the minimum TLS version to 1.2 or higher ensures that only secure
+    cipher suites are used for encrypted connections, protecting against
+    downgrade attacks and known cryptographic weaknesses.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the minimum TLS version check.
+
+        Iterates through all Cloudflare zones and verifies that the minimum
+        TLS version is configured to 1.2 or higher. The check parses the
+        min_tls_version setting as a float for comparison, defaulting to 0
+        if the value cannot be parsed.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if the
+            minimum TLS version is 1.2 or higher, or FAIL status if older
+            TLS versions (1.0, 1.1) are still allowed.
+        """
+        findings = []
+
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            current_version = zone.settings.min_tls_version or "0"
+            try:
+                current = float(current_version)
+            except ValueError:
+                current = 0
+
+            if current >= 1.2:
+                report.status = "PASS"
+                report.status_extended = f"Minimum TLS version for zone {zone.name} is set to {current_version}."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Minimum TLS version for zone {zone.name} is {current_version}, below the recommended 1.2."
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_rate_limiting_enabled/zone_rate_limiting_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_rate_limiting_enabled",
+  "CheckTitle": "Rate limiting is configured for the zone",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **Rate Limiting** configuration by checking if rules are configured to protect against **DDoS attacks**, **brute force attempts**, and **API abuse**.",
+  "Risk": "Without **Rate Limiting**, applications are vulnerable to volumetric attacks.\n- **Confidentiality**: credential brute forcing can compromise user accounts\n- **Integrity**: API abuse can manipulate data through excessive requests\n- **Availability**: volumetric attacks can exhaust resources causing service degradation",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/waf/rate-limiting-rules/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to Security > WAF > Rate limiting rules\n3. Create a new rate limiting rule\n4. Configure thresholds based on expected traffic patterns\n5. Apply stricter limits to sensitive endpoints like authentication and APIs",
+      "Terraform": "```hcl\n# Configure Rate Limiting to protect against volumetric attacks\nresource \"cloudflare_ruleset\" \"rate_limit\" {\n  zone_id = \"<ZONE_ID>\"\n  name    = \"Rate limiting\"\n  kind    = \"zone\"\n  phase   = \"http_ratelimit\"\n  rules {\n    action = \"block\"\n    ratelimit {\n      characteristics     = [\"ip.src\"]\n      period              = 60\n      requests_per_period = 100\n      mitigation_timeout  = 600\n    }\n    expression  = \"true\"\n    description = \"Rate limit all requests\"\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Implement **Rate Limiting** as part of defense in depth.\n- Configure thresholds based on expected traffic patterns\n- Apply stricter limits to sensitive endpoints like authentication and APIs\n- Use different rate limits for different paths or endpoints\n- Monitor rate limiting analytics to fine-tune thresholds",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_rate_limiting_enabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Rate limiting rules are configured in the http_ratelimit phase. Consider different thresholds for different types of endpoints based on their sensitivity and expected usage patterns."
+}

prowler/providers/cloudflare/services/zone/zone_rate_limiting_enabled/zone_rate_limiting_enabled.py

@@ -0,0 +1,50 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_rate_limiting_enabled(Check):
+    """Ensure that Rate Limiting is configured for Cloudflare zones.
+
+    Rate Limiting protects against DDoS attacks, brute force attempts, and API
+    abuse by limiting the number of requests from a single source within a specified
+    time window. Rules are configured in the http_ratelimit phase and help maintain
+    service availability under high-traffic conditions.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the Rate Limiting enabled check.
+
+        Iterates through all Cloudflare zones and verifies that at least one
+        enabled rate limiting rule exists.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if rate
+            limiting rules are configured, or FAIL status if no rules exist.
+        """
+        findings = []
+
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+
+            # Get enabled rate limiting rules for this zone
+            enabled_rules = [rule for rule in zone.rate_limit_rules if rule.enabled]
+
+            if enabled_rules:
+                report.status = "PASS"
+                rules_str = ", ".join(
+                    rule.description or rule.id for rule in enabled_rules
+                )
+                report.status_extended = (
+                    f"Rate limiting is configured for zone {zone.name}: {rules_str}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"No rate limiting rules configured for zone {zone.name}."
+                )
+            findings.append(report)
+
+        return findings

prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_record_caa_exists",
+  "CheckTitle": "CAA record exists with issue or issuewild tag",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **CAA (Certificate Authority Authorization)** DNS records by checking if they exist with **`issue` or `issuewild` tags** that specify which **certificate authorities** are permitted to issue SSL/TLS certificates for the domain.",
+  "Risk": "Without **CAA** records or without `issue`/`issuewild` tags, any certificate authority can issue certificates for your domain.\n- **Confidentiality**: unauthorized certificates enable man-in-the-middle attacks\n- **Integrity**: attackers can impersonate your domain with fraudulently obtained certificates\n- **Trust**: CA compromise or social engineering can result in unauthorized certificate issuance\n- **Missing tags**: CAA records without `issue` or `issuewild` tags (e.g., only `iodef`) do not restrict certificate issuance",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/ssl/edge-certificates/caa-records/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to DNS > Records\n3. Click Add record\n4. Select CAA as the record type\n5. Enter @ for the Name field\n6. Set flags to 0, tag to issue, and value to your authorized CA (e.g., letsencrypt.org)\n7. Click Save\n8. Optionally add issuewild records to control wildcard certificate issuance",
+      "Terraform": "```hcl\n# Create CAA record to restrict certificate issuance\nresource \"cloudflare_record\" \"caa_issue\" {\n  zone_id = \"<ZONE_ID>\"\n  name    = \"@\"\n  type    = \"CAA\"\n  data {\n    flags = \"0\"\n    tag   = \"issue\"                # Restricts which CAs can issue regular certificates\n    value = \"letsencrypt.org\"      # Specify your authorized certificate authority\n  }\n}\n\n# Create CAA record to restrict wildcard certificate issuance\nresource \"cloudflare_record\" \"caa_issuewild\" {\n  zone_id = \"<ZONE_ID>\"\n  name    = \"@\"\n  type    = \"CAA\"\n  data {\n    flags = \"0\"\n    tag   = \"issuewild\"            # Restricts which CAs can issue wildcard certificates\n    value = \"letsencrypt.org\"\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Add **CAA records** with `issue` or `issuewild` tags specifying authorized certificate authorities.\n- `issue` tag: authorizes CAs for regular (non-wildcard) certificates\n- `issuewild` tag: authorizes CAs for wildcard certificates specifically\n- Use `issue \";\"` to block all certificate issuance (for domains that should never have certificates)\n- Use `iodef` tag to receive reports of policy violations (optional, for monitoring)\n- All CAs are required to check CAA records before issuing certificates",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_record_caa_exists"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "CAA records help prevent unauthorized SSL/TLS certificate issuance. This check verifies both existence and that the record contains issue or issuewild tags. Records with only iodef tag will fail this check."
+}

prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.py

@@ -0,0 +1,82 @@
+import re
+
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.dns.dns_client import dns_client
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_record_caa_exists(Check):
+    """Ensure that CAA record exists with certificate issuance restrictions.
+
+    CAA (Certificate Authority Authorization) is a DNS record type that allows
+    domain owners to specify which certificate authorities (CAs) are permitted
+    to issue SSL/TLS certificates for their domain. This check verifies that CAA
+    records exist with "issue" or "issuewild" tags that explicitly authorize
+    specific CAs, preventing unauthorized certificate issuance and reducing the
+    risk of man-in-the-middle attacks from fraudulent certificates.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the CAA record exists check.
+
+        Iterates through all Cloudflare zones and verifies CAA configuration.
+        The check validates two conditions:
+        1. CAA records exist for the zone
+        2. At least one record has an "issue" or "issuewild" tag specifying authorized CAs
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if CAA
+            records with issuance restrictions exist, or FAIL status if no CAA
+            records are found or they lack proper issue/issuewild tags.
+        """
+        findings = []
+
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+
+            # CAA records restrict which CAs can issue certificates
+            caa_records = [
+                record
+                for record in dns_client.records
+                if record.zone_id == zone.id and record.type == "CAA"
+            ]
+
+            if not caa_records:
+                report.status = "FAIL"
+                report.status_extended = f"No CAA record found for zone {zone.name}."
+            else:
+                # Check if CAA records have issue or issuewild tags with CA specified
+                issue_records = [
+                    record
+                    for record in caa_records
+                    if self._has_issue_tag_with_ca(record.content)
+                ]
+
+                records_str = ", ".join(record.name for record in caa_records)
+
+                if issue_records:
+                    report.status = "PASS"
+                    report.status_extended = f"CAA record with certificate issuance restrictions exists for zone {zone.name}: {records_str}."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"CAA record exists for zone {zone.name} but does not specify authorized CAs with issue or issuewild tags: {records_str}."
+
+            findings.append(report)
+
+        return findings
+
+    def _has_issue_tag_with_ca(self, content: str) -> bool:
+        """Check if CAA record has issue or issuewild tag with a CA specified.
+
+        CAA content format: "flags tag value" e.g., "0 issue letsencrypt.org"
+        """
+        # Strip quotes that may be present from Cloudflare API
+        content_lower = content.strip('"').lower()
+        # Match issue or issuewild tag followed by a value (CA name or ";" to block all)
+        # Format: "0 issue letsencrypt.org" or "0 issuewild ;" or "0 issue \"digicert.com\""
+        issue_match = re.search(r"\bissue\b", content_lower)
+        issuewild_match = re.search(r"\bissuewild\b", content_lower)
+        return bool(issue_match or issuewild_match)