prowler 5.16.0__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/gcp/services/compute/compute_project_os_login_2fa_enabled/compute_project_os_login_2fa_enabled.metadata.json

@@ -0,0 +1,41 @@
+{
+  "Provider": "gcp",
+  "CheckID": "compute_project_os_login_2fa_enabled",
+  "CheckTitle": "GCP project has OS Login with 2FA enabled",
+  "CheckType": [],
+  "ServiceName": "compute",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "compute.googleapis.com/Project",
+  "ResourceGroup": "governance",
+  "Description": "OS Login **Two-Factor Authentication (2FA)** requires users to verify their identity with a second factor when connecting via SSH to VM instances.\n\nThis provides an additional security layer beyond passwords or SSH keys, significantly reducing the risk of unauthorized access even if credentials are compromised.",
+  "Risk": "Without 2FA enforcement, compromised credentials (stolen SSH keys or passwords) grant immediate access to VM instances. Attackers could:\n\n- Gain unauthorized shell access to production systems\n- Exfiltrate sensitive data or deploy malware\n- Move laterally within the infrastructure\n\nThis single point of failure significantly increases the attack surface.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://cloud.google.com/compute/docs/oslogin/set-up-oslogin",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-os-login-with-2fa-authentication.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE,enable-oslogin-2fa=TRUE",
+      "NativeIaC": "",
+      "Other": "1. Navigate to **Compute Engine** > **Metadata** in Google Cloud Console\n2. Click **Edit**\n3. Add or update metadata entry with key `enable-oslogin-2fa` and value `TRUE`\n4. Ensure `enable-oslogin` is also set to `TRUE`\n5. Click **Save**",
+      "Terraform": "```hcl\nresource \"google_compute_project_metadata\" \"example_resource\" {\n  metadata = {\n    enable-oslogin     = \"TRUE\"\n    enable-oslogin-2fa = \"TRUE\"  # Enables 2FA for OS Login\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable OS Login with 2FA at the project level to enforce multi-factor authentication for all SSH connections. This adds a critical security layer by requiring users to complete a second verification step, protecting against credential theft and unauthorized access.",
+      "Url": "https://hub.prowler.com/check/compute_project_os_login_2fa_enabled"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [
+    "compute_project_os_login_enabled"
+  ],
+  "RelatedTo": [
+    "compute_project_os_login_enabled"
+  ],
+  "Notes": "OS Login 2FA requires OS Login to be enabled first. Users must have 2-Step Verification configured in their Google account. For organizations, 2FA can be enforced via Google Workspace or Cloud Identity policies."
+}

prowler/providers/gcp/services/compute/compute_project_os_login_2fa_enabled/compute_project_os_login_2fa_enabled.py

@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.compute.compute_client import compute_client
+
+
+class compute_project_os_login_2fa_enabled(Check):
+    """Ensure that OS Login with 2FA is enabled for a GCP project.
+
+    This check verifies that OS Login Two-Factor Authentication (2FA) is enabled
+    at the project level to enforce an additional layer of security for SSH access
+    to VM instances.
+
+    - PASS: Project has OS Login 2FA enabled (enable-oslogin-2fa=TRUE).
+    - FAIL: Project does not have OS Login 2FA enabled.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        findings = []
+        for project in compute_client.compute_projects:
+            report = Check_Report_GCP(
+                metadata=self.metadata(),
+                resource=compute_client.projects[project.id],
+                project_id=project.id,
+                location=compute_client.region,
+                resource_name=(
+                    compute_client.projects[project.id].name
+                    if compute_client.projects[project.id].name
+                    else "GCP Project"
+                ),
+            )
+            report.status = "PASS"
+            report.status_extended = f"Project {project.id} has OS Login 2FA enabled."
+            if not project.enable_oslogin_2fa:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Project {project.id} does not have OS Login 2FA enabled."
+                )
+            findings.append(report)
+
+        return findings

prowler/providers/gcp/services/compute/compute_project_os_login_enabled/compute_project_os_login_enabled.metadata.json

@@ -8,6 +8,7 @@
   "ResourceIdTemplate": "",
   "Severity": "low",
   "ResourceType": "GCPProject",
+  "ResourceGroup": "governance",
   "Description": "Ensure that the OS Login feature is enabled at the Google Cloud Platform (GCP) project level in order to provide you with centralized and automated SSH key pair management.",
   "Risk": "Enabling OS Login feature ensures that the SSH keys used to connect to VM instances are mapped with Google Cloud IAM users. Revoking access to corresponding IAM users will revoke all the SSH keys associated with these users, therefore it facilitates centralized SSH key pair management, which is extremely useful in handling compromised or stolen SSH key pairs and/or revocation of external/third-party/vendor users.",
   "RelatedUrl": "",

prowler/providers/gcp/services/compute/compute_public_address_shodan/compute_public_address_shodan.metadata.json

@@ -10,6 +10,7 @@
   "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "GCPComputeAddress",
+  "ResourceGroup": "network",
   "Description": "Check if any of the Public Addresses are in Shodan (requires Shodan API KEY).",
   "Risk": "Sites like Shodan index exposed systems and further expose them to wider audiences as a quick way to find exploitable systems.",
   "RelatedUrl": "",

prowler/providers/gcp/services/compute/compute_service.py

@@ -1,3 +1,6 @@
+from datetime import datetime
+from typing import Optional
+
 from pydantic.v1 import BaseModel
 
 from prowler.lib.logger import logger
@@ -18,6 +21,9 @@ class Compute(GCPService):
         self.firewalls = []
         self.compute_projects = []
         self.load_balancers = []
+        self.instance_groups = []
+        self.images = []
+        self.snapshots = []
         self._get_regions()
         self._get_projects()
         self._get_url_maps()
@@ -28,6 +34,11 @@ class Compute(GCPService):
         self.__threading_call__(self._get_subnetworks, self.regions)
         self._get_firewalls()
         self.__threading_call__(self._get_addresses, self.regions)
+        self.__threading_call__(self._get_regional_instance_groups, self.regions)
+        self.__threading_call__(self._get_zonal_instance_groups, self.zones)
+        self._associate_migs_with_load_balancers()
+        self._get_images()
+        self._get_snapshots()
 
     def _get_regions(self):
         for project_id in self.project_ids:
@@ -69,6 +80,7 @@ class Compute(GCPService):
         for project_id in self.project_ids:
             try:
                 enable_oslogin = False
+                enable_oslogin_2fa = False
                 response = (
                     self.client.projects()
                     .get(project=project_id)
@@ -77,8 +89,14 @@ class Compute(GCPService):
                 for item in response["commonInstanceMetadata"].get("items", []):
                     if item["key"] == "enable-oslogin" and item["value"] == "TRUE":
                         enable_oslogin = True
+                    if item["key"] == "enable-oslogin-2fa" and item["value"] == "TRUE":
+                        enable_oslogin_2fa = True
                 self.compute_projects.append(
-                    Project(id=project_id, enable_oslogin=enable_oslogin)
+                    Project(
+                        id=project_id,
+                        enable_oslogin=enable_oslogin,
+                        enable_oslogin_2fa=enable_oslogin_2fa,
+                    )
                 )
             except Exception as error:
                 logger.error(
@@ -97,10 +115,30 @@ class Compute(GCPService):
 
                     for instance in response.get("items", []):
                         public_ip = False
-                        for interface in instance.get("networkInterfaces", []):
+                        network_interfaces_raw = instance.get("networkInterfaces", [])
+
+                        network_interfaces = []
+                        for interface in network_interfaces_raw:
                             for config in interface.get("accessConfigs", []):
                                 if "natIP" in config:
                                     public_ip = True
+
+                            network_interfaces.append(
+                                NetworkInterface(
+                                    name=interface.get("name", ""),
+                                    network=(
+                                        interface.get("network", "").split("/")[-1]
+                                        if interface.get("network")
+                                        else ""
+                                    ),
+                                    subnetwork=(
+                                        interface.get("subnetwork", "").split("/")[-1]
+                                        if interface.get("subnetwork")
+                                        else ""
+                                    ),
+                                )
+                            )
+
                         self.instances.append(
                             Instance(
                                 name=instance["name"],
@@ -133,6 +171,19 @@ class Compute(GCPService):
                                     )
                                     for disk in instance.get("disks", [])
                                 ],
+                                disks=[
+                                    Disk(
+                                        name=disk["deviceName"],
+                                        auto_delete=disk.get("autoDelete", False),
+                                        boot=disk.get("boot", False),
+                                        encryption=bool(
+                                            disk.get("diskEncryptionKey", {}).get(
+                                                "sha256"
+                                            )
+                                        ),
+                                    )
+                                    for disk in instance.get("disks", [])
+                                ],
                                 automatic_restart=instance.get("scheduling", {}).get(
                                     "automaticRestart", False
                                 ),
@@ -146,6 +197,10 @@ class Compute(GCPService):
                                 deletion_protection=instance.get(
                                     "deletionProtection", False
                                 ),
+                                network_interfaces=network_interfaces,
+                                on_host_maintenance=instance.get("scheduling", {}).get(
+                                    "onHostMaintenance", "MIGRATE"
+                                ),
                             )
                         )
 
@@ -362,6 +417,268 @@ class Compute(GCPService):
                         f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                     )
 
+    def _get_regional_instance_groups(self, region: str) -> None:
+        for project_id in self.project_ids:
+            try:
+                request = self.client.regionInstanceGroupManagers().list(
+                    project=project_id, region=region
+                )
+                while request is not None:
+                    response = request.execute(
+                        http=self.__get_AuthorizedHttp_client__(),
+                        num_retries=DEFAULT_RETRY_ATTEMPTS,
+                    )
+
+                    for mig in response.get("items", []):
+                        zones = [
+                            zone_info["zone"].split("/")[-1]
+                            for zone_info in mig.get("distributionPolicy", {}).get(
+                                "zones", []
+                            )
+                            if zone_info.get("zone")
+                        ]
+
+                        auto_healing_policies = [
+                            AutoHealingPolicy(
+                                health_check=(
+                                    policy.get("healthCheck", "").split("/")[-1]
+                                    if policy.get("healthCheck")
+                                    else None
+                                ),
+                                initial_delay_sec=policy.get("initialDelaySec"),
+                            )
+                            for policy in mig.get("autoHealingPolicies", [])
+                        ]
+
+                        self.instance_groups.append(
+                            ManagedInstanceGroup(
+                                name=mig.get("name", ""),
+                                id=mig.get("id", ""),
+                                region=region,
+                                zone=None,
+                                zones=zones,
+                                is_regional=True,
+                                target_size=mig.get("targetSize", 0),
+                                project_id=project_id,
+                                auto_healing_policies=auto_healing_policies,
+                            )
+                        )
+
+                    request = self.client.regionInstanceGroupManagers().list_next(
+                        previous_request=request, previous_response=response
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_zonal_instance_groups(self, zone: str) -> None:
+        for project_id in self.project_ids:
+            try:
+                request = self.client.instanceGroupManagers().list(
+                    project=project_id, zone=zone
+                )
+                while request is not None:
+                    response = request.execute(
+                        http=self.__get_AuthorizedHttp_client__(),
+                        num_retries=DEFAULT_RETRY_ATTEMPTS,
+                    )
+
+                    for mig in response.get("items", []):
+                        mig_zone = mig.get("zone", zone).split("/")[-1]
+                        mig_region = mig_zone.rsplit("-", 1)[0]
+
+                        auto_healing_policies = [
+                            AutoHealingPolicy(
+                                health_check=(
+                                    policy.get("healthCheck", "").split("/")[-1]
+                                    if policy.get("healthCheck")
+                                    else None
+                                ),
+                                initial_delay_sec=policy.get("initialDelaySec"),
+                            )
+                            for policy in mig.get("autoHealingPolicies", [])
+                        ]
+
+                        self.instance_groups.append(
+                            ManagedInstanceGroup(
+                                name=mig.get("name", ""),
+                                id=mig.get("id", ""),
+                                region=mig_region,
+                                zone=mig_zone,
+                                zones=[mig_zone],
+                                is_regional=False,
+                                target_size=mig.get("targetSize", 0),
+                                project_id=project_id,
+                                auto_healing_policies=auto_healing_policies,
+                            )
+                        )
+
+                    request = self.client.instanceGroupManagers().list_next(
+                        previous_request=request, previous_response=response
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{zone} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _associate_migs_with_load_balancers(self) -> None:
+        load_balanced_groups = set()
+
+        for project_id in self.project_ids:
+            try:
+                request = self.client.backendServices().list(project=project_id)
+                while request is not None:
+                    response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                    for backend_service in response.get("items", []):
+                        for backend in backend_service.get("backends", []):
+                            group_url = backend.get("group", "")
+                            if group_url:
+                                group_name = group_url.split("/")[-1]
+                                load_balanced_groups.add((project_id, group_name))
+                    request = self.client.backendServices().list_next(
+                        previous_request=request, previous_response=response
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+            for region in self.regions:
+                try:
+                    request = self.client.regionBackendServices().list(
+                        project=project_id, region=region
+                    )
+                    while request is not None:
+                        response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                        for backend_service in response.get("items", []):
+                            for backend in backend_service.get("backends", []):
+                                group_url = backend.get("group", "")
+                                if group_url:
+                                    group_name = group_url.split("/")[-1]
+                                    load_balanced_groups.add((project_id, group_name))
+                        request = self.client.regionBackendServices().list_next(
+                            previous_request=request, previous_response=response
+                        )
+                except Exception as error:
+                    logger.error(
+                        f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+
+        for mig in self.instance_groups:
+            if (mig.project_id, mig.name) in load_balanced_groups:
+                mig.load_balanced = True
+
+    def _get_images(self) -> None:
+        for project_id in self.project_ids:
+            try:
+                request = self.client.images().list(project=project_id)
+                while request is not None:
+                    response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                    for image in response.get("items", []):
+                        publicly_shared = False
+                        try:
+                            iam_policy = (
+                                self.client.images()
+                                .getIamPolicy(
+                                    project=project_id, resource=image["name"]
+                                )
+                                .execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                            )
+                            for binding in iam_policy.get("bindings", []):
+                                # allUsers cannot be assigned to Compute Engine images (API restriction).
+                                # Only allAuthenticatedUsers can be set, which is the security risk.
+                                if "allAuthenticatedUsers" in binding.get(
+                                    "members", []
+                                ):
+                                    publicly_shared = True
+                                    break
+                        except Exception as error:
+                            logger.error(
+                                f"{project_id}/{image['name']} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                            )
+
+                        self.images.append(
+                            Image(
+                                name=image["name"],
+                                id=image["id"],
+                                project_id=project_id,
+                                publicly_shared=publicly_shared,
+                            )
+                        )
+
+                    request = self.client.images().list_next(
+                        previous_request=request, previous_response=response
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{project_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_snapshots(self) -> None:
+        for project_id in self.project_ids:
+            try:
+                request = self.client.snapshots().list(project=project_id)
+                while request is not None:
+                    response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                    for snapshot in response.get("items", []):
+                        # Parse creation timestamp to datetime
+                        creation_timestamp_str = snapshot.get("creationTimestamp", "")
+                        creation_timestamp = None
+                        if creation_timestamp_str:
+                            try:
+                                # GCP timestamps are in RFC 3339 format
+                                creation_timestamp = datetime.fromisoformat(
+                                    creation_timestamp_str.replace("Z", "+00:00")
+                                )
+                            except ValueError:
+                                logger.error(
+                                    f"Could not parse timestamp {creation_timestamp_str} for snapshot {snapshot['name']}"
+                                )
+
+                        # Extract source disk name from the full URL
+                        source_disk_url = snapshot.get("sourceDisk", "")
+                        source_disk = (
+                            source_disk_url.split("/")[-1] if source_disk_url else ""
+                        )
+
+                        self.snapshots.append(
+                            Snapshot(
+                                name=snapshot["name"],
+                                id=snapshot["id"],
+                                project_id=project_id,
+                                creation_timestamp=creation_timestamp,
+                                source_disk=source_disk,
+                                source_disk_id=snapshot.get("sourceDiskId"),
+                                disk_size_gb=int(snapshot.get("diskSizeGb", 0)),
+                                storage_bytes=int(snapshot.get("storageBytes", 0)),
+                                storage_locations=snapshot.get("storageLocations", []),
+                                status=snapshot.get("status", ""),
+                                auto_created=snapshot.get("autoCreated", False),
+                            )
+                        )
+
+                    request = self.client.snapshots().list_next(
+                        previous_request=request, previous_response=response
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{project_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+
+class NetworkInterface(BaseModel):
+    name: str
+    network: str = ""
+    subnetwork: str = ""
+
+
+class Disk(BaseModel):
+    name: str
+    auto_delete: bool = False
+    boot: bool
+    encryption: bool = False
+
 
 class Instance(BaseModel):
     name: str
@@ -377,10 +694,13 @@ class Instance(BaseModel):
     service_accounts: list
     ip_forward: bool
     disks_encryption: list
+    disks: list[Disk] = []
     automatic_restart: bool = False
     preemptible: bool = False
     provisioning_model: str = "STANDARD"
     deletion_protection: bool = False
+    network_interfaces: list[NetworkInterface] = []
+    on_host_maintenance: str = "MIGRATE"
 
 
 class Network(BaseModel):
@@ -420,6 +740,7 @@ class Firewall(BaseModel):
 class Project(BaseModel):
     id: str
     enable_oslogin: bool
+    enable_oslogin_2fa: bool = False
 
 
 class LoadBalancer(BaseModel):
@@ -428,3 +749,42 @@ class LoadBalancer(BaseModel):
     service: str
     logging: bool = False
     project_id: str
+
+
+class AutoHealingPolicy(BaseModel):
+    health_check: Optional[str] = None
+    initial_delay_sec: Optional[int] = None
+
+
+class ManagedInstanceGroup(BaseModel):
+    name: str
+    id: str
+    region: str
+    zone: Optional[str]
+    zones: list
+    is_regional: bool
+    target_size: int
+    project_id: str
+    auto_healing_policies: list[AutoHealingPolicy] = []
+    load_balanced: bool = False
+
+
+class Image(BaseModel):
+    name: str
+    id: str
+    project_id: str
+    publicly_shared: bool = False
+
+
+class Snapshot(BaseModel):
+    name: str
+    id: str
+    project_id: str
+    creation_timestamp: Optional[datetime] = None
+    source_disk: str = ""
+    source_disk_id: Optional[str] = None
+    disk_size_gb: int = 0
+    storage_bytes: int = 0
+    storage_locations: list[str] = []
+    status: str = ""
+    auto_created: bool = False

prowler/providers/gcp/services/compute/compute_snapshot_not_outdated/compute_snapshot_not_outdated.metadata.json

@@ -0,0 +1,38 @@
+{
+  "Provider": "gcp",
+  "CheckID": "compute_snapshot_not_outdated",
+  "CheckTitle": "Compute Engine disk snapshot is not outdated",
+  "CheckType": [],
+  "ServiceName": "compute",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "compute.googleapis.com/Snapshot",
+  "ResourceGroup": "storage",
+  "Description": "Compute Engine **disk snapshots** are evaluated against a configurable age threshold (default `90` days) to identify snapshots exceeding the organization's retention policy.",
+  "Risk": "Outdated snapshots containing **sensitive data** expand the **attack surface** and risk data exposure if compromised.\n\nStale snapshots may violate compliance requirements, complicate disaster recovery efforts, and introduce configuration drift that affects system **integrity**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/remove-old-disk-snapshots.html",
+    "https://cloud.google.com/compute/docs/disks/create-snapshots",
+    "https://cloud.google.com/compute/docs/disks/snapshot-best-practices"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud compute snapshots delete SNAPSHOT_NAME --project=PROJECT_ID",
+      "NativeIaC": "",
+      "Other": "1. Open Google Cloud Console and navigate to Compute Engine > Snapshots\n2. Identify snapshots older than your retention policy\n3. Select outdated snapshots and click **Delete**\n4. Confirm the deletion\n\nTo automate cleanup, create a snapshot schedule with auto-delete policies under Compute Engine > Snapshots > Snapshot schedules.",
+      "Terraform": "```hcl\nresource \"google_compute_resource_policy\" \"snapshot_schedule\" {\n  name   = \"snapshot-schedule-with-retention\"\n  region = var.region\n\n  snapshot_schedule_policy {\n    schedule {\n      daily_schedule {\n        days_in_cycle = 1\n        start_time    = \"04:00\"\n      }\n    }\n\n    # Automatically delete snapshots older than 90 days\n    retention_policy {\n      max_retention_days    = 90\n      on_source_disk_delete = \"KEEP_AUTO_SNAPSHOTS\"\n    }\n  }\n}\n\nresource \"google_compute_disk_resource_policy_attachment\" \"attachment\" {\n  name = google_compute_resource_policy.snapshot_schedule.name\n  disk = google_compute_disk.example.name\n  zone = var.zone\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Implement a snapshot lifecycle policy to automatically delete snapshots older than your organization's retention requirements. Regularly review and clean up outdated snapshots to reduce storage costs and minimize data exposure risks. Consider using scheduled snapshots with automatic deletion policies.",
+      "Url": "https://hub.prowler.com/check/compute_snapshot_not_outdated"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "The age threshold is configurable via the `max_snapshot_age_days` parameter in the configuration file (default: 90 days). Snapshots without a creation timestamp will be flagged for manual review."
+}

prowler/providers/gcp/services/compute/compute_snapshot_not_outdated/compute_snapshot_not_outdated.py

@@ -0,0 +1,60 @@
+from datetime import datetime, timezone
+
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.compute.compute_client import compute_client
+
+
+class compute_snapshot_not_outdated(Check):
+    """Check that Compute Engine disk snapshots are not outdated.
+
+    This check ensures Compute Engine disk snapshots are within the configured
+    age threshold (default 90 days) to help control storage costs and limit
+    exposure from stale data.
+
+    - PASS: Snapshot is not outdated (within the acceptable age threshold).
+    - FAIL: Snapshot is outdated (exceeds the configured age threshold).
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        findings = []
+
+        max_snapshot_age_days = compute_client.audit_config.get(
+            "max_snapshot_age_days", 90
+        )
+
+        current_time = datetime.now(timezone.utc)
+
+        for snapshot in compute_client.snapshots:
+            report = Check_Report_GCP(
+                metadata=self.metadata(),
+                resource=snapshot,
+                location="global",
+            )
+
+            if snapshot.creation_timestamp is None:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Disk snapshot {snapshot.name} timestamp could not be retrieved "
+                    "and cannot be evaluated for age."
+                )
+                findings.append(report)
+                continue
+
+            snapshot_age = (current_time - snapshot.creation_timestamp).days
+
+            if snapshot_age > max_snapshot_age_days:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Disk snapshot {snapshot.name} is {snapshot_age} days old, "
+                    f"exceeding the {max_snapshot_age_days} day threshold."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Disk snapshot {snapshot.name} is {snapshot_age} days old, "
+                    f"within the {max_snapshot_age_days} day threshold."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/gcp/services/compute/compute_subnet_flow_logs_enabled/compute_subnet_flow_logs_enabled.metadata.json

@@ -8,6 +8,7 @@
   "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "Subnet",
+  "ResourceGroup": "network",
   "Description": "Ensure that VPC Flow Logs is enabled for every subnet created within your production Virtual Private Cloud (VPC) network. Flow Logs is a logging feature that enables users to capture information about the IP traffic (accepted, rejected, or all traffic) going to and from the network interfaces (ENIs) available within your VPC subnets.",
   "Risk": "By default, the VPC Flow Logs feature is disabled when a new VPC network subnet is created. Once enabled, VPC Flow Logs will start collecting network traffic data to and from your Virtual Private Cloud (VPC) subnets, logging data that can be useful for understanding network usage, network traffic expense optimization, network forensics, and real-time security analysis. To enhance Google Cloud VPC network visibility and security it is strongly recommended to enable Flow Logs for every business-critical or production VPC subnet.",
   "RelatedUrl": "",

prowler/providers/gcp/services/dataproc/dataproc_encrypted_with_cmks_disabled/dataproc_encrypted_with_cmks_disabled.metadata.json

@@ -8,6 +8,7 @@
   "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "Cluster",
+  "ResourceGroup": "container",
   "Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).",
   "Risk": "The Dataproc cluster data is encrypted using a Google-generated Data Encryption Key (DEK) and a Key Encryption Key (KEK). If you need to control and manage your cluster data encryption yourself, you can use your own Customer-Managed Keys (CMKs). Cloud KMS Customer-Managed Keys can be implemented as an additional security layer on top of existing data encryption, and are often used in the enterprise world, where compliance and security controls are very strict.",
   "RelatedUrl": "",