ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(key_errors): handle Key Errors in Lambda and EMR (#1871)

Browse Source 
Co-authored-by: sergargar <sergargar@users.noreply.github.com>
This commit is contained in:
Sergio Garcia
2023-02-09 10:32:00 +01:00
committed by GitHub
parent 86e27b465a
commit 004b9c95e4
3 changed files with 36 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
prowler/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code.py
View File

@@ -12,31 +12,30 @@ class awslambda_function_no_secrets_in_code(Check):
def execute(self): def execute(self):
findings = [] findings = []
for function in awslambda_client.functions.values(): for function in awslambda_client.functions.values():
report = Check_Report_AWS(self.metadata()) if function.code:
report.region = function.region report = Check_Report_AWS(self.metadata())
report.resource_id = function.name report.region = function.region
report.resource_arn = function.arn report.resource_id = function.name
report.resource_arn = function.arn
report.status = "PASS" report.status = "PASS"
report.status_extended = ( report.status_extended = (
f"No secrets found in Lambda function {function.name} code" f"No secrets found in Lambda function {function.name} code"
) )
with tempfile.TemporaryDirectory() as tmp_dir_name:
function.code.code_zip.extractall(tmp_dir_name)
# List all files
files_in_zip = next(os.walk(tmp_dir_name))[2]
for file in files_in_zip:
secrets = SecretsCollection()
with default_settings():
secrets.scan_file(f"{tmp_dir_name}/{file}")
with tempfile.TemporaryDirectory() as tmp_dir_name: if secrets.json():
function.code.code_zip.extractall(tmp_dir_name) report.status = "FAIL"
# List all files report.status_extended = f"Potential secret found in Lambda function {function.name} code"
files_in_zip = next(os.walk(tmp_dir_name))[2] break
for file in files_in_zip:
secrets = SecretsCollection() findings.append(report)
with default_settings():
secrets.scan_file(f"{tmp_dir_name}/{file}")
if secrets.json():
report.status = "FAIL"
report.status_extended = f"Potential secret found in Lambda function {function.name} code"
break
findings.append(report)
return findings return findings

13
prowler/providers/aws/services/awslambda/awslambda_service.py
View File

@@ -87,12 +87,13 @@ class Lambda:
function_information = regional_client.get_function( function_information = regional_client.get_function(
FunctionName=function.name FunctionName=function.name
) )
code_location_uri = function_information["Code"]["Location"] if "Location" in function_information["Code"]:
raw_code_zip = requests.get(code_location_uri).content code_location_uri = function_information["Code"]["Location"]
self.functions[function.name].code = LambdaCode( raw_code_zip = requests.get(code_location_uri).content
location=code_location_uri, self.functions[function.name].code = LambdaCode(
code_zip=zipfile.ZipFile(io.BytesIO(raw_code_zip)), location=code_location_uri,
) code_zip=zipfile.ZipFile(io.BytesIO(raw_code_zip)),
)
except Exception as error: except Exception as error:
logger.error( logger.error(

10
prowler/providers/aws/services/emr/emr_service.py
View File

@@ -97,9 +97,13 @@ class EMR:
slave_node_security_group = cluster_info["Cluster"][ slave_node_security_group = cluster_info["Cluster"][
"Ec2InstanceAttributes" "Ec2InstanceAttributes"
]["EmrManagedSlaveSecurityGroup"] ]["EmrManagedSlaveSecurityGroup"]
slave_node_additional_security_groups = cluster_info["Cluster"][ if (
"Ec2InstanceAttributes" "AdditionalSlaveSecurityGroups"
]["AdditionalSlaveSecurityGroups"] in cluster_info["Cluster"]["Ec2InstanceAttributes"]
):
slave_node_additional_security_groups = cluster_info["Cluster"][
"Ec2InstanceAttributes"
]["AdditionalSlaveSecurityGroups"]
self.clusters[cluster.id].slave = Node( self.clusters[cluster.id].slave = Node(
security_group_id=slave_node_security_group, security_group_id=slave_node_security_group,
additional_security_groups_id=slave_node_additional_security_groups, additional_security_groups_id=slave_node_additional_security_groups,