From 170241649d7614387598d29aa216137bd0878268 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Thu, 19 Oct 2023 17:05:04 +0200 Subject: [PATCH] fix(ec2_securitygroup_not_used): Mock Lambda service (#2947) --- tests/providers/aws/audit_info_utils.py | 45 ++++++ ...rations_cloudtrail_logging_enabled_test.py | 143 +++++++----------- ...lambda_function_no_secrets_in_code_test.py | 37 +++-- ...a_function_no_secrets_in_variables_test.py | 50 +++--- ...a_function_not_publicly_accessible_test.py | 50 +++--- ...awslambda_function_url_cors_policy_test.py | 50 +++--- .../awslambda_function_url_public_test.py | 37 +++-- ..._function_using_supported_runtimes_test.py | 48 +++--- .../ec2_securitygroup_not_used_test.py | 107 +++++++------ 9 files changed, 310 insertions(+), 257 deletions(-) create mode 100644 tests/providers/aws/audit_info_utils.py diff --git a/tests/providers/aws/audit_info_utils.py b/tests/providers/aws/audit_info_utils.py new file mode 100644 index 00000000..114dbf57 --- /dev/null +++ b/tests/providers/aws/audit_info_utils.py @@ -0,0 +1,45 @@ +from boto3 import session + +from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info +from prowler.providers.common.models import Audit_Metadata + +AWS_REGION_US_EAST_1 = "us-east-1" +AWS_PARTITION = "aws" +AWS_ACCOUNT_NUMBER = "123456789012" +AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root" + + +# Mocked AWS Audit Info +def set_mocked_aws_audit_info( + audited_regions: [str] = [], + audited_account: str = AWS_ACCOUNT_NUMBER, + audited_account_arn: str = AWS_ACCOUNT_ARN, +): + audit_info = AWS_Audit_Info( + session_config=None, + original_session=None, + audit_session=session.Session( + profile_name=None, + botocore_session=None, + ), + audited_account=audited_account, + audited_account_arn=audited_account_arn, + audited_user_id=None, + audited_partition=AWS_PARTITION, + audited_identity_arn=None, + profile=None, + profile_region=None, + credentials=None, + assumed_role_info=None, + audited_regions=audited_regions, + organizations_metadata=None, + audit_resources=None, + mfa_enabled=False, + audit_metadata=Audit_Metadata( + services_scanned=0, + expected_checks=[], + completed_checks=0, + audit_progress=0, + ), + ) + return audit_info diff --git a/tests/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled_test.py b/tests/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled_test.py index 376aa5a5..32c67830 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled_test.py @@ -1,22 +1,24 @@ from unittest import mock -from boto3 import client, session +from boto3 import client from mock import patch from moto import mock_cloudtrail, mock_s3 from moto.core import DEFAULT_ACCOUNT_ID -from prowler.providers.aws.lib.audit_info.audit_info import AWS_Audit_Info from prowler.providers.aws.services.awslambda.awslambda_service import Function -from prowler.providers.common.models import Audit_Metadata - -AWS_REGION = "us-east-1" +from tests.providers.aws.audit_info_utils import ( + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) # Mock generate_regional_clients() def mock_generate_regional_clients(service, audit_info, _): - regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION) - regional_client.region = AWS_REGION - return {AWS_REGION: regional_client} + regional_client = audit_info.audit_session.client( + service, region_name=AWS_REGION_US_EAST_1 + ) + regional_client.region = AWS_REGION_US_EAST_1 + return {AWS_REGION_US_EAST_1: regional_client} # Patch every AWS call using Boto3 and generate_regional_clients to have 1 client @@ -25,37 +27,6 @@ def mock_generate_regional_clients(service, audit_info, _): new=mock_generate_regional_clients, ) class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: - # Mocked Audit Info - def set_mocked_audit_info(self): - audit_info = AWS_Audit_Info( - session_config=None, - original_session=None, - audit_session=session.Session( - profile_name=None, - botocore_session=None, - ), - audited_account=None, - audited_account_arn=None, - audited_user_id=None, - audited_partition="aws", - audited_identity_arn=None, - profile=None, - profile_region=None, - credentials=None, - assumed_role_info=None, - audited_regions=None, - organizations_metadata=None, - audit_resources=None, - mfa_enabled=False, - audit_metadata=Audit_Metadata( - services_scanned=0, - expected_checks=[], - completed_checks=0, - audit_progress=0, - ), - ) - return audit_info - @mock_cloudtrail def test_no_functions(self): lambda_client = mock.MagicMock @@ -66,14 +37,14 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: ) with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_client", new=lambda_client, - ), mock.patch( - "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", - self.set_mocked_audit_info(), ), mock.patch( "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client", - new=Cloudtrail(self.set_mocked_audit_info()), + new=Cloudtrail(set_mocked_aws_audit_info()), ): # Test Check from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import ( @@ -94,22 +65,20 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "python3.9" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { function_name: Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, ) } # CloudTrail Client - cloudtrail_client = client("cloudtrail", region_name=AWS_REGION) - s3_client = client("s3", region_name=AWS_REGION) + cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1) + s3_client = client("s3", region_name=AWS_REGION_US_EAST_1) trail_name = "test-trail" bucket_name = "test-bucket" s3_client.create_bucket(Bucket=bucket_name) @@ -122,14 +91,14 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: ) with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_client", new=lambda_client, - ), mock.patch( - "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", - self.set_mocked_audit_info(), ), mock.patch( "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client", - new=Cloudtrail(self.set_mocked_audit_info()), + new=Cloudtrail(set_mocked_aws_audit_info()), ): # Test Check from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import ( @@ -142,7 +111,7 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" @@ -159,22 +128,20 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "python3.9" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { function_name: Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, ) } # CloudTrail Client - cloudtrail_client = client("cloudtrail", region_name=AWS_REGION) - s3_client = client("s3", region_name=AWS_REGION) + cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1) + s3_client = client("s3", region_name=AWS_REGION_US_EAST_1) trail_name = "test-trail" bucket_name = "test-bucket" s3_client.create_bucket(Bucket=bucket_name) @@ -199,14 +166,14 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: ) with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_client", new=lambda_client, - ), mock.patch( - "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", - self.set_mocked_audit_info(), ), mock.patch( "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client", - new=Cloudtrail(self.set_mocked_audit_info()), + new=Cloudtrail(set_mocked_aws_audit_info()), ): # Test Check from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import ( @@ -219,7 +186,7 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" @@ -236,22 +203,20 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "python3.9" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { function_name: Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, ) } # CloudTrail Client - cloudtrail_client = client("cloudtrail", region_name=AWS_REGION) - s3_client = client("s3", region_name=AWS_REGION) + cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1) + s3_client = client("s3", region_name=AWS_REGION_US_EAST_1) trail_name = "test-trail" bucket_name = "test-bucket" s3_client.create_bucket(Bucket=bucket_name) @@ -279,14 +244,14 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: ) with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_client", new=lambda_client, - ), mock.patch( - "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", - self.set_mocked_audit_info(), ), mock.patch( "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client", - new=Cloudtrail(self.set_mocked_audit_info()), + new=Cloudtrail(set_mocked_aws_audit_info()), ): # Test Check from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import ( @@ -299,7 +264,7 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" @@ -322,14 +287,14 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, ) } # CloudTrail Client - cloudtrail_client = client("cloudtrail", region_name=AWS_REGION) - s3_client = client("s3", region_name=AWS_REGION) + cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1) + s3_client = client("s3", region_name=AWS_REGION_US_EAST_1) trail_name = "test-trail" bucket_name = "test-bucket" s3_client.create_bucket(Bucket=bucket_name) @@ -354,14 +319,14 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: ) with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_client", new=lambda_client, - ), mock.patch( - "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", - self.set_mocked_audit_info(), ), mock.patch( "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client", - new=Cloudtrail(self.set_mocked_audit_info()), + new=Cloudtrail(set_mocked_aws_audit_info()), ): # Test Check from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import ( @@ -374,7 +339,7 @@ class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" diff --git a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py index f24c0ce5..89277d1b 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py @@ -8,8 +8,10 @@ from prowler.providers.aws.services.awslambda.awslambda_service import ( Function, LambdaCode, ) - -AWS_REGION = "us-east-1" +from tests.providers.aws.audit_info_utils import ( + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) class Test_awslambda_function_no_secrets_in_code: @@ -18,7 +20,10 @@ class Test_awslambda_function_no_secrets_in_code: lambda_client.functions = {} with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client", new=lambda_client, ): # Test Check @@ -35,9 +40,7 @@ class Test_awslambda_function_no_secrets_in_code: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" code_with_secrets = """ def lambda_handler(event, context): db_password = "test-password" @@ -49,7 +52,7 @@ class Test_awslambda_function_no_secrets_in_code: name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, code=LambdaCode( location="", @@ -59,7 +62,10 @@ class Test_awslambda_function_no_secrets_in_code: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client", new=lambda_client, ): # Test Check @@ -71,7 +77,7 @@ class Test_awslambda_function_no_secrets_in_code: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" @@ -85,9 +91,7 @@ class Test_awslambda_function_no_secrets_in_code: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" code_with_secrets = """ def lambda_handler(event, context): print("custom log event") @@ -98,7 +102,7 @@ class Test_awslambda_function_no_secrets_in_code: name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, code=LambdaCode( location="", @@ -108,7 +112,10 @@ class Test_awslambda_function_no_secrets_in_code: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client", new=lambda_client, ): # Test Check @@ -120,7 +127,7 @@ class Test_awslambda_function_no_secrets_in_code: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" diff --git a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py index 3f3207cc..ef9100c4 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py @@ -3,8 +3,10 @@ from unittest import mock from moto.core import DEFAULT_ACCOUNT_ID from prowler.providers.aws.services.awslambda.awslambda_service import Function - -AWS_REGION = "us-east-1" +from tests.providers.aws.audit_info_utils import ( + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) class Test_awslambda_function_no_secrets_in_variables: @@ -13,7 +15,10 @@ class Test_awslambda_function_no_secrets_in_variables: lambda_client.functions = {} with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.awslambda_client", new=lambda_client, ): # Test Check @@ -30,22 +35,23 @@ class Test_awslambda_function_no_secrets_in_variables: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, ) } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.awslambda_client", new=lambda_client, ): # Test Check @@ -57,7 +63,7 @@ class Test_awslambda_function_no_secrets_in_variables: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" @@ -71,23 +77,24 @@ class Test_awslambda_function_no_secrets_in_variables: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, environment={"db_password": "test-password"}, ) } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.awslambda_client", new=lambda_client, ): # Test Check @@ -99,7 +106,7 @@ class Test_awslambda_function_no_secrets_in_variables: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" @@ -113,23 +120,24 @@ class Test_awslambda_function_no_secrets_in_variables: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, environment={"db_username": "test-user"}, ) } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables.awslambda_client", new=lambda_client, ): # Test Check @@ -141,7 +149,7 @@ class Test_awslambda_function_no_secrets_in_variables: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" diff --git a/tests/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible_test.py b/tests/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible_test.py index 777095be..f4e8cbe5 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible_test.py @@ -3,8 +3,10 @@ from unittest import mock from moto.core import DEFAULT_ACCOUNT_ID from prowler.providers.aws.services.awslambda.awslambda_service import Function - -AWS_REGION = "us-east-1" +from tests.providers.aws.audit_info_utils import ( + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) class Test_awslambda_function_not_publicly_accessible: @@ -13,7 +15,10 @@ class Test_awslambda_function_not_publicly_accessible: lambda_client.functions = {} with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible.awslambda_client", new=lambda_client, ): # Test Check @@ -30,9 +35,7 @@ class Test_awslambda_function_not_publicly_accessible: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_policy = { "Version": "2012-10-17", "Statement": [ @@ -53,14 +56,17 @@ class Test_awslambda_function_not_publicly_accessible: name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, policy=lambda_policy, ) } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible.awslambda_client", new=lambda_client, ): # Test Check @@ -72,7 +78,7 @@ class Test_awslambda_function_not_publicly_accessible: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" @@ -86,9 +92,7 @@ class Test_awslambda_function_not_publicly_accessible: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_policy = { "Version": "2012-10-17", "Statement": [ @@ -109,14 +113,17 @@ class Test_awslambda_function_not_publicly_accessible: name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, policy=lambda_policy, ) } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible.awslambda_client", new=lambda_client, ): # Test Check @@ -128,7 +135,7 @@ class Test_awslambda_function_not_publicly_accessible: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" @@ -142,9 +149,7 @@ class Test_awslambda_function_not_publicly_accessible: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_policy = { "Version": "2012-10-17", "Statement": [ @@ -165,14 +170,17 @@ class Test_awslambda_function_not_publicly_accessible: name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, policy=lambda_policy, ) } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible.awslambda_client", new=lambda_client, ): # Test Check @@ -184,7 +192,7 @@ class Test_awslambda_function_not_publicly_accessible: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" diff --git a/tests/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy_test.py b/tests/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy_test.py index dd0de932..edc80e46 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy_test.py @@ -8,8 +8,10 @@ from prowler.providers.aws.services.awslambda.awslambda_service import ( URLConfig, URLConfigCORS, ) - -AWS_REGION = "us-east-1" +from tests.providers.aws.audit_info_utils import ( + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) class Test_awslambda_function_url_cors_policy: @@ -18,7 +20,10 @@ class Test_awslambda_function_url_cors_policy: lambda_client.functions = {} with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy.awslambda_client", new=lambda_client, ): # Test Check @@ -35,15 +40,13 @@ class Test_awslambda_function_url_cors_policy: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, url_config=URLConfig( auth_type=AuthType.NONE, @@ -54,7 +57,10 @@ class Test_awslambda_function_url_cors_policy: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy.awslambda_client", new=lambda_client, ): # Test Check @@ -66,7 +72,7 @@ class Test_awslambda_function_url_cors_policy: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" @@ -80,15 +86,13 @@ class Test_awslambda_function_url_cors_policy: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "python3.9" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, url_config=URLConfig( auth_type=AuthType.AWS_IAM, @@ -99,7 +103,10 @@ class Test_awslambda_function_url_cors_policy: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy.awslambda_client", new=lambda_client, ): # Test Check @@ -111,7 +118,7 @@ class Test_awslambda_function_url_cors_policy: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" @@ -125,15 +132,13 @@ class Test_awslambda_function_url_cors_policy: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "python3.9" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, url_config=URLConfig( auth_type=AuthType.AWS_IAM, @@ -146,7 +151,10 @@ class Test_awslambda_function_url_cors_policy: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy.awslambda_client", new=lambda_client, ): # Test Check @@ -158,7 +166,7 @@ class Test_awslambda_function_url_cors_policy: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" diff --git a/tests/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public_test.py b/tests/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public_test.py index bbb7898a..9adbef2e 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public_test.py @@ -8,8 +8,10 @@ from prowler.providers.aws.services.awslambda.awslambda_service import ( URLConfig, URLConfigCORS, ) - -AWS_REGION = "us-east-1" +from tests.providers.aws.audit_info_utils import ( + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) class Test_awslambda_function_url_public: @@ -18,7 +20,10 @@ class Test_awslambda_function_url_public: lambda_client.functions = {} with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_url_public.awslambda_function_url_public.awslambda_client", new=lambda_client, ): # Test Check @@ -35,15 +40,13 @@ class Test_awslambda_function_url_public: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, url_config=URLConfig( auth_type=AuthType.NONE, @@ -54,7 +57,10 @@ class Test_awslambda_function_url_public: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_url_public.awslambda_function_url_public.awslambda_client", new=lambda_client, ): # Test Check @@ -66,7 +72,7 @@ class Test_awslambda_function_url_public: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" @@ -80,15 +86,13 @@ class Test_awslambda_function_url_public: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "python3.9" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, url_config=URLConfig( auth_type=AuthType.AWS_IAM, @@ -99,7 +103,10 @@ class Test_awslambda_function_url_public: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_url_public.awslambda_function_url_public.awslambda_client", new=lambda_client, ): # Test Check @@ -111,7 +118,7 @@ class Test_awslambda_function_url_public: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" diff --git a/tests/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes_test.py b/tests/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes_test.py index 7185996c..9e518ca9 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes_test.py @@ -3,8 +3,10 @@ from unittest import mock from moto.core import DEFAULT_ACCOUNT_ID from prowler.providers.aws.services.awslambda.awslambda_service import Function - -AWS_REGION = "us-east-1" +from tests.providers.aws.audit_info_utils import ( + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) class Test_awslambda_function_using_supported_runtimes: @@ -13,7 +15,10 @@ class Test_awslambda_function_using_supported_runtimes: lambda_client.functions = {} with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes.awslambda_client", new=lambda_client, ): # Test Check @@ -30,15 +35,13 @@ class Test_awslambda_function_using_supported_runtimes: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "nodejs4.3" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, ) } @@ -62,7 +65,10 @@ class Test_awslambda_function_using_supported_runtimes: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes.awslambda_client", new=lambda_client, ): # Test Check @@ -74,7 +80,7 @@ class Test_awslambda_function_using_supported_runtimes: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "FAIL" @@ -88,15 +94,13 @@ class Test_awslambda_function_using_supported_runtimes: lambda_client = mock.MagicMock function_name = "test-lambda" function_runtime = "python3.9" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, runtime=function_runtime, ) } @@ -120,7 +124,10 @@ class Test_awslambda_function_using_supported_runtimes: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes.awslambda_client", new=lambda_client, ): # Test Check @@ -132,7 +139,7 @@ class Test_awslambda_function_using_supported_runtimes: result = check.execute() assert len(result) == 1 - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == function_name assert result[0].resource_arn == function_arn assert result[0].status == "PASS" @@ -145,15 +152,13 @@ class Test_awslambda_function_using_supported_runtimes: def test_function_no_runtime(self): lambda_client = mock.MagicMock function_name = "test-lambda" - function_arn = ( - f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" - ) + function_arn = f"arn:aws:lambda:{AWS_REGION_US_EAST_1}:{DEFAULT_ACCOUNT_ID}:function/{function_name}" lambda_client.functions = { "function_name": Function( name=function_name, security_groups=[], arn=function_arn, - region=AWS_REGION, + region=AWS_REGION_US_EAST_1, ) } @@ -176,7 +181,10 @@ class Test_awslambda_function_using_supported_runtimes: } with mock.patch( - "prowler.providers.aws.services.awslambda.awslambda_service.Lambda", + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + set_mocked_aws_audit_info(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes.awslambda_client", new=lambda_client, ): # Test Check diff --git a/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py b/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py index 28acdf0d..cf216574 100644 --- a/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py +++ b/tests/providers/aws/services/ec2/ec2_securitygroup_not_used/ec2_securitygroup_not_used_test.py @@ -1,58 +1,32 @@ from re import search from unittest import mock -from boto3 import client, resource, session +from boto3 import client, resource from moto import mock_ec2, mock_iam, mock_lambda -from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info -from prowler.providers.common.models import Audit_Metadata +from tests.providers.aws.audit_info_utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_US_EAST_1, + set_mocked_aws_audit_info, +) -AWS_REGION = "us-east-1" EXAMPLE_AMI_ID = "ami-12c6146b" -AWS_ACCOUNT_NUMBER = "123456789012" class Test_ec2_securitygroup_not_used: - def set_mocked_audit_info(self): - audit_info = AWS_Audit_Info( - session_config=None, - original_session=None, - audit_session=session.Session( - profile_name=None, - botocore_session=None, - ), - audited_account=AWS_ACCOUNT_NUMBER, - audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root", - audited_user_id=None, - audited_partition="aws", - audited_identity_arn=None, - profile=None, - profile_region=None, - credentials=None, - assumed_role_info=None, - audited_regions=["us-east-1", "eu-west-1"], - organizations_metadata=None, - audit_resources=None, - mfa_enabled=False, - audit_metadata=Audit_Metadata( - services_scanned=0, - expected_checks=[], - completed_checks=0, - audit_progress=0, - ), - ) - - return audit_info - @mock_ec2 + @mock_lambda def test_ec2_default_sgs(self): # Create EC2 Mocked Resources - ec2_client = client("ec2", region_name=AWS_REGION) + ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1) ec2_client.create_vpc(CidrBlock="10.0.0.0/16") + from prowler.providers.aws.services.awslambda.awslambda_service import Lambda from prowler.providers.aws.services.ec2.ec2_service import EC2 - current_audit_info = self.set_mocked_audit_info() + current_audit_info = set_mocked_aws_audit_info( + audited_regions=["us-east-1", "eu-west-1"] + ) with mock.patch( "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", @@ -60,6 +34,9 @@ class Test_ec2_securitygroup_not_used: ), mock.patch( "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.ec2_client", new=EC2(current_audit_info), + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.awslambda_client", + new=Lambda(current_audit_info), ): # Test Check from prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used import ( @@ -73,19 +50,23 @@ class Test_ec2_securitygroup_not_used: assert len(result) == 0 @mock_ec2 + @mock_lambda def test_ec2_unused_sg(self): # Create EC2 Mocked Resources - ec2 = resource("ec2", AWS_REGION) - ec2_client = client("ec2", region_name=AWS_REGION) + ec2 = resource("ec2", AWS_REGION_US_EAST_1) + ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1) vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] sg_name = "test-sg" sg = ec2.create_security_group( GroupName=sg_name, Description="test", VpcId=vpc_id ) + from prowler.providers.aws.services.awslambda.awslambda_service import Lambda from prowler.providers.aws.services.ec2.ec2_service import EC2 - current_audit_info = self.set_mocked_audit_info() + current_audit_info = set_mocked_aws_audit_info( + audited_regions=["us-east-1", "eu-west-1"] + ) with mock.patch( "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", @@ -93,6 +74,9 @@ class Test_ec2_securitygroup_not_used: ), mock.patch( "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.ec2_client", new=EC2(current_audit_info), + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.awslambda_client", + new=Lambda(current_audit_info), ): # Test Check from prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used import ( @@ -105,24 +89,25 @@ class Test_ec2_securitygroup_not_used: # One custom sg assert len(result) == 1 assert result[0].status == "FAIL" - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert ( result[0].status_extended == f"Security group {sg_name} ({sg.id}) it is not being used." ) assert ( result[0].resource_arn - == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{sg.id}" + == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_US_EAST_1}:{current_audit_info.audited_account}:security-group/{sg.id}" ) assert result[0].resource_id == sg.id assert result[0].resource_details == sg_name assert result[0].resource_tags == [] @mock_ec2 + @mock_lambda def test_ec2_used_default_sg(self): # Create EC2 Mocked Resources - ec2 = resource("ec2", AWS_REGION) - ec2_client = client("ec2", region_name=AWS_REGION) + ec2 = resource("ec2", AWS_REGION_US_EAST_1) + ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1) vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] sg_name = "test-sg" sg = ec2.create_security_group( @@ -131,9 +116,12 @@ class Test_ec2_securitygroup_not_used: subnet = ec2.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/18") subnet.create_network_interface(Groups=[sg.id]) + from prowler.providers.aws.services.awslambda.awslambda_service import Lambda from prowler.providers.aws.services.ec2.ec2_service import EC2 - current_audit_info = self.set_mocked_audit_info() + current_audit_info = set_mocked_aws_audit_info( + audited_regions=["us-east-1", "eu-west-1"] + ) with mock.patch( "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", @@ -141,6 +129,9 @@ class Test_ec2_securitygroup_not_used: ), mock.patch( "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.ec2_client", new=EC2(current_audit_info), + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.awslambda_client", + new=Lambda(current_audit_info), ): # Test Check from prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used import ( @@ -153,7 +144,7 @@ class Test_ec2_securitygroup_not_used: # One custom sg assert len(result) == 1 assert result[0].status == "PASS" - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert ( result[0].status_extended == f"Security group {sg_name} ({sg.id}) it is being used." @@ -164,7 +155,7 @@ class Test_ec2_securitygroup_not_used: ) assert ( result[0].resource_arn - == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{sg.id}" + == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_US_EAST_1}:{current_audit_info.audited_account}:security-group/{sg.id}" ) assert result[0].resource_id == sg.id assert result[0].resource_details == sg_name @@ -175,8 +166,8 @@ class Test_ec2_securitygroup_not_used: @mock_iam def test_ec2_used_default_sg_by_lambda(self): # Create EC2 Mocked Resources - ec2 = resource("ec2", AWS_REGION) - ec2_client = client("ec2", region_name=AWS_REGION) + ec2 = resource("ec2", AWS_REGION_US_EAST_1) + ec2_client = client("ec2", region_name=AWS_REGION_US_EAST_1) vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"] sg_name = "test-sg" sg = ec2.create_security_group( @@ -184,13 +175,13 @@ class Test_ec2_securitygroup_not_used: ) subnet = ec2.create_subnet(VpcId=vpc_id, CidrBlock="10.0.0.0/18") subnet.create_network_interface(Groups=[sg.id]) - iam_client = client("iam", region_name=AWS_REGION) + iam_client = client("iam", region_name=AWS_REGION_US_EAST_1) iam_role = iam_client.create_role( RoleName="my-role", AssumeRolePolicyDocument="some policy", Path="/my-path/", )["Role"]["Arn"] - lambda_client = client("lambda", AWS_REGION) + lambda_client = client("lambda", AWS_REGION_US_EAST_1) lambda_client.create_function( FunctionName="test-function", Runtime="python3.11", @@ -209,9 +200,12 @@ class Test_ec2_securitygroup_not_used: }, ) + from prowler.providers.aws.services.awslambda.awslambda_service import Lambda from prowler.providers.aws.services.ec2.ec2_service import EC2 - current_audit_info = self.set_mocked_audit_info() + current_audit_info = set_mocked_aws_audit_info( + audited_regions=["us-east-1", "eu-west-1"] + ) with mock.patch( "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", @@ -219,6 +213,9 @@ class Test_ec2_securitygroup_not_used: ), mock.patch( "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.ec2_client", new=EC2(current_audit_info), + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used.awslambda_client", + new=Lambda(current_audit_info), ): # Test Check from prowler.providers.aws.services.ec2.ec2_securitygroup_not_used.ec2_securitygroup_not_used import ( @@ -231,7 +228,7 @@ class Test_ec2_securitygroup_not_used: # One custom sg assert len(result) == 1 assert result[0].status == "PASS" - assert result[0].region == AWS_REGION + assert result[0].region == AWS_REGION_US_EAST_1 assert ( result[0].status_extended == f"Security group {sg_name} ({sg.id}) it is being used." @@ -242,7 +239,7 @@ class Test_ec2_securitygroup_not_used: ) assert ( result[0].resource_arn - == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{sg.id}" + == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_US_EAST_1}:{current_audit_info.audited_account}:security-group/{sg.id}" ) assert result[0].resource_id == sg.id assert result[0].resource_details == sg_name