mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 06:45:08 +00:00
docs(style): Add more details (#2724)
This commit is contained in:
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
Here you can find how to create new checks for Prowler.
|
Here you can find how to create new checks for Prowler.
|
||||||
|
|
||||||
**To create a check is required to have a Prowler provider service already created, so if the service is not present or the attribute you want to audit is not retrieved by the service, please refer to the [Service](./service.md) documentation.**
|
**To create a check is required to have a Prowler provider service already created, so if the service is not present or the attribute you want to audit is not retrieved by the service, please refer to the [Service](./services.md) documentation.**
|
||||||
|
|
||||||
## Introduction
|
## Introduction
|
||||||
To create a new check for a supported Prowler provider, you will need to create a folder with the check name inside the specific service for the selected provider.
|
To create a new check for a supported Prowler provider, you will need to create a folder with the check name inside the specific service for the selected provider.
|
||||||
@@ -106,6 +106,7 @@ All the checks MUST fill the `report.status` and `report.status_extended` with t
|
|||||||
- Status Extended -- `report.status_extended`
|
- Status Extended -- `report.status_extended`
|
||||||
- MUST end in a dot `.`
|
- MUST end in a dot `.`
|
||||||
- MUST include the service audited with the resource and a brief explanation of the result generated, e.g.: `EC2 AMI ami-0123456789 is not public.`
|
- MUST include the service audited with the resource and a brief explanation of the result generated, e.g.: `EC2 AMI ami-0123456789 is not public.`
|
||||||
|
|
||||||
### Resource ID, Name and ARN
|
### Resource ID, Name and ARN
|
||||||
All the hecks must fill the `report.resource_id` and `report.resource_arn` with the following criteria:
|
All the hecks must fill the `report.resource_id` and `report.resource_arn` with the following criteria:
|
||||||
|
|
||||||
@@ -32,7 +32,7 @@ Due to the complexity and differencies of each provider API we are going to use
|
|||||||
|
|
||||||
The following is the `<service>_service.py` file:
|
The following is the `<service>_service.py` file:
|
||||||
|
|
||||||
```python
|
```python title="Service Class"
|
||||||
from datetime import datetime
|
from datetime import datetime
|
||||||
from typing import Optional
|
from typing import Optional
|
||||||
|
|
||||||
@@ -174,9 +174,15 @@ class <Service>(ServiceParentClass):
|
|||||||
logger.error(
|
logger.error(
|
||||||
f"{<item>.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
f"{<item>.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||||
)
|
)
|
||||||
|
```
|
||||||
|
|
||||||
|
### Service Models
|
||||||
|
|
||||||
# In each service class we have to create some classes using the Pydantic's Basemodel for the resources we want to audit.
|
For each class object we need to model we use the Pydantic's [BaseModel](https://docs.pydantic.dev/latest/api/base_model/#pydantic.BaseModel) to take advantage of the data validation.
|
||||||
|
|
||||||
|
```python title="Service Model"
|
||||||
|
# In each service class we have to create some classes using
|
||||||
|
# the Pydantic's Basemodel for the resources we want to audit.
|
||||||
class <Item>(BaseModel):
|
class <Item>(BaseModel):
|
||||||
"""<Item> holds a <Service> <Item>"""
|
"""<Item> holds a <Service> <Item>"""
|
||||||
|
|
||||||
@@ -193,19 +199,18 @@ class <Item>(BaseModel):
|
|||||||
"""<Items>[].public"""
|
"""<Items>[].public"""
|
||||||
|
|
||||||
# We can create Optional attributes set to None by default
|
# We can create Optional attributes set to None by default
|
||||||
tags: Optional[list] = []
|
tags: Optional[list]
|
||||||
"""<Items>[].tags"""
|
"""<Items>[].tags"""
|
||||||
|
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
### Service Objects
|
### Service Objects
|
||||||
In the service each list of resources should be created as a Python [dictionaries](https://docs.python.org/3/tutorial/datastructures.html#dictionaries) since we are performing lookups all the time the Python dictionary lookup has [O(1) complexity](https://en.wikipedia.org/wiki/Big_O_notation#Orders_of_common_functions).
|
In the service each group of resources should be created as a Python [dictionary](https://docs.python.org/3/tutorial/datastructures.html#dictionaries). This is because we are performing lookups all the time and the Python dictionary lookup has [O(1) complexity](https://en.wikipedia.org/wiki/Big_O_notation#Orders_of_common_functions).
|
||||||
|
|
||||||
|
We MUST set as the dictionary key a unique ID, like the resource Unique ID or ARN.
|
||||||
|
|
||||||
Example:
|
Example:
|
||||||
```python
|
```python
|
||||||
self.vpcs = {}
|
self.vpcs = {}
|
||||||
self.vpcs["vpc-01234567890abcdef"] = VPC_Object_Class
|
self.vpcs["vpc-01234567890abcdef"] = VPC_Object_Class()
|
||||||
```
|
```
|
||||||
|
|
||||||
## Service Client
|
## Service Client
|
||||||
@@ -54,7 +54,7 @@ When creating tests for some provider's checks we follow these guidelines trying
|
|||||||
|
|
||||||
## How to run Prowler tests
|
## How to run Prowler tests
|
||||||
|
|
||||||
To run the Prowler test suite you need to install the testing dependencies already included in the `pyproject.toml` file. If you didn't install it yet please read the developer guide introduction [here](./developer-guide.md#get-the-code-and-install-all-dependencies).
|
To run the Prowler test suite you need to install the testing dependencies already included in the `pyproject.toml` file. If you didn't install it yet please read the developer guide introduction [here](./introduction.md#get-the-code-and-install-all-dependencies).
|
||||||
|
|
||||||
Then in the project's root path execute `pytest -n auto -vvv -s -x` or use the `Makefile` with `make test`.
|
Then in the project's root path execute `pytest -n auto -vvv -s -x` or use the `Makefile` with `make test`.
|
||||||
|
|
||||||
@@ -10,9 +10,9 @@
|
|||||||
For **Prowler v2 Documentation**, please go [here](https://github.com/prowler-cloud/prowler/tree/2.12.0) to the branch and its README.md.
|
For **Prowler v2 Documentation**, please go [here](https://github.com/prowler-cloud/prowler/tree/2.12.0) to the branch and its README.md.
|
||||||
|
|
||||||
- You are currently in the **Getting Started** section where you can find general information and requirements to help you start with the tool.
|
- You are currently in the **Getting Started** section where you can find general information and requirements to help you start with the tool.
|
||||||
- In the [Tutorials](tutorials/overview) section you will see how to take advantage of all the features in Prowler.
|
- In the [Tutorials](./tutorials/misc.md) section you will see how to take advantage of all the features in Prowler.
|
||||||
- In the [Contact Us](contact) section you can find how to reach us out in case of technical issues.
|
- In the [Contact Us](./contact.md) section you can find how to reach us out in case of technical issues.
|
||||||
- In the [About](about) section you will find more information about the Prowler team and license.
|
- In the [About](./about.md) section you will find more information about the Prowler team and license.
|
||||||
|
|
||||||
## About Prowler
|
## About Prowler
|
||||||
|
|
||||||
@@ -201,7 +201,7 @@ To run Prowler, you will need to specify the provider (e.g aws, gcp or azure):
|
|||||||
prowler <provider>
|
prowler <provider>
|
||||||
```
|
```
|
||||||

|

|
||||||
> Running the `prowler` command without options will use your environment variable credentials, see [Requirements](getting-started/requirements/) section to review the credentials settings.
|
> Running the `prowler` command without options will use your environment variable credentials, see [Requirements](./getting-started/requirements.md) section to review the credentials settings.
|
||||||
|
|
||||||
If you miss the former output you can use `--verbose` but Prowler v3 is smoking fast, so you won't see much ;)
|
If you miss the former output you can use `--verbose` but Prowler v3 is smoking fast, so you won't see much ;)
|
||||||
|
|
||||||
|
|||||||
@@ -11,4 +11,4 @@
|
|||||||
This error is also related with a lack of system requirements. To improve performance, Prowler stores information in memory so it may need to be run in a system with more than 1GB of memory.
|
This error is also related with a lack of system requirements. To improve performance, Prowler stores information in memory so it may need to be run in a system with more than 1GB of memory.
|
||||||
|
|
||||||
|
|
||||||
See section [Logging](/tutorials/logging/) for further information or [contact us](/contact/).
|
See section [Logging](./tutorials/logging.md) for further information or [contact us](./contact.md).
|
||||||
|
|||||||
@@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
Prowler v3 comes with different identifiers but we maintained the same checks that were implemented in v2. The reason for this change is because in previous versions of Prowler, check names were mostly based on CIS Benchmark for AWS. In v3 all checks are independent from any security framework and they have its own name and ID.
|
Prowler v3 comes with different identifiers but we maintained the same checks that were implemented in v2. The reason for this change is because in previous versions of Prowler, check names were mostly based on CIS Benchmark for AWS. In v3 all checks are independent from any security framework and they have its own name and ID.
|
||||||
|
|
||||||
If you need more information about how new compliance implementation works in Prowler v3 see [Compliance](../../compliance/) section.
|
If you need more information about how new compliance implementation works in Prowler v3 see [Compliance](../compliance.md) section.
|
||||||
|
|
||||||
```
|
```
|
||||||
checks_v3_to_v2_mapping = {
|
checks_v3_to_v2_mapping = {
|
||||||
|
|||||||
@@ -24,4 +24,4 @@ prowler azure --browser-auth --tenant-id "XXXXXXXX"
|
|||||||
prowler azure --managed-identity-auth
|
prowler azure --managed-identity-auth
|
||||||
```
|
```
|
||||||
|
|
||||||
To use Prowler you need to set up also the permissions required to access your resources in your Azure account, to more details refer to [Requirements](/getting-started/requirements)
|
To use Prowler you need to set up also the permissions required to access your resources in your Azure account, to more details refer to [Requirements](../../getting-started/requirements.md)
|
||||||
|
|||||||
@@ -65,7 +65,7 @@ The custom checks folder must contain one subfolder per check, each subfolder mu
|
|||||||
- A `check_name.metadata.json` containing the check's metadata.
|
- A `check_name.metadata.json` containing the check's metadata.
|
||||||
>The check name must start with the service name followed by an underscore (e.g., ec2_instance_public_ip).
|
>The check name must start with the service name followed by an underscore (e.g., ec2_instance_public_ip).
|
||||||
|
|
||||||
To see more information about how to write checks see the [Developer Guide](../developer-guide/#create-a-new-check-for-a-provider).
|
To see more information about how to write checks see the [Developer Guide](../developer-guide/checks.md#create-a-new-check-for-a-provider).
|
||||||
|
|
||||||
> If you want to run ONLY your custom check(s), import it with -x (--checks-folder) and then run it with -c (--checks), e.g.:
|
> If you want to run ONLY your custom check(s), import it with -x (--checks-folder) and then run it with -c (--checks), e.g.:
|
||||||
```console
|
```console
|
||||||
|
|||||||
22
mkdocs.yml
22
mkdocs.yml
@@ -38,7 +38,7 @@ nav:
|
|||||||
- Logging: tutorials/logging.md
|
- Logging: tutorials/logging.md
|
||||||
- Allowlist: tutorials/allowlist.md
|
- Allowlist: tutorials/allowlist.md
|
||||||
- Pentesting: tutorials/pentesting.md
|
- Pentesting: tutorials/pentesting.md
|
||||||
- Developer Guide: tutorials/developer-guide/developer-guide.md
|
- Developer Guide: developer-guide/introduction.md
|
||||||
- AWS:
|
- AWS:
|
||||||
- Authentication: tutorials/aws/authentication.md
|
- Authentication: tutorials/aws/authentication.md
|
||||||
- Assume Role: tutorials/aws/role-assumption.md
|
- Assume Role: tutorials/aws/role-assumption.md
|
||||||
@@ -57,17 +57,17 @@ nav:
|
|||||||
- Google Cloud:
|
- Google Cloud:
|
||||||
- Authentication: tutorials/gcp/authentication.md
|
- Authentication: tutorials/gcp/authentication.md
|
||||||
- Developer Guide:
|
- Developer Guide:
|
||||||
- Introduction: tutorials/developer-guide/developer-guide.md
|
- Introduction: developer-guide/introduction.md
|
||||||
- Audit Info: tutorials/developer-guide/audit-info.md
|
- Audit Info: developer-guide/audit-info.md
|
||||||
- Services: tutorials/developer-guide/service.md
|
- Services: developer-guide/services.md
|
||||||
- Checks: tutorials/developer-guide/checks.md
|
- Checks: developer-guide/checks.md
|
||||||
- Documentation: tutorials/developer-guide/documentation.md
|
- Documentation: developer-guide/documentation.md
|
||||||
- Compliance: tutorials/developer-guide/security-compliance-framework.md
|
- Compliance: developer-guide/security-compliance-framework.md
|
||||||
- Outputs: tutorials/developer-guide/outputs.md
|
- Outputs: developer-guide/outputs.md
|
||||||
- Integrations: tutorials/developer-guide/integrations.md
|
- Integrations: developer-guide/integrations.md
|
||||||
- Testing:
|
- Testing:
|
||||||
- Unit Tests: tutorials/developer-guide/unit-testing.md
|
- Unit Tests: developer-guide/unit-testing.md
|
||||||
- Integration Tests: tutorials/developer-guide/integration-testing.md
|
- Integration Tests: developer-guide/integration-testing.md
|
||||||
- Security: security.md
|
- Security: security.md
|
||||||
- Contact Us: contact.md
|
- Contact Us: contact.md
|
||||||
- Troubleshooting: troubleshooting.md
|
- Troubleshooting: troubleshooting.md
|
||||||
|
|||||||
Reference in New Issue
Block a user