ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(errors): solve different errors in KMS, EFS and Lambda (#1835)

Browse Source 
Co-authored-by: sergargar <sergargar@users.noreply.github.com>
This commit is contained in:
Sergio Garcia
2023-02-03 15:05:07 +01:00
committed by GitHub
parent 08376cb15e
commit 24e19e6b18
3 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
prowler/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.py
View File

@@ -21,13 +21,14 @@ class awslambda_function_invoke_api_operations_cloudtrail_logging_enabled(Check)
lambda_recorded_cloudtrail = False lambda_recorded_cloudtrail = False
for trail in cloudtrail_client.trails: for trail in cloudtrail_client.trails:
for data_event in trail.data_events: for data_event in trail.data_events:
for resource in data_event.event_selector["DataResources"]: if "DataResources" in data_event.event_selector:
if ( for resource in data_event.event_selector["DataResources"]:
resource["Type"] == "AWS::Lambda::Function" if (
and function.arn in resource["Values"] resource["Type"] == "AWS::Lambda::Function"
): and function.arn in resource["Values"]
lambda_recorded_cloudtrail = True ):
break lambda_recorded_cloudtrail = True
break
if lambda_recorded_cloudtrail: if lambda_recorded_cloudtrail:
break break

8
prowler/providers/aws/services/efs/efs_not_publicly_accessible/efs_not_publicly_accessible.py
View File

@@ -21,8 +21,12 @@ class efs_not_publicly_accessible(Check):
for statement in fs.policy["Statement"]: for statement in fs.policy["Statement"]:
if statement["Effect"] == "Allow": if statement["Effect"] == "Allow":
if ( if (
statement["Principal"]["AWS"] == "*" ("Principal" in statement and statement["Principal"] == "*")
or statement["Principal"] == "*" or (
"Principal" in statement
and "AWS" in statement["Principal"]
and statement["Principal"]["AWS"] == "*"
)
or ( or (
"CanonicalUser" in statement["Principal"] "CanonicalUser" in statement["Principal"]
and statement["Principal"]["CanonicalUser"] == "*" and statement["Principal"]["CanonicalUser"] == "*"

9
prowler/providers/aws/services/kms/kms_service.py
View File

@@ -73,10 +73,11 @@ class KMS:
logger.info("KMS - Get Key Rotation Status...") logger.info("KMS - Get Key Rotation Status...")
for key in self.keys: for key in self.keys:
try: try:
regional_client = self.regional_clients[key.region] if "EXTERNAL" not in key.origin:
key.rotation_enabled = regional_client.get_key_rotation_status( regional_client = self.regional_clients[key.region]
KeyId=key.id key.rotation_enabled = regional_client.get_key_rotation_status(
)["KeyRotationEnabled"] KeyId=key.id
)["KeyRotationEnabled"]
except Exception as error: except Exception as error:
logger.error( logger.error(
f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}" f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"