feat(wellarchitected): add WellArchitected service and check (#2461)

2026-02-10 14:55:00 +00:00 · 2023-06-09 13:19:01 +02:00
parent cfd7099743
commit 5c4cae8c9d
13 changed files with 458 additions and 5 deletions
--- a/tests/providers/aws/services/wellarchitected/wellarchitected_service_test.py
+++ b/tests/providers/aws/services/wellarchitected/wellarchitected_service_test.py
@@ -0,0 +1,123 @@
+from unittest.mock import patch
+from uuid import uuid4
+
+import botocore
+from boto3 import session
+
+from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
+from prowler.providers.aws.services.wellarchitected.wellarchitected_service import (
+    WellArchitected,
+)
+
+AWS_ACCOUNT_NUMBER = "123456789012"
+AWS_REGION = "eu-west-1"
+
+
+workload_id = str(uuid4())
+
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+    if operation_name == "ListWorkloads":
+        return {
+            "WorkloadSummaries": [
+                {
+                    "WorkloadId": workload_id,
+                    "WorkloadArn": f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}",
+                    "WorkloadName": "test",
+                    "Owner": AWS_ACCOUNT_NUMBER,
+                    "UpdatedAt": "2023-06-07T15:40:24+02:00",
+                    "Lenses": ["wellarchitected", "serverless", "softwareasaservice"],
+                    "RiskCounts": {"UNANSWERED": 56, "NOT_APPLICABLE": 4, "HIGH": 10},
+                    "ImprovementStatus": "NOT_APPLICABLE",
+                },
+            ]
+        }
+    if operation_name == "ListTagsForResource":
+        return {
+            "Tags": {"Key": "test", "Value": "test"},
+        }
+    return make_api_call(self, operation_name, kwarg)
+
+
+def mock_generate_regional_clients(service, audit_info):
+    regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
+    regional_client.region = AWS_REGION
+    return {AWS_REGION: regional_client}
+
+
+@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+@patch(
+    "prowler.providers.aws.services.wellarchitected.wellarchitected_service.generate_regional_clients",
+    new=mock_generate_regional_clients,
+)
+class Test_WellArchitected_Service:
+    # Mocked Audit Info
+    def set_mocked_audit_info(self):
+        audit_info = AWS_Audit_Info(
+            session_config=None,
+            original_session=None,
+            audit_session=session.Session(
+                profile_name=None,
+                botocore_session=None,
+            ),
+            audited_account=AWS_ACCOUNT_NUMBER,
+            audited_user_id=None,
+            audited_partition="aws",
+            audited_identity_arn=None,
+            profile=None,
+            profile_region=None,
+            credentials=None,
+            assumed_role_info=None,
+            audited_regions=None,
+            organizations_metadata=None,
+            audit_resources=None,
+        )
+        return audit_info
+
+    # Test WellArchitected Service
+    def test_service(self):
+        audit_info = self.set_mocked_audit_info()
+        wellarchitected = WellArchitected(audit_info)
+        assert wellarchitected.service == "wellarchitected"
+
+    # Test WellArchitected client
+    def test_client(self):
+        audit_info = self.set_mocked_audit_info()
+        wellarchitected = WellArchitected(audit_info)
+        for reg_client in wellarchitected.regional_clients.values():
+            assert reg_client.__class__.__name__ == "WellArchitected"
+
+    # Test WellArchitected session
+    def test__get_session__(self):
+        audit_info = self.set_mocked_audit_info()
+        wellarchitected = WellArchitected(audit_info)
+        assert wellarchitected.session.__class__.__name__ == "Session"
+
+    # Test WellArchitected list workloads
+    def test__list_workloads__(self):
+        audit_info = self.set_mocked_audit_info()
+        wellarchitected = WellArchitected(audit_info)
+        assert len(wellarchitected.workloads) == 1
+        assert wellarchitected.workloads[0].id == workload_id
+        assert (
+            wellarchitected.workloads[0].arn
+            == f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}"
+        )
+        assert wellarchitected.workloads[0].name == "test"
+        assert wellarchitected.workloads[0].region == AWS_REGION
+        assert wellarchitected.workloads[0].tags == [
+            {"Key": "test", "Value": "test"},
+        ]
+        assert wellarchitected.workloads[0].lenses == [
+            "wellarchitected",
+            "serverless",
+            "softwareasaservice",
+        ]
+        assert wellarchitected.workloads[0].improvement_status == "NOT_APPLICABLE"
+        assert wellarchitected.workloads[0].risks == {
+            "UNANSWERED": 56,
+            "NOT_APPLICABLE": 4,
+            "HIGH": 10,
+        }
--- a/tests/providers/aws/services/wellarchitected/wellarchitected_workload_no_high_or_medium_risks/wellarchitected_workload_no_high_or_medium_risks_test.py
+++ b/tests/providers/aws/services/wellarchitected/wellarchitected_workload_no_high_or_medium_risks/wellarchitected_workload_no_high_or_medium_risks_test.py
@@ -0,0 +1,154 @@
+from re import search
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.aws.services.wellarchitected.wellarchitected_service import (
+    Workload,
+)
+
+AWS_REGION = "eu-west-1"
+AWS_ACCOUNT_NUMBER = "123456789012"
+
+workload_id = str(uuid4())
+
+
+class Test_wellarchitected_workload_no_high_or_medium_risks:
+    def test_no_wellarchitected(self):
+        wellarchitected_client = mock.MagicMock
+        wellarchitected_client.workloads = []
+        with mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_service.WellArchitected",
+            wellarchitected_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_client.wellarchitected_client",
+            wellarchitected_client,
+        ):
+            from prowler.providers.aws.services.wellarchitected.wellarchitected_workload_no_high_or_medium_risks.wellarchitected_workload_no_high_or_medium_risks import (
+                wellarchitected_workload_no_high_or_medium_risks,
+            )
+
+            check = wellarchitected_workload_no_high_or_medium_risks()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_wellarchitected_no_risks(self):
+        wellarchitected_client = mock.MagicMock
+        wellarchitected_client.workloads = []
+        wellarchitected_client.workloads.append(
+            Workload(
+                id=workload_id,
+                arn=f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}",
+                name="test",
+                lenses=["wellarchitected", "serverless", "softwareasaservice"],
+                improvement_status="NOT_APPLICABLE",
+                risks={},
+                region=AWS_REGION,
+            )
+        )
+        with mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_service.WellArchitected",
+            wellarchitected_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_client.wellarchitected_client",
+            wellarchitected_client,
+        ):
+            from prowler.providers.aws.services.wellarchitected.wellarchitected_workload_no_high_or_medium_risks.wellarchitected_workload_no_high_or_medium_risks import (
+                wellarchitected_workload_no_high_or_medium_risks,
+            )
+
+            check = wellarchitected_workload_no_high_or_medium_risks()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert search(
+                "does not contain high or medium risks", result[0].status_extended
+            )
+            assert result[0].resource_id == workload_id
+            assert (
+                result[0].resource_arn
+                == f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}"
+            )
+
+    def test_wellarchitected_no_high_medium_risks(self):
+        wellarchitected_client = mock.MagicMock
+        wellarchitected_client.workloads = []
+        wellarchitected_client.workloads.append(
+            Workload(
+                id=workload_id,
+                arn=f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}",
+                name="test",
+                lenses=["wellarchitected", "serverless", "softwareasaservice"],
+                improvement_status="NOT_APPLICABLE",
+                risks={
+                    "UNANSWERED": 56,
+                    "NOT_APPLICABLE": 4,
+                },
+                region=AWS_REGION,
+            )
+        )
+        with mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_service.WellArchitected",
+            wellarchitected_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_client.wellarchitected_client",
+            wellarchitected_client,
+        ):
+            from prowler.providers.aws.services.wellarchitected.wellarchitected_workload_no_high_or_medium_risks.wellarchitected_workload_no_high_or_medium_risks import (
+                wellarchitected_workload_no_high_or_medium_risks,
+            )
+
+            check = wellarchitected_workload_no_high_or_medium_risks()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert search(
+                "does not contain high or medium risks", result[0].status_extended
+            )
+            assert result[0].resource_id == workload_id
+            assert (
+                result[0].resource_arn
+                == f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}"
+            )
+
+    def test_wellarchitected_with_high_medium_risks(self):
+        wellarchitected_client = mock.MagicMock
+        wellarchitected_client.workloads = []
+        wellarchitected_client.workloads.append(
+            Workload(
+                id=workload_id,
+                arn=f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}",
+                name="test",
+                lenses=["wellarchitected", "serverless", "softwareasaservice"],
+                improvement_status="NOT_APPLICABLE",
+                risks={
+                    "UNANSWERED": 56,
+                    "NOT_APPLICABLE": 4,
+                    "HIGH": 10,
+                    "MEDIUM": 20,
+                },
+                region=AWS_REGION,
+            )
+        )
+        with mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_service.WellArchitected",
+            wellarchitected_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.wellarchitected.wellarchitected_client.wellarchitected_client",
+            wellarchitected_client,
+        ):
+            from prowler.providers.aws.services.wellarchitected.wellarchitected_workload_no_high_or_medium_risks.wellarchitected_workload_no_high_or_medium_risks import (
+                wellarchitected_workload_no_high_or_medium_risks,
+            )
+
+            check = wellarchitected_workload_no_high_or_medium_risks()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert search(
+                "contains 10 high and 20 medium risks", result[0].status_extended
+            )
+            assert result[0].resource_id == workload_id
+            assert (
+                result[0].resource_arn
+                == f"arn:aws:wellarchitected:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:workload/{workload_id}"
+            )