test(audit_info): refactor secretsmanager (#3134)

This commit is contained in:
Nacho Rivera
2023-12-05 11:33:54 +01:00
committed by GitHub
parent f0da63c850
commit 6a901bb7de
2 changed files with 30 additions and 59 deletions

View File

@@ -3,9 +3,7 @@ from unittest import mock
from moto.core import DEFAULT_ACCOUNT_ID
from prowler.providers.aws.services.secretsmanager.secretsmanager_service import Secret
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_secretsmanager_automatic_rotation_enabled:
@@ -29,11 +27,11 @@ class Test_secretsmanager_automatic_rotation_enabled:
def test_secret_rotation_disabled(self):
secretsmanager_client = mock.MagicMock
secret_name = "test-secret"
secret_arn = f"arn:aws:secretsmanager:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:secret:{secret_name}"
secret_arn = f"arn:aws:secretsmanager:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:secret:{secret_name}"
secretsmanager_client.secrets = {
secret_name: Secret(
arn=secret_arn,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
name=secret_name,
rotation_enabled=False,
)
@@ -51,7 +49,7 @@ class Test_secretsmanager_automatic_rotation_enabled:
result = check.execute()
assert len(result) == 1
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == secret_name
assert result[0].resource_arn == secret_arn
assert result[0].status == "FAIL"
@@ -63,11 +61,11 @@ class Test_secretsmanager_automatic_rotation_enabled:
def test_secret_rotation_enabled(self):
secretsmanager_client = mock.MagicMock
secret_name = "test-secret"
secret_arn = f"arn:aws:secretsmanager:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:secret:{secret_name}"
secret_arn = f"arn:aws:secretsmanager:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:secret:{secret_name}"
secretsmanager_client.secrets = {
secret_name: Secret(
arn=secret_arn,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
name=secret_name,
rotation_enabled=True,
)
@@ -85,7 +83,7 @@ class Test_secretsmanager_automatic_rotation_enabled:
result = check.execute()
assert len(result) == 1
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == secret_name
assert result[0].resource_arn == secret_arn
assert result[0].status == "PASS"

View File

@@ -2,25 +2,25 @@ import io
import zipfile
from unittest.mock import patch
from boto3 import client, resource, session
from boto3 import client, resource
from moto import mock_ec2, mock_iam, mock_lambda, mock_s3, mock_secretsmanager
from moto.core import DEFAULT_ACCOUNT_ID
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.secretsmanager.secretsmanager_service import (
SecretsManager,
)
from prowler.providers.common.models import Audit_Metadata
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
# Mock generate_regional_clients()
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
# Patch every AWS call using Boto3 and generate_regional_clients to have 1 client
@@ -29,57 +29,28 @@ def mock_generate_regional_clients(service, audit_info, _):
new=mock_generate_regional_clients,
)
class Test_SecretsManager_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=DEFAULT_ACCOUNT_ID,
audited_account_arn=f"arn:aws:iam::{DEFAULT_ACCOUNT_ID}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test SecretsManager Client
@mock_secretsmanager
def test__get_client__(self):
audit_info = self.set_mocked_audit_info()
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
secretsmanager = SecretsManager(audit_info)
assert (
secretsmanager.regional_clients[AWS_REGION].__class__.__name__
secretsmanager.regional_clients[AWS_REGION_EU_WEST_1].__class__.__name__
== "SecretsManager"
)
# Test SecretsManager Session
@mock_secretsmanager
def test__get_session__(self):
audit_info = self.set_mocked_audit_info()
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
secretsmanager = SecretsManager(audit_info)
assert secretsmanager.session.__class__.__name__ == "Session"
# Test SecretsManager Service
@mock_secretsmanager
def test__get_service__(self):
audit_info = self.set_mocked_audit_info()
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
secretsmanager = SecretsManager(audit_info)
assert secretsmanager.service == "secretsmanager"
@@ -89,7 +60,9 @@ class Test_SecretsManager_Service:
@mock_iam
@mock_s3
def test__list_secrets__(self):
secretsmanager_client = client("secretsmanager", region_name=AWS_REGION)
secretsmanager_client = client(
"secretsmanager", region_name=AWS_REGION_EU_WEST_1
)
# Create Secret
resp = secretsmanager_client.create_secret(
Name="test-secret",
@@ -101,17 +74,17 @@ class Test_SecretsManager_Service:
secret_arn = resp["ARN"]
secret_name = resp["Name"]
# Create IAM Lambda Role
iam_client = client("iam", region_name=AWS_REGION)
iam_client = client("iam", region_name=AWS_REGION_EU_WEST_1)
iam_role = iam_client.create_role(
RoleName="rotation-lambda-role",
AssumeRolePolicyDocument="test-policy",
Path="/",
)["Role"]["Arn"]
# Create S3 Bucket
s3_client = resource("s3", region_name=AWS_REGION)
s3_client = resource("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(
Bucket="test-bucket",
CreateBucketConfiguration={"LocationConstraint": AWS_REGION},
CreateBucketConfiguration={"LocationConstraint": AWS_REGION_EU_WEST_1},
)
# Create Lambda Code
zip_output = io.BytesIO()
@@ -127,7 +100,7 @@ class Test_SecretsManager_Service:
zip_file.close()
zip_output.seek(0)
# Create Rotation Lambda
lambda_client = client("lambda", region_name=AWS_REGION)
lambda_client = client("lambda", region_name=AWS_REGION_EU_WEST_1)
resp = lambda_client.create_function(
FunctionName="rotation-lambda",
Runtime="python3.7",
@@ -158,7 +131,7 @@ class Test_SecretsManager_Service:
)
# Set partition for the service
audit_info = self.set_mocked_audit_info()
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
secretsmanager = SecretsManager(audit_info)
assert len(secretsmanager.secrets) == 1
@@ -166,7 +139,7 @@ class Test_SecretsManager_Service:
assert secretsmanager.secrets[secret_arn]
assert secretsmanager.secrets[secret_arn].name == secret_name
assert secretsmanager.secrets[secret_arn].arn == secret_arn
assert secretsmanager.secrets[secret_arn].region == AWS_REGION
assert secretsmanager.secrets[secret_arn].region == AWS_REGION_EU_WEST_1
assert secretsmanager.secrets[secret_arn].rotation_enabled is True
assert secretsmanager.secrets[secret_arn].tags == [
{"Key": "test", "Value": "test"},