ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(): add ECS task revision number (#1657)

Browse Source 
Co-authored-by: sergargar <sergio@verica.io>
This commit is contained in:
Fennerr
2023-01-05 14:36:32 +02:00
committed by GitHub
parent 571280f0cd
commit 76a694d043
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
prowler/providers/aws/services/ecs/ecs_service.py
View File

@@ -41,6 +41,7 @@ class ECS:
# we want the family name without the revision
name=sub(":.*", "", task_definition.split("/")[1]),
arn=task_definition,
revision=task_definition.split(":")[-1],
region=regional_client.region,
environment_variables=[],
)
@@ -80,5 +81,6 @@ class ContainerEnvVariable(BaseModel):
class TaskDefinition(BaseModel):
name: str
arn: str
revision: str
region: str
environment_variables: list[ContainerEnvVariable]

4
prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py
View File

@@ -18,7 +18,7 @@ class ecs_task_definitions_no_environment_secrets(Check):
report.resource_id = task_definition.name
report.resource_arn = task_definition.arn
report.status = "PASS"
report.status_extended = f"No secrets found in ECS task definition {task_definition.name} variables"
report.status_extended = f"No secrets found in variables of ECS task definition {task_definition.name} revision {task_definition.revision}"
if task_definition.environment_variables:
for env_var in task_definition.environment_variables:
dump_env_vars = {}
@@ -36,7 +36,7 @@ class ecs_task_definitions_no_environment_secrets(Check):
if secrets.json():
report.status = "FAIL"
report.status_extended = f"Potential secret found in ECS in ECS task definition {task_definition.name} variables"
report.status_extended = f"Potential secret found in variables of ECS task definition {task_definition.name} revision {task_definition.revision}"
os.remove(temp_env_data_file.name)

7
tests/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets_test.py
View File

@@ -39,6 +39,7 @@ class Test_ecs_task_definitions_no_environment_secrets:
TaskDefinition(
name=task_name,
arn=f"arn:aws:ecs:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:task-definition/{task_name}:1",
revision="1",
region=AWS_REGION,
environment_variables=[
ContainerEnvVariable(
@@ -61,7 +62,8 @@ class Test_ecs_task_definitions_no_environment_secrets:
assert len(result) == 1
assert result[0].status == "PASS"
assert search(
"No secrets found in ECS task definition", result[0].status_extended
"No secrets found in variables of ECS task definition",
result[0].status_extended,
)
assert result[0].resource_id == task_name
assert (
@@ -76,6 +78,7 @@ class Test_ecs_task_definitions_no_environment_secrets:
TaskDefinition(
name=task_name,
arn=f"arn:aws:ecs:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:task-definition/{task_name}:1",
revision="1",
region=AWS_REGION,
environment_variables=[
ContainerEnvVariable(
@@ -98,7 +101,7 @@ class Test_ecs_task_definitions_no_environment_secrets:
assert len(result) == 1
assert result[0].status == "FAIL"
assert search(
"Potential secret found in ECS in ECS task definition",
"Potential secret found in variables of ECS task definition",
result[0].status_extended,
)
assert result[0].resource_id == task_name