feat(pip): Prepare for PyPI (#1531)

tests/providers/aws/services/awslambda/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled/awslambda_function_invoke_api_operations_cloudtrail_logging_enabled_test.py

@@ -0,0 +1,217 @@
+from unittest import mock
+
+from boto3 import client, session
+from mock import patch
+from moto import mock_cloudtrail, mock_s3
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.lib.audit_info.audit_info import AWS_Audit_Info
+from prowler.providers.aws.services.awslambda.awslambda_service import Function
+
+AWS_REGION = "us-east-1"
+
+
+# Mock generate_regional_clients()
+def mock_generate_regional_clients(service, audit_info):
+    regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
+    regional_client.region = AWS_REGION
+    return {AWS_REGION: regional_client}
+
+
+# Patch every AWS call using Boto3 and generate_regional_clients to have 1 client
+@patch(
+    "prowler.providers.aws.services.accessanalyzer.accessanalyzer_service.generate_regional_clients",
+    new=mock_generate_regional_clients,
+)
+class Test_awslambda_function_invoke_api_operations_cloudtrail_logging_enabled:
+    # Mocked Audit Info
+    def set_mocked_audit_info(self):
+        audit_info = AWS_Audit_Info(
+            original_session=None,
+            audit_session=session.Session(
+                profile_name=None,
+                botocore_session=None,
+            ),
+            audited_account=None,
+            audited_user_id=None,
+            audited_partition="aws",
+            audited_identity_arn=None,
+            profile=None,
+            profile_region=None,
+            credentials=None,
+            assumed_role_info=None,
+            audited_regions=None,
+            organizations_metadata=None,
+        )
+        return audit_info
+
+    @mock_cloudtrail
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ), mock.patch(
+            "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
+            self.set_mocked_audit_info(),
+        ), mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client",
+            new=Cloudtrail(self.set_mocked_audit_info()),
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import (
+                awslambda_function_invoke_api_operations_cloudtrail_logging_enabled,
+            )
+
+            check = (
+                awslambda_function_invoke_api_operations_cloudtrail_logging_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 0
+
+    @mock_cloudtrail
+    @mock_s3
+    def test_lambda_not_recorded_by_cloudtrail(self):
+        # Lambda Client
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "python3.9"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            function_name: Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+            )
+        }
+
+        # CloudTrail Client
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
+        s3_client = client("s3", region_name=AWS_REGION)
+        trail_name = "test-trail"
+        bucket_name = "test-bucket"
+        s3_client.create_bucket(Bucket=bucket_name)
+        cloudtrail_client.create_trail(
+            Name=trail_name, S3BucketName=bucket_name, IsMultiRegionTrail=False
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ), mock.patch(
+            "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
+            self.set_mocked_audit_info(),
+        ), mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client",
+            new=Cloudtrail(self.set_mocked_audit_info()),
+        ):
+
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import (
+                awslambda_function_invoke_api_operations_cloudtrail_logging_enabled,
+            )
+
+            check = (
+                awslambda_function_invoke_api_operations_cloudtrail_logging_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} is not recorded by CloudTrail"
+            )
+
+    @mock_cloudtrail
+    @mock_s3
+    def test_lambda_recorded_by_cloudtrail(self):
+        # Lambda Client
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "python3.9"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            function_name: Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+            )
+        }
+
+        # CloudTrail Client
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
+        s3_client = client("s3", region_name=AWS_REGION)
+        trail_name = "test-trail"
+        bucket_name = "test-bucket"
+        s3_client.create_bucket(Bucket=bucket_name)
+        cloudtrail_client.create_trail(
+            Name=trail_name, S3BucketName=bucket_name, IsMultiRegionTrail=False
+        )
+        _ = cloudtrail_client.put_event_selectors(
+            TrailName=trail_name,
+            EventSelectors=[
+                {
+                    "ReadWriteType": "All",
+                    "IncludeManagementEvents": True,
+                    "DataResources": [
+                        {"Type": "AWS::Lambda::Function", "Values": [function_arn]}
+                    ],
+                }
+            ],
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ), mock.patch(
+            "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
+            self.set_mocked_audit_info(),
+        ), mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.cloudtrail_client",
+            new=Cloudtrail(self.set_mocked_audit_info()),
+        ):
+
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled.awslambda_function_invoke_api_operations_cloudtrail_logging_enabled import (
+                awslambda_function_invoke_api_operations_cloudtrail_logging_enabled,
+            )
+
+            check = (
+                awslambda_function_invoke_api_operations_cloudtrail_logging_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} is recorded by CloudTrail {trail_name}"
+            )

tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py

@@ -0,0 +1,127 @@
+import zipfile
+from unittest import mock
+
+from awslambda_service_test import create_zip_file
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.services.awslambda.awslambda_service import (
+    Function,
+    LambdaCode,
+)
+
+AWS_REGION = "us-east-1"
+
+
+class Test_awslambda_function_no_secrets_in_code:
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+                awslambda_function_no_secrets_in_code,
+            )
+
+            check = awslambda_function_no_secrets_in_code()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_function_code_with_secrets(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        code_with_secrets = """
+        def lambda_handler(event, context):
+                db_password = "test-password"
+                print("custom log event")
+                return event
+        """
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                code=LambdaCode(
+                    location="",
+                    code_zip=zipfile.ZipFile(create_zip_file(code_with_secrets)),
+                ),
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+                awslambda_function_no_secrets_in_code,
+            )
+
+            check = awslambda_function_no_secrets_in_code()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Potential secret found in Lambda function {function_name} code"
+            )
+
+    def test_function_code_without_secrets(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        code_with_secrets = """
+        def lambda_handler(event, context):
+                print("custom log event")
+                return event
+        """
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                code=LambdaCode(
+                    location="",
+                    code_zip=zipfile.ZipFile(create_zip_file(code_with_secrets)),
+                ),
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import (
+                awslambda_function_no_secrets_in_code,
+            )
+
+            check = awslambda_function_no_secrets_in_code()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"No secrets found in Lambda function {function_name} code"
+            )

tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_variables/awslambda_function_no_secrets_in_variables_test.py

@@ -0,0 +1,146 @@
+from unittest import mock
+
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.services.awslambda.awslambda_service import Function
+
+AWS_REGION = "us-east-1"
+
+
+class Test_awslambda_function_no_secrets_in_variables:
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables import (
+                awslambda_function_no_secrets_in_variables,
+            )
+
+            check = awslambda_function_no_secrets_in_variables()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_function_no_variables(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables import (
+                awslambda_function_no_secrets_in_variables,
+            )
+
+            check = awslambda_function_no_secrets_in_variables()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"No secrets found in Lambda function {function_name} variables"
+            )
+
+    def test_function_secrets_in_variables(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                environment={"db_password": "test-password"},
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables import (
+                awslambda_function_no_secrets_in_variables,
+            )
+
+            check = awslambda_function_no_secrets_in_variables()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Potential secret found in Lambda function {function_name} variables"
+            )
+
+    def test_function_no_secrets_in_variables(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                environment={"db_username": "test-user"},
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_variables.awslambda_function_no_secrets_in_variables import (
+                awslambda_function_no_secrets_in_variables,
+            )
+
+            check = awslambda_function_no_secrets_in_variables()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"No secrets found in Lambda function {function_name} variables"
+            )

tests/providers/aws/services/awslambda/awslambda_function_not_publicly_accessible/awslambda_function_not_publicly_accessible_test.py

@@ -0,0 +1,189 @@
+from unittest import mock
+
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.services.awslambda.awslambda_service import Function
+
+AWS_REGION = "us-east-1"
+
+
+class Test_awslambda_function_not_publicly_accessible:
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_function_public(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Sid": "public-access",
+                    "Principal": {"AWS": ["*", DEFAULT_ACCOUNT_ID]},
+                    "Effect": "Allow",
+                    "Action": [
+                        "lambda:InvokeFunction",
+                    ],
+                    "Resource": [function_arn],
+                }
+            ],
+        }
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                policy=lambda_policy,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has a policy resource-based policy with public access"
+            )
+
+    def test_function_not_public(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Sid": "public-access",
+                    "Principal": {"AWS": [DEFAULT_ACCOUNT_ID]},
+                    "Effect": "Allow",
+                    "Action": [
+                        "lambda:InvokeFunction",
+                    ],
+                    "Resource": [function_arn],
+                }
+            ],
+        }
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                policy=lambda_policy,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has a policy resource-based policy not public"
+            )
+
+    def test_function_public_with_canonical(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Sid": "public-access",
+                    "Principal": {"CanonicalUser": ["*"]},
+                    "Effect": "Allow",
+                    "Action": [
+                        "lambda:InvokeFunction",
+                    ],
+                    "Resource": [function_arn],
+                }
+            ],
+        }
+
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                policy=lambda_policy,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_not_publicly_accessible.awslambda_function_not_publicly_accessible import (
+                awslambda_function_not_publicly_accessible,
+            )
+
+            check = awslambda_function_not_publicly_accessible()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has a policy resource-based policy with public access"
+            )

tests/providers/aws/services/awslambda/awslambda_function_url_cors_policy/awslambda_function_url_cors_policy_test.py

@@ -0,0 +1,163 @@
+from unittest import mock
+
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.services.awslambda.awslambda_service import (
+    AuthType,
+    Function,
+    URLConfig,
+    URLConfigCORS,
+)
+
+AWS_REGION = "us-east-1"
+
+
+class Test_awslambda_function_url_cors_policy:
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy import (
+                awslambda_function_url_cors_policy,
+            )
+
+            check = awslambda_function_url_cors_policy()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_function_cors_asterisk(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                url_config=URLConfig(
+                    auth_type=AuthType.NONE,
+                    url="",
+                    cors_config=URLConfigCORS(allow_origins=["*"]),
+                ),
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy import (
+                awslambda_function_url_cors_policy,
+            )
+
+            check = awslambda_function_url_cors_policy()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} URL has a wide CORS configuration"
+            )
+
+    def test_function_cors_not_wide(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "python3.9"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                url_config=URLConfig(
+                    auth_type=AuthType.AWS_IAM,
+                    url="",
+                    cors_config=URLConfigCORS(allow_origins=["https://example.com"]),
+                ),
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy import (
+                awslambda_function_url_cors_policy,
+            )
+
+            check = awslambda_function_url_cors_policy()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has not a wide CORS configuration"
+            )
+
+    def test_function_cors_wide_with_two_origins(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "python3.9"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                url_config=URLConfig(
+                    auth_type=AuthType.AWS_IAM,
+                    url="",
+                    cors_config=URLConfigCORS(
+                        allow_origins=["https://example.com", "*"]
+                    ),
+                ),
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_url_cors_policy.awslambda_function_url_cors_policy import (
+                awslambda_function_url_cors_policy,
+            )
+
+            check = awslambda_function_url_cors_policy()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} URL has a wide CORS configuration"
+            )

tests/providers/aws/services/awslambda/awslambda_function_url_public/awslambda_function_url_public_test.py

@@ -0,0 +1,118 @@
+from unittest import mock
+
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.services.awslambda.awslambda_service import (
+    AuthType,
+    Function,
+    URLConfig,
+    URLConfigCORS,
+)
+
+AWS_REGION = "us-east-1"
+
+
+class Test_awslambda_function_url_public:
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_url_public.awslambda_function_url_public import (
+                awslambda_function_url_public,
+            )
+
+            check = awslambda_function_url_public()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_function_public_url(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                url_config=URLConfig(
+                    auth_type=AuthType.NONE,
+                    url="",
+                    cors_config=URLConfigCORS(allow_origins=[]),
+                ),
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_url_public.awslambda_function_url_public import (
+                awslambda_function_url_public,
+            )
+
+            check = awslambda_function_url_public()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has a publicly accessible function URL"
+            )
+
+    def test_function_private_url(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "python3.9"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+                url_config=URLConfig(
+                    auth_type=AuthType.AWS_IAM,
+                    url="",
+                    cors_config=URLConfigCORS(allow_origins=[]),
+                ),
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_url_public.awslambda_function_url_public import (
+                awslambda_function_url_public,
+            )
+
+            check = awslambda_function_url_public()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} has not a publicly accessible function URL"
+            )

tests/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes_test.py

@@ -0,0 +1,126 @@
+from unittest import mock
+
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.services.awslambda.awslambda_service import Function
+
+AWS_REGION = "us-east-1"
+
+
+def mock_get_config_var(config_var: str):
+    return [
+        "python3.6",
+        "python2.7",
+        "nodejs4.3",
+        "nodejs4.3-edge",
+        "nodejs6.10",
+        "nodejs",
+        "nodejs8.10",
+        "nodejs10.x",
+        "dotnetcore1.0",
+        "dotnetcore2.0",
+        "dotnetcore2.1",
+        "ruby2.5",
+    ]
+
+
+class Test_awslambda_function_using_supported_runtimes:
+    def test_no_functions(self):
+        lambda_client = mock.MagicMock
+        lambda_client.functions = {}
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes import (
+                awslambda_function_using_supported_runtimes,
+            )
+
+            check = awslambda_function_using_supported_runtimes()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_function_obsolete_runtime(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "nodejs4.3"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes.get_config_var",
+            new=mock_get_config_var,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes import (
+                awslambda_function_using_supported_runtimes,
+            )
+
+            check = awslambda_function_using_supported_runtimes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} is using {function_runtime} which is obsolete"
+            )
+
+    def test_function_supported_runtime(self):
+        lambda_client = mock.MagicMock
+        function_name = "test-lambda"
+        function_runtime = "python3.9"
+        function_arn = (
+            f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function/{function_name}"
+        )
+        lambda_client.functions = {
+            "function_name": Function(
+                name=function_name,
+                arn=function_arn,
+                region=AWS_REGION,
+                runtime=function_runtime,
+            )
+        }
+
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.Lambda",
+            new=lambda_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes.get_config_var",
+            new=mock_get_config_var,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.awslambda.awslambda_function_using_supported_runtimes.awslambda_function_using_supported_runtimes import (
+                awslambda_function_using_supported_runtimes,
+            )
+
+            check = awslambda_function_using_supported_runtimes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].region == AWS_REGION
+            assert result[0].resource_id == function_name
+            assert result[0].resource_arn == function_arn
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Lambda function {function_name} is using {function_runtime} which is supported"
+            )

tests/providers/aws/services/awslambda/awslambda_service_test.py

@@ -0,0 +1,227 @@
+import io
+import os
+import tempfile
+import zipfile
+from re import search
+from unittest.mock import patch
+
+import mock
+from boto3 import client, resource, session
+from moto import mock_iam, mock_lambda, mock_s3
+from moto.core import DEFAULT_ACCOUNT_ID
+
+from prowler.providers.aws.lib.audit_info.audit_info import current_audit_info
+from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
+from prowler.providers.aws.services.awslambda.awslambda_service import AuthType, Lambda
+
+# Mock Test Region
+AWS_REGION = "eu-west-1"
+
+
+def create_zip_file(code: str = "") -> io.BytesIO:
+    zip_output = io.BytesIO()
+    zip_file = zipfile.ZipFile(zip_output, "w", zipfile.ZIP_DEFLATED)
+    if not code:
+        zip_file.writestr(
+            "lambda_function.py",
+            """
+            def lambda_handler(event, context):
+                print("custom log event")
+                return event
+            """,
+        )
+    else:
+        zip_file.writestr("lambda_function.py", code)
+    zip_file.close()
+    zip_output.seek(0)
+    return zip_output
+
+
+def mock_request_get(_):
+    """Mock requests.get() to get the Lambda Code in Zip Format"""
+    mock_resp = mock.MagicMock
+    mock_resp.status_code = 200
+    mock_resp.content = create_zip_file().read()
+    return mock_resp
+
+
+# Mock generate_regional_clients()
+def mock_generate_regional_clients(service, audit_info):
+    regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
+    regional_client.region = AWS_REGION
+    return {AWS_REGION: regional_client}
+
+
+@patch(
+    "prowler.providers.aws.services.awslambda.awslambda_service.generate_regional_clients",
+    new=mock_generate_regional_clients,
+)
+class Test_Lambda_Service:
+    def set_mocked_audit_info(self):
+        audit_info = AWS_Audit_Info(
+            original_session=None,
+            audit_session=session.Session(
+                profile_name=None,
+                botocore_session=None,
+            ),
+            audited_account=DEFAULT_ACCOUNT_ID,
+            audited_user_id=None,
+            audited_partition="aws",
+            audited_identity_arn=None,
+            profile=None,
+            profile_region=None,
+            credentials=None,
+            assumed_role_info=None,
+            audited_regions=None,
+            organizations_metadata=None,
+        )
+        return audit_info
+
+    # Test Lambda Client
+    def test__get_client__(self):
+        awslambda = Lambda(current_audit_info)
+        assert awslambda.regional_clients[AWS_REGION].__class__.__name__ == "Lambda"
+
+    # Test Lambda Session
+    def test__get_session__(self):
+        awslambda = Lambda(current_audit_info)
+        assert awslambda.session.__class__.__name__ == "Session"
+
+    # Test Lambda Service
+    def test__get_service__(self):
+        awslambda = Lambda(current_audit_info)
+        assert awslambda.service == "lambda"
+
+    @mock_lambda
+    @mock_iam
+    @mock_s3
+    def test__list_functions__(self):
+        # Create IAM Lambda Role
+        iam_client = client("iam", region_name=AWS_REGION)
+        iam_role = iam_client.create_role(
+            RoleName="test-lambda-role",
+            AssumeRolePolicyDocument="test-policy",
+            Path="/",
+        )["Role"]["Arn"]
+        # Create S3 Bucket
+        s3_client = resource("s3", region_name=AWS_REGION)
+        s3_client.create_bucket(
+            Bucket="test-bucket",
+            CreateBucketConfiguration={"LocationConstraint": AWS_REGION},
+        )
+        # Create Test Lambda
+        lambda_client = client("lambda", region_name=AWS_REGION)
+        lambda_name = "test-lambda"
+        resp = lambda_client.create_function(
+            FunctionName=lambda_name,
+            Runtime="python3.7",
+            Role=iam_role,
+            Handler="lambda_function.lambda_handler",
+            Code={"ZipFile": create_zip_file().read()},
+            Description="test lambda function",
+            Timeout=3,
+            MemorySize=128,
+            PackageType="ZIP",
+            Publish=True,
+            VpcConfig={
+                "SecurityGroupIds": ["sg-123abc"],
+                "SubnetIds": ["subnet-123abc"],
+            },
+            Environment={"Variables": {"db-password": "test-password"}},
+        )
+        # Update Lambda Policy
+        lambda_policy = {
+            "Version": "2012-10-17",
+            "Id": "default",
+            "Statement": [
+                {
+                    "Action": "lambda:GetFunction",
+                    "Principal": "*",
+                    "Effect": "Allow",
+                    "Resource": f"arn:aws:lambda:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:function:{lambda_name}",
+                    "Sid": "test",
+                }
+            ],
+        }
+        _ = lambda_client.add_permission(
+            FunctionName=lambda_name,
+            StatementId="test",
+            Action="lambda:GetFunction",
+            Principal="*",
+        )
+        # Create Function URL Config
+        _ = lambda_client.create_function_url_config(
+            FunctionName=lambda_name,
+            AuthType=AuthType.AWS_IAM.value,
+            Cors={
+                "AllowCredentials": True,
+                "AllowHeaders": [
+                    "string",
+                ],
+                "AllowMethods": [
+                    "string",
+                ],
+                "AllowOrigins": [
+                    "*",
+                ],
+                "ExposeHeaders": [
+                    "string",
+                ],
+                "MaxAge": 123,
+            },
+        )
+
+        lambda_arn = resp["FunctionArn"]
+        with mock.patch(
+            "prowler.providers.aws.services.awslambda.awslambda_service.requests.get",
+            new=mock_request_get,
+        ):
+            awslambda = Lambda(self.set_mocked_audit_info())
+
+            assert awslambda.functions
+            assert awslambda.functions[lambda_name].name == lambda_name
+            assert awslambda.functions[lambda_name].arn == lambda_arn
+            assert awslambda.functions[lambda_name].runtime == "python3.7"
+            assert awslambda.functions[lambda_name].environment == {
+                "db-password": "test-password"
+            }
+            assert awslambda.functions[lambda_name].region == AWS_REGION
+            assert awslambda.functions[lambda_name].policy == lambda_policy
+
+            assert awslambda.functions[lambda_name].code
+            assert search(
+                f"s3://awslambda-{AWS_REGION}-tasks.s3-{AWS_REGION}.amazonaws.com",
+                awslambda.functions[lambda_name].code.location,
+            )
+
+            assert awslambda.functions[lambda_name].url_config
+            assert (
+                awslambda.functions[lambda_name].url_config.auth_type
+                == AuthType.AWS_IAM
+            )
+            assert search(
+                "lambda-url.eu-west-1.on.aws",
+                awslambda.functions[lambda_name].url_config.url,
+            )
+
+            assert awslambda.functions[lambda_name].url_config.cors_config
+            assert awslambda.functions[
+                lambda_name
+            ].url_config.cors_config.allow_origins == ["*"]
+
+            # Pending ZipFile tests
+            with tempfile.TemporaryDirectory() as tmp_dir_name:
+                awslambda.functions[lambda_name].code.code_zip.extractall(tmp_dir_name)
+                files_in_zip = next(os.walk(tmp_dir_name))[2]
+                assert len(files_in_zip) == 1
+                assert files_in_zip[0] == "lambda_function.py"
+                with open(f"{tmp_dir_name}/{files_in_zip[0]}", "r") as lambda_code_file:
+                    _ = lambda_code_file
+                    # assert (
+                    #     lambda_code_file.read()
+                    #     == """
+                    # def lambda_handler(event, context):
+                    # print("custom log event")
+                    # return event
+                    # """
+                    # )