diff --git a/prowler/__main__.py b/prowler/__main__.py index 1d7eb19b..f7f79202 100644 --- a/prowler/__main__.py +++ b/prowler/__main__.py @@ -12,6 +12,7 @@ from prowler.lib.check.check import ( exclude_services_to_run, execute_checks, list_categories, + list_checks_json, list_services, parse_checks_from_folder, print_categories, @@ -113,6 +114,11 @@ def prowler(): provider, ) + # if --list-checks-json, dump a json file and exit + if args.list_checks_json: + print(list_checks_json(provider, sorted(checks_to_execute))) + sys.exit() + # If -l/--list-checks passed as argument, print checks to execute and quit if args.list_checks: print_checks(provider, sorted(checks_to_execute), bulk_checks_metadata) diff --git a/prowler/lib/check/check.py b/prowler/lib/check/check.py index 27e685c9..5248f0e2 100644 --- a/prowler/lib/check/check.py +++ b/prowler/lib/check/check.py @@ -1,5 +1,6 @@ import functools import importlib +import json import os import re import shutil @@ -270,6 +271,15 @@ def print_compliance_requirements( ) +def list_checks_json(provider: str, check_list: set): + try: + output = {provider: check_list} + return json.dumps(output, indent=2, default=str) + except Exception as e: + logger.critical(f"{e.__class__.__name__}[{e.__traceback__.tb_lineno}]: {e}") + sys.exit(1) + + def print_checks( provider: str, check_list: set, diff --git a/prowler/lib/cli/parser.py b/prowler/lib/cli/parser.py index 32022835..823012c6 100644 --- a/prowler/lib/cli/parser.py +++ b/prowler/lib/cli/parser.py @@ -90,7 +90,7 @@ Detailed documentation at https://docs.prowler.cloud ) # Only Logging Configuration - if args.only_logs: + if args.only_logs or args.list_checks_json: args.no_banner = True return args @@ -244,6 +244,11 @@ Detailed documentation at https://docs.prowler.cloud list_group.add_argument( "-l", "--list-checks", action="store_true", help="List checks" ) + list_group.add_argument( + "--list-checks-json", + action="store_true", + help="Output a list of checks in json for use with --checks-file", + ) list_group.add_argument( "--list-services", action="store_true", help="List services" ) diff --git a/tests/lib/check/check_test.py b/tests/lib/check/check_test.py index 9321d92c..c7563a56 100644 --- a/tests/lib/check/check_test.py +++ b/tests/lib/check/check_test.py @@ -12,6 +12,7 @@ from prowler.lib.check.check import ( exclude_checks_to_run, exclude_services_to_run, list_categories, + list_checks_json, list_modules, list_services, parse_checks_from_file, @@ -595,3 +596,20 @@ class Test_Check: assert audit_metadata.services_scanned == 1 assert audit_metadata.expected_checks == expected_checks assert audit_metadata.completed_checks == 1 + + def test_list_checks_json_aws_lambda_and_s3(self): + provider = "aws" + check_list = { + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "awslambda_function_not_publicly_accessible", + "awslambda_function_url_cors_policy", + "awslambda_function_url_public", + "awslambda_function_using_supported_runtimes", + } + checks_json = list_checks_json(provider, sorted(check_list)) + assert ( + checks_json + == '{\n "aws": [\n "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled",\n "awslambda_function_no_secrets_in_code",\n "awslambda_function_no_secrets_in_variables",\n "awslambda_function_not_publicly_accessible",\n "awslambda_function_url_cors_policy",\n "awslambda_function_url_public",\n "awslambda_function_using_supported_runtimes"\n ]\n}' + ) diff --git a/tests/lib/cli/parser_test.py b/tests/lib/cli/parser_test.py index 3894a0ca..1f718c8e 100644 --- a/tests/lib/cli/parser_test.py +++ b/tests/lib/cli/parser_test.py @@ -592,6 +592,12 @@ class Test_Parser: parsed = self.parser.parse(command) assert parsed.list_checks + def test_list_checks_parser_list_checks_json(self): + argument = "--list-checks-json" + command = [prowler_command, argument] + parsed = self.parser.parse(command) + assert parsed.list_checks_json + def test_list_checks_parser_list_services(self): argument = "--list-services" command = [prowler_command, argument]