ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-12 15:55:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(vpc): add vpc, nacl or subnet names in findings (#2928)

Browse Source
This commit is contained in:
Sergio Garcia
2023-10-18 16:07:53 +02:00
committed by GitHub
parent 236f57ab0e
commit eb3cb97115
15 changed files with 170 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
tests/providers/aws/services/networkfirewall/networkfirewall_in_all_vpc/networkfirewall_in_all_vpc_test.py
View File

@@ -102,6 +102,7 @@ class Test_networkfirewall_in_all_vpc:
vpc_client.vpcs = {
VPC_ID_PROTECTED: VPCs(
id=VPC_ID_PROTECTED,
name="",
default=False,
cidr_block="192.168.0.0/16",
flow_log=False,
@@ -111,6 +112,7 @@ class Test_networkfirewall_in_all_vpc:
VpcSubnet(
id="subnet-123456789",
arn="arn_test",
name="",
default=False,
vpc_id=VPC_ID_PROTECTED,
cidr_block="192.168.0.0/24",
@@ -168,6 +170,7 @@ class Test_networkfirewall_in_all_vpc:
vpc_client.vpcs = {
VPC_ID_UNPROTECTED: VPCs(
id=VPC_ID_UNPROTECTED,
name="",
default=False,
cidr_block="192.168.0.0/16",
flow_log=False,
@@ -177,6 +180,7 @@ class Test_networkfirewall_in_all_vpc:
VpcSubnet(
id="subnet-123456789",
arn="arn_test",
name="",
default=False,
vpc_id=VPC_ID_UNPROTECTED,
cidr_block="192.168.0.0/24",
@@ -225,6 +229,74 @@ class Test_networkfirewall_in_all_vpc:
assert result[0].resource_tags == []
assert result[0].resource_arn == "arn_test"
def test_vpcs_with_name_without_firewall(self):
networkfirewall_client = mock.MagicMock
networkfirewall_client.region = AWS_REGION
networkfirewall_client.network_firewalls = []
vpc_client = mock.MagicMock
vpc_client.region = AWS_REGION
vpc_client.vpcs = {
VPC_ID_UNPROTECTED: VPCs(
id=VPC_ID_UNPROTECTED,
name="vpc_name",
default=False,
cidr_block="192.168.0.0/16",
flow_log=False,
region=AWS_REGION,
arn="arn_test",
subnets=[
VpcSubnet(
id="subnet-123456789",
arn="arn_test",
name="",
default=False,
vpc_id=VPC_ID_UNPROTECTED,
cidr_block="192.168.0.0/24",
availability_zone="us-east-1a",
public=False,
nat_gateway=False,
region=AWS_REGION,
tags=[],
mapPublicIpOnLaunch=False,
)
],
tags=[],
)
}
audit_info = self.set_mocked_audit_info()
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
new=audit_info,
):
with mock.patch(
"prowler.providers.aws.services.networkfirewall.networkfirewall_in_all_vpc.networkfirewall_in_all_vpc.vpc_client",
new=vpc_client,
):
with mock.patch(
"prowler.providers.aws.services.networkfirewall.networkfirewall_in_all_vpc.networkfirewall_in_all_vpc.networkfirewall_client",
new=networkfirewall_client,
):
# Test Check
from prowler.providers.aws.services.networkfirewall.networkfirewall_in_all_vpc.networkfirewall_in_all_vpc import (
networkfirewall_in_all_vpc,
)
check = networkfirewall_in_all_vpc()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "VPC vpc_name does not have Network Firewall enabled."
)
assert result[0].region == AWS_REGION
assert result[0].resource_id == VPC_ID_UNPROTECTED
assert result[0].resource_tags == []
assert result[0].resource_arn == "arn_test"
def test_vpcs_with_and_without_firewall(self):
networkfirewall_client = mock.MagicMock
networkfirewall_client.region = AWS_REGION
@@ -244,6 +316,7 @@ class Test_networkfirewall_in_all_vpc:
vpc_client.vpcs = {
VPC_ID_UNPROTECTED: VPCs(
id=VPC_ID_UNPROTECTED,
name="",
default=False,
cidr_block="192.168.0.0/16",
flow_log=False,
@@ -253,6 +326,7 @@ class Test_networkfirewall_in_all_vpc:
VpcSubnet(
id="subnet-123456789",
arn="arn_test",
name="",
default=False,
vpc_id=VPC_ID_UNPROTECTED,
cidr_block="192.168.0.0/24",
@@ -268,6 +342,7 @@ class Test_networkfirewall_in_all_vpc:
),
VPC_ID_PROTECTED: VPCs(
id=VPC_ID_PROTECTED,
name="",
default=False,
cidr_block="192.168.0.0/16",
flow_log=False,
@@ -277,6 +352,7 @@ class Test_networkfirewall_in_all_vpc:
VpcSubnet(
id="subnet-123456789",
arn="arn_test",
name="",
default=False,
vpc_id=VPC_ID_PROTECTED,
cidr_block="192.168.0.0/24",