feat(backup): New backup service and checks (#2172)

Co-authored-by: Nacho Rivera <nacho@verica.io>

tests/providers/aws/services/backup/backup_plans_exist/backup_plans_exist_test.py

@@ -0,0 +1,67 @@
+from datetime import datetime
+from unittest import mock
+
+from prowler.providers.aws.services.backup.backup_service import BackupPlan
+
+AWS_REGION = "eu-west-1"
+
+
+class Test_backup_plans_exist:
+    def test_no_backup_plans(self):
+        backup_client = mock.MagicMock
+        backup_client.general_region = AWS_REGION
+        backup_client.backup_plans = []
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_plans_exist.backup_plans_exist import (
+                backup_plans_exist,
+            )
+
+            check = backup_plans_exist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "No Backup Plan Exist"
+            assert result[0].resource_id == "No Backups"
+            assert result[0].resource_arn == ""
+            assert result[0].region == AWS_REGION
+
+    def test_one_backup_plan(self):
+        backup_client = mock.MagicMock
+        backup_client.general_region = AWS_REGION
+        backup_client.backup_plans = [
+            BackupPlan(
+                arn="ARN",
+                id="MyBackupPlan",
+                region=AWS_REGION,
+                name="MyBackupPlan",
+                version_id="version_id",
+                last_execution_date=datetime(2015, 1, 1),
+                advanced_settings=[],
+            )
+        ]
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_plans_exist.backup_plans_exist import (
+                backup_plans_exist,
+            )
+
+            check = backup_plans_exist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "At least one backup plan exists: " + result[0].resource_id
+            )
+            assert result[0].resource_id == "MyBackupPlan"
+            assert result[0].resource_arn == "ARN"
+            assert result[0].region == AWS_REGION

tests/providers/aws/services/backup/backup_reportplans_exist/backup_reportplans_exist_test.py

@@ -0,0 +1,66 @@
+from datetime import datetime
+from unittest import mock
+
+from prowler.providers.aws.services.backup.backup_service import BackupReportPlan
+
+AWS_REGION = "eu-west-1"
+
+
+class Test_backup_reportplans_exist:
+    def test_no_backup_report_plans(self):
+        backup_client = mock.MagicMock
+        backup_client.general_region = AWS_REGION
+        backup_client.backup_report_plans = []
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_reportplans_exist.backup_reportplans_exist import (
+                backup_reportplans_exist,
+            )
+
+            check = backup_reportplans_exist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "No Backup Report Plan Exist"
+            assert result[0].resource_id == "No Backups"
+            assert result[0].resource_arn == ""
+            assert result[0].region == AWS_REGION
+
+    def test_one_backup_report_plan(self):
+        backup_client = mock.MagicMock
+        backup_client.general_region = AWS_REGION
+        backup_client.backup_report_plans = [
+            BackupReportPlan(
+                arn="ARN",
+                region=AWS_REGION,
+                name="MyBackupReportPlan",
+                last_attempted_execution_date=datetime(2015, 1, 1),
+                last_successful_execution_date=datetime(2015, 1, 1),
+            )
+        ]
+
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_reportplans_exist.backup_reportplans_exist import (
+                backup_reportplans_exist,
+            )
+
+            check = backup_reportplans_exist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "At least one backup report plan exists: " + result[0].resource_id
+            )
+            assert result[0].resource_id == "MyBackupReportPlan"
+            assert result[0].resource_arn == "ARN"
+            assert result[0].region == AWS_REGION

tests/providers/aws/services/backup/backup_service_test.py

@@ -0,0 +1,157 @@
+from datetime import datetime
+from unittest.mock import patch
+
+import botocore
+from boto3 import session
+
+from prowler.providers.aws.lib.audit_info.audit_info import AWS_Audit_Info
+from prowler.providers.aws.services.backup.backup_service import Backup
+
+# Mock Test Region
+AWS_REGION = "eu-west-1"
+
+# Mocking Backup Calls
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+    """
+    Mock every AWS API call
+    """
+    if operation_name == "ListBackupVaults":
+        return {
+            "BackupVaultList": [
+                {
+                    "BackupVaultArn": "ARN",
+                    "BackupVaultName": "Test Vault",
+                    "EncryptionKeyArn": "",
+                    "NumberOfRecoveryPoints": 0,
+                    "Locked": True,
+                    "MinRetentionDays": 1,
+                    "MaxRetentionDays": 2,
+                }
+            ]
+        }
+    if operation_name == "ListBackupPlans":
+        return {
+            "BackupPlansList": [
+                {
+                    "BackupPlanArn": "ARN",
+                    "BackupPlanId": "ID",
+                    "BackupPlanName": "Test Plan",
+                    "VersionId": "test_version_id",
+                    "LastExecutionDate": datetime(2015, 1, 1),
+                    "AdvancedBackupSettings": [],
+                }
+            ]
+        }
+    if operation_name == "ListReportPlans":
+        return {
+            "ReportPlans": [
+                {
+                    "ReportPlanArn": "ARN",
+                    "ReportPlanName": "Test Report Plan",
+                    "LastAttemptedExecutionTime": datetime(2015, 1, 1),
+                    "LastSuccessfulExecutionTime": datetime(2015, 1, 1),
+                }
+            ]
+        }
+    return make_api_call(self, operation_name, kwarg)
+
+
+def mock_generate_regional_clients(service, audit_info):
+    regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
+    regional_client.region = AWS_REGION
+    return {AWS_REGION: regional_client}
+
+
+# Patch every AWS call using Boto3 and generate_regional_clients to have 1 client
+@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+@patch(
+    "prowler.providers.aws.services.backup.backup_service.generate_regional_clients",
+    new=mock_generate_regional_clients,
+)
+class Test_Backup_Service:
+
+    # Mocked Audit Info
+    def set_mocked_audit_info(self):
+        audit_info = AWS_Audit_Info(
+            session_config=None,
+            original_session=None,
+            audit_session=session.Session(
+                profile_name=None,
+                botocore_session=None,
+            ),
+            audited_account=None,
+            audited_user_id=None,
+            audited_partition="aws",
+            audited_identity_arn=None,
+            profile=None,
+            profile_region=None,
+            credentials=None,
+            assumed_role_info=None,
+            audited_regions=None,
+            organizations_metadata=None,
+            audit_resources=None,
+        )
+        return audit_info
+
+    # Test Backup Client
+    def test__get_client__(self):
+        audit_info = self.set_mocked_audit_info()
+        backup = Backup(audit_info)
+        assert backup.regional_clients[AWS_REGION].__class__.__name__ == "Backup"
+
+    # Test Backup Session
+    def test__get_session__(self):
+        audit_info = self.set_mocked_audit_info()
+        access_analyzer = Backup(audit_info)
+        assert access_analyzer.session.__class__.__name__ == "Session"
+
+    # Test Backup Service
+    def test__get_service__(self):
+        audit_info = self.set_mocked_audit_info()
+        access_analyzer = Backup(audit_info)
+        assert access_analyzer.service == "backup"
+
+    # Test Backup List Backup Vaults
+    def test__list_backup_vaults__(self):
+        audit_info = self.set_mocked_audit_info()
+        backup = Backup(audit_info)
+        assert len(backup.backup_vaults) == 1
+        assert backup.backup_vaults[0].arn == "ARN"
+        assert backup.backup_vaults[0].name == "Test Vault"
+        assert backup.backup_vaults[0].region == AWS_REGION
+        assert backup.backup_vaults[0].encryption == ""
+        assert backup.backup_vaults[0].recovery_points == 0
+        assert backup.backup_vaults[0].locked is True
+        assert backup.backup_vaults[0].min_retention_days == 1
+        assert backup.backup_vaults[0].max_retention_days == 2
+
+    # Test Backup List Backup Plans
+    def test__list_backup_plans__(self):
+        audit_info = self.set_mocked_audit_info()
+        backup = Backup(audit_info)
+        assert len(backup.backup_plans) == 1
+        assert backup.backup_plans[0].arn == "ARN"
+        assert backup.backup_plans[0].id == "ID"
+        assert backup.backup_plans[0].region == AWS_REGION
+        assert backup.backup_plans[0].name == "Test Plan"
+        assert backup.backup_plans[0].version_id == "test_version_id"
+        assert backup.backup_plans[0].last_execution_date == datetime(2015, 1, 1)
+        assert backup.backup_plans[0].advanced_settings == []
+
+    # Test Backup List Report Plans
+    def test__list_backup_report_plans__(self):
+        audit_info = self.set_mocked_audit_info()
+        backup = Backup(audit_info)
+        assert len(backup.backup_report_plans) == 1
+        assert backup.backup_report_plans[0].arn == "ARN"
+        assert backup.backup_report_plans[0].region == AWS_REGION
+        assert backup.backup_report_plans[0].name == "Test Report Plan"
+        assert backup.backup_report_plans[0].last_attempted_execution_date == datetime(
+            2015, 1, 1
+        )
+        assert backup.backup_report_plans[0].last_successful_execution_date == datetime(
+            2015, 1, 1
+        )

tests/providers/aws/services/backup/backup_vaults_encrypted/backup_vaults_encrypted_test.py

@@ -0,0 +1,98 @@
+from unittest import mock
+
+from prowler.providers.aws.services.backup.backup_service import BackupVault
+
+AWS_REGION = "eu-west-1"
+
+
+class Test_backup_vaults_encrypted:
+    def test_no_backup_vaults(self):
+        backup_client = mock.MagicMock
+        backup_client.backup_vaults = []
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_vaults_encrypted.backup_vaults_encrypted import (
+                backup_vaults_encrypted,
+            )
+
+            check = backup_vaults_encrypted()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_one_backup_vault_unencrypted(self):
+        backup_client = mock.MagicMock
+        backup_client.backup_vaults = [
+            BackupVault(
+                arn="ARN",
+                name="MyBackupVault",
+                region=AWS_REGION,
+                encryption="",
+                recovery_points=1,
+                locked=True,
+                min_retention_days=1,
+                max_retention_days=2,
+            )
+        ]
+
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_vaults_encrypted.backup_vaults_encrypted import (
+                backup_vaults_encrypted,
+            )
+
+            check = backup_vaults_encrypted()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Backup Vault " + result[0].resource_id + " is not encrypted"
+            )
+            assert result[0].resource_id == "MyBackupVault"
+            assert result[0].resource_arn == "ARN"
+            assert result[0].region == AWS_REGION
+
+    def test_one_backup_vault_encrypted(self):
+        backup_client = mock.MagicMock
+        backup_client.backup_vaults = [
+            BackupVault(
+                arn="ARN",
+                name="MyBackupVault",
+                region=AWS_REGION,
+                encryption="test",
+                recovery_points=1,
+                locked=True,
+                min_retention_days=1,
+                max_retention_days=2,
+            )
+        ]
+
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_vaults_encrypted.backup_vaults_encrypted import (
+                backup_vaults_encrypted,
+            )
+
+            check = backup_vaults_encrypted()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Backup Vault " + result[0].resource_id + " is encrypted"
+            )
+            assert result[0].resource_id == "MyBackupVault"
+            assert result[0].resource_arn == "ARN"
+            assert result[0].region == AWS_REGION

tests/providers/aws/services/backup/backup_vaults_exist/backup_vaults_exist_test.py

@@ -0,0 +1,68 @@
+from unittest import mock
+
+from prowler.providers.aws.services.backup.backup_service import BackupVault
+
+AWS_REGION = "eu-west-1"
+
+
+class Test_backup_vaults_exist:
+    def test_no_backup_vaults(self):
+        backup_client = mock.MagicMock
+        backup_client.general_region = AWS_REGION
+        backup_client.backup_vaults = []
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_vaults_exist.backup_vaults_exist import (
+                backup_vaults_exist,
+            )
+
+            check = backup_vaults_exist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "No Backup Vault Exist"
+            assert result[0].resource_id == "No Backups"
+            assert result[0].resource_arn == ""
+            assert result[0].region == AWS_REGION
+
+    def test_one_backup_vault(self):
+        backup_client = mock.MagicMock
+        backup_client.general_region = AWS_REGION
+        backup_client.backup_vaults = [
+            BackupVault(
+                arn="ARN",
+                name="MyBackupVault",
+                region=AWS_REGION,
+                encryption="",
+                recovery_points=1,
+                locked=True,
+                min_retention_days=1,
+                max_retention_days=2,
+            )
+        ]
+
+        with mock.patch(
+            "prowler.providers.aws.services.backup.backup_service.Backup",
+            new=backup_client,
+        ):
+            # Test Check
+            from prowler.providers.aws.services.backup.backup_vaults_exist.backup_vaults_exist import (
+                backup_vaults_exist,
+            )
+
+            check = backup_vaults_exist()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "At least one backup vault exists: " + result[0].resource_id
+            )
+            assert result[0].resource_id == "MyBackupVault"
+            assert result[0].resource_arn == "ARN"
+            assert result[0].region == AWS_REGION