Skip to content

Commit 18885d0

Browse files
puchy22puchy22
authored
chore(ec2): Change security groups to dict (#4700)
1 parent ca56ac4 commit 18885d0

File tree

44 files changed

+127
-132
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+127
-132
lines changed

‎docs/developer-guide/checks.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ class ec2_securitygroup_with_many_ingress_egress_rules(Check):
222222
max_security_group_rules = ec2_client.audit_config.get(
223223
"max_security_group_rules", 50
224224
)
225-
for security_group in ec2_client.security_groups:
225+
for security_group_arn, security_group in ec2_client.security_groups.items():
226226
```
227227

228228
```yaml title="config.yaml"

‎prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ def execute(self):
2222
if instance.security_groups:
2323
report.status = "PASS"
2424
report.status_extended = f"DMS Replication Instance {instance.id} is set as publicly accessible but filtered with security groups."
25-
for security_group in ec2_client.security_groups:
25+
for security_group in ec2_client.security_groups.values():
2626
if security_group.id in instance.security_groups:
2727
for ingress_rule in security_group.ingress_rules:
2828
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_cassandra_exposed_to_internet/ec2_instance_port_cassandra_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_cifs_exposed_to_internet/ec2_instance_port_cifs_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ def execute(self):
2222
report.resource_tags = instance.tags
2323
is_open_port = False
2424
if instance.security_groups:
25-
for sg in ec2_client.security_groups:
25+
for sg in ec2_client.security_groups.values():
2626
if sg.id in instance.security_groups:
2727
for ingress_rule in sg.ingress_rules:
2828
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_elasticsearch_kibana_exposed_to_internet/ec2_instance_port_elasticsearch_kibana_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_ftp_exposed_to_internet/ec2_instance_port_ftp_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ def execute(self):
2222
report.resource_tags = instance.tags
2323
is_open_port = False
2424
if instance.security_groups:
25-
for sg in ec2_client.security_groups:
25+
for sg in ec2_client.security_groups.values():
2626
if sg.id in instance.security_groups:
2727
for ingress_rule in sg.ingress_rules:
2828
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_kafka_exposed_to_internet/ec2_instance_port_kafka_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_kerberos_exposed_to_internet/ec2_instance_port_kerberos_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_ldap_exposed_to_internet/ec2_instance_port_ldap_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ def execute(self):
2222
report.resource_tags = instance.tags
2323
is_open_port = False
2424
if instance.security_groups:
25-
for sg in ec2_client.security_groups:
25+
for sg in ec2_client.security_groups.values():
2626
if sg.id in instance.security_groups:
2727
for ingress_rule in sg.ingress_rules:
2828
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_memcached_exposed_to_internet/ec2_instance_port_memcached_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_mongodb_exposed_to_internet/ec2_instance_port_mongodb_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_oracle_exposed_to_internet/ec2_instance_port_oracle_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_postgresql_exposed_to_internet/ec2_instance_port_postgresql_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_rdp_exposed_to_internet/ec2_instance_port_rdp_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_redis_exposed_to_internet/ec2_instance_port_redis_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_sqlserver_exposed_to_internet/ec2_instance_port_sqlserver_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_ssh_exposed_to_internet/ec2_instance_port_ssh_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_instance_port_telnet_exposed_to_internet/ec2_instance_port_telnet_exposed_to_internet.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def execute(self):
2020
report.resource_tags = instance.tags
2121
is_open_port = False
2222
if instance.security_groups:
23-
for sg in ec2_client.security_groups:
23+
for sg in ec2_client.security_groups.values():
2424
if sg.id in instance.security_groups:
2525
for ingress_rule in sg.ingress_rules:
2626
if check_security_group(

‎prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_all_ports/ec2_securitygroup_allow_ingress_from_internet_to_all_ports.py

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
from prowler.lib.check.models import Check, Check_Report_AWS
22
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
3-
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
43
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
4+
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
55

66

77
class ec2_securitygroup_allow_ingress_from_internet_to_all_ports(Check):
88
def execute(self):
99
findings = []
10-
for security_group in ec2_client.security_groups:
10+
for security_group_arn, security_group in ec2_client.security_groups.items():
1111
# Check if ignoring flag is set and if the VPC and the SG is in use
1212
if ec2_client.provider.scan_unused_services or (
1313
security_group.vpc_id in vpc_client.vpcs
@@ -20,13 +20,13 @@ def execute(self):
2020
report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have all ports open to the Internet."
2121
report.resource_details = security_group.name
2222
report.resource_id = security_group.id
23-
report.resource_arn = security_group.arn
23+
report.resource_arn = security_group_arn
2424
report.resource_tags = security_group.tags
2525
for ingress_rule in security_group.ingress_rules:
2626
if check_security_group(ingress_rule, "-1", any_address=True):
2727
ec2_client.set_failed_check(
2828
self.__class__.__name__,
29-
security_group.arn,
29+
security_group_arn,
3030
)
3131
report.status = "FAIL"
3232
report.status_extended = f"Security group {security_group.name} ({security_group.id}) has all ports open to the Internet."

‎prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py

+6-7
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
from prowler.lib.check.models import Check, Check_Report_AWS
22
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
3-
from prowler.providers.aws.services.ec2.ec2_service import NetworkInterface
4-
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
5-
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
63
from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import (
74
ec2_securitygroup_allow_ingress_from_internet_to_all_ports,
85
)
6+
from prowler.providers.aws.services.ec2.ec2_service import NetworkInterface
7+
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
8+
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
99

1010

1111
class ec2_securitygroup_allow_ingress_from_internet_to_any_port(Check):
1212
def execute(self):
1313
findings = []
14-
for security_group in ec2_client.security_groups:
14+
for security_group_arn, security_group in ec2_client.security_groups.items():
1515
# Check if ignoring flag is set and if the VPC and the SG is in use
1616
if ec2_client.provider.scan_unused_services or (
1717
security_group.vpc_id in vpc_client.vpcs
@@ -24,12 +24,12 @@ def execute(self):
2424
report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have any port open to the Internet."
2525
report.resource_details = security_group.name
2626
report.resource_id = security_group.id
27-
report.resource_arn = security_group.arn
27+
report.resource_arn = security_group_arn
2828
report.resource_tags = security_group.tags
2929
# only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice
3030
if not ec2_client.is_failed_check(
3131
ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__,
32-
security_group.arn,
32+
security_group_arn,
3333
):
3434
# Loop through every security group's ingress rule and check it
3535
for ingress_rule in security_group.ingress_rules:
@@ -61,7 +61,6 @@ def check_enis(
6161
):
6262
report.status_extended = f"Security group {security_group_name} ({security_group_id}) has at least one port open to the Internet but is exclusively not attached to any network interface."
6363
for eni in enis:
64-
6564
if self.is_allowed_eni_type(eni_type=eni.type):
6665
report.status = "PASS"
6766
report.status_extended = f"Security group {security_group_name} ({security_group_id}) has at least one port open to the Internet but is exclusively attached to an allowed network interface type ({eni.type})."

‎prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018/ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018.py

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
from prowler.lib.check.models import Check, Check_Report_AWS
22
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
3-
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
4-
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
53
from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import (
64
ec2_securitygroup_allow_ingress_from_internet_to_all_ports,
75
)
6+
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
7+
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
88

99

1010
class ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018(Check):
1111
def execute(self):
1212
findings = []
1313
check_ports = [27017, 27018]
14-
for security_group in ec2_client.security_groups:
14+
for security_group_arn, security_group in ec2_client.security_groups.items():
1515
# Check if ignoring flag is set and if the VPC and the SG is in use
1616
if ec2_client.provider.scan_unused_services or (
1717
security_group.vpc_id in vpc_client.vpcs
@@ -22,14 +22,14 @@ def execute(self):
2222
report.region = security_group.region
2323
report.resource_details = security_group.name
2424
report.resource_id = security_group.id
25-
report.resource_arn = security_group.arn
25+
report.resource_arn = security_group_arn
2626
report.resource_tags = security_group.tags
2727
report.status = "PASS"
2828
report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have MongoDB ports 27017 and 27018 open to the Internet."
2929
# only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice
3030
if not ec2_client.is_failed_check(
3131
ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__,
32-
security_group.arn,
32+
security_group_arn,
3333
):
3434
# Loop through every security group's ingress rule and check it
3535
for ingress_rule in security_group.ingress_rules:

‎prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21/ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21.py

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
from prowler.lib.check.models import Check, Check_Report_AWS
22
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
3-
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
4-
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
53
from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import (
64
ec2_securitygroup_allow_ingress_from_internet_to_all_ports,
75
)
6+
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
7+
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
88

99

1010
class ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21(Check):
1111
def execute(self):
1212
findings = []
1313
check_ports = [20, 21]
14-
for security_group in ec2_client.security_groups:
14+
for security_group_arn, security_group in ec2_client.security_groups.items():
1515
# Check if ignoring flag is set and if the VPC and the SG is in use
1616
if ec2_client.provider.scan_unused_services or (
1717
security_group.vpc_id in vpc_client.vpcs
@@ -24,12 +24,12 @@ def execute(self):
2424
report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have FTP ports 20 and 21 open to the Internet."
2525
report.resource_details = security_group.name
2626
report.resource_id = security_group.id
27-
report.resource_arn = security_group.arn
27+
report.resource_arn = security_group_arn
2828
report.resource_tags = security_group.tags
2929
# only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice
3030
if not ec2_client.is_failed_check(
3131
ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__,
32-
security_group.arn,
32+
security_group_arn,
3333
):
3434
# Loop through every security group's ingress rule and check it
3535
for ingress_rule in security_group.ingress_rules:

‎prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22/ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22.py

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
from prowler.lib.check.models import Check, Check_Report_AWS
22
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
3-
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
4-
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
53
from prowler.providers.aws.services.ec2.ec2_securitygroup_allow_ingress_from_internet_to_all_ports import (
64
ec2_securitygroup_allow_ingress_from_internet_to_all_ports,
75
)
6+
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
7+
from prowler.providers.aws.services.vpc.vpc_client import vpc_client
88

99

1010
class ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22(Check):
1111
def execute(self):
1212
findings = []
1313
check_ports = [22]
14-
for security_group in ec2_client.security_groups:
14+
for security_group_arn, security_group in ec2_client.security_groups.items():
1515
# Check if ignoring flag is set and if the VPC and the SG is in use
1616
if ec2_client.provider.scan_unused_services or (
1717
security_group.vpc_id in vpc_client.vpcs
@@ -24,12 +24,12 @@ def execute(self):
2424
report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have SSH port 22 open to the Internet."
2525
report.resource_details = security_group.name
2626
report.resource_id = security_group.id
27-
report.resource_arn = security_group.arn
27+
report.resource_arn = security_group_arn
2828
report.resource_tags = security_group.tags
2929
# only proceed if check "..._to_all_ports" did not run or did not FAIL to avoid to report open ports twice
3030
if not ec2_client.is_failed_check(
3131
ec2_securitygroup_allow_ingress_from_internet_to_all_ports.__name__,
32-
security_group.arn,
32+
security_group_arn,
3333
):
3434
# Loop through every security group's ingress rule and check it
3535
for ingress_rule in security_group.ingress_rules:

0 commit comments

Comments
 (0)