Skip to content

Prowler 3.10.0 - Dance of Death
Compare
Choose a tag to compare
@MrCloudSec MrCloudSec released this 11 Oct 14:44
· 2375 commits to master since this release
3.10.0
34cc6d0

Then they summoned me over to join in with them
At the dance of the dead
Into the circle of fire I followed them
Into the middle I was led

Dance of Death is an Iron Maiden's song, released on their 2003 album of the same name. The song combines the band's signature heavy metal sound with progressive elements. Lyrically, the song tells a story of a medieval dance of death, a symbolic representation of mortality and the inevitability of death. The lyrics are filled with vivid and dark imagery, and the song features intricate guitar work and powerful vocals from Bruce Dickinson. Enjoy this great song (https://www.youtube.com/watch?v=3659fTXvFts) while reading what's new! 🎸

New features to highlight in this version:

⚙️ New checks for AWS!

  • New AWS IAM check iam_role_administratoraccess_policy.
  • New AWS WAFv2 check wafv2_webacl_logging_enabled.
  • Now the AWS IAM credentials checks (iam_disable_90_days_credentials, iam_disable_45_days_credentials and iam_disable_30_days_credentials) have been changed to two generic checks called iam_user_accesskey_unused and iam_user_console_access_unused. By default, it will fail when they are unused for 45 days, you can configure this value using the max_unused_access_keys_days and max_console_access_days configuration values. Read more at https://docs.prowler.cloud/en/latest/tutorials/configuration_file/

Try them with prowler aws and improve your security posture now! 🔒

🏷️ Security Hub Tagging

  • Now Prowler will add AWS Resource Tags to every Security Hub finding and to json-asff outputs!

🧑‍🤝‍🧑 Five new Prowler contributors!

What's Changed

Features

  • feat(Dockerfile): add curl package to docker image by @n4ch04 in #2812
  • feat(iam): add new check iam_role_administratoraccess_policy by @kagahd in #2822
  • feat(iam): improve disable credentials checks by @sergargar in #2909
  • feat(json-asff): adds AWS resource tags in json-asff and SecurityHub findings by @sbldevnet in #2786
  • feat(unix timestamp): add the --unix-timestamp flag to docs by @n4ch04 in #2816
  • feat(unix timestamp): add unix timestamp to outputs by @n4ch04 in #2813
  • feat(wafv2): Add check wafv2_webacl_logging_enabled by @devopspacellp in #2898

Fixes

  • fix(acm): add certificate id by @sergargar in #2903
  • fix(apigw): KeyError name by @jfagoagas in #2858
  • fix(apikeys_..._90_days): fix key creation time with dinamic date by @n4ch04 in #2798
  • fix(autoscaling_find_secrets_ec2_launch_configuration): Fix UnicodeDecodeError by @jfagoagas in #2870
  • fix(aws): Include missing ARNs by @jfagoagas in #2880
  • fix(azure): Typo in SQL check by @JackStuart in #2881
  • fix(cloudtrail_s3_dataevents_read/write_enabled): Handle S3 ARN by @jfagoagas in #2844
  • fix(cloudwatch): ignore new lines in filters by @sergargar in #2912
  • fix(custom checks): fix import from s3 by @n4ch04 in #2901
  • fix(dockerfile): Use latest curl by @jfagoagas in #2897
  • fix(Dockerfile): update alpine version by @n4ch04 in #2925
  • fix(ds): GetSnapshotLimits for MicrosoftAD by @jfagoagas in #2859
  • fix(ebs): improve snapshot encryption logic and typos by @taylerhaviland in #2836
  • fix(ec2 ebs/instance checks): unify checks logic by @n4ch04 in #2795
  • fix(ec2 nacl checks):unify logic by @n4ch04 in #2799
  • fix(ec2 tests): add region and delete search sg checks by @n4ch04 in #2788
  • fix(ec2 tests): add tags and region non sg checks by @n4ch04 in #2781
  • fix(ec2_elastic_ip_unassigned): rename check by @n4ch04 in #2882
  • fix(ec2_instance_..._ssm): mock ssm service and client in all the tests by @n4ch04 in #2804
  • fix(eks_control_plane_endpoint_access_restricted): handle endpoint private access by @Fennerr in #2824
  • fix(eks_endpoints_not_publicly_accessible): handle endpoint private access by @Fennerr in #2825
  • fix(elb): add resource ARN to checks by @sergargar in #2906
  • fix(elbv2): Handle LoadBalancerNotFound by @jfagoagas in #2860
  • fix(findingID): remove duplicate finding IDs by @sergargar in #2890
  • fix(html): unroll regions set prior concat by @n4ch04 in #2790
  • fix(iam): findings of some checks may have been lost by @kagahd in #2847
  • fix(iam): Handle NoSuchEntityException in ListRolePolicies by @jfagoagas in #2857
  • fix(iam): Handle NoSuchEntity when calling list_role_policies by @jfagoagas in #2872
  • fix(iam credentials checks): unify logic by @n4ch04 in #2883
  • fix(iam creds checks): add missing tests and fix current ones by @n4ch04 in #2888
  • fix(iam creds tests): dont use search and negative indexes by @n4ch04 in #2899
  • fix(iam_inline_policy_no_administrative_privileges): set resource id as the entity name by @sergargar in #2820
  • fix(iam_policy_no_administrative_privileges): check does not exist and maps not to check122 by @kagahd in #2797
  • fix(is_valid_arn): include . into resource name by @n4ch04 in #2789
  • fix(outputs_unix_timestamp): Remove subsecond by @jfagoagas in #2861
  • fix(pipeline): launch linters with file changes by @n4ch04 in #2911
  • fix(policy_condition_parser): add StringEquals aws:SourceArn condition by @n4ch04 in #2793
  • fix(pre-commit): add file filter to python linters by @n4ch04 in #2818
  • fix(remove_custom_checks_module): delete service folder if empty by @n4ch04 in #2885
  • fix(s3_bucket_policy_public_write_access): Handle S3 Policy without Principal by @jfagoagas in #2871
  • fix(securityhub): archive SecurityHub findings in empty regions by @sergargar in #2908
  • fix(sqs_queues_not_publicly_accessible): Improve status extended by @Fennerr in #2848
  • fix(storage_ensure_minimum_tls_version_12): misspelling in metadata by @CameronTStark in #2835
  • fix(testing docs): fix testing docs typos and syntax by @n4ch04 in #2803
  • fix(version): add timeout and check HTTP errors by @sergargar in #2886
  • fix(vpc): solves CidrBlock KeyError by @sergargar in #2817
  • fix(vpc_peering_routing_tables_with_least_privilege): check only peering routes by @sergargar in #2887
  • fix(pull-request.yml): launch linters when source code modified by @n4ch04 in #2922
  • fix(build-lint-push pipeline): pass pipeline when ignored files by @n4ch04 in #2915

Chores

Dependencies

New Contributors

Full Changelog: 3.9.0...3.10.0

Contributors

taylerhaviland, CameronTStark, and 9 other contributors
Assets 2
Loading