Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(securityhub): archive SecurityHub findings in empty regions #2908

Merged
merged 2 commits into from
Oct 5, 2023
Merged

fix(securityhub): archive SecurityHub findings in empty regions #2908

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dc616d4
fix(securityhub): archive shub findings in empty regions
sergargar Oct 5, 2023
5ad86fe
fix tests
sergargar Oct 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions prowler/providers/aws/lib/security_hub/security_hub.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,12 @@


def prepare_security_hub_findings(
findings: [], audit_info, output_options, enabled_regions: []
findings: [], audit_info: AWS_Audit_Info, output_options, enabled_regions: []
) -> dict:
security_hub_findings_per_region = {}
# Create a key per region
for region in audit_info.audited_regions:
security_hub_findings_per_region[region] = []
for finding in findings:
# We don't send the INFO findings to AWS Security Hub
if finding.status == "INFO":
Expand All @@ -30,10 +33,6 @@
# Get the finding region
region = finding.region

# Check if the security_hub_findings_per_region has the region, if not we have to create it
if region not in security_hub_findings_per_region:
security_hub_findings_per_region[region] = []

# Format the finding in the JSON ASFF format
finding_json_asff = fill_json_asff(
Check_Output_JSON_ASFF(), audit_info, finding, output_options
Expand Down Expand Up @@ -117,9 +116,10 @@
resolve_security_hub_previous_findings archives all the findings that does not appear in the current execution
"""
logger.info("Checking previous findings in Security Hub to archive them.")

for region, current_findings in security_hub_findings_per_region.items():
success_count = 0
for region in security_hub_findings_per_region.keys():

Check warning on line 120 in prowler/providers/aws/lib/security_hub/security_hub.py

View check run for this annotation

Codecov / codecov/patch

prowler/providers/aws/lib/security_hub/security_hub.py#L119-L120 

Added lines #L119 - L120 were not covered by tests
try:
current_findings = security_hub_findings_per_region[region]

Check warning on line 122 in prowler/providers/aws/lib/security_hub/security_hub.py

View check run for this annotation

Codecov / codecov/patch

prowler/providers/aws/lib/security_hub/security_hub.py#L122 

Added line #L122 was not covered by tests
# Get current findings IDs
current_findings_ids = []
for finding in current_findings:
Expand Down Expand Up @@ -151,14 +151,14 @@
logger.info(f"Archiving {len(findings_to_archive)} findings.")

# Send archive findings to SHub
success_count = __send_findings_to_security_hub__(
success_count += __send_findings_to_security_hub__(

Check warning on line 154 in prowler/providers/aws/lib/security_hub/security_hub.py

View check run for this annotation

Codecov / codecov/patch

prowler/providers/aws/lib/security_hub/security_hub.py#L154 

Added line #L154 was not covered by tests
findings_to_archive, region, security_hub_client
)
return success_count
except Exception as error:
logger.error(
f"{error.__class__.__name__} -- [{error.__traceback__.tb_lineno}]:{error} in region {region}"
)
return success_count

Check warning on line 161 in prowler/providers/aws/lib/security_hub/security_hub.py

View check run for this annotation

Codecov / codecov/patch

prowler/providers/aws/lib/security_hub/security_hub.py#L161 

Added line #L161 was not covered by tests


def __send_findings_to_security_hub__(
Expand Down
48 changes: 20 additions & 28 deletions tests/providers/aws/lib/security_hub/security_hub_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,8 @@ def test_prepare_security_hub_findings_enabled_region_not_quiet(self):
}
},
}
]
],
AWS_REGION_2: [],
}

def test_prepare_security_hub_findings_quiet_INFO_finding(self):
Expand All @@ -168,47 +169,38 @@ def test_prepare_security_hub_findings_quiet_INFO_finding(self):
findings = [self.generate_finding("INFO", AWS_REGION_1)]
audit_info = self.set_mocked_audit_info()

assert (
prepare_security_hub_findings(
findings,
audit_info,
output_options,
enabled_regions,
)
== {}
)
assert prepare_security_hub_findings(
findings,
audit_info,
output_options,
enabled_regions,
) == {AWS_REGION_1: [], AWS_REGION_2: []}

def test_prepare_security_hub_findings_disabled_region(self):
enabled_regions = [AWS_REGION_1]
output_options = self.set_mocked_output_options(is_quiet=False)
findings = [self.generate_finding("PASS", AWS_REGION_2)]
audit_info = self.set_mocked_audit_info()

assert (
prepare_security_hub_findings(
findings,
audit_info,
output_options,
enabled_regions,
)
== {}
)
assert prepare_security_hub_findings(
findings,
audit_info,
output_options,
enabled_regions,
) == {AWS_REGION_1: [], AWS_REGION_2: []}

def test_prepare_security_hub_findings_quiet(self):
enabled_regions = [AWS_REGION_1]
output_options = self.set_mocked_output_options(is_quiet=True)
findings = [self.generate_finding("PASS", AWS_REGION_1)]
audit_info = self.set_mocked_audit_info()

assert (
prepare_security_hub_findings(
findings,
audit_info,
output_options,
enabled_regions,
)
== {}
)
assert prepare_security_hub_findings(
findings,
audit_info,
output_options,
enabled_regions,
) == {AWS_REGION_1: [], AWS_REGION_2: []}

@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
def test_batch_send_to_security_hub_one_finding(self):
Expand Down