Prowler Sdk Check

# Example: AWS S3 Bucket Encryption Check
# Source: prowler/providers/aws/services/s3/s3_bucket_default_encryption/

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client


class s3_bucket_default_encryption(Check):
    def execute(self):
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            if bucket.encryption:
                report.status = "PASS"
                report.status_extended = f"S3 Bucket {bucket.name} has Server Side Encryption with {bucket.encryption}."
            else:
                report.status = "FAIL"
                report.status_extended = f"S3 Bucket {bucket.name} does not have Server Side Encryption enabled."
            findings.append(report)
        return findings

{
  "Provider": "aws",
  "CheckID": "s3_bucket_default_encryption",
  "CheckTitle": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.",
  "CheckType": [
    "Data Protection"
  ],
  "ServiceName": "s3",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:s3:::bucket_name",
  "Severity": "medium",
  "ResourceType": "AwsS3Bucket",
  "ResourceGroup": "storage",
  "Description": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.",
  "Risk": "Amazon S3 default encryption provides a way to set the default encryption behavior for an S3 bucket. This will ensure data-at-rest is encrypted.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "aws s3api put-bucket-encryption --bucket <bucket_name> --server-side-encryption-configuration '{\"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]}'",
      "NativeIaC": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#cloudformation",
      "Other": "",
      "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#terraform"
    },
    "Recommendation": {
      "Text": "Ensure that S3 buckets have encryption at rest enabled.",
      "Url": "https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/"
    }
  },
  "Categories": [
    "encryption"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}

# Example: Azure Storage Secure Transfer Check
# Source: prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_secure_transfer_required_is_enabled(Check):
    def execute(self) -> list[Check_Report_Azure]:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required enabled."
                if not storage_account.enable_https_traffic_only:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required disabled."

                findings.append(report)

        return findings

{
  "Provider": "azure",
  "CheckID": "storage_secure_transfer_required_is_enabled",
  "CheckTitle": "Ensure that all data transferred between clients and your Azure Storage account is encrypted using the HTTPS protocol.",
  "CheckType": [],
  "ServiceName": "storage",
  "SubServiceName": "",
  "ResourceIdTemplate": "",
  "Severity": "medium",
  "ResourceType": "AzureStorageAccount",
  "ResourceGroup": "storage",
  "Description": "Ensure that all data transferred between clients and your Azure Storage account is encrypted using the HTTPS protocol.",
  "Risk": "Requests to the storage account sent outside of a secure connection can be eavesdropped",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "az storage account update --name <STORAGE_ACCOUNT_NAME> --https-only true",
      "NativeIaC": "",
      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/StorageAccounts/secure-transfer-required.html",
      "Terraform": "https://docs.prowler.com/checks/azure/azure-networking-policies/ensure-that-storage-account-enables-secure-transfer"
    },
    "Recommendation": {
      "Text": "Enable data encryption in transit.",
      "Url": ""
    }
  },
  "Categories": [
    "encryption"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}

# Example: GCP Cloud Storage Bucket Versioning Check
# Source: prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_versioning_enabled/

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_versioning_enabled(Check):
    """Ensure Cloud Storage buckets have Object Versioning enabled."""

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = (
                f"Bucket {bucket.name} does not have Object Versioning enabled."
            )

            if bucket.versioning_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} has Object Versioning enabled."
                )

            findings.append(report)
        return findings

{
  "Provider": "gcp",
  "CheckID": "cloudstorage_bucket_versioning_enabled",
  "CheckTitle": "Cloud Storage buckets have Object Versioning enabled",
  "CheckType": [],
  "ServiceName": "cloudstorage",
  "SubServiceName": "",
  "ResourceIdTemplate": "",
  "Severity": "medium",
  "ResourceType": "storage.googleapis.com/Bucket",
  "ResourceGroup": "storage",
  "Description": "Google Cloud Storage buckets are evaluated to ensure that Object Versioning is enabled.",
  "Risk": "Buckets without Object Versioning enabled cannot recover previous object versions after accidental deletion or overwrites.",
  "RelatedUrl": "",
  "AdditionalURLs": [
    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudStorage/enable-versioning.html",
    "https://cloud.google.com/storage/docs/object-versioning"
  ],
  "Remediation": {
    "Code": {
      "CLI": "gcloud storage buckets update gs://<BUCKET_NAME> --versioning",
      "NativeIaC": "",
      "Other": "1) Open Google Cloud Console -> Storage -> Buckets\n2) Select the bucket\n3) Click 'Edit bucket' -> 'Protection'\n4) Enable 'Object versioning'\n5) Save",
      "Terraform": "resource \"google_storage_bucket\" \"example\" {\n  versioning {\n    enabled = true\n  }\n}"
    },
    "Recommendation": {
      "Text": "Enable Object Versioning on Cloud Storage buckets to protect against accidental data loss.",
      "Url": "https://hub.prowler.com/check/cloudstorage_bucket_versioning_enabled"
    }
  },
  "Categories": [
    "resilience"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}