-
Notifications
You must be signed in to change notification settings - Fork 1.9k
feat(attack-surfaces): add new endpoints to retrieve overview data #9309
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
✅ All necessary |
|
✅ Conflict Markers Resolved All conflict markers have been successfully resolved in this pull request. |
🔒 Container Security ScanImage: 📊 Vulnerability Summary
3 package(s) affected
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #9309 +/- ##
==========================================
- Coverage 92.96% 92.72% -0.24%
==========================================
Files 126 155 +29
Lines 3013 21544 +18531
==========================================
+ Hits 2801 19977 +17176
- Misses 212 1567 +1355
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
josemazo
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚀
josemazo
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚀🚀
Description
A new endpoint has been added to retrieve an overview of the attack surfaces in the tenant. In essence, these are just category filters. Given Prowler's attack surface definition, we do not have a set of defined check IDs for every category, for every provider type. That's the reason behind having some hardcoded values for now.
In addition, some refactoring was included in the PR to DRY some parts of the code.
{ "data": [ { "type": "attack-surface-overviews", "id": "internet-exposed", "attributes": { "total_findings": 118, "failed_findings": 3, "muted_failed_findings": 0, "check_ids": [ "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", "rds_snapshots_public_access", "neptune_cluster_public_snapshot", "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", "elbv2_internet_facing", "emr_cluster_publicly_accesible", "ecr_repositories_not_publicly_accessible", "emr_cluster_master_nodes_no_public_ip", "ec2_instance_port_telnet_exposed_to_internet", "ec2_instance_port_ssh_exposed_to_internet", "documentdb_cluster_public_snapshot", "elb_internet_facing", "awslambda_function_not_publicly_accessible", "glue_data_catalogs_not_publicly_accessible", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", "emr_cluster_account_public_block_enabled", "sqs_queues_not_publicly_accessible", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", "ec2_networkacl_allow_ingress_any_port", "apigateway_restapi_public_with_authorizer", "s3_bucket_policy_public_write_access", "lightsail_instance_public", "ec2_securitygroup_allow_ingress_from_internet_to_any_port", "ec2_instance_port_ldap_exposed_to_internet", "s3_bucket_public_access", "ec2_instance_port_redis_exposed_to_internet", "eventbridge_bus_exposed", "accessanalyzer_enabled_without_findings", "lightsail_database_public", "rds_instance_no_public_access", "cloudwatch_log_group_not_publicly_accessible", "ec2_instance_port_memcached_exposed_to_internet", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", "sns_topics_not_publicly_accessible", "ec2_instance_port_rdp_exposed_to_internet", "ec2_instance_port_sqlserver_exposed_to_internet", "ec2_networkacl_allow_ingress_tcp_port_22", "ec2_instance_account_imdsv2_enabled", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", "ec2_instance_internet_facing_with_instance_profile", "ec2_instance_port_oracle_exposed_to_internet", "ec2_instance_port_kafka_exposed_to_internet", "ec2_networkacl_unused", "ec2_instance_port_mysql_exposed_to_internet", "elasticache_cluster_uses_public_subnet", "eks_cluster_private_nodes_enabled", "opensearch_service_domains_not_publicly_accessible", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", "codebuild_project_not_publicly_accessible", "ec2_elastic_ip_shodan", "ec2_securitygroup_allow_wide_open_public_ipv4", "ec2_instance_port_mongodb_exposed_to_internet", "eks_cluster_not_publicly_accessible", "cloudfront_distributions_geo_restrictions_enabled", "redshift_cluster_public_access", "ecs_service_no_assign_public_ip", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", "sagemaker_notebook_instance_without_direct_internet_access_configured", "autoscaling_group_launch_configuration_no_public_ip", "awslambda_function_url_cors_policy", "neptune_cluster_uses_public_subnet", "ec2_ebs_snapshot_account_block_public_access", "efs_mount_target_not_publicly_accessible", "ec2_instance_port_ftp_exposed_to_internet", "secretsmanager_not_publicly_accessible", "mq_broker_not_publicly_accessible", "ec2_ebs_public_snapshot", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21", "ecs_task_set_no_assign_public_ip", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018", "ses_identity_not_publicly_accessible", "cloudfront_distributions_https_enabled", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", "ssm_documents_set_as_public", "s3_bucket_public_list_acl", "ec2_instance_port_cifs_exposed_to_internet", "appstream_fleet_default_internet_access_disabled", "awslambda_function_url_public", "ec2_instance_port_postgresql_exposed_to_internet", "cloudfront_distributions_using_waf", "dms_instance_no_public_access", "kafka_cluster_is_public", "apigateway_restapi_public", "ec2_instance_public_ip", "fms_policy_compliant", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", "ec2_instance_port_kerberos_exposed_to_internet", "ec2_ami_public", "glacier_vaults_policy_public_access", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", "s3_bucket_public_write_acl", "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", "ec2_networkacl_allow_ingress_tcp_port_3389", "ec2_instance_port_cassandra_exposed_to_internet" ] } }, { "type": "attack-surface-overviews", "id": "secrets", "attributes": { "total_findings": 9, "failed_findings": 0, "muted_failed_findings": 0, "check_ids": [ "autoscaling_find_secrets_ec2_launch_configuration", "secretsmanager_secret_unused", "ec2_instance_secrets_user_data", "ecs_task_definitions_no_environment_secrets", "ec2_launch_template_no_secrets", "autoscaling_group_launch_configuration_requires_imdsv2", "cloudformation_stack_outputs_find_secrets", "awslambda_function_no_secrets_in_variables", "codebuild_project_source_repo_url_no_sensitive_credentials", "cloudwatch_log_group_no_secrets_in_logs", "ssm_document_secrets", "awslambda_function_no_secrets_in_code", "secretsmanager_secret_rotated_periodically", "codebuild_project_no_secrets_in_variables" ] } }, { "type": "attack-surface-overviews", "id": "privilege-escalation", "attributes": { "total_findings": 19, "failed_findings": 1, "muted_failed_findings": 0, "check_ids": [ "iam_inline_policy_allows_privilege_escalation", "iam_policy_allows_privilege_escalation" ] } }, { "type": "attack-surface-overviews", "id": "ec2-imdsv1", "attributes": { "total_findings": 0, "failed_findings": 0, "muted_failed_findings": 0, "check_ids": [ "ec2_instance_imdsv2_enabled" ] } } ], "meta": { "version": "v1" } }Query plans
Note
Some sequential scans for provider and scans are due to the lack of enough sample data in the test lab. More tenants would be needed.
GET /overviews/attack-surfaces
GET /overviews/attack-surfaces?filter[provider_id]=
GET /overviews/attack-surfaces?filter[provider_type__in]=
Steps to review
Please add a detailed description of how to review this PR.
Checklist
UI
API
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.