-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(mq): add new check
mq_broker_active_deployment_mode
(#5433)
Co-authored-by: Sergio <[email protected]>
- Loading branch information
1 parent
df37327
commit 1a6b2ea
Showing
6 changed files
with
255 additions
and
6 deletions.
There are no files selected for viewing
Empty file.
34 changes: 34 additions & 0 deletions
34
...rvices/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.metadata.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
{ | ||
"Provider": "aws", | ||
"CheckID": "mq_broker_active_deployment_mode", | ||
"CheckTitle": "Apache ActiveMQ brokers should be configured in active/standby mode.", | ||
"CheckType": [ | ||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls" | ||
], | ||
"ServiceName": "mq", | ||
"SubServiceName": "", | ||
"ResourceIdTemplate": "arn:aws:mq:region:account-id:broker:broker-id", | ||
"Severity": "low", | ||
"ResourceType": "AwsAmazonMQBroker", | ||
"Description": "Ensure Amazon MQ Apache ActiveMQ brokers are configured in active/standby mode for high availability and fault tolerance.", | ||
"Risk": "Apache ActiveMQ brokers not configured in active/standby mode lack high availability, increasing the risk of downtime and data loss during failures.", | ||
"RelatedUrl": "https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-basic-elements.html", | ||
"Remediation": { | ||
"Code": { | ||
"CLI": "aws mq create-broker --broker-name <broker-name> --engine-type ActiveMQ --deployment-mode ACTIVE_STANDBY_MULTI_AZ", | ||
"NativeIaC": "", | ||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/mq-controls.html#mq-5", | ||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/MQ/deployment-mode.html" | ||
}, | ||
"Recommendation": { | ||
"Text": "Ensure Amazon MQ Apache ActiveMQ brokers use active/standby deployment mode for high availability and fault tolerance.", | ||
"Url": "https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-broker-architecture.html#active-standby-broker-deployment" | ||
} | ||
}, | ||
"Categories": [ | ||
"redundancy" | ||
], | ||
"DependsOn": [], | ||
"RelatedTo": [], | ||
"Notes": "" | ||
} |
24 changes: 24 additions & 0 deletions
24
...ders/aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
from prowler.lib.check.models import Check, Check_Report_AWS | ||
from prowler.providers.aws.services.mq.mq_client import mq_client | ||
from prowler.providers.aws.services.mq.mq_service import DeploymentMode, EngineType | ||
|
||
|
||
class mq_broker_active_deployment_mode(Check): | ||
def execute(self): | ||
findings = [] | ||
for broker in mq_client.brokers.values(): | ||
if broker.engine_type == EngineType.ACTIVEMQ: | ||
report = Check_Report_AWS(self.metadata()) | ||
report.region = broker.region | ||
report.resource_id = broker.id | ||
report.resource_arn = broker.arn | ||
report.resource_tags = broker.tags | ||
report.status = "FAIL" | ||
report.status_extended = f"MQ Broker {broker.name} does not have an active/standby deployment mode." | ||
if broker.deployment_mode == DeploymentMode.ACTIVE_STANDBY_MULTI_AZ: | ||
report.status = "PASS" | ||
report.status_extended = f"MQ Broker {broker.name} does have an active/standby deployment mode." | ||
|
||
findings.append(report) | ||
|
||
return findings |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
183 changes: 183 additions & 0 deletions
183
...aws/services/mq/mq_broker_active_deployment_mode/mq_broker_active_deployment_mode_test.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,183 @@ | ||
from unittest import mock | ||
|
||
from boto3 import client | ||
from moto import mock_aws | ||
|
||
from tests.providers.aws.utils import ( | ||
AWS_ACCOUNT_NUMBER, | ||
AWS_REGION_US_EAST_1, | ||
set_mocked_aws_provider, | ||
) | ||
|
||
|
||
class Test_mq_activemq_broker_active_standby_mode: | ||
@mock_aws | ||
def test_no_brokers(self): | ||
from prowler.providers.aws.services.mq.mq_service import MQ | ||
|
||
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) | ||
|
||
with mock.patch( | ||
"prowler.providers.common.provider.Provider.get_global_provider", | ||
return_value=aws_provider, | ||
): | ||
with mock.patch( | ||
"prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode.mq_client", | ||
new=MQ(aws_provider), | ||
): | ||
# Test Check | ||
from prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode import ( | ||
mq_broker_active_deployment_mode, | ||
) | ||
|
||
check = mq_broker_active_deployment_mode() | ||
result = check.execute() | ||
|
||
assert len(result) == 0 | ||
|
||
@mock_aws | ||
def test_no_activemq_brokers(self): | ||
from prowler.providers.aws.services.mq.mq_service import MQ | ||
|
||
mq_client = client("mq", region_name=AWS_REGION_US_EAST_1) | ||
mq_client.create_broker( | ||
BrokerName="test-broker", | ||
EngineType="RABBITMQ", | ||
EngineVersion="5.15.0", | ||
HostInstanceType="mq.t2.micro", | ||
Users=[ | ||
{ | ||
"Username": "admin", | ||
"Password": "admin", | ||
}, | ||
], | ||
DeploymentMode="ACTIVE_STANDBY_MULTI_AZ", | ||
PubliclyAccessible=False, | ||
AutoMinorVersionUpgrade=True, | ||
)["BrokerId"] | ||
|
||
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) | ||
|
||
with mock.patch( | ||
"prowler.providers.common.provider.Provider.get_global_provider", | ||
return_value=aws_provider, | ||
): | ||
with mock.patch( | ||
"prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode.mq_client", | ||
new=MQ(aws_provider), | ||
): | ||
# Test Check | ||
from prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode import ( | ||
mq_broker_active_deployment_mode, | ||
) | ||
|
||
check = mq_broker_active_deployment_mode() | ||
result = check.execute() | ||
|
||
assert len(result) == 0 | ||
|
||
@mock_aws | ||
def test_activemq_broker_active_standby_mode_enabled(self): | ||
mq_client = client("mq", region_name=AWS_REGION_US_EAST_1) | ||
broker_name = "test-broker" | ||
broker_id = mq_client.create_broker( | ||
BrokerName="test-broker", | ||
EngineType="ACTIVEMQ", | ||
EngineVersion="5.15.0", | ||
HostInstanceType="mq.t2.micro", | ||
Users=[ | ||
{ | ||
"Username": "admin", | ||
"Password": "admin", | ||
}, | ||
], | ||
DeploymentMode="ACTIVE_STANDBY_MULTI_AZ", | ||
PubliclyAccessible=False, | ||
AutoMinorVersionUpgrade=True, | ||
)["BrokerId"] | ||
|
||
from prowler.providers.aws.services.mq.mq_service import MQ | ||
|
||
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) | ||
|
||
with mock.patch( | ||
"prowler.providers.common.provider.Provider.get_global_provider", | ||
return_value=aws_provider, | ||
): | ||
with mock.patch( | ||
"prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode.mq_client", | ||
new=MQ(aws_provider), | ||
): | ||
# Test Check | ||
from prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode import ( | ||
mq_broker_active_deployment_mode, | ||
) | ||
|
||
check = mq_broker_active_deployment_mode() | ||
result = check.execute() | ||
|
||
assert len(result) == 1 | ||
assert result[0].status == "PASS" | ||
assert ( | ||
result[0].status_extended | ||
== f"MQ Broker {broker_name} does have an active/standby deployment mode." | ||
) | ||
assert result[0].resource_id == broker_id | ||
assert ( | ||
result[0].resource_arn | ||
== f"arn:{aws_provider.identity.partition}:mq:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:broker:{broker_id}" | ||
) | ||
assert result[0].region == AWS_REGION_US_EAST_1 | ||
|
||
@mock_aws | ||
def test_activemq_broker_active_standby_mode_disabled(self): | ||
mq_client = client("mq", region_name=AWS_REGION_US_EAST_1) | ||
broker_name = "test-broker" | ||
broker_id = mq_client.create_broker( | ||
BrokerName=broker_name, | ||
EngineType="ACTIVEMQ", | ||
EngineVersion="5.15.0", | ||
HostInstanceType="mq.t2.micro", | ||
Users=[ | ||
{ | ||
"Username": "admin", | ||
"Password": "admin", | ||
}, | ||
], | ||
DeploymentMode="SINGLE_INSTANCE", | ||
PubliclyAccessible=False, | ||
AutoMinorVersionUpgrade=False, | ||
)["BrokerId"] | ||
|
||
from prowler.providers.aws.services.mq.mq_service import MQ | ||
|
||
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) | ||
|
||
with mock.patch( | ||
"prowler.providers.common.provider.Provider.get_global_provider", | ||
return_value=aws_provider, | ||
): | ||
with mock.patch( | ||
"prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode.mq_client", | ||
new=MQ(aws_provider), | ||
): | ||
# Test Check | ||
from prowler.providers.aws.services.mq.mq_broker_active_deployment_mode.mq_broker_active_deployment_mode import ( | ||
mq_broker_active_deployment_mode, | ||
) | ||
|
||
check = mq_broker_active_deployment_mode() | ||
result = check.execute() | ||
|
||
assert len(result) == 1 | ||
assert result[0].status == "FAIL" | ||
assert ( | ||
result[0].status_extended | ||
== f"MQ Broker {broker_name} does not have an active/standby deployment mode." | ||
) | ||
assert result[0].resource_id == broker_id | ||
assert ( | ||
result[0].resource_arn | ||
== f"arn:{aws_provider.identity.partition}:mq:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:broker:{broker_id}" | ||
) | ||
assert result[0].region == AWS_REGION_US_EAST_1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters