Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(waf): add new check waf_global_rule_with_conditions #5465

Conversation

HugoPBrito
Copy link
Member

Context

AWS WAF Classic global rules are used to manage and control web traffic by specifying conditions that determine how the firewall handles requests. These conditions help identify, inspect, and mitigate potential security threats, such as malicious or suspicious traffic, thereby improving the overall security posture. Without any conditions in place, web traffic flows freely, which can lead to vulnerabilities being exploited, bypassing security policies.

Description

This check ensures that AWS WAF Classic global rules contain at least one condition. If no conditions are present, the rule becomes ineffective, allowing all traffic to pass unchecked.

Checklist

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@HugoPBrito HugoPBrito requested review from a team as code owners October 18, 2024 13:57
@github-actions github-actions bot added the provider/aws Issues/PRs related with the AWS provider label Oct 18, 2024
Copy link

codecov bot commented Oct 18, 2024

Codecov Report

Attention: Patch coverage is 92.85714% with 6 lines in your changes missing coverage. Please review.

Project coverage is 89.59%. Comparing base (23a20a5) to head (829b485).
Report is 10 commits behind head on master.

Files with missing lines Patch % Lines
prowler/providers/aws/services/waf/waf_service.py 90.90% 6 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5465      +/-   ##
==========================================
+ Coverage   89.45%   89.59%   +0.14%     
==========================================
  Files        1059     1070      +11     
  Lines       32855    33172     +317     
==========================================
+ Hits        29390    29721     +331     
+ Misses       3465     3451      -14     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Member

@sergargar sergargar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have made necessary changes in the PR @HugoPBrito, but the call _list_resources_for_web_acl does not exist for the WAF API. Please, take a look!

@sergargar sergargar self-requested a review October 21, 2024 15:06
@sergargar sergargar merged commit 5b0868e into master Oct 21, 2024
11 checks passed
@sergargar sergargar deleted the PRWLR-4456-ensure-aws-waf-classic-global-rules-have-at-least-one-condition branch October 21, 2024 17:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
provider/aws Issues/PRs related with the AWS provider
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants