fix(aws): review checks with wrong attributes #5503
Conversation
github-actions
bot
added
the
provider/aws
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #5503 +/- ##
==========================================
+ Coverage 89.66% 89.67% +0.01%
==========================================
Files 1076 1085 +9
Lines 33305 33525 +220
==========================================
+ Hits 29862 30063 +201
- Misses 3443 3462 +19 ☔ View full report in Codecov by Sentry. |
| @@ -11,8 +11,7 @@ def execute(self): | |||
| report = Check_Report_AWS(self.metadata()) | |||
| report.region = registry.region | |||
| report.resource_id = registry.id | |||
| # A registry cannot have tags | |||
| report.resource_tags = [] | |||
| report.resource_arn = ecr_client.audited_account_arn | |||
There was a problem hiding this comment.
I think here we should create our own ARN, what do you think?
| @@ -67,11 +67,11 @@ def execute(self): | |||
| utc | |||
| ): | |||
| report.status = "FAIL" | |||
| report.check_metadata.Severity = "high" | |||
| report.check_metadata.Severity = Severity.high | |||
There was a problem hiding this comment.
Please, add a test to cover this scenarion.
| @@ -11,6 +11,7 @@ def execute(self) -> Check_Report_AWS: | |||
| for domain in route53domains_client.domains.values(): | |||
| report = Check_Report_AWS(self.metadata()) | |||
| report.resource_id = domain.name | |||
| report.resource_arn = route53domains_client.audited_account_arn | |||
There was a problem hiding this comment.
The same again to create an ARN for this one.
| @@ -11,6 +11,7 @@ def execute(self) -> Check_Report_AWS: | |||
| for domain in route53domains_client.domains.values(): | |||
| report = Check_Report_AWS(self.metadata()) | |||
| report.resource_id = domain.name | |||
| report.resource_arn = route53domains_client.audited_account_arn | |||
There was a problem hiding this comment.
The same again to create an ARN for this one.
| self._list_web_acls() | ||
| self.__threading_call__(self._get_web_acl, self.web_acls.values()) | ||
| self.__threading_call__(self._get_logging_configuration, self.web_acls.values()) | ||
| if self.audited_partition == "aws": |
There was a problem hiding this comment.
Why only aws? China has also CloudFront, at least by our regions file.
There was a problem hiding this comment.
You can see in https://docs.aws.amazon.com/general/latest/gr/waf-classic.html that only this partition is supported.
|
@jfagoagas comments were solved! |
Context
Some checks did not have ARN, Resource Type or
Recommendation.Text, which was making SecurityHub failing when sending findings.Fix #5498.
Description
Checklist
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.