fix(organizations): no finding for access denied in listing policies

prowler-cloud · Oct 14, 2024 · 236a398 · 236a398
1 parent 037e40f
commit 236a398
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 25 deletions.
diff --git a/...ions/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py b/...ions/organizations_opt_out_ai_services_policy/organizations_opt_out_ai_services_policy.py
@@ -9,17 +9,17 @@ def execute(self):
         findings = []
 
         for org in organizations_client.organizations:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = org.id
-            report.resource_arn = org.arn
-            report.region = organizations_client.region
-            report.status = "FAIL"
-            report.status_extended = (
-                "AWS Organizations is not in-use for this AWS Account."
-            )
-            if org.status == "ACTIVE":
-                report.status_extended = f"AWS Organization {org.id} has not opted out of all AI services, granting consent for AWS to access its data."
-                if org.policies is not None:  # Access Denied to list_policies
+            if org.policies is not None:  # Access Denied to list_policies
+                report = Check_Report_AWS(self.metadata())
+                report.resource_id = org.id
+                report.resource_arn = org.arn
+                report.region = organizations_client.region
+                report.status = "FAIL"
+                report.status_extended = (
+                    "AWS Organizations is not in-use for this AWS Account."
+                )
+                if org.status == "ACTIVE":
+                    report.status_extended = f"AWS Organization {org.id} has not opted out of all AI services, granting consent for AWS to access its data."
                     for policy in org.policies.get("AISERVICES_OPT_OUT_POLICY", []):
                         if (
                             policy.content.get("services", {})
@@ -32,6 +32,6 @@ def execute(self):
                             report.status_extended = f"AWS Organization {org.id} has opted out of all AI services, not granting consent for AWS to access its data."
                             break
 
-            findings.append(report)
+                findings.append(report)
 
         return findings
diff --git a/...ns_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py b/...ns_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.py
@@ -9,26 +9,26 @@ def execute(self):
         findings = []
 
         for org in organizations_client.organizations:
-            report = Check_Report_AWS(self.metadata())
-            report.resource_id = org.id
-            report.resource_arn = org.arn
-            report.region = organizations_client.region
-            report.status = "FAIL"
-            report.status_extended = (
-                "AWS Organizations is not in-use for this AWS Account."
-            )
-
-            if org.status == "ACTIVE":
+            if org.policies is not None:  # Access Denied to list_policies
+                report = Check_Report_AWS(self.metadata())
+                report.resource_id = org.id
+                report.resource_arn = org.arn
+                report.region = organizations_client.region
+                report.status = "FAIL"
                 report.status_extended = (
-                    f"AWS Organizations {org.id} does not have tag policies."
+                    "AWS Organizations is not in-use for this AWS Account."
                 )
-                if org.policies is not None:  # Access Denied to list_policies
+
+                if org.status == "ACTIVE":
+                    report.status_extended = (
+                        f"AWS Organizations {org.id} does not have tag policies."
+                    )
                     for policy in org.policies.get("TAG_POLICY", []):
                         report.status_extended = f"AWS Organization {org.id} has tag policies enabled but not attached."
                         if policy.targets:
                             report.status = "PASS"
                             report.status_extended = f"AWS Organization {org.id} has tag policies enabled and attached to an AWS account."
 
-            findings.append(report)
+                findings.append(report)
 
         return findings