Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(cis): add CIS output class #4400

72 changes: 72 additions & 0 deletions prowler/__main__.py
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@
from prowler.lib.cli.parser import ProwlerArgumentParser
from prowler.lib.logger import logger, set_logging_config
from prowler.lib.outputs.asff.asff import ASFF
from prowler.lib.outputs.compliance.cis_aws import AWSCIS
from prowler.lib.outputs.compliance.cis_azure import AzureCIS
from prowler.lib.outputs.compliance.cis_gcp import GCPCIS
from prowler.lib.outputs.compliance.cis_kubernetes import KubernetesCIS

Check warning on line 49 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L46-L49

Added lines #L46 - L49 were not covered by tests
from prowler.lib.outputs.compliance.compliance import display_compliance_table
from prowler.lib.outputs.csv.models import CSV
from prowler.lib.outputs.finding import Finding
Expand Down Expand Up @@ -355,6 +359,74 @@
bucket_session,
)

# Compliance Frameworks
input_compliance_frameworks = set(

Check warning on line 363 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L363

Added line #L363 was not covered by tests
global_provider.output_options.output_modes
).intersection(get_available_compliance_frameworks(provider))
if provider == "aws":
for compliance_name in input_compliance_frameworks:
if compliance_name.startswith("cis_"):

Check warning on line 368 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L366-L368

Added lines #L366 - L368 were not covered by tests
# Generate CIS Finding Object
filename = (

Check warning on line 370 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L370

Added line #L370 was not covered by tests
f"{global_provider.output_options.output_directory}/compliance/"
f"{global_provider.output_options.output_filename}_{compliance_name}.csv"
)
cis_finding = AWSCIS(

Check warning on line 374 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L374

Added line #L374 was not covered by tests
findings=finding_outputs,
compliance=bulk_compliance_frameworks[compliance_name],
create_file_descriptor=True,
file_path=filename,
)
cis_finding.batch_write_data_to_file()

Check warning on line 380 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L380

Added line #L380 was not covered by tests

elif provider == "azure":
for compliance_name in input_compliance_frameworks:
if compliance_name.startswith("cis_"):

Check warning on line 384 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L382-L384

Added lines #L382 - L384 were not covered by tests
# Generate CIS Finding Object
filename = (

Check warning on line 386 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L386

Added line #L386 was not covered by tests
f"{global_provider.output_options.output_directory}/compliance/"
f"{global_provider.output_options.output_filename}_{compliance_name}.csv"
)
cis_finding = AzureCIS(

Check warning on line 390 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L390

Added line #L390 was not covered by tests
findings=finding_outputs,
compliance=bulk_compliance_frameworks[compliance_name],
create_file_descriptor=True,
file_path=filename,
)
cis_finding.batch_write_data_to_file()

Check warning on line 396 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L396

Added line #L396 was not covered by tests

elif provider == "gcp":
for compliance_name in input_compliance_frameworks:
if compliance_name.startswith("cis_"):

Check warning on line 400 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L398-L400

Added lines #L398 - L400 were not covered by tests
# Generate CIS Finding Object
filename = (

Check warning on line 402 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L402

Added line #L402 was not covered by tests
f"{global_provider.output_options.output_directory}/compliance/"
f"{global_provider.output_options.output_filename}_{compliance_name}.csv"
)
cis_finding = GCPCIS(

Check warning on line 406 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L406

Added line #L406 was not covered by tests
findings=finding_outputs,
compliance=bulk_compliance_frameworks[compliance_name],
create_file_descriptor=True,
file_path=filename,
)
cis_finding.batch_write_data_to_file()

Check warning on line 412 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L412

Added line #L412 was not covered by tests

elif provider == "kubernetes":
for compliance_name in input_compliance_frameworks:
if compliance_name.startswith("cis_"):

Check warning on line 416 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L414-L416

Added lines #L414 - L416 were not covered by tests
# Generate CIS Finding Object
filename = (

Check warning on line 418 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L418

Added line #L418 was not covered by tests
f"{global_provider.output_options.output_directory}/compliance/"
f"{global_provider.output_options.output_filename}_{compliance_name}.csv"
)
cis_finding = KubernetesCIS(

Check warning on line 422 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L422

Added line #L422 was not covered by tests
findings=finding_outputs,
compliance=bulk_compliance_frameworks[compliance_name],
create_file_descriptor=True,
file_path=filename,
)
cis_finding.batch_write_data_to_file()

Check warning on line 428 in prowler/__main__.py

View check run for this annotation

Codecov / codecov/patch

prowler/__main__.py#L428

Added line #L428 was not covered by tests

# AWS Security Hub Integration
if provider == "aws" and args.security_hub:
print(
Expand Down
6 changes: 3 additions & 3 deletions prowler/lib/check/compliance.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

from pydantic import parse_obj_as

from prowler.lib.check.compliance_models import Compliance_Base_Model
from prowler.lib.check.compliance_models import ComplianceBaseModel
from prowler.lib.check.models import Check_Metadata_Model
from prowler.lib.logger import logger

Expand All @@ -22,7 +22,7 @@ def update_checks_metadata_with_compliance(
# Include the requirement into the check's framework requirements
compliance_requirements.append(requirement)
# Create the Compliance_Model
compliance = Compliance_Base_Model(
compliance = ComplianceBaseModel(
Framework=framework.Framework,
Provider=framework.Provider,
Version=framework.Version,
Expand All @@ -43,7 +43,7 @@ def update_checks_metadata_with_compliance(
if not requirement.Checks:
compliance_requirements.append(requirement)
# Create the Compliance_Model
compliance = Compliance_Base_Model(
compliance = ComplianceBaseModel(
Framework=framework.Framework,
Provider=framework.Provider,
Version=framework.Version,
Expand Down
8 changes: 4 additions & 4 deletions prowler/lib/check/compliance_models.py
Original file line number Diff line number Diff line change
Expand Up @@ -189,8 +189,8 @@
Checks: list[str]


class Compliance_Base_Model(BaseModel):
"""Compliance_Base_Model holds the base model for every compliance framework"""
class ComplianceBaseModel(BaseModel):
"""ComplianceBaseModel holds the base model for every compliance framework"""

Framework: str
Provider: str
Expand Down Expand Up @@ -218,10 +218,10 @@
# Testing Pending
def load_compliance_framework(
compliance_specification_file: str,
) -> Compliance_Base_Model:
) -> ComplianceBaseModel:
"""load_compliance_framework loads and parse a Compliance Framework Specification"""
try:
compliance_framework = Compliance_Base_Model.parse_file(
compliance_framework = ComplianceBaseModel.parse_file(

Check warning on line 224 in prowler/lib/check/compliance_models.py

View check run for this annotation

Codecov / codecov/patch

prowler/lib/check/compliance_models.py#L224

Added line #L224 was not covered by tests
compliance_specification_file
)
except ValidationError as error:
Expand Down
Loading