-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(ecs): add new check
ecs_service_fargate_latest_platform_version
(
#5258) Co-authored-by: Sergio <[email protected]>
- Loading branch information
1 parent
158263a
commit 2ffe7f3
Showing
9 changed files
with
291 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Empty file.
34 changes: 34 additions & 0 deletions
34
...fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.metadata.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
{ | ||
"Provider": "aws", | ||
"CheckID": "ecs_service_fargate_latest_platform_version", | ||
"CheckTitle": "ECS Fargate services should run on the latest Fargate platform version", | ||
"CheckType": [ | ||
"Software and Configuration Checks/AWS Security Best Practices" | ||
], | ||
"ServiceName": "ecs", | ||
"SubServiceName": "", | ||
"ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:service/{service-name}", | ||
"Severity": "medium", | ||
"ResourceType": "AwsEcsService", | ||
"Description": "This control checks if Amazon ECS Fargate services are running the latest Fargate platform version. The control fails if the platform version is not the latest.", | ||
"Risk": "Not running the latest Fargate platform version may expose your services to security vulnerabilities and bugs that are resolved in newer versions.", | ||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-fargate-latest-platform-version.html", | ||
"Remediation": { | ||
"Code": { | ||
"CLI": "aws ecs update-service --cluster <cluster-name> --service <service-name> --platform-version LATEST", | ||
"NativeIaC": "", | ||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-10", | ||
"Terraform": "" | ||
}, | ||
"Recommendation": { | ||
"Text": "Update your ECS Fargate services to the latest platform version to ensure they are running in a secure and optimized environment.", | ||
"Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html" | ||
} | ||
}, | ||
"Categories": [ | ||
"vulnerabilities" | ||
], | ||
"DependsOn": [], | ||
"RelatedTo": [], | ||
"Notes": "" | ||
} |
38 changes: 38 additions & 0 deletions
38
...cs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,38 @@ | ||
from prowler.lib.check.models import Check, Check_Report_AWS | ||
from prowler.providers.aws.services.ecs.ecs_client import ecs_client | ||
|
||
|
||
class ecs_service_fargate_latest_platform_version(Check): | ||
def execute(self): | ||
findings = [] | ||
for service in ecs_client.services.values(): | ||
if service.launch_type == "FARGATE": | ||
report = Check_Report_AWS(self.metadata()) | ||
report.region = service.region | ||
report.resource_id = service.name | ||
report.resource_arn = service.arn | ||
report.resource_tags = service.tags | ||
fargate_latest_linux_version = ecs_client.audit_config.get( | ||
"fargate_linux_latest_version", "1.4.0" | ||
) | ||
fargate_latest_windows_version = ecs_client.audit_config.get( | ||
"fargate_windows_latest_version", "1.0.0" | ||
) | ||
report.status = "PASS" | ||
report.status_extended = f"ECS Service {service.name} is using latest FARGATE {service.platform_family} version {fargate_latest_linux_version if service.platform_family == 'Linux' else fargate_latest_windows_version}." | ||
if ( | ||
service.platform_version != "LATEST" | ||
and ( | ||
service.platform_family == "Linux" | ||
and service.platform_version != fargate_latest_linux_version | ||
) | ||
or ( | ||
service.platform_family == "Windows" | ||
and service.platform_version != fargate_latest_windows_version | ||
) | ||
): | ||
report.status = "FAIL" | ||
report.status_extended = f"ECS Service {service.name} is not using latest FARGATE {service.platform_family} version {fargate_latest_linux_version if service.platform_family == 'Linux' else fargate_latest_windows_version}, currently using {service.platform_version}." | ||
|
||
findings.append(report) | ||
return findings |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
195 changes: 195 additions & 0 deletions
195
...rvice_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version_test.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,195 @@ | ||
from unittest import mock | ||
|
||
from prowler.providers.aws.services.ecs.ecs_service import Service | ||
from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_US_EAST_1 | ||
|
||
SERVICE_ARN = ( | ||
f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:service/sample-service" | ||
) | ||
SERVICE_NAME = "sample-service" | ||
|
||
|
||
class Test_ecs_service_fargate_latest_platform_version: | ||
def test_no_services(self): | ||
ecs_client = mock.MagicMock | ||
ecs_client.services = {} | ||
|
||
with mock.patch( | ||
"prowler.providers.aws.services.ecs.ecs_service.ECS", | ||
ecs_client, | ||
): | ||
from prowler.providers.aws.services.ecs.ecs_service_fargate_latest_platform_version.ecs_service_fargate_latest_platform_version import ( | ||
ecs_service_fargate_latest_platform_version, | ||
) | ||
|
||
check = ecs_service_fargate_latest_platform_version() | ||
result = check.execute() | ||
assert len(result) == 0 | ||
|
||
def test_service_ec2_type(self): | ||
ecs_client = mock.MagicMock | ||
ecs_client.services = {} | ||
ecs_client.services[SERVICE_ARN] = Service( | ||
name=SERVICE_NAME, | ||
arn=SERVICE_ARN, | ||
region=AWS_REGION_US_EAST_1, | ||
launch_type="EC2", | ||
assign_public_ip=False, | ||
tags=[], | ||
) | ||
|
||
with mock.patch( | ||
"prowler.providers.aws.services.ecs.ecs_service.ECS", | ||
ecs_client, | ||
): | ||
from prowler.providers.aws.services.ecs.ecs_service_fargate_latest_platform_version.ecs_service_fargate_latest_platform_version import ( | ||
ecs_service_fargate_latest_platform_version, | ||
) | ||
|
||
check = ecs_service_fargate_latest_platform_version() | ||
result = check.execute() | ||
assert len(result) == 0 | ||
|
||
def test_service_linux_latest_version(self): | ||
ecs_client = mock.MagicMock | ||
ecs_client.services = {} | ||
ecs_client.services[SERVICE_ARN] = Service( | ||
name=SERVICE_NAME, | ||
arn=SERVICE_ARN, | ||
region=AWS_REGION_US_EAST_1, | ||
launch_type="FARGATE", | ||
platform_family="Linux", | ||
platform_version="1.4.0", | ||
assign_public_ip=False, | ||
tags=[], | ||
) | ||
|
||
ecs_client.audit_config = { | ||
"fargate_linux_latest_version": "1.4.0", | ||
} | ||
|
||
with mock.patch( | ||
"prowler.providers.aws.services.ecs.ecs_service.ECS", | ||
ecs_client, | ||
): | ||
from prowler.providers.aws.services.ecs.ecs_service_fargate_latest_platform_version.ecs_service_fargate_latest_platform_version import ( | ||
ecs_service_fargate_latest_platform_version, | ||
) | ||
|
||
check = ecs_service_fargate_latest_platform_version() | ||
result = check.execute() | ||
assert len(result) == 1 | ||
assert result[0].status == "PASS" | ||
assert result[0].status_extended == ( | ||
f"ECS Service {SERVICE_NAME} is using latest FARGATE Linux version 1.4.0." | ||
) | ||
assert result[0].resource_id == SERVICE_NAME | ||
assert result[0].resource_arn == SERVICE_ARN | ||
|
||
def test_service_windows_latest_version(self): | ||
ecs_client = mock.MagicMock | ||
ecs_client.services = {} | ||
ecs_client.services[SERVICE_ARN] = Service( | ||
name=SERVICE_NAME, | ||
arn=SERVICE_ARN, | ||
region=AWS_REGION_US_EAST_1, | ||
launch_type="FARGATE", | ||
platform_family="Windows", | ||
platform_version="1.0.0", | ||
assign_public_ip=False, | ||
tags=[], | ||
) | ||
|
||
ecs_client.audit_config = { | ||
"fargate_windows_latest_version": "1.0.0", | ||
} | ||
|
||
with mock.patch( | ||
"prowler.providers.aws.services.ecs.ecs_service.ECS", | ||
ecs_client, | ||
): | ||
from prowler.providers.aws.services.ecs.ecs_service_fargate_latest_platform_version.ecs_service_fargate_latest_platform_version import ( | ||
ecs_service_fargate_latest_platform_version, | ||
) | ||
|
||
check = ecs_service_fargate_latest_platform_version() | ||
result = check.execute() | ||
assert len(result) == 1 | ||
assert result[0].status == "PASS" | ||
assert result[0].status_extended == ( | ||
f"ECS Service {SERVICE_NAME} is using latest FARGATE Windows version 1.0.0." | ||
) | ||
assert result[0].resource_id == SERVICE_NAME | ||
assert result[0].resource_arn == SERVICE_ARN | ||
|
||
def test_service_linux_no_latest_version(self): | ||
ecs_client = mock.MagicMock | ||
ecs_client.services = {} | ||
ecs_client.services[SERVICE_ARN] = Service( | ||
name=SERVICE_NAME, | ||
arn=SERVICE_ARN, | ||
region=AWS_REGION_US_EAST_1, | ||
launch_type="FARGATE", | ||
platform_family="Linux", | ||
platform_version="1.2.0", | ||
assign_public_ip=False, | ||
tags=[], | ||
) | ||
|
||
ecs_client.audit_config = { | ||
"fargate_linux_latest_version": "1.4.0", | ||
} | ||
|
||
with mock.patch( | ||
"prowler.providers.aws.services.ecs.ecs_service.ECS", | ||
ecs_client, | ||
): | ||
from prowler.providers.aws.services.ecs.ecs_service_fargate_latest_platform_version.ecs_service_fargate_latest_platform_version import ( | ||
ecs_service_fargate_latest_platform_version, | ||
) | ||
|
||
check = ecs_service_fargate_latest_platform_version() | ||
result = check.execute() | ||
assert len(result) == 1 | ||
assert result[0].status == "FAIL" | ||
assert result[0].status_extended == ( | ||
f"ECS Service {SERVICE_NAME} is not using latest FARGATE Linux version 1.4.0, currently using 1.2.0." | ||
) | ||
assert result[0].resource_id == SERVICE_NAME | ||
assert result[0].resource_arn == SERVICE_ARN | ||
|
||
def test_service_windows_no_latest_version(self): | ||
ecs_client = mock.MagicMock | ||
ecs_client.services = {} | ||
ecs_client.services[SERVICE_ARN] = Service( | ||
name=SERVICE_NAME, | ||
arn=SERVICE_ARN, | ||
region=AWS_REGION_US_EAST_1, | ||
launch_type="FARGATE", | ||
platform_family="Windows", | ||
platform_version="0.9.0", | ||
assign_public_ip=False, | ||
tags=[], | ||
) | ||
|
||
ecs_client.audit_config = { | ||
"fargate_windows_latest_version": "1.0.0", | ||
} | ||
|
||
with mock.patch( | ||
"prowler.providers.aws.services.ecs.ecs_service.ECS", | ||
ecs_client, | ||
): | ||
from prowler.providers.aws.services.ecs.ecs_service_fargate_latest_platform_version.ecs_service_fargate_latest_platform_version import ( | ||
ecs_service_fargate_latest_platform_version, | ||
) | ||
|
||
check = ecs_service_fargate_latest_platform_version() | ||
result = check.execute() | ||
assert len(result) == 1 | ||
assert result[0].status == "FAIL" | ||
assert result[0].status_extended == ( | ||
f"ECS Service {SERVICE_NAME} is not using latest FARGATE Windows version 1.0.0, currently using 0.9.0." | ||
) | ||
assert result[0].resource_id == SERVICE_NAME | ||
assert result[0].resource_arn == SERVICE_ARN |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters