feat(securityhub): add tags securityhub_enabled

prowler/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled.py

@@ -12,6 +12,7 @@ def execute(self):
             report.region = securityhub.region
             report.resource_id = securityhub.id
             report.resource_arn = securityhub.arn
+            report.resource_tags = securityhub.tags
             if securityhub.status == "ACTIVE":
                 report.status = "PASS"
                 if securityhub.standards:

prowler/providers/aws/services/securityhub/securityhub_service.py

@@ -1,3 +1,5 @@
+from typing import Optional
+
 from botocore.client import ClientError
 from pydantic import BaseModel
 
@@ -6,13 +8,13 @@
 from prowler.providers.aws.lib.service.service import AWSService
 
 
-################## SecurityHub
 class SecurityHub(AWSService):
     def __init__(self, provider):
         # Call AWSService's __init__
         super().__init__(__class__.__name__, provider)
         self.securityhubs = []
         self.__threading_call__(self._describe_hub)
+        self.__threading_call__(self._list_tags, self.securityhubs)
 
     def _describe_hub(self, regional_client):
         logger.info("SecurityHub - Describing Hub...")
@@ -85,6 +87,19 @@
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _list_tags(self, resource: any):
+        try:
+            if resource.status != "NOT_AVAILABLE":
+                resource.tags = [
+                    self.regional_clients[resource.region].list_tags_for_resource(
+                        ResourceArn=resource.arn
+                    )["Tags"]
+                ]
+        except Exception as error:
+            logger.error(
+                f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
 
 class SecurityHubHub(BaseModel):
     arn: str
@@ -93,3 +108,4 @@
     standards: str
     integrations: str
     region: str
+    tags: Optional[list]

tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py

@@ -18,6 +18,7 @@ def test_securityhub_hub_inactive(self):
                 standards="",
                 integrations="",
                 region=AWS_REGION_EU_WEST_1,
+                tags=[{"test_key": "test_value"}],
             )
         ]
         with mock.patch(
@@ -37,6 +38,7 @@ def test_securityhub_hub_inactive(self):
             assert result[0].resource_id == "Security Hub"
             assert result[0].resource_arn == AWS_ACCOUNT_ARN
             assert result[0].region == AWS_REGION_EU_WEST_1
+            assert result[0].resource_tags == [{"test_key": "test_value"}]
 
     def test_securityhub_hub_active_with_standards(self):
         securityhub_client = mock.MagicMock
@@ -47,7 +49,8 @@ def test_securityhub_hub_active_with_standards(self):
                 status="ACTIVE",
                 standards="cis-aws-foundations-benchmark/v/1.2.0",
                 integrations="",
-                region="eu-west-1",
+                region=AWS_REGION_EU_WEST_1,
+                tags=[{"test_key": "test_value"}],
             )
         ]
         with mock.patch(
@@ -73,6 +76,7 @@ def test_securityhub_hub_active_with_standards(self):
                 == "arn:aws:securityhub:us-east-1:0123456789012:hub/default"
             )
             assert result[0].region == AWS_REGION_EU_WEST_1
+            assert result[0].resource_tags == [{"test_key": "test_value"}]
 
     def test_securityhub_hub_active_with_integrations(self):
         securityhub_client = mock.MagicMock
@@ -83,7 +87,8 @@ def test_securityhub_hub_active_with_integrations(self):
                 status="ACTIVE",
                 standards="",
                 integrations="prowler",
-                region="eu-west-1",
+                region=AWS_REGION_EU_WEST_1,
+                tags=[{"test_key": "test_value"}],
             )
         ]
         with mock.patch(
@@ -109,6 +114,7 @@ def test_securityhub_hub_active_with_integrations(self):
                 == "arn:aws:securityhub:us-east-1:0123456789012:hub/default"
             )
             assert result[0].region == AWS_REGION_EU_WEST_1
+            assert result[0].resource_tags == [{"test_key": "test_value"}]
 
     def test_securityhub_hub_active_without_integrations_or_standards(self):
         securityhub_client = mock.MagicMock
@@ -120,7 +126,8 @@ def test_securityhub_hub_active_without_integrations_or_standards(self):
                 status="ACTIVE",
                 standards="",
                 integrations="",
-                region="eu-west-1",
+                region=AWS_REGION_EU_WEST_1,
+                tags=[{"test_key": "test_value"}],
             )
         ]
         with mock.patch(
@@ -146,6 +153,7 @@ def test_securityhub_hub_active_without_integrations_or_standards(self):
                 == "arn:aws:securityhub:us-east-1:0123456789012:hub/default"
             )
             assert result[0].region == AWS_REGION_EU_WEST_1
+            assert result[0].resource_tags == [{"test_key": "test_value"}]
 
     def test_securityhub_hub_active_without_integrations_or_standards_muted(self):
         securityhub_client = mock.MagicMock
@@ -159,6 +167,7 @@ def test_securityhub_hub_active_without_integrations_or_standards_muted(self):
                 standards="",
                 integrations="",
                 region="eu-south-2",
+                tags=[],
             )
         ]
         with mock.patch(
@@ -185,3 +194,4 @@ def test_securityhub_hub_active_without_integrations_or_standards_muted(self):
                 == "arn:aws:securityhub:us-east-1:0123456789012:hub/default"
             )
             assert result[0].region == "eu-south-2"
+            assert result[0].resource_tags == []

tests/providers/aws/services/securityhub/securityhub_service_test.py

@@ -37,6 +37,11 @@ def mock_make_api_call(self, operation_name, kwarg):
         return {
             "HubArn": "arn:aws:securityhub:us-east-1:0123456789012:hub/default",
         }
+    if operation_name == "ListTagsForResource":
+        return {
+            "Tags": {"test_key": "test_value"},
+        }
+
     return make_api_call(self, operation_name, kwarg)
 
 
@@ -80,3 +85,9 @@ def test_describe_hub(self):
         assert securityhub.securityhubs[0].id == "default"
         assert securityhub.securityhubs[0].standards == "cis-aws-foundations-benchmark "
         assert securityhub.securityhubs[0].integrations == "prowler "
+
+    def test_list_tags(self):
+        # Set partition for the service
+        securityhub = SecurityHub(set_mocked_aws_provider([AWS_REGION_EU_WEST_1]))
+        assert len(securityhub.securityhubs) == 1
+        assert securityhub.securityhubs[0].tags == [{"test_key": "test_value"}]