-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(aws): remove cloudwatch_log_group_no_critical_pii_in_logs
check
#5735
Conversation
61d6c8a
to
cbde940
Compare
cbde940
to
1471bd5
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We are removing the check cloudwatch_log_group_no_critical_pii_in_logs
for the following reasons:
- It uses the
presidio-analyzer
library which by default loads during runtime the NLP module and other PII recognizers from external sources not defined in the Prowler dependencies. That's something we could not do as a security product taking also into account that Prowler can run in environments with little to zero access to the Internet. - Those dependencies cannot be installed via
poetry
since they are not available inPyPI
and would require adding more steps to our installation procedure to get them. - The NLP module installed,
en-core-web-lg
is a large vector table with ~500k entries with a size of 400MiB. This is a huge package to be donwloaded during runtime. - The installation procedure of the above dependencies adds several lines to our terminal UI with the download process and some logs.
presidio-analyzer
requires a ton of new libraries that we need to review first.
We will work to reintroduce the cloudwatch_log_group_no_critical_pii_in_logs
in a way that all dependencies are explicitly defined, required and verified.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## v4.5 #5735 +/- ##
==========================================
- Coverage 89.89% 89.85% -0.04%
==========================================
Files 1115 1114 -1
Lines 34560 34501 -59
==========================================
- Hits 31067 31002 -65
- Misses 3493 3499 +6 ☔ View full report in Codecov by Sentry. |
Description
Remove check
cloudwatch_log_group_no_critical_pii_in_logs
sincepresidio-analyzer
is downloading a package during Prowler execution.Checklist
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.