Skip to content

Commit

Permalink
[8.13](backport #2095) fix panic due to missing logger of aws Identit…
Browse files Browse the repository at this point in the history 
…yProvider (#2103)

* fix panic due to missing logger of aws IdentityProvider (#2095)

fix missing logger of aws IdentityProvider

(cherry picked from commit 6bf970a)

# Conflicts:
#	internal/flavors/asset_inventory.go
#	internal/flavors/benchmark/strategy.go

* fix merge

* Disable integration tests for Azure 4.4.1 (#2094)

---------

Co-authored-by: Kostas Stamatakis <[email protected]>
Co-authored-by: Kuba Soboń <[email protected]>
  • Loading branch information
@mergify @moukoublen @kubasobon
3 people authored Apr 8, 2024
1 parent f181b6e commit 9b1c7be
Show file tree
Hide file tree
Showing 5 changed files with 32 additions and 29 deletions.
11 changes: 6 additions & 5 deletions internal/flavors/benchmark/strategy.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,23 +38,23 @@ type Strategy interface {
checkDependencies() error
}

func GetStrategy(cfg *config.Config) (Strategy, error) {
func GetStrategy(cfg *config.Config, log *logp.Logger) (Strategy, error) {
switch cfg.Benchmark {
case config.CIS_AWS:
if cfg.CloudConfig.Aws.AccountType == config.OrganizationAccount {
return &AWSOrg{
IdentityProvider: awslib.IdentityProvider{},
IdentityProvider: awslib.IdentityProvider{Logger: log},
AccountProvider: awslib.AccountProvider{},
}, nil
}

return &AWS{
IdentityProvider: awslib.IdentityProvider{},
IdentityProvider: awslib.IdentityProvider{Logger: log},
}, nil
case config.CIS_EKS:
return &EKS{
AWSCfgProvider: awslib.ConfigProvider{MetadataProvider: awslib.Ec2MetadataProvider{}},
AWSIdentityProvider: awslib.IdentityProvider{},
AWSIdentityProvider: awslib.IdentityProvider{Logger: log},
AWSMetadataProvider: awslib.Ec2MetadataProvider{},
EKSClusterNameProvider: awslib.EKSClusterNameProvider{},
ClientProvider: k8s.ClientGetter{},
Expand All @@ -73,7 +73,8 @@ func GetStrategy(cfg *config.Config) (Strategy, error) {
case config.CIS_AZURE:
return &Azure{
cfgProvider: &azure_auth.ConfigProvider{AuthProvider: &azure_auth.AzureAuthProvider{}},
providerInitializer: &azurelib.ProviderInitializer{}}, nil
providerInitializer: &azurelib.ProviderInitializer{},
}, nil
}
return nil, fmt.Errorf("unknown benchmark: '%s'", cfg.Benchmark)
}
2 changes: 1 addition & 1 deletion internal/flavors/benchmark/strategy_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ func TestGetStrategy(t *testing.T) {
}
for _, tt := range tests {
t.Run(fmt.Sprintf("%T", tt.wantType), func(t *testing.T) {
got, err := GetStrategy(&tt.cfg)
got, err := GetStrategy(&tt.cfg, testhelper.NewLogger(t))
if tt.wantErr {
require.Error(t, err)
return
Expand Down
2 changes: 1 addition & 1 deletion internal/flavors/posture.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ func newPostureFromCfg(b *beat.Beat, cfg *config.Config) (*posture, error) {
log.Info("Config initiated with cycle period of ", cfg.Period)
ctx, cancel := context.WithCancel(context.Background())

strategy, err := benchmark.GetStrategy(cfg)
strategy, err := benchmark.GetStrategy(cfg, log)
if err != nil {
cancel()
return nil, err
Expand Down
4 changes: 2 additions & 2 deletions security-policies/RULES.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -404,7 +404,7 @@

#### Manual rules: 0/74 (0%)

#### Integration Tests Coverage: 102/302 (34%)
#### Integration Tests Coverage: 100/302 (33%)

<details><summary><h3>Full Table 📋</h3></summary>

Expand Down Expand Up @@ -501,7 +501,7 @@
| [4.3.6](bundle/compliance/cis_azure/rules/cis_4_3_6) | PostgreSQL Database Server | Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server | :white_check_mark: | Passed :white_check_mark: / Failed :white_check_mark: | Automated |
| [4.3.7](bundle/compliance/cis_azure/rules/cis_4_3_7) | PostgreSQL Database Server | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | :white_check_mark: | Passed :white_check_mark: / Failed :white_check_mark: | Automated |
| [4.3.8](bundle/compliance/cis_azure/rules/cis_4_3_8) | PostgreSQL Database Server | Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled' | :white_check_mark: | Passed :x: / Failed :white_check_mark: | Automated |
| [4.4.1](bundle/compliance/cis_azure/rules/cis_4_4_1) | MySQL Database | Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server | :white_check_mark: | Passed :white_check_mark: / Failed :white_check_mark: | Automated |
| [4.4.1](bundle/compliance/cis_azure/rules/cis_4_4_1) | MySQL Database | Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server | :white_check_mark: | Passed :x: / Failed :x: | Automated |
| [4.4.2](bundle/compliance/cis_azure/rules/cis_4_4_2) | MySQL Database | Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server | :white_check_mark: | Passed :white_check_mark: / Failed :x: | Automated |
| 4.4.3 | MySQL Database | Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server | :x: | Passed :x: / Failed :x: | Manual |
| 4.4.4 | MySQL Database | Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server | :x: | Passed :x: / Failed :x: | Manual |
Expand Down
42 changes: 22 additions & 20 deletions tests/product/tests/data/azure/azure_database_service_test_cases.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@
CIS_4_3_6 = "CIS 4.3.6"
CIS_4_3_7 = "CIS 4.3.7"
CIS_4_3_8 = "CIS 4.3.8"
CIS_4_4_1 = "CIS 4.4.1"
# Disable 4.4.1 - Azure Database for MySQL - Single Server is being retired
# See: https://learn.microsoft.com/en-us/azure/mysql/single-server/whats-happening-to-mysql-single-server
# CIS_4_4_1 = "CIS 4.4.1"
CIS_4_4_2 = "CIS 4.4.2"
CIS_4_5_1 = "CIS 4.5.1"

Expand Down Expand Up @@ -327,24 +329,24 @@

# 4.4.* Rules ====================================

cis_azure_4_4_1_pass = AzureServiceCase(
rule_tag=CIS_4_4_1,
case_identifier="rule-441",
expected=RULE_PASS_STATUS,
)

cis_azure_4_4_1_fail = AzureServiceCase(
rule_tag=CIS_4_4_1,
case_identifier="rule-441-fail",
expected=RULE_FAIL_STATUS,
)

cis_azure_4_4_1 = {
"""4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled'
for Standard MySQL Database Server expect: passed""": cis_azure_4_4_1_pass,
"""4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled'
for Standard MySQL Database Server expect: failed""": cis_azure_4_4_1_fail,
}
# cis_azure_4_4_1_pass = AzureServiceCase(
# rule_tag=CIS_4_4_1,
# case_identifier="rule-441",
# expected=RULE_PASS_STATUS,
# )
#
# cis_azure_4_4_1_fail = AzureServiceCase(
# rule_tag=CIS_4_4_1,
# case_identifier="rule-441-fail",
# expected=RULE_FAIL_STATUS,
# )
#
# cis_azure_4_4_1 = {
# """4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled'
# for Standard MySQL Database Server expect: passed""": cis_azure_4_4_1_pass,
# """4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled'
# for Standard MySQL Database Server expect: failed""": cis_azure_4_4_1_fail,
# }

cis_azure_4_4_2_pass = AzureServiceCase(
rule_tag=CIS_4_4_2,
Expand Down Expand Up @@ -395,7 +397,7 @@
**cis_azure_4_3_6,
**cis_azure_4_3_7,
**cis_azure_4_3_8,
**cis_azure_4_4_1,
# **cis_azure_4_4_1,
**cis_azure_4_4_2,
**cis_azure_4_5_1,
}

0 comments on commit 9b1c7be

Please sign in to comment.