feat(internet-exposed): New public exposed checks

prowler/providers/aws/services/awslambda/awslambda_function_not_directly_publicly_accessible_via_elbv2/awslambda_function_not_directly_publicly_accessible_via_elbv2.metadata.json

@@ -0,0 +1,32 @@
+{
+ "Provider": "aws",
+ "CheckID": "awslambda_function_not_directly_publicly_accessible_via_elbv2",
+ "CheckTitle": "Check if Lambda functions have public application load balancer ahead of them.",
+ "CheckType": [],
+ "ServiceName": "lambda",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "arn:partition:lambda:region:account-id:function/function-name",
+ "Severity": "critical",
+ "ResourceType": "AwsLambdaFunction",
+ "Description": "Check if Lambda functions have public application load balancer ahead of them.",
+ "Risk": "Publicly accessible services could expose sensitive data to bad actors.",
+ "RelatedUrl": "https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html",
+ "Remediation": {
+ "Code": {
+ "CLI": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Lambda/function-exposed.html",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Place security groups around public load balancers",
+ "Url": "https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html"
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}

prowler/providers/aws/services/awslambda/awslambda_function_not_directly_publicly_accessible_via_elbv2/awslambda_function_not_directly_publicly_accessible_via_elbv2.py

@@ -0,0 +1,29 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client
+from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client
+
+
+class awslambda_function_not_directly_publicly_accessible_via_elbv2(Check):
+ def execute(self):
+ findings = []
+
+ if awslambda_client.functions:
+ public_lambda_functions = {}
+ for target_group in elbv2_client.target_groups:
+ if target_group.public and target_group.target_type == "lambda":
+ public_lambda_functions[target_group.target] = target_group.arn
+
+ for function in awslambda_client.functions.values():
+ report = Check_Report_AWS(self.metadata())
+ report.region = function.region
+ report.resource_id = function.name
+ report.resource_arn = function.arn
+ report.resource_tags = function.tags
+ report.status = "PASS"
+ report.status_extended = f"Lambda function {function.name} is not behind an Internet facing Load Balancer."
+
+ if function.arn in public_lambda_functions:
+ report.status = "FAIL"
+ report.status_extended = f"Lambda function {function.name} is behind an Internet facing Load Balancer through target group {public_lambda_functions[function.arn]}."
+ findings.append(report)
+ return findings

prowler/providers/aws/services/ec2/ec2_instance_not_directly_publicly_accessible_via_elb/ec2_instance_not_directly_publicly_accessible_via_elb.metadata.json

@@ -0,0 +1,34 @@
+{
+ "Provider": "aws",
+ "CheckID": "ec2_instance_not_directly_publicly_accessible_via_elb",
+ "CheckTitle": "Check for EC2 instances behind internet facing classic load balancers.",
+ "CheckType": [
+ "Infrastructure Security"
+ ],
+ "ServiceName": "ec2",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "Severity": "medium",
+ "ResourceType": "AwsEc2Instance",
+ "Description": "Check for EC2 instances behind internet facing classic load balancers.",
+ "Risk": "Exposing an EC2 to a classic load balancer that is internet facing can lead to comprimisation",
+ "RelatedUrl": "",
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Apply security groups to classic load balancers",
+ "Url": ""
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}

prowler/providers/aws/services/ec2/ec2_instance_not_directly_publicly_accessible_via_elb/ec2_instance_not_directly_publicly_accessible_via_elb.py

@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.ec2.ec2_client import ec2_client
+from prowler.providers.aws.services.elb.elb_client import elb_client
+
+
+class ec2_instance_not_directly_publicly_accessible_via_elb(Check):
+ def execute(self):
+ findings = []
+ if ec2_client.instances:
+ public_instances = {}
+ for lb in elb_client.loadbalancers:
+ if lb.scheme == "internet-facing" and len(lb.security_groups) > 0:
+ for instance in lb.instances:
+ public_instances[instance] = lb
+
+ for instance in ec2_client.instances:
+ if instance.state != "terminated":
+ report = Check_Report_AWS(self.metadata())
+ report.region = instance.region
+ report.resource_id = instance.id
+ report.resource_arn = instance.arn
+ report.resource_tags = instance.tags
+ report.status = "PASS"
+ report.status_extended = f"EC2 Instance {instance.id} is not behind an Internet facing Classic Load Balancer."
+
+ if instance.id in public_instances:
+ report.status = "FAIL"
+ report.status_extended = f"EC2 Instance {instance.id} is behind an Internet facing Classic Load Balancer {public_instances[instance.id].dns}."
+ findings.append(report)
+ return findings

prowler/providers/aws/services/ec2/ec2_instance_not_directly_publicly_accessible_via_elbv2/ec2_instance_not_directly_publicly_accessible_via_elbv2.metadata.json

@@ -0,0 +1,34 @@
+{
+ "Provider": "aws",
+ "CheckID": "ec2_instance_not_directly_publicly_accessible_via_elbv2",
+ "CheckTitle": "Check for EC2 instances behind internet facing ALB/NLB/GLB.",
+ "CheckType": [
+ "Infrastructure Security"
+ ],
+ "ServiceName": "ec2",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "Severity": "medium",
+ "ResourceType": "AwsEc2Instance",
+ "Description": "Check for EC2 instances behind internet facing ALB/NLB/GLB.",
+ "Risk": "Exposing an EC2 to a ALB/NLB/GLB that is internet facing can lead to comprimisation",
+ "RelatedUrl": "",
+ "Remediation": {
+ "Code": {
+ "CLI": "",
+ "NativeIaC": "",
+ "Other": "",
+ "Terraform": ""
+ },
+ "Recommendation": {
+ "Text": "Apply security groups to load balancers",
+ "Url": ""
+ }
+ },
+ "Categories": [
+ "internet-exposed"
+ ],
+ "DependsOn": [],
+ "RelatedTo": [],
+ "Notes": ""
+}

prowler/providers/aws/services/ec2/ec2_instance_not_directly_publicly_accessible_via_elbv2/ec2_instance_not_directly_publicly_accessible_via_elbv2.py

@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.ec2.ec2_client import ec2_client
+from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client
+
+
+class ec2_instance_not_directly_publicly_accessible_via_elbv2(Check):
+ def execute(self):
+ findings = []
+ if ec2_client.instances:
+ public_instances = {}
+
+ for tg in elbv2_client.target_groups:
+ if tg.public and tg.target_type == "instance":
+ public_instances[tg.target] = tg.arn
+
+ for instance in ec2_client.instances:
+ if instance.state != "terminated":
+ report = Check_Report_AWS(self.metadata())
+ report.region = instance.region
+ report.resource_id = instance.id
+ report.resource_arn = instance.arn
+ report.resource_tags = instance.tags
+ report.status = "PASS"
+ report.status_extended = f"EC2 Instance {instance.id} is not behind an Internet facing Load Balancer."
+
+ if instance.id in public_instances:
+ report.status = "FAIL"
+ report.status_extended = f"EC2 Instance {instance.id} is behind an Internet facing Load Balancer through target group {public_instances[instance.id]}."
+ findings.append(report)
+ return findings

prowler/providers/aws/services/elb/elb_service.py

@@ -37,6 +37,11 @@ def __describe_load_balancers__(self, regional_client):
  policies=listener["PolicyNames"],
  )
  )
+
+ instance_ids = []
+ for id in elb["Instances"]:
+ instance_ids.append(id["InstanceId"])
+
  self.loadbalancers.append(
  LoadBalancer(
  name=elb["LoadBalancerName"],
@@ -45,6 +50,8 @@ def __describe_load_balancers__(self, regional_client):
  region=regional_client.region,
  scheme=elb["Scheme"],
  listeners=listeners,
+ security_groups=elb["SecurityGroups"],
+ instances=instance_ids,
  )
  )
 
@@ -98,3 +105,5 @@ class LoadBalancer(BaseModel):
  access_logs: Optional[bool]
  listeners: list[Listener]
  tags: Optional[list] = []
+ security_groups: list[str]
+ instances: list[str]

prowler/providers/aws/services/elbv2/elbv2_service.py

@@ -16,6 +16,8 @@ def __init__(self, provider):
  self.loadbalancersv2 = []
  self.__threading_call__(self.__describe_load_balancers__)
  self.listeners = []
+ self.target_groups = []
+ self.__threading_call__(self.__describe_target_groups__)
  self.__threading_call__(self.__describe_listeners__)
  self.__threading_call__(self.__describe_load_balancer_attributes__)
  self.__threading_call__(self.__describe_rules__)
@@ -40,6 +42,7 @@ def __describe_load_balancers__(self, regional_client):
  arn=elbv2["LoadBalancerArn"],
  type=elbv2["Type"],
  listeners=[],
+ security_groups=elbv2["SecurityGroups"],
  )
  if "DNSName" in elbv2:
  lb.dns = elbv2["DNSName"]
@@ -51,6 +54,64 @@ def __describe_load_balancers__(self, regional_client):
  f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
  )
 
+ def __describe_target_groups__(self, regional_client):
+ logger.info("ELBv2 - Describing target groups...")
+ try:
+ for lb in self.loadbalancersv2:
+ try:
+ if (
+ lb.scheme == "internet-facing"
+ and lb.type == "application"
+ and len(lb.security_groups) > 0
+ ):
+ describe_target_groups_paginator = (
+ regional_client.get_paginator("describe_target_groups")
+ )
+ for page in describe_target_groups_paginator.paginate(
+ LoadBalancerArn=lb.arn
+ ):
+ for target_group in page["TargetGroups"]:
+ for (
+ target_health
+ ) in regional_client.describe_target_health(
+ TargetGroupArn=target_group["TargetGroupArn"]
+ )[
+ "TargetHealthDescriptions"
+ ]:
+ tg = TargetGroups(
+ name=target_group["TargetGroupName"],
+ arn=target_group["TargetGroupArn"],
+ target_type=target_group["TargetType"],
+ target=target_health["Target"]["Id"],
+ public=(
+ True
+ if lb.scheme == "internet-facing"
+ and lb.type == "application"
+ and len(lb.security_groups) > 0
+ else False
+ ),
+ )
+ if "DNSName" in lb:
+ tg.lbdns = lb.dns
+ self.target_groups.append(tg)
+ except ClientError as error:
+ if error.response["Error"]["Code"] == "LoadBalancerNotFound":
+ logger.warning(
+ f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ else:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+ except Exception as error:
+ logger.error(
+ f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+ )
+
  def __describe_listeners__(self, regional_client):
  logger.info("ELBv2 - Describing listeners...")
  try:
@@ -235,3 +296,12 @@ class LoadBalancerv2(BaseModel):
  listeners: list[Listenerv2]
  scheme: Optional[str]
  tags: Optional[list] = []
+ security_groups: list[str]
+
+
+class TargetGroups(BaseModel):
+ name: str
+ arn: str
+ target_type: str
+ target: str
+ lbdns: Optional[str]