Skip to content

Releases: prowler-cloud/prowler

Prowler 3.7.2 - Gates of Tomorrow

26 Jul 11:16
@sergargar sergargar
3.7.2
6f7ed9a
Compare
Choose a tag to compare
Prowler 3.7.2 - Gates of Tomorrow

Fixes

Dependencies

  • build(deps): bump azure-storage-blob from 12.16.0 to 12.17.0 by @dependabot in #2596
  • build(deps): bump google-api-python-client from 2.93.0 to 2.94.0 by @dependabot in #2614
  • build(deps): bump mkdocs-material from 9.1.18 to 9.1.19 by @dependabot in #2615
  • build(deps): bump pydantic from 1.10.11 to 1.10.12 by @dependabot in #2613
  • build(deps-dev): bump moto from 4.1.12 to 4.1.13 by @dependabot in #2598

Chores

Tests

Documentation

New Contributors

Full Changelog: 3.7.1...3.7.2

Contributors

jfagoagas, kagahd, and 4 other contributors
Assets 2

Prowler 3.7.1 - Gates of Tomorrow

12 Jul 13:45
@jfagoagas jfagoagas
3.7.1
386563c
Compare
Choose a tag to compare
Prowler 3.7.1 - Gates of Tomorrow

Fixes

  • fix(iam): Handle NoSuchEntityException when calling list_attached_role_policies by @jfagoagas in #2571
  • fix(allowlist): handle wildcard in account field by @n4ch04 in #2577
  • fix(cond parser): add policy condition parser & apply in SQS public check by @n4ch04 in #2575

Dependencies

  • build(deps-dev): bump pytest-randomly from 3.12.0 to 3.13.0 by @dependabot in #2567
  • build(deps): bump boto3 from 1.26.161 to 1.26.165 by @dependabot in #2566
  • build(deps): bump pydantic from 1.10.9 to 1.10.11 by @dependabot in #2568
  • build(deps-dev): bump openapi-spec-validator from 0.5.7 to 0.6.0 by @dependabot in #2569
  • build(deps): bump google-api-python-client from 2.91.0 to 2.92.0 by @dependabot in #2570

Chores

Tests

Documentation

Full Changelog: 3.7.0...3.7.1

Contributors

toniblyx, jfagoagas, and 3 other contributors
Assets 2

Prowler 3.7.0 - Gates of Tomorrow

06 Jul 15:19
@sergargar sergargar
3.7.0
55311c8
Compare
Choose a tag to compare
Prowler 3.7.0 - Gates of Tomorrow

Trapped in the web, but I cut the threads
Show you the gates of tomorrow
Trapped in the web, no mercy is shed
Show you the gates of tomorrow
Trapped in the web, slaves to the dead
Show you the gates of tomorrow
Trapped in the web, but I cut the threads
Show you the gates of tomorrow

As the song says, this version of Prowler is opening gates of tomorrow! More compliance frameworks like MITRE ATT&CK®, ISO27001 (2013), AWS Well-Architected Framework Reliability pillar (in addition to the existing Security pillar), better support for the Allowlist feature, with all 73 checks for GCP covering CIS Benchmark 2.0 for Google Cloud! Take this one and start closing doors to the bad guys!

New features to highlight in this version:

🥳 GCP CIS v2.0.0 benchmark coverage!

  • Prowler now supports CIS v2.0.0 benchmark for Google Cloud Platform! There were added 73 checks of GCP to fully cover the CIS framework, you can execute it with the following flag to get all CSV standard and compliance, HTML, JSON and JSON OCSF reports:
prowler gcp --compliance cis_2.0_gcp

📝 New AWS compliance frameworks available

  • Prowler now supports MITRE ATT&CK for AWS, ISO27001 (2013) for AWS and AWS Well-Architected Framework Reliability Pillar v0.1. Also, the Spanish ENS RD2022 Compliance Framework has been updated.
imagen
  • You can run the new compliance frameworks with the following command:
prowler aws --compliance mitre_attack_aws
prowler aws --compliance iso27001_2013_aws
prowler aws --compliance aws_well_architected_framework_reliability_pillar_aws
prowler aws --compliance ens_rd2022_aws

⚙️ Allowlist supports exceptions:

Allowlist:
  Accounts:
    "*":
      Checks:
        "ecs_task_definitions_no_environment_secrets":
          Regions:
            - "*"
          Resources:
            - "*"
          Exceptions:
            Accounts:
              - "0123456789012"
            Regions:
              - "eu-west-1"
              - "eu-south-2"        # Will ignore every resource in check ecs_task_definitions_no_environment_secrets except the ones in account 0123456789012 located in eu-south-2 or eu-west-1

    "123456789012":
      Checks:
        "*":
          Regions:
            - "*"
          Resources:
            - "*"
          Exceptions:
            Resources:
              - "test"
            Tags:
              - "environment=prod"   # Will ignore every resource except in account 123456789012 except the ones containing the string "test" and tag environment=prod

What's Changed

Features

  • feat(ENS): complete ENS Compliance Framework mapping by @sergargar in #2534
  • feat(MITRE): add MITRE ATT&CK framework for AWS by @sergargar in #2537
  • feat(allowlist): add exceptions to allowlist by @sergargar in #2527
  • feat(compliance): AWS Well-Architected Framework Reliability Pillar v0.1 by @sssalim-aws in #2536
  • feat(compliance): add ISO27001 compliance framework by @pedromarting3 in #2517
  • feat(lambda service): mapping lambda service to awslambda by @n4ch04 in #2538
  • feat(gcp): add CIS checks by @sergargar in #2544

Fixes

  • fix(apigw): Update metadata for API GW checks by @n4ch04 in #2512
  • fix(bigquery_dataset_public_access): handle status correctly by @sergargar in #2542
  • fix(cloudwatch secrets): fix nonetype error handling by @n4ch04 in #2543
  • fix(compliance): add version to ISO27001 by @sergargar in #2523
  • fix(compliance): remove unnecessary Optional attributes by @sergargar in #2514
  • fix(contrib): migrate multi-account-securityhub/run-prowler-securityhub.sh to v3 by @sergargar in #2503
  • fix(gcp): update Prowler SDK info of GCP by @sergargar in #2515
  • fix(iam): add StringLike condition in iam_role_cross_service_confused_deputy_prevention by @sergargar in #2533
  • fix(list-checks): handle listing checks when -s by @sergargar in #2540
  • fix(security hub): solve Security Hub format requirements by @sergargar in #2520
  • fix(vpc): handle ephemeral VPC endpoint services by @n4ch04 in #2501
  • fix(reporting docs): fix S3 reporting desc by @n4ch04 in #2551
  • fix(allowlist): reformat allowlist logic by @n4ch04 in #2555

Chores

Dependencies

New Contributors

Full Changelog: 3.6.1...3.7.0

Contributors

czantoine, dependabot, and 5 other contributors
Assets 2

Prowler 3.6.1 - Boots On

16 Jun 10:18
@sergargar sergargar
3.6.1
4ee77d5
Compare
Choose a tag to compare
Prowler 3.6.1 - Boots On

Fixes

  • fix(rds checks): test if key exists prior checking it by @n4ch04 in #2489
  • fix(security hub): Adds logic to map to valid ASFF statuses by @ckdake in #2491
  • fix(route53): correct Hosted Zone ARN by @sergargar in #2494
  • fix(asff): handle empty Recommendation Url by @sergargar in #2496

New Contributors

Full Changelog: 3.6.0...3.6.1

Contributors

ckdake, sergargar, and n4ch04
Assets 2

Prowler 3.6.0 - Boots On

13 Jun 15:21
@sergargar sergargar
3.6.0
23fd09a
Compare
Choose a tag to compare
Prowler 3.6.0 - Boots On

Die With Your Boots On is a song of Iron Maiden's album Piece of mind, it is self explanatory, we like the vibe of that song in their lives, watch it here.
Basically, this is what we do here, we go all in or nothing! 💪🏼
We are bringing the best we have in this code of Prowler 3.6.0: some new checks, improved GCP support, new features, more fixes making it a better piece of software and more helpful for your daily job 😄
Remember to run pip install prowler --upgrade and rock on! 🤘

New features to highlight in this version:

🥳 GCP Multi-Project support:

  • Prowler now supports GCP Multi-Project scans! By default Prowler will scan all the GCP Projects that is allowed to scan, if you want to scan a single project or various specific projects you can use the following flag:
prowler gcp --project-ids <Project ID 1> <Project ID 2> ... <Project ID N>

✅ 16 new checks for GCP (Thanks to @jit-contrib ! 💪🏼 ):

  • New services ApiKeys, DNS and Dataproc are covered and additional checks for Compute and IAM services.
  • See all checks with prowler gcp --list-checks

📝 OCSF Integration (Hello Amazon Security Lake!):

📊 AWS Well Architected Framework:

prowler aws --compliance aws_well_architected_framework_security_pillar_aws

⚙️ MFA supported in AWS:

  • If your IAM entity enforces MFA for AWS Calls you can use --mfa and Prowler will ask you to input the following values to get a new session:
prowler aws --mfa
Enter ARN of MFA: arn:aws:iam::012345678910:mfa/xxxxxx
Enter MFA code: XXXXXX

What's Changed

Features

  • feat(checks-gcp): Include 4 new checks covering GCP CIS by @jit-contrib in #2376
  • feat(gcp): add 12 new checks for CIS Framework by @jit-contrib in #2426
  • feat(gcp): add --project-ids flag and scan all projects by default by @sergargar in #2393
  • feat(mfa): Add MFA flag if it is required by AWS IAM Entity by @senyberg in #2478
  • feat(new_security_framework): AWS Well Architected Framework security pillar by @pedromarting3 in #2382
  • feat(ocsf): add OCSF format as JSON output for AWS, Azure and GCP. Hello Amazon Security Lake! by @sergargar in #2429
  • feat(vpc): add check vpc_subnet_no_public_ip_by_default by @senyberg in #2472
  • feat(wellarchitected): add WellArchitected service and check by @sergargar in #2461

Fixes

Chores

  • chore(arn): add missing ARNs to AWS Services by @sergargar in #2476
  • chore(arn): include ARN of AWS accounts by @sergargar in #2477
  • chore(boto3): update boto3 config by @sergargar in #2459
  • chore(compliance): Update Description in aws_well_architected_framework_security_pillar_aws.json by @sssalim-aws in #2432
  • chore(docs): add summary table to README.md by @toniblyx in #2402
  • chore(docs): Create CONTRIBUTING.md by @toniblyx in #2416
  • chore(docs): improve allowlist suggestion by @sergargar in #2466
  • chore(docs): improve custom checks docs by @sergargar in #2428
  • chore(logo): Add Prowler logo in SVG format & Propose to Prowler icon design by @dsict in #2423
  • chore(quick inventory): add warning message by @sergargar in #2460
  • chore(regions_update): Changes in regions for AWS services. by @sergargar in #2474
  • chore(vpc): add mapPublicIpOnLaunch attribute to VPC subnets by @senyberg in #2470

Dependencies

New Contributors

Full Changelog: 3.5.3...3.6.0

Contributors

toniblyx, jfagoagas, and 9 other contributors
Assets 2

Prowler 3.5.3 - Dune (To Tame a Land)

24 May 10:05
@sergargar sergargar
3.5.3
3092256
Compare
Choose a tag to compare
Prowler 3.5.3 - Dune (To Tame a Land)

Fixes

  • fix(ClientError): handle ClientErrors in DynamoDB and Directory Service by @sergargar in #2400
  • fix(OSError): handle different OSErrors by @kij in #2398
  • fix(allowlist) - tags parameter is a string, not a list by @kppullin in #2375
  • fix(aws): Handle unique map keys by @jfagoagas in #2390
  • fix(categories): remove empty categories from metadata by @sergargar in #2401
  • fix(inspector2): fix active findings count by @sergargar in #2395
  • fix(pypi-release): Push version change to the branch by @jfagoagas in #2374
  • fix(route53_dangling_ip_subdomain_takeover): notify only IPs with AWS IP Ranges by @sergargar in #2396

Dependencies

Chores

  • chore(quick-inventory): send quick inventory to output bucket by @sergargar in #2399
  • chore(regions_update): Changes in regions for AWS services. by @sergargar in #2378

New Contributors

  • @kij made their first contribution in #2398

Full Changelog: 3.5.2...3.5.3

Contributors

kij, kppullin, and 3 other contributors
Assets 2

Prowler 3.5.2 - Dune (To Tame a Land)

18 May 14:46
@sergargar sergargar
3.5.2
fad5a19
Compare
Choose a tag to compare
Prowler 3.5.2 - Dune (To Tame a Land)

Fixes

  • fix(action): solve pypi-release action creating the release branch by @sergargar in #2364
  • fix(sts): Use the right region to validate credentials by @jfagoagas in #2349
  • fix(resource_not_found): Handle error by @jfagoagas in #2370
  • fix(ssm incidents): check if service available in aws partition by @sergargar in #2372

Chores

  • chore(docs): format regions-and-partitions by @jfagoagas in #2371
  • chore(regions_update): Changes in regions for AWS services. by @sergargar in #2366

Full Changelog: 3.5.1...3.5.2

Contributors

jfagoagas and sergargar
Assets 2

Prowler 3.5.1 - Dune (To Tame a Land)

16 May 09:16
@jfagoagas jfagoagas
3.5.1
fb53d07
Compare
Choose a tag to compare
Prowler 3.5.1 - Dune (To Tame a Land)

Fixes

Dependencies

Chores

  • chore(regions_update): Changes in regions for AWS services. by @sergargar in #2350
  • chore(regions_update): Changes in regions for AWS services. by @sergargar in #2353

Full Changelog: 3.5.0...3.5.1

Contributors

dependabot and sergargar
Assets 2

Prowler 3.5.0 - Dune (To Tame a Land)

11 May 14:20
@sergargar sergargar
3.5.0
cc59c1c
Compare
Choose a tag to compare
Prowler 3.5.0 - Dune (To Tame a Land)

I like the story behind this Iron Maiden song. Enjoy Prowler 3.5.0 - Dune!

New features to highlight in this version:

🥳 Slack integration:

  • Prowler now supports Slack integrations! Send a summary of the execution with a Slack APP in your channel, see more in our Integrations Docs

image

✅ 9 new checks for AWS:

  • New services covered like FMS and NetworkFirewall, additional checks for AutoScaling, Organizations, RDS, Route53, S3, SSM Incidents and Workspaces.
  • New important checks:
    • iam_role_cross_account_readonlyaccess_policy Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts
    • route53_dangling_ip_subdomain_takeover Check if Route53 Records contains dangling IPs (based on https://github.com/assetnote/ghostbuster)
  • See all checks withprowler aws --list-checks

🔨 Allowlist improvements:

  • You can allowlist an specific service and include regex expressions in the tags, see more in our Allowlist Docs

What's Changed:

Features

  • feat(allowlist): allowlist a specific service by @sergargar in #2331
  • feat(allowlist): Support regexes in Tags to allow "or"-like conditional matching by @kppullin in #2300
  • feat(autoscaling): new check autoscaling_group_multiple_az by @gabrielsoltz in #2273
  • feat(FMS): New Service FMS and Check fms_accounts_compliant by @gabrielsoltz in #2259
  • feat(iam): add iam_role_cross_account_readonlyaccess_policy check by @sergargar in #2312
  • feat(NetworkFirewall): New Service and Check by @gabrielsoltz in #2261
  • feat(Organizations): New check organizations_tags_policies_enabled_and_attached by @gabrielsoltz in #2287
  • feat(pre-commit): added trufflehog to pre-commit by @n4ch04 in #2311
  • feat(rds): new check rds_instance_deprecated_engine_version by @pedromarting3 in #2298
  • feat(route53): add route53_dangling_ip_subdomain_takeover check by @sergargar in #2288
  • feat(s3): add s3_bucket_object_lock check by @sergargar in #2274
  • feat(slack): add Slack App integration by @sergargar in #2305
  • feat(ssmincidents): Use regional_client region instead of audit_profile region by @gabrielsoltz in #2306
  • feat(workspaces): New check workspaces_vpc_2private_1public_subnets_nat by @gabrielsoltz in #2286

Fixes

Chores

Dependencies

New Contributors

Full Changelog: 3.4.1...3.5.0

Contributors

kppullin, gabrielsoltz, and 6 other contributors
Assets 2

Prowler 3.4.1 - Still Life

25 Apr 11:46
@sergargar sergargar
3.4.1
05b86c6
Compare
Choose a tag to compare
Prowler 3.4.1 - Still Life

Fixes

  • fix(iam_role_cross_service_confused_deputy_prevention): avoid service linked roles by @sergargar in #2249
  • fix(version): execute check current version function only when -v by @sergargar in #2263
  • fix(log_group_retention): handle log groups that never expire by @jfagoagas in #2272

Chores

  • chore(test): add rds_instance_transport_encrypted test by @sergargar in #2252
  • chore(regions_update): Changes in regions for AWS services. by @sergargar in #2251
  • chore(regions_update): Changes in regions for AWS services. by @sergargar in #2258
  • chore(test): add CloudWatch and Logs tests by @sergargar in #2264

Builds

Full Changelog: 3.4.0...3.4.1

Contributors

jfagoagas, dependabot, and sergargar
Assets 2