search

prowler-cloud / prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
https://prowler.com
Apache License 2.0
10.51k stars 1.5k forks source link

False positive on ec2_securitygroup_not_used with Batch Compute #3264

Open christiandavilakoobin opened 8 months ago

christiandavilakoobin commented 8 months ago

Steps to Reproduce

If a security group is assigned only on a lambda function, prowlers thinks that is unused and rises an alert.

Expected behavior

Prowler should detect that is assigned to a lambda

Actual Result with Screenshots or Logs

image image

How did you install Prowler?

Docker (docker pull toniblyx/prowler)

Environment Resource

Docker cointainer

OS used

Linux

Prowler version

3.12

Pip version

The one inside docker image

Context

No response

sergargar commented 7 months ago

Hi @christiandavilakoobin , thanks for reaching us out! However, I cannot reproduce your error and the check works as expected on my side. Make sure that you have the latest version and that you are not getting any error when Prowler retrieves the information from the Lambda functions, using the flag --log-level ERROR.

christiandavilakoobin commented 7 months ago

Hi @sergargar!

My bad! I just checked again, and I had an exception on this rule, so all of them appear as warning, not only the not used ones. I just saw that on the same screenshot I send this, it says "is used". When I removed the exception it works fine.

sergargar commented 7 months ago

Awesome, glad that it works. I will close this issue then. Let us know if you have any other issues.

christiandavilakoobin commented 7 months ago

Hi again,

Regardless, it same to fail on Batch Compute. I have a security group assigned to a batch compute, but Prowler says it is not attached:

image image
sergargar commented 7 months ago

Hi @christiandavilakoobin, since we still do not cover the batch service, we cannot check that use case. I have include it in our roadmap. Thanks for letting us know!

christiandavilakoobin commented 7 months ago

Roger that! I'll add those security groups to an exception, meanwhile.

Thank you!