search

prowler-cloud / prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
https://prowler.com
Apache License 2.0
10.88k stars 1.55k forks source link

vpc_different_regions check returning false positive #3540

Open adistasio opened 8 months ago

adistasio commented 8 months ago

Steps to Reproduce

prowler aws

Expected behavior

Check Passes.

Actual Result with Screenshots or Logs

Check fails.

How did you install Prowler?

From pip package (pip install prowler)

Environment Resource

Workstation

OS used

MacOS

Prowler version

3.14.0

Pip version

23.3.2

Context

When running the "vpc_different_regions" check for AWS, the check always fails even though I have a VPC in multiple regions (us-east-1 and us-east-2). It's unclear why it's failing so either there is an issue with the check not working or the recommendation section could be updated to be more clear on what the specific configuration should be.

MrCloudSec commented 8 months ago

Hi @adistasio, thanks for reaching us out! I could not reproduce this error, can you share the command that you are using of Prowler?

adistasio commented 8 months ago

Hello @sergargar, I run the following command.

prowler aws --profile PROFILE --checks vpc_different_regions

I can also run it without the check flag, but it fails. My credentials file has one entry with my AWS key and secret specified. I also tried this with and with an AWS config file that specified the default region.

Here are the VPC's in my AWS account, one in us-east-1 and one in us-east-2.

vpc-us-east-1 vpc-us-east-2

MrCloudSec commented 8 months ago

Thanks for the information @adistasio , can you execute it again with --log-level ERROR?

adistasio commented 8 months ago

@sergargar That didn't result in any more specific logs. Here are screenshots of the command line run and prowler output report.

commandline prowler output

sansns commented 4 weeks ago

@adistasio Is there any chance the VPCs you have in different regions are the default VPC? I could only reproduce this error if I only had default VPCs other regions.

The check specifically makes sure that the VPC is not the default using this bit of code if not vpc.default:.