Skip to content

Prowler 4.3.0 - The Alchemist
Compare
Choose a tag to compare
@sergargar sergargar released this 29 Jul 16:39
· 73 commits to v4.3 since this release
4.3.0
This tag was signed with the committer’s verified signature.
sergargar Sergio Garcia
GPG key ID: 8E4745A2F6F806A7
Learn about vigilant mode.
3e03553
This commit was signed with the committer’s verified signature.
sergargar Sergio Garcia
GPG key ID: 8E4745A2F6F806A7
Learn about vigilant mode.

I will return to this land
Rebuild where the ruins did stand
Chain of the demons set free
Strange alchemy

Prowler 4.3.0 - The Alchemist 🚀 brings a whole bunch of new checks, new features and fixes, also we offer you to listen to this Iron Maiden song.

Special thanks to our new engineers' contributions, @danibarranqueroo and @HugoPBrito, and to our new community contributors @sejimhp, @lshw54, @andoniaf, @shot4free, @jacky9813, @chaipot and @JOSHUAJEBARAJ 🥳

New features to highlight in this version

AWS

Prowler is improving its AWS coverage by including 24 new checks for DMS, DocumentDB, Elasticache, IAM, Neptune, NetworkFirewall and RDS. Special thanks to our external contributor @sansns for doing new checks 🙌

See all the new available checks with prowler aws --list-checks

  • dms_instance_minor_version_upgrade_enabled
  • dms_instance_multi_az_enabled
  • dms_instance_no_public_access
  • documentdb_cluster_backup_enabled
  • documentdb_cluster_cloudwatch_log_export
  • documentdb_cluster_deletion_protection
  • elasticache_redis_cluster_backup_enabled
  • elasticache_redis_cluster_in_transit_encryption_enabled
  • elasticache_redis_cluster_multi_az_enabled
  • elasticache_redis_cluster_rest_encryption_enabled
  • iam_inline_policy_allows_privilege_escalation
  • iam_inline_policy_no_full_access_to_cloudtrail
  • iam_inline_policy_no_full_access_to_kms
  • neptune_cluster_backup_enabled
  • neptune_cluster_deletion_protection
  • neptune_cluster_iam_authentication_enabled
  • neptune_cluster_multi_az
  • neptune_cluster_storage_encrypted
  • networkfirewall_deletion_protection
  • rds_cluster_backtrack_enabled
  • rds_instance_default_admin
  • rds_instance_event_subscription_security_groups
  • rds_instance_iam_authentication_enabled
  • rds_snapshots_encrypted

Also for AWS now you can make check eks_control_plane_logging_all_types_enabled configurable by @kagahd.

Azure

This release includes 8 new checks of security best practices for Azure App Functions thanks to the great work of @puchy22 🥇

See new available checks with prowler azure --list-checks --service app

  • app_function_access_keys_configured
  • app_function_app_insights_is_configured
  • app_function_identity_without_admin_privileges
  • app_function_identity_is_configured
  • app_function_not_publicly_accessible
  • app_function_runtime_is_the_latest
  • app_function_vnet_integration_enabled
  • app_function_ftps_deployment_disabled

GCP

  • Service Account Impersonation supported!
    Instead of saving a credentials file or running Prowler inside a GCP workload, now you have the ability of impersonate a GCP Service Account using the argument --impersonate-service-account <service-account-email> and follow security best practices. See more information in our docs here.

🔧 Other issues and bug fixes solved for all the cloud providers

Features

  • feat(app): Add new Azure functions checks by @puchy22 in #4189
  • feat(AWS): make check eks_control_plane_logging_all_types_enabled configurable by @kagahd in #4553
  • feat(DMS): Add Database Migration Service (DMS) by @sansns in #4249
  • feat(DocumentDB): New DocumentDB checks by @sansns in #4247
  • feat(Elasticache): Additional Elasticache checks by @sansns in #4317
  • feat(GCP): add service account impersonation by @sergargar in #4291
  • feat(IAM): Add inline policies checks and improve custom policy checks by @puchy22 in #4255
  • feat(Neptune): Additional Neptune checks by @sansns in #4243
  • feat(NetworkFirewall): Add Deletion Protection Check by @sansns in #4318
  • feat(output): Add a setter for the file descriptor and include extension by @jfagoagas in #4468
  • feat(RDS): Additional RDS checks by @sansns in #4233
  • feat(RDS): Add security group event subscription check by @sansns in #4130

Fixes

Chores

Docs

  • docs(debugging): Improve actual VSCode debugging file by @puchy22 in #4279
  • docs(requirements): Add management group for multiple subscriptions by @puchy22 in #4282
  • docs(azure): Review actual roles necessary to execute Prowler by @puchy22 in #4501
  • docs(developer): improve developers docs with Trufflehog and --no-verify by @pedrooot in #4502
  • docs(developer-guide): How to fork the repo by @jfagoagas in #4238
  • docs(gcp): Fix typo in title by @jfagoagas in #4434
  • docs(kubernetes): add docs about kubernetes in tutorials page by @pedrooot in #4288
  • docs(readme): add Prowler animation gif to README by @pedrooot in #4492
  • docs(readme): update check number on readme by @pedrooot in #4377
  • docs(readme): Update checks number by @pedrooot in #4197
  • docs(readme): update dashboard screenshot in README by @pedrooot in #4479
  • docs(readme): update README.md by @eltociear in #4483
  • docs(services): Fixed changed links by @HugoPBrito in #4536

Tests

  • chore(test): add missing acm imported certificate test by @sergargar in #4485
  • chore(test): enhance OCSF tests by @pedrooot in #4386
  • chore(tests): add for empty findings and little renamings by @jfagoagas in #4388
  • chore(tests): Improve CloudTrail tests checking for multiregional trails by @jfagoagas in #4177
  • test(cloudstorage): Add remaining GCP tests for CloudStorage checks by @danibarranqueroo in #4464
  • test(compute): Add remaining tests for Compute service in GCP provider by @puchy22 in #4458
  • test(gcp): Add bigquery and half of cloudsql check tests by @puchy22 in #4462
  • test(gcp): Add remaining CloudSQL tests by @puchy22 in #4380
  • test(gcp): Test GCP provider new auth and print credentials by @puchy22 in #4331
  • test(iam): Add remaining GCP tests for IAM checks by @danibarranqueroo in #4519
  • test(logging): Add remaining tests for Logging checks by @puchy22 in #4481

Dependencies

New Contributors

Full Changelog: 4.2.4...4.3.0

Contributors

sejimhp, jacky9813, and 16 other contributors
Assets 2
Loading