Exemplo n.º 1
0
def test_valid_security_group_port443(valid_security_group_port443):
    rule = EC2SecurityGroupOpenToWorldRule(None)
    result = rule.invoke(valid_security_group_port443)

    assert result.valid
    assert len(result.failed_rules) == 0
    assert len(result.failed_monitored_rules) == 0
Exemplo n.º 2
0
def test_invalid_security_group_cidripv6(invalid_security_group_cidripv6):
    rule = EC2SecurityGroupOpenToWorldRule(None)
    result = rule.invoke(invalid_security_group_cidripv6)

    assert not result.valid
    assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
    assert result.failed_rules[
        0].reason == "Port(s) 22 open to public IPs: (::/0) in security group 'SecurityGroup'"
Exemplo n.º 3
0
def test_security_group_type_slash0(security_group_type_slash0):
    rule = EC2SecurityGroupOpenToWorldRule(None)
    result = rule.invoke(security_group_type_slash0)

    assert not result.valid
    assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
    assert (
        result.failed_rules[0].reason ==
        "Port(s) 22 open to public IPs: (0.0.0.0/0) in security group 'SecurityGroup'"
    )
Exemplo n.º 4
0
def test_invalid_security_group_range(invalid_security_group_range):
    rule = EC2SecurityGroupOpenToWorldRule(None)
    result = rule.invoke(invalid_security_group_range)

    assert not result.valid
    assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
    assert (
        result.failed_rules[0].reason ==
        "Port(s) 0-79, 81-100 open to public IPs: (11.0.0.0/8) in security group 'SecurityGroup'"
    )
Exemplo n.º 5
0
def test_invalid_security_group_multiple_statements(
        invalid_security_group_multiple_statements):
    rule = EC2SecurityGroupOpenToWorldRule(None)
    result = rule.invoke(invalid_security_group_multiple_statements)

    assert not result.valid
    assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
    assert (
        result.failed_rules[0].reason ==
        "Port(s) 9090 open to public IPs: (172.0.0.0/8) in security group 'SecurityGroup'"
    )
Exemplo n.º 6
0
def test_security_group_type_slash0(security_group_type_slash0):
    rule = EC2SecurityGroupOpenToWorldRule(None)
    result = rule.invoke(security_group_type_slash0)

    assert not result.valid
    assert compare_lists_of_failures(
        result.failures,
        [
            Failure(
                granularity=RuleGranularity.RESOURCE,
                reason=
                "Port(s) 22 open to public IPs: (0.0.0.0/0) in security group 'SecurityGroup'",
                risk_value=RuleRisk.MEDIUM,
                rule="EC2SecurityGroupOpenToWorldRule",
                rule_mode=RuleMode.BLOCKING,
                actions=None,
                resource_ids={"SecurityGroup"},
            )
        ],
    )
Exemplo n.º 7
0
def test_valid_security_group_port443(valid_security_group_port443):
    rule = EC2SecurityGroupOpenToWorldRule(None)
    result = rule.invoke(valid_security_group_port443)

    assert result.valid
    assert compare_lists_of_failures(result.failures, [])