def test_valid_security_group_port443(valid_security_group_port443):
rule = EC2SecurityGroupOpenToWorldRule(None)
result = rule.invoke(valid_security_group_port443)
assert result.valid
assert len(result.failed_rules) == 0
assert len(result.failed_monitored_rules) == 0
def test_invalid_security_group_cidripv6(invalid_security_group_cidripv6):
rule = EC2SecurityGroupOpenToWorldRule(None)
result = rule.invoke(invalid_security_group_cidripv6)
assert not result.valid
assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
assert result.failed_rules[
0].reason == "Port(s) 22 open to public IPs: (::/0) in security group 'SecurityGroup'"
def test_security_group_type_slash0(security_group_type_slash0):
rule = EC2SecurityGroupOpenToWorldRule(None)
result = rule.invoke(security_group_type_slash0)
assert not result.valid
assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
assert (
result.failed_rules[0].reason ==
"Port(s) 22 open to public IPs: (0.0.0.0/0) in security group 'SecurityGroup'"
)
def test_invalid_security_group_range(invalid_security_group_range):
rule = EC2SecurityGroupOpenToWorldRule(None)
result = rule.invoke(invalid_security_group_range)
assert not result.valid
assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
assert (
result.failed_rules[0].reason ==
"Port(s) 0-79, 81-100 open to public IPs: (11.0.0.0/8) in security group 'SecurityGroup'"
)
def test_invalid_security_group_multiple_statements(
invalid_security_group_multiple_statements):
rule = EC2SecurityGroupOpenToWorldRule(None)
result = rule.invoke(invalid_security_group_multiple_statements)
assert not result.valid
assert result.failed_rules[0].rule == "EC2SecurityGroupOpenToWorldRule"
assert (
result.failed_rules[0].reason ==
"Port(s) 9090 open to public IPs: (172.0.0.0/8) in security group 'SecurityGroup'"
)
def test_security_group_type_slash0(security_group_type_slash0):
rule = EC2SecurityGroupOpenToWorldRule(None)
result = rule.invoke(security_group_type_slash0)
assert not result.valid
assert compare_lists_of_failures(
result.failures,
[
Failure(
granularity=RuleGranularity.RESOURCE,
reason=
"Port(s) 22 open to public IPs: (0.0.0.0/0) in security group 'SecurityGroup'",
risk_value=RuleRisk.MEDIUM,
rule="EC2SecurityGroupOpenToWorldRule",
rule_mode=RuleMode.BLOCKING,
actions=None,
resource_ids={"SecurityGroup"},
)
],
)
def test_valid_security_group_port443(valid_security_group_port443):
rule = EC2SecurityGroupOpenToWorldRule(None)
result = rule.invoke(valid_security_group_port443)
assert result.valid
assert compare_lists_of_failures(result.failures, [])