def test_celery_beat(self, mock_expired_exceptions, mock_account_tech, mock_purge, mock_setup): from security_monkey.task_scheduler.beat import setup_the_tasks from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.auditors.iam.iam_role import IAMRoleAuditor # Set up the monitor: test_account = Account.query.filter( Account.name == "TEST_ACCOUNT1").one() watcher = IAMRole(accounts=[test_account.name]) batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = watcher batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] import security_monkey.task_scheduler.tasks old_get_monitors = security_monkey.task_scheduler.tasks.get_monitors security_monkey.task_scheduler.tasks.get_monitors = lambda x, y, z: [ batched_monitor ] setup_the_tasks(mock.Mock()) assert mock_setup.called assert mock_purge.called # "apply_async" where the immediately scheduled tasks assert mock_account_tech.apply_async.called # The ".s" are the scheduled tasks. Too lazy to grab the intervals out. assert mock_account_tech.s.called assert mock_expired_exceptions.s.called #assert mock_task_audit.s.called # Build the expected mock results: scheduled_tech_result_list = [] async_result_list = [] # audit_result_list = [] import security_monkey.watcher import security_monkey.auditor for account in Account.query.filter( Account.third_party == False).filter( Account.active == True).all(): # noqa for w in security_monkey.watcher.watcher_registry.iterkeys(): scheduled_tech_result_list.append(((account.name, w), )) async_result_list.append((((account.name, w), ), )) # It's just policy for IAM: # audit_result_list.append(((account.name, "policy"),)) assert mock_account_tech.s.call_args_list == scheduled_tech_result_list assert async_result_list == mock_account_tech.apply_async.call_args_list # assert audit_result_list == mock_task_audit.s.call_args_list security_monkey.task_scheduler.tasks.get_monitors = old_get_monitors
def test_audit_specific_changes(self): from security_monkey.task_scheduler.tasks import _audit_specific_changes from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.cloudaux_watcher import CloudAuxChangeItem from security_monkey.auditors.iam.iam_role import IAMRoleAuditor # Set up the monitor: test_account = Account.query.filter( Account.name == "TEST_ACCOUNT1").one() batched_monitor = Monitor(IAMRole, test_account) batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] technology = Technology(name="iamrole") db.session.add(technology) db.session.commit() watcher = Watcher(accounts=[test_account.name]) watcher.current_account = (test_account, 0) watcher.technology = technology # Create some IAM roles for testing: items = [] for x in range(0, 3): role_policy = dict(ROLE_CONF) role_policy[ "Arn"] = ARN_PREFIX + ":iam::012345678910:role/roleNumber{}".format( x) role_policy["RoleName"] = "roleNumber{}".format(x) role = CloudAuxChangeItem.from_item(name=role_policy['RoleName'], item=role_policy, record_region='universal', account_name=test_account.name, index='iamrole', source_watcher=watcher) items.append(role) audit_items = watcher.find_changes_batch(items, {}) assert len(audit_items) == 3 # Perform the audit: _audit_specific_changes(batched_monitor, audit_items, False) # Check all the issues are there: assert len(ItemAudit.query.all()) == 3
def test_audit_specific_changes(self): from security_monkey.scheduler import _audit_specific_changes from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole, IAMRoleItem from security_monkey.auditors.iam.iam_role import IAMRoleAuditor # Set up the monitor: test_account = Account.query.filter( Account.name == "TEST_ACCOUNT1").one() batched_monitor = Monitor(IAMRole, test_account) batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] technology = Technology(name="iamrole") db.session.add(technology) db.session.commit() watcher = Watcher(accounts=[test_account.name]) watcher.current_account = (test_account, 0) watcher.technology = technology # Create some IAM roles for testing: items = [] for x in range(0, 3): role_policy = dict(ROLE_CONF) role_policy[ "Arn"] = "arn:aws:iam::012345678910:role/roleNumber{}".format( x) role_policy["RoleName"] = "roleNumber{}".format(x) role = IAMRoleItem.from_slurp(role_policy, account_name=test_account.name) items.append(role) audit_items = watcher.find_changes_batch(items, {}) assert len(audit_items) == 3 # Perform the audit: _audit_specific_changes(batched_monitor, audit_items, False) # Check all the issues are there: assert len(ItemAudit.query.all()) == 3
def test_audit_specific_changes(self): from security_monkey.scheduler import _audit_specific_changes from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole, IAMRoleItem from security_monkey.auditors.iam.iam_role import IAMRoleAuditor # Set up the monitor: test_account = Account.query.filter(Account.name == "TEST_ACCOUNT1").one() batched_monitor = Monitor(IAMRole, test_account) batched_monitor.auditors = [IAMRoleAuditor(accounts=[test_account.name])] technology = Technology(name="iamrole") db.session.add(technology) db.session.commit() watcher = Watcher(accounts=[test_account.name]) watcher.current_account = (test_account, 0) watcher.technology = technology # Create some IAM roles for testing: items = [] for x in range(0, 3): role_policy = dict(ROLE_CONF) role_policy["Arn"] = "arn:aws:iam::012345678910:role/roleNumber{}".format(x) role_policy["RoleName"] = "roleNumber{}".format(x) role = IAMRoleItem.from_slurp(role_policy, account_name=test_account.name) items.append(role) audit_items = watcher.find_changes_batch(items, {}) assert len(audit_items) == 3 # Perform the audit: _audit_specific_changes(batched_monitor, audit_items, False) # Check all the issues are there: assert len(ItemAudit.query.all()) == 3
def test_find_batch_changes(self, mock_fix_orphaned): """ Runs through a full find job via the IAMRole watcher, as that supports batching. However, this is mostly testing the logic through each function call -- this is not going to do any boto work and that will instead be mocked out. :return: """ from security_monkey.task_scheduler.tasks import manual_run_change_finder from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.auditors.iam.iam_role import IAMRoleAuditor test_account = Account(name="TEST_ACCOUNT1") watcher = IAMRole(accounts=[test_account.name]) technology = Technology(name="iamrole") db.session.add(technology) db.session.commit() watcher.batched_size = 3 # should loop 4 times self.add_roles() # Set up the monitor: batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = watcher batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] import security_monkey.task_scheduler.tasks old_get_monitors = security_monkey.task_scheduler.tasks.get_monitors security_monkey.task_scheduler.tasks.get_monitors = lambda x, y, z: [ batched_monitor ] # Moto screws up the IAM Role ARN -- so we need to fix it: original_slurp_list = watcher.slurp_list original_slurp = watcher.slurp def mock_slurp_list(): items, exception_map = original_slurp_list() for item in watcher.total_list: item["Arn"] = ARN_PREFIX + ":iam::012345678910:role/{}".format( item["RoleName"]) return items, exception_map def mock_slurp(): batched_items, exception_map = original_slurp() for item in batched_items: item.arn = ARN_PREFIX + ":iam::012345678910:role/{}".format( item.name) item.config["Arn"] = item.arn item.config["RoleId"] = item.name # Need this to stay the same return batched_items, exception_map watcher.slurp_list = mock_slurp_list watcher.slurp = mock_slurp manual_run_change_finder([test_account.name], [watcher.index]) assert mock_fix_orphaned.called # Check that all items were added to the DB: assert len(Item.query.all()) == 11 # Check that we have exactly 11 item revisions: assert len(ItemRevision.query.all()) == 11 # Check that there are audit issues for all 11 items: assert len(ItemAudit.query.all()) == 11 # Delete one of the items: # Moto lacks implementation for "delete_role" (and I'm too lazy to submit a PR :D) -- so need to create again... mock_iam().stop() mock_sts().stop() self.add_roles(initial=False) # Run the it again: watcher.current_account = None # Need to reset the watcher manual_run_change_finder([test_account.name], [watcher.index]) # Check that nothing new was added: assert len(Item.query.all()) == 11 # There should be the same number of issues and 2 more revisions: assert len(ItemAudit.query.all()) == 11 assert len(ItemRevision.query.all()) == 13 # Check that the deleted roles show as being inactive: ir = ItemRevision.query.join((Item, ItemRevision.id == Item.latest_revision_id)) \ .filter(Item.arn.in_( [ARN_PREFIX + ":iam::012345678910:role/roleNumber9", ARN_PREFIX + ":iam::012345678910:role/roleNumber10"])).all() assert len(ir) == 2 assert not ir[0].active assert not ir[1].active # Finally -- test with a slurp list exception (just checking that things don't blow up): import security_monkey.watchers.iam.iam_role old_list_roles = security_monkey.watchers.iam.iam_role.list_roles def mock_slurp_list_with_exception(): security_monkey.watchers.iam.iam_role.list_roles = lambda **kwargs: 1 / 0 items, exception_map = original_slurp_list() assert len(exception_map) > 0 return items, exception_map watcher.slurp_list = mock_slurp_list_with_exception watcher.current_account = None # Need to reset the watcher manual_run_change_finder([test_account.name], [watcher.index]) security_monkey.task_scheduler.tasks.get_monitors = old_get_monitors security_monkey.watchers.iam.iam_role.list_roles = old_list_roles mock_iam().stop() mock_sts().stop()
def test_report_batch_changes(self, mock_fix_orphaned): from security_monkey.task_scheduler.tasks import manual_run_change_reporter from security_monkey.datastore import Item, ItemRevision, ItemAudit from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.auditors.iam.iam_role import IAMRoleAuditor test_account = Account.query.filter( Account.name == "TEST_ACCOUNT1").one() watcher = IAMRole(accounts=[test_account.name]) watcher.batched_size = 3 # should loop 4 times self.add_roles() # Set up the monitor: batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = watcher batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] # Set up the Reporter: import security_monkey.reporter old_all_monitors = security_monkey.reporter.all_monitors security_monkey.reporter.all_monitors = lambda x, y: [batched_monitor] import security_monkey.task_scheduler.tasks old_get_monitors = security_monkey.task_scheduler.tasks.get_monitors security_monkey.task_scheduler.tasks.get_monitors = lambda x, y, z: [ batched_monitor ] # Moto screws up the IAM Role ARN -- so we need to fix it: original_slurp_list = watcher.slurp_list original_slurp = watcher.slurp def mock_slurp_list(): items, exception_map = original_slurp_list() for item in watcher.total_list: item["Arn"] = ARN_PREFIX + ":iam::012345678910:role/{}".format( item["RoleName"]) return items, exception_map def mock_slurp(): batched_items, exception_map = original_slurp() for item in batched_items: item.arn = ARN_PREFIX + ":iam::012345678910:role/{}".format( item.name) item.config["Arn"] = item.arn item.config["RoleId"] = item.name # Need this to stay the same return batched_items, exception_map watcher.slurp_list = mock_slurp_list watcher.slurp = mock_slurp manual_run_change_reporter([test_account.name]) assert mock_fix_orphaned.called # Check that all items were added to the DB: assert len(Item.query.all()) == 11 # Check that we have exactly 11 item revisions: assert len(ItemRevision.query.all()) == 11 # Check that there are audit issues for all 11 items: assert len(ItemAudit.query.all()) == 11 mock_iam().stop() mock_sts().stop() security_monkey.reporter.all_monitors = old_all_monitors security_monkey.task_scheduler.tasks.get_monitors = old_get_monitors
def test_celery_ignore_tech(self, mock_store_exception, mock_expired_exceptions, mock_account_tech, mock_purge, mock_setup): import security_monkey.celeryconfig security_monkey.celeryconfig.security_monkey_watcher_ignore = { "policy" } from security_monkey.task_scheduler.beat import setup_the_tasks from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.watchers.iam.managed_policy import ManagedPolicy from security_monkey.auditors.iam.iam_role import IAMRoleAuditor from security_monkey.auditors.iam.iam_policy import IAMPolicyAuditor # Stop the watcher registry from stepping on everyone's toes: import security_monkey.watcher import security_monkey.monitors security_monkey.watcher.watcher_registry = { IAMRole.index: IAMRole, ManagedPolicy.index: ManagedPolicy } security_monkey.monitors.watcher_registry = security_monkey.watcher.watcher_registry # Set up the monitors: test_account = Account.query.filter( Account.name == "TEST_ACCOUNT1").one() role_watcher = IAMRole(accounts=[test_account.name]) mp_watcher = ManagedPolicy(accounts=[test_account.name]) batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = role_watcher batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] normal_monitor = Monitor(ManagedPolicy, test_account) normal_monitor.watcher = mp_watcher normal_monitor.auditors = [ IAMPolicyAuditor(accounts=[test_account.name]) ] import security_monkey.task_scheduler.tasks old_get_monitors = security_monkey.task_scheduler.tasks.get_monitors security_monkey.task_scheduler.tasks.get_monitors = lambda x, y, z: [ batched_monitor, normal_monitor ] setup_the_tasks(mock.Mock()) assert mock_setup.called assert mock_purge.called assert not mock_store_exception.called # "apply_async" where the immediately scheduled tasks assert mock_account_tech.apply_async.called # The ".s" are the scheduled tasks. Too lazy to grab the intervals out. assert mock_account_tech.s.called assert mock_expired_exceptions.s.called assert mock_expired_exceptions.apply_async.called # Policy should not be called at all: for mocked_call in mock_account_tech.s.call_args_list: assert mocked_call[0][1] == "iamrole" for mocked_call in mock_account_tech.apply_async.call_args_list: assert mocked_call[0][0][1] == "iamrole" security_monkey.task_scheduler.tasks.get_monitors = old_get_monitors
def test_celery_skipabeat(self, mock_store_exception, mock_expired_exceptions, mock_account_tech, mock_purge, mock_setup): from security_monkey.task_scheduler.beat import setup_the_tasks from security_monkey.watchers.github.org import GitHubOrg from security_monkey.auditors.github.org import GitHubOrgAuditor # Stop the watcher registry from stepping on everyone's toes: import security_monkey.watcher import security_monkey.monitors security_monkey.watcher.watcher_registry = {GitHubOrg.index: GitHubOrg} security_monkey.monitors.watcher_registry = security_monkey.watcher.watcher_registry app.config["GITHUB_CREDENTIALS"] = {} # Set up the monitor: self.account_type = AccountType(name="GitHub") db.session.add(self.account_type) db.session.commit() app.config["GITHUB_CREDENTIALS"] = {"Org-one": "token-one"} db.session.add( Account(name="Org-one", account_type_id=self.account_type.id, identifier="Org-one", active=True, third_party=False)) self.technology = Technology(name="organization") db.session.add(self.technology) db.session.commit() # Disable the other accounts: disable_account_1 = Account.query.filter( Account.name == "TEST_ACCOUNT1").one() disable_account_2 = Account.query.filter( Account.name == "TEST_ACCOUNT2").one() disable_account_1.active = False disable_account_2.active = False db.session.add(disable_account_1) db.session.add(disable_account_2) db.session.commit() test_account = Account.query.filter(Account.name == "Org-one").one() watcher = GitHubOrg(accounts=[test_account.name]) monitor = Monitor(GitHubOrg, test_account) monitor.watcher = watcher monitor.auditors = [GitHubOrgAuditor(accounts=[test_account.name])] # This is externally executed (as in not with Celery): db.session.add( WatcherConfig(index=GitHubOrg.index, active=True, interval=0)) db.session.commit() import security_monkey.task_scheduler.tasks old_get_monitors = security_monkey.task_scheduler.tasks.get_monitors security_monkey.task_scheduler.tasks.get_monitors = lambda x, y, z: [ monitor ] get_interval = mock.Mock() monitor.watcher.get_interval = get_interval setup_the_tasks(mock.Mock()) assert mock_setup.called assert mock_purge.called assert not mock_store_exception.called # "apply_async" will NOT be called... assert not mock_account_tech.apply_async.called # The ".s" are the scheduled tasks. Too lazy to grab the intervals out. assert not mock_account_tech.s.called # Will not be called assert mock_expired_exceptions.s.called assert mock_expired_exceptions.apply_async.called # Cleanup: security_monkey.task_scheduler.tasks.get_monitors = old_get_monitors disable_account_1.active = True disable_account_2.active = True test_account.active = False db.session.add(disable_account_1) db.session.add(disable_account_2) db.session.add(test_account) db.session.commit()
def test_report_batch_changes(self): from security_monkey.alerter import Alerter from security_monkey.reporter import Reporter from security_monkey.datastore import Item, ItemRevision, ItemAudit from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.auditors.iam.iam_role import IAMRoleAuditor account_type_result = AccountType.query.filter( AccountType.name == "AWS").one() db.session.add(account_type_result) db.session.commit() test_account = Account(identifier="012345678910", name="TEST_ACCOUNT", account_type_id=account_type_result.id, notes="TEST_ACCOUNT1", third_party=False, active=True) watcher = IAMRole(accounts=[test_account.name]) db.session.commit() watcher.batched_size = 3 # should loop 4 times self.add_roles() # Set up the monitor: batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = watcher batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] # Set up the Reporter: import security_monkey.reporter old_all_monitors = security_monkey.reporter.all_monitors security_monkey.reporter.all_monitors = lambda x, y: [] test_reporter = Reporter() test_reporter.all_monitors = [batched_monitor] test_reporter.account_alerter = Alerter( watchers_auditors=test_reporter.all_monitors, account=test_account.name) import security_monkey.scheduler # import security_monkey.monitors # old_get_monitors = security_monkey.scheduler.get_monitors security_monkey.scheduler.get_monitors = lambda x, y, z: [ batched_monitor ] # Moto screws up the IAM Role ARN -- so we need to fix it: original_slurp_list = watcher.slurp_list original_slurp = watcher.slurp def mock_slurp_list(): items, exception_map = original_slurp_list() for item in watcher.total_list: item["Arn"] = "arn:aws:iam::012345678910:role/{}".format( item["RoleName"]) return items, exception_map def mock_slurp(): batched_items, exception_map = original_slurp() for item in batched_items: item.arn = "arn:aws:iam::012345678910:role/{}".format( item.name) item.config["Arn"] = item.arn item.config["RoleId"] = item.name # Need this to stay the same return batched_items, exception_map watcher.slurp_list = mock_slurp_list watcher.slurp = mock_slurp test_reporter.run(account=test_account.name) # Check that all items were added to the DB: assert len(Item.query.all()) == 11 # Check that we have exactly 11 item revisions: assert len(ItemRevision.query.all()) == 11 # Check that there are audit issues for all 11 items: assert len(ItemAudit.query.all()) == 11 mock_iam().stop() mock_sts().stop() # Something isn't cleaning itself up properly and causing other core tests to fail. # This is the solution: security_monkey.reporter.all_monitors = old_all_monitors import monitor_mock security_monkey.scheduler.get_monitors = monitor_mock.mock_get_monitors
def test_report_batch_changes(self): from security_monkey.alerter import Alerter from security_monkey.reporter import Reporter from security_monkey.datastore import Item, ItemRevision, ItemAudit from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.auditors.iam.iam_role import IAMRoleAuditor account_type_result = AccountType.query.filter(AccountType.name == "AWS").one() db.session.add(account_type_result) db.session.commit() test_account = Account(name="TEST_ACCOUNT") watcher = IAMRole(accounts=[test_account.name]) db.session.commit() watcher.batched_size = 3 # should loop 4 times self.add_roles() # Set up the monitor: batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = watcher batched_monitor.auditors = [IAMRoleAuditor(accounts=[test_account.name])] # Set up the Reporter: import security_monkey.reporter old_all_monitors = security_monkey.reporter.all_monitors security_monkey.reporter.all_monitors = lambda x, y: [] test_reporter = Reporter() test_reporter.all_monitors = [batched_monitor] test_reporter.account_alerter = Alerter(watchers_auditors=test_reporter.all_monitors, account=test_account.name) import security_monkey.scheduler # import security_monkey.monitors # old_get_monitors = security_monkey.scheduler.get_monitors security_monkey.scheduler.get_monitors = lambda x, y, z: [batched_monitor] # Moto screws up the IAM Role ARN -- so we need to fix it: original_slurp_list = watcher.slurp_list original_slurp = watcher.slurp def mock_slurp_list(): exception_map = original_slurp_list() for item in watcher.total_list: item["Arn"] = "arn:aws:iam::012345678910:role/{}".format(item["RoleName"]) return exception_map def mock_slurp(): batched_items, exception_map = original_slurp() for item in batched_items: item.arn = "arn:aws:iam::012345678910:role/{}".format(item.name) item.config["Arn"] = item.arn item.config["RoleId"] = item.name # Need this to stay the same return batched_items, exception_map watcher.slurp_list = mock_slurp_list watcher.slurp = mock_slurp test_reporter.run(account=test_account.name) # Check that all items were added to the DB: assert len(Item.query.all()) == 11 # Check that we have exactly 11 item revisions: assert len(ItemRevision.query.all()) == 11 # Check that there are audit issues for all 11 items: assert len(ItemAudit.query.all()) == 11 mock_iam().stop() mock_sts().stop() # Something isn't cleaning itself up properly and causing other core tests to fail. # This is the solution: security_monkey.reporter.all_monitors = old_all_monitors import monitor_mock security_monkey.scheduler.get_monitors = monitor_mock.mock_get_monitors
def test_find_batch_changes(self, mock_fix_orphaned): """ Runs through a full find job via the IAMRole watcher, as that supports batching. However, this is mostly testing the logic through each function call -- this is not going to do any boto work and that will instead be mocked out. :return: """ from security_monkey.task_scheduler.tasks import manual_run_change_finder from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.auditors.iam.iam_role import IAMRoleAuditor test_account = Account(name="TEST_ACCOUNT1") watcher = IAMRole(accounts=[test_account.name]) technology = Technology(name="iamrole") db.session.add(technology) db.session.commit() watcher.batched_size = 3 # should loop 4 times ## CREATE MOCK IAM ROLES ## client = boto3.client("iam") aspd = { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": "sts:AssumeRole", "Principal": { "Service": "ec2.amazonaws.com" } }] } for x in range(0, 11): # Create the IAM Role via Moto: aspd["Statement"][0][ "Resource"] = ARN_PREFIX + ":iam:012345678910:role/roleNumber{}".format( x) client.create_role(Path="/", RoleName="roleNumber{}".format(x), AssumeRolePolicyDocument=json.dumps(aspd, indent=4)) client.put_role_policy(RoleName="roleNumber{}".format(x), PolicyName="testpolicy", PolicyDocument=json.dumps(OPEN_POLICY, indent=4)) # Set up the monitor: batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = watcher batched_monitor.auditors = [ IAMRoleAuditor(accounts=[test_account.name]) ] import security_monkey.task_scheduler.tasks old_get_monitors = security_monkey.task_scheduler.tasks.get_monitors security_monkey.task_scheduler.tasks.get_monitors = lambda x, y, z: [ batched_monitor ] # Moto screws up the IAM Role ARN -- so we need to fix it: original_slurp_list = watcher.slurp_list original_slurp = watcher.slurp def mock_slurp_list(): items, exception_map = original_slurp_list() for item in watcher.total_list: item["Arn"] = ARN_PREFIX + ":iam::012345678910:role/{}".format( item["RoleName"]) return items, exception_map def mock_slurp(): batched_items, exception_map = original_slurp() for item in batched_items: item.arn = ARN_PREFIX + ":iam::012345678910:role/{}".format( item.name) item.config["Arn"] = item.arn item.config["RoleId"] = item.name # Need this to stay the same return batched_items, exception_map watcher.slurp_list = mock_slurp_list watcher.slurp = mock_slurp manual_run_change_finder([test_account.name], [watcher.index]) assert mock_fix_orphaned.called # Check that all items were added to the DB: assert len(Item.query.all()) == 11 # Check that we have exactly 11 item revisions: assert len(ItemRevision.query.all()) == 11 # Check that there are audit issues for all 11 items: assert len(ItemAudit.query.all()) == 11 # Delete two of the items: managedPolicy = client.list_attached_role_policies( RoleName="roleNumber9") for each in managedPolicy['AttachedPolicies']: print("Detaching ", each) client.detach_role_policy(RoleName="roleNumber9", PolicyArn=each['PolicyArn']) inlinePolicy = client.list_role_policies(RoleName="roleNumber9") for each in inlinePolicy['PolicyNames']: print("Deleting ", each) client.delete_role_policy(RoleName="roleNumber9", PolicyName=each) instanceProfiles = client.list_instance_profiles_for_role( RoleName="roleNumber9") for each in instanceProfiles['InstanceProfiles']: print("Removing role from instance profile ", each) client.remove_role_from_instance_profile( RoleName="roleNumber9", InstanceProfileName=each['InstanceProfileName']) client.delete_role(RoleName="roleNumber9") managedPolicy = client.list_attached_role_policies( RoleName="roleNumber10") for each in managedPolicy['AttachedPolicies']: print("Detaching ", each) client.detach_role_policy(RoleName="roleNumber10", PolicyArn=each['PolicyArn']) inlinePolicy = client.list_role_policies(RoleName="roleNumber10") for each in inlinePolicy['PolicyNames']: print("Deleting ", each) client.delete_role_policy(RoleName="roleNumber10", PolicyName=each) instanceProfiles = client.list_instance_profiles_for_role( RoleName="roleNumber10") for each in instanceProfiles['InstanceProfiles']: print("Removing role from instance profile ", each) client.remove_role_from_instance_profile( RoleName="roleNumber10", InstanceProfileName=each['InstanceProfileName']) client.delete_role(RoleName="roleNumber10") # Run the it again: watcher.current_account = None # Need to reset the watcher manual_run_change_finder([test_account.name], [watcher.index]) # Check that nothing new was added: assert len(Item.query.all()) == 11 # There should be the same number of issues and 2 more revisions: assert len(ItemAudit.query.all()) == 11 assert len(ItemRevision.query.all()) == 13 # Check that the deleted roles show as being inactive: ir = ItemRevision.query.join((Item, ItemRevision.id == Item.latest_revision_id)) \ .filter(Item.arn.in_( [ARN_PREFIX + ":iam::012345678910:role/roleNumber9", ARN_PREFIX + ":iam::012345678910:role/roleNumber10"])).all() assert len(ir) == 2 assert not ir[0].active assert not ir[1].active # Finally -- test with a slurp list exception (just checking that things don't blow up): import security_monkey.watchers.iam.iam_role old_list_roles = security_monkey.watchers.iam.iam_role.list_roles def mock_slurp_list_with_exception(): security_monkey.watchers.iam.iam_role.list_roles = lambda **kwargs: 1 / 0 items, exception_map = original_slurp_list() assert len(exception_map) > 0 return items, exception_map watcher.slurp_list = mock_slurp_list_with_exception watcher.current_account = None # Need to reset the watcher manual_run_change_finder([test_account.name], [watcher.index]) security_monkey.task_scheduler.tasks.get_monitors = old_get_monitors security_monkey.watchers.iam.iam_role.list_roles = old_list_roles
def test_find_batch_changes(self): """ Runs through a full find job via the IAMRole watcher, as that supports batching. However, this is mostly testing the logic through each function call -- this is not going to do any boto work and that will instead be mocked out. :return: """ from security_monkey.scheduler import find_changes from security_monkey.monitors import Monitor from security_monkey.watchers.iam.iam_role import IAMRole from security_monkey.auditors.iam.iam_role import IAMRoleAuditor test_account = Account(name="TEST_ACCOUNT1") watcher = IAMRole(accounts=[test_account.name]) technology = Technology(name="iamrole") db.session.add(technology) db.session.commit() watcher.batched_size = 3 # should loop 4 times self.add_roles() # Set up the monitor: batched_monitor = Monitor(IAMRole, test_account) batched_monitor.watcher = watcher batched_monitor.auditors = [IAMRoleAuditor(accounts=[test_account.name])] import security_monkey.scheduler security_monkey.scheduler.get_monitors = lambda x, y, z: [batched_monitor] # Moto screws up the IAM Role ARN -- so we need to fix it: original_slurp_list = watcher.slurp_list original_slurp = watcher.slurp def mock_slurp_list(): exception_map = original_slurp_list() for item in watcher.total_list: item["Arn"] = "arn:aws:iam::012345678910:role/{}".format(item["RoleName"]) return exception_map def mock_slurp(): batched_items, exception_map = original_slurp() for item in batched_items: item.arn = "arn:aws:iam::012345678910:role/{}".format(item.name) item.config["Arn"] = item.arn item.config["RoleId"] = item.name # Need this to stay the same return batched_items, exception_map watcher.slurp_list = mock_slurp_list watcher.slurp = mock_slurp find_changes([test_account.name], test_account.name) # Check that all items were added to the DB: assert len(Item.query.all()) == 11 # Check that we have exactly 11 item revisions: assert len(ItemRevision.query.all()) == 11 # Check that there are audit issues for all 11 items: assert len(ItemAudit.query.all()) == 11 # Delete one of the items: # Moto lacks implementation for "delete_role" (and I'm too lazy to submit a PR :D) -- so need to create again... mock_iam().stop() mock_sts().stop() self.add_roles(initial=False) # Run the it again: watcher.current_account = None # Need to reset the watcher find_changes([test_account.name], test_account.name) # Check that nothing new was added: assert len(Item.query.all()) == 11 # There should be 2 less issues and 2 more revisions: assert len(ItemAudit.query.all()) == 9 assert len(ItemRevision.query.all()) == 13 # Check that the deleted roles show as being inactive: ir = ItemRevision.query.join((Item, ItemRevision.id == Item.latest_revision_id)) \ .filter(Item.arn.in_( ["arn:aws:iam::012345678910:role/roleNumber9", "arn:aws:iam::012345678910:role/roleNumber10"])).all() assert len(ir) == 2 assert not ir[0].active assert not ir[1].active # Finally -- test with a slurp list exception (just checking that things don't blow up): def mock_slurp_list_with_exception(): import security_monkey.watchers.iam.iam_role security_monkey.watchers.iam.iam_role.list_roles = lambda **kwargs: 1 / 0 exception_map = original_slurp_list() assert len(exception_map) > 0 return exception_map watcher.slurp_list = mock_slurp_list_with_exception watcher.current_account = None # Need to reset the watcher find_changes([test_account.name], test_account.name) mock_iam().stop() mock_sts().stop()
from security_monkey.watchers.redshift import Redshift from security_monkey.auditors.redshift import RedshiftAuditor from security_monkey.watchers.elastic_ip import ElasticIP from security_monkey.watchers.ses import SES from security_monkey.auditors.ses import SESAuditor from security_monkey.watchers.vpc.vpc import VPC from security_monkey.watchers.vpc.subnet import Subnet from security_monkey.watchers.vpc.route_table import RouteTable from moz_security_monkey.auditors.cloudtrail import CloudTrailAuditor from moz_security_monkey.auditors.route53 import Route53Auditor from security_monkey.monitors import Monitor __MONITORS = { SecurityGroup.index: Monitor(SecurityGroup.index, SecurityGroup, SecurityGroupAuditor), S3.index: Monitor(S3.index, S3, S3Auditor), IAMAccount.index: Monitor(IAMAccount.index, IAMAccount, IAMAccountAuditor), CloudTrail.index: Monitor(CloudTrail.index, CloudTrail, CloudTrailAuditor), Route53.index: Monitor(Route53.index, Route53, Route53Auditor), } __ORIGINAL_MONITORS = { SQS.index: Monitor(SQS.index, SQS, None), ELB.index: Monitor(ELB.index, ELB, ELBAuditor),