_Die With Your Boots On_ is a song of Iron Maiden's album _Piece of mind_, it is self explanatory, we like the vibe of that song in their lives, watch it [here](https://www.youtube.com/watch?v=p5jTV81Eyes).
Basically, this is what we do here, we go all in or nothing! 💪🏼
We are bringing the best we have in this code of **Prowler 3.6.0**: some new checks, improved GCP support, new features, more fixes making it a better piece of software and more helpful for your daily job 😄
Remember to run `pip install prowler --upgrade` and rock on! 🤘
New features to highlight in this version:
🥳 **GCP Multi-Project support:**
- Prowler now supports GCP Multi-Project scans! By default Prowler will scan all the GCP Projects that is allowed to scan, if you want to scan a single project or various specific projects you can use the following flag:
prowler gcp --project-ids <Project ID 1> <Project ID 2> ... <Project ID N>
✅ **16 new checks for GCP** (Thanks to jit-contrib ! 💪🏼 ):
- New services ApiKeys, DNS and Dataproc are covered and additional checks for Compute and IAM services.
- See all checks with `prowler gcp --list-checks`
📝 **OCSF Integration** (Hello Amazon Security Lake!):
- OCSF JSON was added as a default output for AWS, Azure and GCP. It was based on the [OCSF Schema's Security Finding v1.0.0-rc.3](https://schema.ocsf.io/1.0.0-rc.3/classes/security_finding?extensions=#).
📊 **AWS Well Architected Framework**:
- The Security Pillar of the [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html) is now supported by Prowler, you can run it with the following command:
prowler aws --compliance aws_well_architected_framework_security_pillar_aws
⚙️ **MFA supported in AWS**:
- If your IAM entity enforces MFA for AWS Calls you can use `--mfa` and Prowler will ask you to input the following values to get a new session:
prowler aws --mfa
Enter ARN of MFA: arn:aws:iam::012345678910:mfa/xxxxxx
Enter MFA code: XXXXXX
What's Changed
Features
* feat(checks-gcp): Include 4 new checks covering GCP CIS by jit-contrib in https://github.com/prowler-cloud/prowler/pull/2376
* feat(gcp): add 12 new checks for CIS Framework by jit-contrib in https://github.com/prowler-cloud/prowler/pull/2426
* feat(gcp): add `--project-ids` flag and scan all projects by default by sergargar in https://github.com/prowler-cloud/prowler/pull/2393
* feat(mfa): Add MFA flag if it is required by AWS IAM Entity by senyberg in https://github.com/prowler-cloud/prowler/pull/2478
* feat(new_security_framework): AWS Well Architected Framework security pillar by pedromarting3 in https://github.com/prowler-cloud/prowler/pull/2382
* feat(ocsf): add OCSF format as JSON output for AWS, Azure and GCP. Hello Amazon Security Lake! by sergargar in https://github.com/prowler-cloud/prowler/pull/2429
* feat(vpc): add check `vpc_subnet_no_public_ip_by_default` by senyberg in https://github.com/prowler-cloud/prowler/pull/2472
* feat(wellarchitected): add WellArchitected service and check by sergargar in https://github.com/prowler-cloud/prowler/pull/2461
Fixes
* fix(arn validator): include `:` in regex by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2471
* fix(aws): Add missing resources ARN by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2453
* fix(azure): fix empty subscriptions case by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2455
* fix(backup): Handle last_execution_date when None by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2454
* fix(browser auth): fix browser auth in Azure to include tenant id by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2415
* fix(cloudfront): Bad https_enabled check comparison by christiandavilakoobin in https://github.com/prowler-cloud/prowler/pull/2430
* fix(codebuild): handle FAIL in codebuild_project_user_controlled_buildspec by sergargar in https://github.com/prowler-cloud/prowler/pull/2410
* fix(dataevents checks): add trails home region by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2484
* fix(ec2): handle false positive in `ec2_securitygroup_allow_ingress_from_internet_to_any_port` by sergargar in https://github.com/prowler-cloud/prowler/pull/2449
* fix(ecr): handle LifecyclePolicyNotFoundException by sergargar in https://github.com/prowler-cloud/prowler/pull/2411
* fix(efs): Include resource ARN and handle from input by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2452
* fix(inventory): handle exception for every call by sergargar in https://github.com/prowler-cloud/prowler/pull/2457
* fix(kms): check only KMS CMK tags by sergargar in https://github.com/prowler-cloud/prowler/pull/2468
* fix(README): add references to tenant-id when browser auth by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2439
* fix(services): Handle AWS service errors by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2440
* fix(services): verify Route53 records and handle TrustedAdvisor error by sergargar in https://github.com/prowler-cloud/prowler/pull/2448
* fix(typo): typo in README.md by sergargar in https://github.com/prowler-cloud/prowler/pull/2406
* fix(typo) typo in README.md by toniblyx in https://github.com/prowler-cloud/prowler/pull/2407
Chores
* chore(arn): add missing ARNs to AWS Services by sergargar in https://github.com/prowler-cloud/prowler/pull/2476
* chore(arn): include ARN of AWS accounts by sergargar in https://github.com/prowler-cloud/prowler/pull/2477
* chore(boto3): update boto3 config by sergargar in https://github.com/prowler-cloud/prowler/pull/2459
* chore(compliance): Update Description in aws_well_architected_framework_security_pillar_aws.json by sssalim-aws in https://github.com/prowler-cloud/prowler/pull/2432
* chore(docs): add summary table to README.md by toniblyx in https://github.com/prowler-cloud/prowler/pull/2402
* chore(docs): Create CONTRIBUTING.md by toniblyx in https://github.com/prowler-cloud/prowler/pull/2416
* chore(docs): improve allowlist suggestion by sergargar in https://github.com/prowler-cloud/prowler/pull/2466
* chore(docs): improve custom checks docs by sergargar in https://github.com/prowler-cloud/prowler/pull/2428
* chore(logo): Add Prowler logo in SVG format & Propose to Prowler icon design by dsict in https://github.com/prowler-cloud/prowler/pull/2423
* chore(quick inventory): add warning message by sergargar in https://github.com/prowler-cloud/prowler/pull/2460
* chore(regions_update): Changes in regions for AWS services. by sergargar in https://github.com/prowler-cloud/prowler/pull/2474
* chore(vpc): add mapPublicIpOnLaunch attribute to VPC subnets by senyberg in https://github.com/prowler-cloud/prowler/pull/2470
Dependencies
* build(deps): bump alive-progress from 3.1.1 to 3.1.4 by dependabot in https://github.com/prowler-cloud/prowler/pull/2446
* build(deps): bump boto3 from 1.26.142 to 1.26.147 by dependabot in https://github.com/prowler-cloud/prowler/pull/2480
* build(deps): bump botocore from 1.29.147 to 1.29.152 by dependabot in https://github.com/prowler-cloud/prowler/pull/2482
* build(deps): bump cryptography from 40.0.2 to 41.0.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/2436
* build(deps): bump google-api-python-client from 2.86.0 to 2.88.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/2483
* build(deps): bump mkdocs-material from 9.1.12 to 9.1.15 by dependabot in https://github.com/prowler-cloud/prowler/pull/2420
* build(deps): bump pydantic from 1.10.8 to 1.10.9 by dependabot in https://github.com/prowler-cloud/prowler/pull/2481
* build(deps-dev): bump coverage from 7.2.5 to 7.2.7 by dependabot in https://github.com/prowler-cloud/prowler/pull/2422
* build(deps-dev): bump docker from 6.1.2 to 6.1.3 by dependabot in https://github.com/prowler-cloud/prowler/pull/2445
* build(deps-dev): bump moto from 4.1.10 to 4.1.11 by dependabot in https://github.com/prowler-cloud/prowler/pull/2443
* build(deps-dev): bump pytest-xdist from 3.3.0 to 3.3.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/2421
* build(deps-dev): bump pytest from 7.3.1 to 7.3.2 by dependabot in https://github.com/prowler-cloud/prowler/pull/2479
New Contributors
* jit-contrib made their first contribution in https://github.com/prowler-cloud/prowler/pull/2376
* dsict made their first contribution in https://github.com/prowler-cloud/prowler/pull/2423
* sssalim-aws made their first contribution in https://github.com/prowler-cloud/prowler/pull/2432
* christiandavilakoobin made their first contribution in https://github.com/prowler-cloud/prowler/pull/2430
* senyberg made their first contribution in https://github.com/prowler-cloud/prowler/pull/2470
**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.5.3...3.6.0