_Sailing on and on and north across the sea
Sailing on and on and north 'til all is calm_
Dare to delve into this spectral realm, where the frightful protection of Prowler awaits you.
Happy haunting and secure coding this Halloween! π§ββοΈπΈοΈπ
New features to highlight in this version:
π **Ignore Findings from services not in actual use**
- Prowler now allows you to ignore unused services findings, so you can reduce the number of findings in Prowler's reports.
`prowler <provider> --ignore-unused-services`
> See more in https://docs.prowler.cloud/en/latest/tutorials/ignore-unused-services/
βοΈ **New AWS Allowlist including AWS Control Tower resources**
- New allowlist file that ensures that applies to all resources created by AWS Control Tower when setting up a landing zone:
`prowler aws --allowlist prowler/config/aws_allowlist.yaml`
> See more in https://docs.prowler.cloud/en/latest/tutorials/allowlist/#default-aws-allowlist
π·οΈ **STS V2 Tokens**
- Now Prowler will call Regional AWS STS endpoints to get session tokens valid in all AWS Regions.
> See more in https://docs.prowler.cloud/en/latest/tutorials/aws/role-assumption/#sts-endpoint-region
β
**New 9 checks for AWS!**
- New Account check `account_maintain_different_contact_details_to_security_billing_and_operations`
- New CloudTrail check `cloudtrail_multi_region_enabled_logging_management_events`
- New EC2 DataLifecycle Manager service and check `dlm_ebs_snapshot_lifecycle_policy_exists`
- New EC2 EBS check `ec2_ebs_volume_snapshots_exists`
- New DocumentDB service and check `documentdb_instance_storage_encrypted`
- New Support check `trustedadvisor_premium_support_plan_subscribed`
- New Neptune service and check `neptune_cluster_uses_public_subnet`
- New Elasticache service and check `elasticache_cluster_uses_public_subnet`
- New IAM check `iam_user_with_temporary_credentials`
Thanks to [Jit](https://www.jit.io/.) jit-contrib for their help on this checks.
Try them with `prowler aws` and improve your security posture now! π
π **Check Aliases are now supported**
- Now, Prowler allows you to use aliases for the checks. You only have to add the CheckAliases key to the check's metadata with a list of the aliases and then, you can execute it with: `prowler <provider> -c/--checks <check_alias_1>`
> See more in https://docs.prowler.cloud/en/latest/tutorials/check-aliases/
What's Changed
Features
* feat(alias): add check alias functionality by sergargar in https://github.com/prowler-cloud/prowler/pull/2971
* feat(allowlist): allowlist non-default regions configuration by sergargar in https://github.com/prowler-cloud/prowler/pull/2974
* feat(aws): New CloudTrail, DLM, DocumentDB, EC2, Account and Support checks by jit-contrib in https://github.com/prowler-cloud/prowler/pull/2675
* feat(aws): New Neptune, ElastiCache, APIGW and IAM checks by jit-contrib in https://github.com/prowler-cloud/prowler/pull/2862
* feat(controltower): add AWS Control Tower resources to default Allowlist configuration file by sergargar in https://github.com/prowler-cloud/prowler/pull/2953
* feat(ignore unused services): add `--ignore-unused-services` argument to ignore findings from services not in actual use by sergargar in https://github.com/prowler-cloud/prowler/pull/2936
* feat(report interface): add reporting interface call after report by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2948
* feat(vpc): add vpc, nacl or subnet names in findings by sergargar in https://github.com/prowler-cloud/prowler/pull/2928
Fixes
* fix(allowlist): verify if allowlist file exists by sergargar in https://github.com/prowler-cloud/prowler/pull/2988
* fix(APIGateway): Improve check naming by sergargar in https://github.com/prowler-cloud/prowler/pull/2952
* fix(cis): remove new lines in CIS csv by sergargar https://github.com/prowler-cloud/prowler/pull/2989
* fix(cloudtrail service): typo in logging info by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2976
* fix(ec2_instance_imdsv2_enabled ): verify if metadata service is disabled by therealtoastycat in https://github.com/prowler-cloud/prowler/pull/2978
* fix(ec2_securitygroup_not_used): Mock Lambda service by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2947
* fix(elbv2_desync_mitigation_mode): improve logic by sergargar in https://github.com/prowler-cloud/prowler/pull/2986
* fix(gcp): set always location to lowercase by sergargar in https://github.com/prowler-cloud/prowler/pull/2970
* fix(GuardDuty): Add `enabled_in_account` parameter by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2979
* fix(outputs): remove empty outputs by sergargar https://github.com/prowler-cloud/prowler/pull/2990
* fix(resource filters): add missing resource filters by sergargar in https://github.com/prowler-cloud/prowler/pull/2951
* fix(security group): check if security groups are used by Lambda by sergargar in https://github.com/prowler-cloud/prowler/pull/2944
* fix(sqs): Handle AWS.SimpleQueueService.NonExistentQueue in list_queue_tags by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2939
* fix(sts): force v2 STS tokens by sergargar in https://github.com/prowler-cloud/prowler/pull/2956
* fix(vpc): ignore com.amazonaws.vpce endpoints by sergargar in https://github.com/prowler-cloud/prowler/pull/2929
* fix(vpc_endpoint_services_allowed_principals_trust_boundaries): Principal by jfagoagas https://github.com/prowler-cloud/prowler/pull/2991
* fix(tests): remove tests folder after execution by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2962
Documentation
* chore(docs): Add report.region criteria by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2930
* docs(config): add missing configurable variables by kagahd in https://github.com/prowler-cloud/prowler/pull/2941
* chore(docs): add STS Endpoint and Allowlist updates by sergargar in https://github.com/prowler-cloud/prowler/pull/2964
* chore(docs): allowlist non-default regions by sergargar in https://github.com/prowler-cloud/prowler/pull/2980
* docs(v2_v3_mapping): document prowler v3.10.0 changes by kagahd in https://github.com/prowler-cloud/prowler/pull/2955
Chores
* chore(regions_update): Changes in regions for AWS services. by sergargar in https://github.com/prowler-cloud/prowler/pull/2927, https://github.com/prowler-cloud/prowler/pull/2937, https://github.com/prowler-cloud/prowler/pull/2942, https://github.com/prowler-cloud/prowler/pull/2945, https://github.com/prowler-cloud/prowler/pull/2954, https://github.com/prowler-cloud/prowler/pull/2961
* chore(allowlist): Extract allowlist from report by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2975
* chore(allowlist): prettify allowlist names by sergargar in https://github.com/prowler-cloud/prowler/pull/2963
* chore(APIGatewayV2): improve check naming by sergargar in https://github.com/prowler-cloud/prowler/pull/2966
* chore(create_role_to_assume_cfn.yaml): Add DLM permissions by sergargar in https://github.com/prowler-cloud/prowler/pull/2949
* chore(gcp): print inactive GCP APIs by sergargar in https://github.com/prowler-cloud/prowler/pull/2987
* chore(github): ignore permissions path in GitHub actions by sergargar in https://github.com/prowler-cloud/prowler/pull/2950
* chore(permissions): add DLM permissions by sergargar in https://github.com/prowler-cloud/prowler/pull/2946
Dependencies
* build(deps): bump azure-identity from 1.14.1 to 1.15.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/2982
* build(deps): bump azure-storage-blob from 12.18.2 to 12.18.3 by dependabot in https://github.com/prowler-cloud/prowler/pull/2931
* build(deps): bump google-api-python-client from 2.104.0 to 2.105.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/2985
* build(deps): bump mkdocs-material from 9.4.6 to 9.4.7 by dependabot in https://github.com/prowler-cloud/prowler/pull/2983
* build(deps): bump shodan from 1.30.0 to 1.30.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/2935
* build(deps): bump urllib3 from 1.26.17 to 1.26.18 by dependabot in https://github.com/prowler-cloud/prowler/pull/2940
* build(deps-dev): bump moto from 4.2.6 to 4.2.7 by dependabot in https://github.com/prowler-cloud/prowler/pull/2984
* build(deps-dev): bump openapi-spec-validator from 0.6.0 to 0.7.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/2958
* build(deps-dev): bump pylint from 3.0.1 to 3.0.2 by dependabot in https://github.com/prowler-cloud/prowler/pull/2957
* build(deps-dev): bump pytest from 7.4.2 to 7.4.3 by dependabot in https://github.com/prowler-cloud/prowler/pull/2981
* build(deps-dev): bump vulture from 2.9.1 to 2.10 by dependabot in https://github.com/prowler-cloud/prowler/pull/2960
* build(deps-dev): bump werkzeug from 2.3.4 to 3.0.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/2968
New Contributors
* therealtoastycat made their first contribution in https://github.com/prowler-cloud/prowler/pull/2978
**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.10.0...3.11.0