Prowler

_Through earth and water, fire and wind
You came at last, nothing was the end..._

As this series of Prowler versions, _Sun and Steel_ is a song part of _Piece of Mind_ album of _Iron Maiden_. In this side of the world (north hemisphere), spring is about to start and this song is about Sun (and Steel) so here you go! 🤘🏽See below the amazing new features we have added to **Prowler 3.3.0 🔥[Sun and Steel](https://www.youtube.com/watch?v=aOKJIynZlZ0)🔥**

New features to highlight in this version:

🏷️ **Resource Tags everywhere**:
- Now all findings outputs like HTML, CSV and JSON for AWS provider contains every resource tags.

⚖️ **Compliance everywhere**:
- Now all findings in outputs like HTML, CSV and JSON contains any security framework related to the finding.

🛡️ **Security Hub integration with compliance from Prowler**:
- All findings sent to Security Hub include their compliance information and all frameworks that they belongs to. This allow user to filter by Compliance Associated Standards ID and others and take advantage of all new supported frameworks in Prowler:

📊 **New inventory output include regions**:
- When running Prowler Quick Inventory (`prowler -i`) the output is as nice as this one:
<img width="778" alt="Screenshot 2023-03-16 at 18 25 07" src="https://user-images.githubusercontent.com/3985464/225703412-5a59a70e-900f-4c27-9336-f7d41a422ced.png">

✅ **3 new checks**:
- s3_bucket_level_public_access_block
- rds_instance_transport_encrypted - this is valid so far only for Postgresql and MS SQL Server
- cloudwatch_log_group_no_secrets_in_logs

What's Changed:

* feat(templates): New versions of issues and fr templates by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2072
* feat(tags): add resource tags by sergargar in https://github.com/prowler-cloud/prowler/pull/2020
* feat(s3_bucket_level_public_access_block): new check by sergargar in https://github.com/prowler-cloud/prowler/pull/1953
* feat(rds_instance_transport_encrypted): add new check by sergargar in https://github.com/prowler-cloud/prowler/pull/1963
* feat(quick_inventory): add regions to inventory table by sergargar in https://github.com/prowler-cloud/prowler/pull/2026
* feat(new_check): cloudwatch_log_group_no_secrets_in_logs by Fennerr in https://github.com/prowler-cloud/prowler/pull/1980
* feat(lambda_cloudtrail check): improved logic and status extended by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2092
* feat(inventory): add tags to quick inventory by sergargar in https://github.com/prowler-cloud/prowler/pull/2051
* feat(encryption): add new encryption category by sergargar in https://github.com/prowler-cloud/prowler/pull/1999
* feat(dispatch): add tag info to dispatch by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2002
* feat(compliance): add compliance field to HTML, CSV and JSON outputs including frameworks and reqs by sergargar in https://github.com/prowler-cloud/prowler/pull/2060
* feat(SecurityHub): add compliance details to Security Hub findings by sergargar in https://github.com/prowler-cloud/prowler/pull/2100

Fixes:
* fix(windows-path): --list-services bad split by garym-krrv in https://github.com/prowler-cloud/prowler/pull/2028
* fix(ulimit): handle low ulimit OSError by sergargar in https://github.com/prowler-cloud/prowler/pull/2042
* fix(ulimit check): test only when platform is not windows by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2094
* fix(quick inventory): add non-tagged s3 buckets to inventory by sergargar in https://github.com/prowler-cloud/prowler/pull/2041
* fix(providers): Move provider's logic outside main by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2043
* fix(iam): pydantic migration and reformat logic service by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2010
* fix(head): Pass head commit to dispatch action by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2022
* fix(emr): solve emr_cluster_publicly_accesible error by sergargar in https://github.com/prowler-cloud/prowler/pull/2086
* fix(emr): KeyError EmrManagedSlaveSecurityGroup by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2000
* fix(ec2_securitygroup_allow_wide_open_public_ipv4): correct check title by sergargar in https://github.com/prowler-cloud/prowler/pull/2101
* fix(ec2): avoid terminated instances by sergargar in https://github.com/prowler-cloud/prowler/pull/2063
* fix(compliance): add check to 2.1.5 CIS by sergargar in https://github.com/prowler-cloud/prowler/pull/2077
* fix(cloudwatch): solve inexistent filterPattern error by sergargar in https://github.com/prowler-cloud/prowler/pull/2087
* fix(cloudtrail): list tags only in owned trails by sergargar in https://github.com/prowler-cloud/prowler/pull/2025
* fix(check): change cloudformation_outputs_find_secrets name by sergargar in https://github.com/prowler-cloud/prowler/pull/2027
* fix(bug_report): typo in bug reporting template by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2078
* fix(bug_report): Update wording by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2074
* fix(awslambdacloudtrail): include advanced event and all lambdas in check by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1994
* fix(actions): fixed dispatch commit message by n4ch04 in https://github.com/prowler-cloud/prowler/pull/2023
* fix(actions): Typo push should be true by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2019
* fix(actions): Stop using github storage by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2016

Documentation and other updates
* chore(docs): update readme with new ECR alias by toniblyx in https://github.com/prowler-cloud/prowler/pull/2079
* chore(docs): Corrected spelling mistake in multiacount by alexnelsone in https://github.com/prowler-cloud/prowler/pull/2056
* chore(docs): Add brew and github installation to quick start by toniblyx in https://github.com/prowler-cloud/prowler/pull/1991
* chore(release): update Prowler Version to 3.2.4 by sergargar in https://github.com/prowler-cloud/prowler/pull/1988
* chore(regions_update): Changes in regions for AWS services. by sergargar in https://github.com/prowler-cloud/prowler/pull/2095
* chore(poetry): add poetry checks to pre-commit by sergargar in https://github.com/prowler-cloud/prowler/pull/2040
* chore(metadata): remove tags from metadata by sergargar in https://github.com/prowler-cloud/prowler/pull/1998
* chore(iam): update prowler permissions by sergargar in https://github.com/prowler-cloud/prowler/pull/2050
* chore(dependabot): Change to weekly by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2057
* chore(brew): bump new version to brew by sergargar in https://github.com/prowler-cloud/prowler/pull/1990
* chore(actions): Use GHA cache by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2066
* chore(actions): Missing cache in the PR by jfagoagas in https://github.com/prowler-cloud/prowler/pull/2067
* build(deps-dev): bump pytest-xdist from 3.2.0 to 3.2.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/2084
* build(deps-dev): bump pytest from 7.2.1 to 7.2.2 by dependabot in https://github.com/prowler-cloud/prowler/pull/2046
* build(deps-dev): bump pylint from 2.16.4 to 2.17.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/2062
* build(deps-dev): bump moto from 4.1.3 to 4.1.4 by dependabot in https://github.com/prowler-cloud/prowler/pull/2045
* build(deps-dev): bump freezegun from 1.2.1 to 1.2.2 by dependabot in https://github.com/prowler-cloud/prowler/pull/2033
* build(deps-dev): bump flake8 from 5.0.4 to 6.0.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/2012
* build(deps-dev): bump docker from 6.0.0 to 6.0.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/2030
* build(deps-dev): bump coverage from 7.1.0 to 7.2.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/2032
* build(deps-dev): bump black from 22.10.0 to 22.12.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/2013
* build(deps-dev): bump bandit from 1.7.4 to 1.7.5 by dependabot in https://github.com/prowler-cloud/prowler/pull/2082
* build(deps): bump pydantic from 1.10.5 to 1.10.6 by dependabot in https://github.com/prowler-cloud/prowler/pull/2081
* build(deps): bump mkdocs-material from 9.1.1 to 9.1.2 by dependabot in https://github.com/prowler-cloud/prowler/pull/2080
* build(deps): bump botocore from 1.29.86 to 1.29.90 by dependabot in https://github.com/prowler-cloud/prowler/pull/2083
* build(deps): bump boto3 from 1.26.85 to 1.26.86 by dependabot in https://github.com/prowler-cloud/prowler/pull/2061

New Contributors
* garym-krrv made their first contribution in https://github.com/prowler-cloud/prowler/pull/2028
* alexnelsone made their first contribution in https://github.com/prowler-cloud/prowler/pull/2056

**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.2.4...3.3.0

Fixes
* fix(compliance): solve AWS compliance directory path by sergargar in https://github.com/prowler-cloud/prowler/pull/1987
* fix(pypi-release.yml): create PR before replicating by sergargar in https://github.com/prowler-cloud/prowler/pull/1986


**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.2.3...3.2.4

Dependencies
* build(deps): bump colorama from 0.4.5 to 0.4.6 by dependabot in https://github.com/prowler-cloud/prowler/pull/1967
* build(deps): bump azure-storage-blob from 12.14.1 to 12.15.0 by dependabot in https://github.com/prowler-cloud/prowler/pull/1966
* build(deps): bump botocore from 1.29.74 to 1.29.78 by dependabot in https://github.com/prowler-cloud/prowler/pull/1968
* build(deps): bump mkdocs-material from 8.2.1 to 9.0.14 by dependabot in https://github.com/prowler-cloud/prowler/pull/1964
* build(deps): bump alive-progress from 2.4.1 to 3.0.1 by dependabot in https://github.com/prowler-cloud/prowler/pull/1965
* build(deps): bump botocore from 1.29.78 to 1.29.79 by dependabot in https://github.com/prowler-cloud/prowler/pull/1978
* build(deps): bump boto3 from 1.26.74 to 1.26.79 by dependabot in https://github.com/prowler-cloud/prowler/pull/1981

Fixes
* fix(toml): add toml dependency to pypi release action by sergargar in https://github.com/prowler-cloud/prowler/pull/1960
* fix(kms): handle if describe_keys returns no value by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1961
* fix(cloudfront): handle empty objects in checks by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1962
* fix(directoryservice): tzinfo without _ by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1971
* fix(acm): Fix issues with list-certificates by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1970
* fix(service errors): solve EMR, VPC and ELBv2 service errors by sergargar in https://github.com/prowler-cloud/prowler/pull/1974
* fix(action): Use PathContext to get version changes by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1983

Chores
* chore(regions_update): Changes in regions for AWS services. by sergargar in https://github.com/prowler-cloud/prowler/pull/1972
* chore(compliance): implements dynamic handling of available compliance frameworks by pedromarting3 in https://github.com/prowler-cloud/prowler/pull/1977
* chore(readme): add brew stats by sergargar in https://github.com/prowler-cloud/prowler/pull/1982
* chore(codeowners): Update team to OSS by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1984


**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.2.2...3.2.3

Chores
* chore(poetry): make python-poetry as packaging and dependency manager by sergargar in https://github.com/prowler-cloud/prowler/pull/1935
* chore(resource-based scan): execute only applicable checks by sergargar in https://github.com/prowler-cloud/prowler/pull/1934

Fixes
* fix(actions): add README to docker action and filter steps for releases by sergargar in https://github.com/prowler-cloud/prowler/pull/1955
* fix(cloudtrail): Handle when the CloudTrail bucket is in another account by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1956
* fix(key errors): solver EMR and IAM errrors by sergargar in https://github.com/prowler-cloud/prowler/pull/1957
* fix(metadata): remove `us-east-1` in remediation by sergargar in https://github.com/prowler-cloud/prowler/pull/1958

Builds
* build(deps): bump botocore from 1.29.75 to 1.29.76 by dependabot in https://github.com/prowler-cloud/prowler/pull/1946
* build(deps): bump boto3 from 1.26.74 to 1.26.76 by dependabot in https://github.com/prowler-cloud/prowler/pull/1948

**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.2.1...3.2.2

Chores
* chore(Security Hub): add --skip-sh-update by sergargar in https://github.com/prowler-cloud/prowler/pull/1911
* chore(Security Hub): add status extended to Security Hub by sergargar in https://github.com/prowler-cloud/prowler/pull/1921
* chore(secrets): Improve the status_extended with more information by Fennerr in https://github.com/prowler-cloud/prowler/pull/1937
* chore(iam_disable_N_days_credentials): improve checks logic by sergargar in https://github.com/prowler-cloud/prowler/pull/1923

Fixes
* fix(cloudtrail_logs_s3_bucket_access_logging_enabled): cloudtrail s3 bucket logging by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1902
* fix(codebuild): Handle endTime in builds by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1900
* fix(iam-credentials-expiration): IAM password policy expires passwords fix by congon4tor in https://github.com/prowler-cloud/prowler/pull/1903
* fix(compliance): Set Version as optional and fix list by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1899
* fix(ecs_task_definitions_no_environment_secrets): dump_env_vars is reintialised by Fennerr in https://github.com/prowler-cloud/prowler/pull/1922
* fix(quick_inventory): handle ApiGateway resources by Fennerr in https://github.com/prowler-cloud/prowler/pull/1924
* fix(iam_rotate_access_key_90_days): check only active access keys by Fennerr in https://github.com/prowler-cloud/prowler/pull/1929
* fix(services): solve errors in EMR, RDS, S3 and VPC services by sergargar in https://github.com/prowler-cloud/prowler/pull/1913
* fix(regions): add unique branch name by sergargar in https://github.com/prowler-cloud/prowler/pull/1941
* fix(errors): handle errors when S3 buckets or EC2 instances are deleted by sergargar in https://github.com/prowler-cloud/prowler/pull/1942
* fix(cloudwatch): allow `"` in regex patterns by sergargar in https://github.com/prowler-cloud/prowler/pull/1943

Dependencies
* build(deps-dev): bump pylint from 2.16.1 to 2.16.2 by dependabot in https://github.com/prowler-cloud/prowler/pull/1896
* build(deps-dev): bump moto from 4.1.2 to 4.1.3 by dependabot in https://github.com/prowler-cloud/prowler/pull/1939
* build(deps): bump boto3 from 1.26.51 to 1.26.69 by dependabot in https://github.com/prowler-cloud/prowler/pull/1897
* build(deps): bump botocore from 1.29.69 to 1.29.70 by dependabot in https://github.com/prowler-cloud/prowler/pull/1898
* build(deps): bump boto3 from 1.26.69 to 1.26.70 by dependabot in https://github.com/prowler-cloud/prowler/pull/1908
* build(deps): bump botocore from 1.29.70 to 1.29.71 by dependabot in https://github.com/prowler-cloud/prowler/pull/1909
* build(deps): bump boto3 from 1.26.70 to 1.26.71 by dependabot in https://github.com/prowler-cloud/prowler/pull/1920
* build(deps): bump pydantic from 1.10.4 to 1.10.5 by dependabot in https://github.com/prowler-cloud/prowler/pull/1918
* build(deps): bump botocore from 1.29.71 to 1.29.72 by dependabot in https://github.com/prowler-cloud/prowler/pull/1919
* build(deps): bump boto3 from 1.26.71 to 1.26.72 by dependabot in https://github.com/prowler-cloud/prowler/pull/1925
* build(deps): bump botocore from 1.29.72 to 1.29.73 by dependabot in https://github.com/prowler-cloud/prowler/pull/1926
* build(deps): bump botocore from 1.29.73 to 1.29.74 by dependabot in https://github.com/prowler-cloud/prowler/pull/1932
* build(deps): bump boto3 from 1.26.72 to 1.26.74 by dependabot in https://github.com/prowler-cloud/prowler/pull/1933
* build(deps): bump botocore from 1.29.74 to 1.29.75 by dependabot in https://github.com/prowler-cloud/prowler/pull/1938

**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.2.0...3.2.1

_Drawn by quest for fire
They searched all through the land
Drawn by quest for fire
Discovery of man._

_Quest for Fire_ is a song part of _Piece of Mind_ album of _Iron Maiden_. This new version is the result of our _quest_ for your security issues and our _quest_ to help you to improve your cloud security posture. See below the amazing new features we have added to **Prowler 3.2.0 🔥[Quest for Fire](https://www.youtube.com/watch?v=_ppwIZ0EnXg)🔥**

New features to highlight in this version:

🏷️ **Tag-based scan**: now you can scan only resources with specific tags across your entire account with the following command:
- `prowler aws --resource-tags Environment=dev Project=prowler`
- You can use as many tags as you need. More information here: https://docs.prowler.cloud/en/latest/tutorials/aws/tag-based-scan/

🎯 **Resource-based scan**: now you can scan only a specific resources by the ARN
- `prowler aws --resource-arn arn:aws:iam::012345678910:user/test arn:aws:ec2:us-east-1:123456789012:vpc/vpc-12345678`
- That command will run all IAM user related checks to `test` and all VPC related checks to VPC `vpc-12345678`
- This is very helpful for new found resources or even pipelines! More information here: https://docs.prowler.cloud/en/latest/tutorials/aws/resource-arn-based-scan/

⚖️ **17 New Security Compliance Frameworks**: we added 17 new security frameworks for AWS.
- In addition to CIS 1.4, CIS 1.5 and Spanish ENS (that comes with more enhancements) we have added the following security frameworks for the AWS provider.
- CISA Cyber Essentials
- FedRAMP Low Revision 4
- FedRAMP Moderate Revision 4
- Federal Financial Institutions Examination Council (FFIEC)
- AWS Foundational Security Best Practices
- General Data Protection Regulation (GDPR)
- GxP 21 CFR Part 11
- GxP EU Annex 11
- HIPAA
- NIST 800-171 Revision 2
- NIST 800-53 Revision 4
- NIST 800-53 Revision 5
- NIST Cybersecurity Framework (CSF) v1.1
- PCI v3.2.1
- RBI Cyber Security Framework
- SOC 2
- These can be considered test mode at this point, we are open for feedback and updates.
- More information about how to use them with Prowler and compliance here: https://docs.prowler.cloud/en/latest/tutorials/compliance/.
- We want to thank pedromarting3 for his contribution, AWS and their public documentation and also [steampipe.io](http://steampipe.io/) mod page https://hub.steampipe.io/mods/turbot/aws_compliance because they were pretty helpful for us. 🙏🏼 🤜🏼🤛🏼

✅**New check**:
- Check if IAM Access Analyzer is enabled (in addition of the existing one that looks for issues as well)

📺**Handler for output code**:
- Like in v2, now you can handle what output code to get when Prowler gets failed findings. (-z)

📄**Allow list feature now supports Lambda to manage it**:
- More information https://github.com/prowler-cloud/prowler/pull/1793

What's Changed:

* feat(compliance): Add 17 new security compliance frameworks for AWS by pedromarting3 in https://github.com/prowler-cloud/prowler/pull/1824
* feat(new check): add accessanalyzer_enabled check by sergargar in https://github.com/prowler-cloud/prowler/pull/1864
* feat(boto3-config): Use standard retrier by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1868
* feat(allowlist): AWS Lambda function support by pplu in https://github.com/prowler-cloud/prowler/pull/1793
* feat(scan-type): AWS Resource ARNs based scan by sergargar in https://github.com/prowler-cloud/prowler/pull/1807
* feat(exit_code 3): add -z option by sergargar in https://github.com/prowler-cloud/prowler/pull/1848
* feat(scanner): Tag-based scan by sergargar in https://github.com/prowler-cloud/prowler/pull/1751

Fixes:
* fix(elbv2): handle service for GWLB resources by daftkid in https://github.com/prowler-cloud/prowler/pull/1860
* fix(checks): added validation for non-existing VPC endpoint policy by daftkid in https://github.com/prowler-cloud/prowler/pull/1859
* fix(action): do not trigger action when editing release by sergargar in https://github.com/prowler-cloud/prowler/pull/1865
* fix(key_errors): handle Key Errors in Lambda and EMR by sergargar in https://github.com/prowler-cloud/prowler/pull/1871
* fix(permissive role assumption): actions list handling by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1869
* fix(key_errors): handle Key Errors in Lambda and EMR by sergargar in https://github.com/prowler-cloud/prowler/pull/1871
* fix(hardware mfa): changed hardware mfa description by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1873
* fix(metadata): typo in appstream_fleet_session_disconnect_timeout.metadata.json by sergargar in https://github.com/prowler-cloud/prowler/pull/1875
* fix(compliance): ENS RD2022 Spanish security framework updates by alexr3y in https://github.com/prowler-cloud/prowler/pull/1809
* fix(errors): solve several services errors (AccessAnalyzer, AppStream, KMS, S3, SQS, R53, IAM, CodeArtifact and EC2) by sergargar in https://github.com/prowler-cloud/prowler/pull/1879
* fix(cloudtrail_multi_region_enabled): reformat check by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1880
* chore(compliance): add manual checks to compliance CSV by sergargar in https://github.com/prowler-cloud/prowler/pull/1872
* fix(service errors): solve errors in IAM, S3, Lambda, DS, Cloudfront services by sergargar in https://github.com/prowler-cloud/prowler/pull/1882
* chore(Dockerfile): Remove build files by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1886
* fix(list_checks): filter checks after audit_info set by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1887
* fix(Azure_Audit_Info): Added audited_resources field by n4ch04 in https://github.com/prowler-cloud/prowler/pull/1891

Documentation
* docs: Boto3 Standard Retrier by jfagoagas in https://github.com/prowler-cloud/prowler/pull/1885
* docs: Update AWS Role Assumption by Fennerr in https://github.com/prowler-cloud/prowler/pull/1890
* docs: Minor changes to the intro paragraph by Fennerr in https://github.com/prowler-cloud/prowler/pull/1892
* docs: Minor changes to logging by Fennerr in https://github.com/prowler-cloud/prowler/pull/1893

New Contributors
* pedromarting3 made their first contribution in https://github.com/prowler-cloud/prowler/pull/1824
* pplu made their first contribution in https://github.com/prowler-cloud/prowler/pull/1792

**Full Changelog**: https://github.com/prowler-cloud/prowler/compare/3.1.4...3.2.0