Prowler 2.7.0 - Brave

[toniblyx]

Prowler 2.7.0 - Brave

This release name is in honor of Brave New World, a great song of 🔥Iron Maiden🔥 from their Brave New World album. Dedicated to all of you looking forward to having the world we had before COVID... We hope is not hitting you bad. Enjoy!

Important changes in this version (read this!):

• As you can see, Prowler is now in a new organization called https://github.com/prowler-cloud/.
• From this version, master branch will be the latest available code and we will keep the stable code as each release, if you are installing or deploying Prowler using git clone to master take that into account and use the latest release instead, i.e.: git clone --branch 2.7 https://github.com/prowler-cloud/prowler or curl https://github.com/toniblyx/prowler/archive/refs/tags/2.7.0.tar.gz -o prowler-2.7.0.tar.gz
• For known issues please see https://github.com/prowler-cloud/prowler/issues the ones open with bug as a red tag.
• Discussions is now open in the Prowler repo https://github.com/prowler-cloud/prowler/discussions, feel free to use it if that works for you better than the current Discord server.
• 11 new checks!! Thanks to @michael-dickinson-sainsburys, @jonloza, @rustic, @Obiakara, @Daniel-Peladeau, @maisenhe, @7thseraph. Now there have a total of 218 checks. See below for details.
• An issue with Security Hub integration when resolving closed findings are either a lot of new findings, or a lot of resolved findings is now working as expected thanks to @Kirizan
• When credential are in environment variable it failed to review, that was fixed by @lazize
• See below new features and more details for this version.

New Features

• 11 New checks for Redshift, EFS, CloudWatch, Secrets Manager, DynamoDB and Shield Advanced:

7.160 [extra7160] Check if Redshift has automatic upgrades enabled - redshift [Medium]
7.161 [extra7161] Check if EFS have protects sensative data with encryption at rest - efs [Medium]
7.162 [extra7162] Check if CloudWatch Log Groups have a retention policy of 365 days - cloudwatch [Medium]
7.163 [extra7163] Check if Secrets Manager key rotation is enabled - secretsmanager [Medium]
7.164 [extra7164] Check if CloudWatch log groups are protected by AWS KMS  - logs [Medium]
7.165 [extra7165] Check if DynamoDB: DAX Clusters are encrypted at rest - dynamodb [Medium]
7.166 [extra7166] Check if Elastic IP addresses with associations are protected by AWS Shield Advanced - shield [Medium]
7.167 [extra7167] Check if Cloudfront distributions are protected by AWS Shield Advanced - shield [Medium]
7.168 [extra7168] Check if Route53 hosted zones are protected by AWS Shield Advanced - shield [Medium]
7.169 [extra7169] Check if global accelerators are protected by AWS Shield Advanced - shield [Medium]
7.170 [extra7170] Check if internet-facing application load balancers are protected by AWS Shield Advanced - shield [Medium]
7.171 [extra7171] Check if classic load balancers are protected by AWS Shield Advanced - shield [Medium]

• Add -D option to copy to S3 with the initial AWS credentials instead of the assumed as with -B option by @sectoramen in Added -D option to copy to S3 with the initial AWS credentials instead of the assumed as with -B option @sectoramen #974
• Add new functions to backup and restore initial AWS credentials, for better handling chaining role by @sectoramen in restoreInitialAWSCredentials, unset the credentials if never set #978
• Add additional action permissions for Glue and Shield Advanced checks by @lazize in Add additional action permissions for Glue and Shield Advanced checks @lazize #995

Enhancements

• Update Dockerfile to use Amazon Linux container image by @Kirizan in Updated Dockerfile to use amazonlinux container @Kirizan #972
• Update Readme: -T option is not mandatory by @jfagoagas in Docs Readme: -T option is not mandatory @jfagoagas #944
• Add $PROFILE_OPT to CopyToS3 commands by @sectoramen in Added $PROFILE_OPT to CopyToS3 commands @sectoramen #976
• Remove unneeded package "file" from Dockerfile by @sectoramen in Removed unneeded package "file" from Dockerfile @sectoramen #977
• Update docs (templates): Improve bug template with more info by @jfagoagas in docs(templates): Improve bug template with more info #982

Fixes

• Fix in README and multiaccount serverless deployment templates by @dlorch in Smaller fixes in README and multiaccount serverless deployment templates @dlorch #939
• Fix assume-role: check if -T and -A options are set together by @jfagoagas in Fix assume-role: check if -T and -A options are set together @jfagoagas #945
• Fix group25 FTR by @lopmoris in Fix group25 FTR @lopmoris #948
• Fix in README link for group25 FTR by @lopmoris in Docs Readme: fix link for group25 FTR @lopmoris #949
• Fix issue $PROFILE_OPT empty when working with assumed roles #938 assume_role multiple times by @halfluke in Fix issue #938 assume_role multiple times @halfluke #951
• Fix and clean assume-role to better handle AWS STS CLI errors by @jfagoagas in Fix and clean assume-role to better handle AWS STS CLI errors @jfagoagas #946
• Fix issue with Security Hub integration when resolving closed findings are either a lot of new findings, or a lot of resolved findings by @Kirizan in Fix issue with Security Hub integration when resolving closed findings are either a lot of new findings, or a lot of resolved findings @Kirizan #953
• Fix broken link in README.md by @rtcms in Fix broken link in README.md @rtcms #966
• Fix checks with comma issues in checks by @j2clerck in Fix checks with comma issues in checks @j2clerck #975
• Fix: Credential chaining from environment variables by @lazize in Fix: Credential chaining from environment variables @lazize #996

New Contributors

• @jonloza made their first contribution in New check 7160 Redshift cluster AutomaticVersionUpgrade enabled @jonloza #932
• @Obiakara made their first contribution in New check 7162 CloudWatch log groups have 365 days retention @Obiakara #935
• @dlorch made their first contribution in Smaller fixes in README and multiaccount serverless deployment templates @dlorch #939
• @Daniel-Peladeau made their first contribution in New check 7163 Secrets Manager key rotation enabled @Daniel-Peladeau #937
• @lopmoris made their first contribution in Fix group25 FTR @lopmoris #948
• @halfluke made their first contribution in Fix issue #938 assume_role multiple times @halfluke #951
• @maisenhe made their first contribution in New check 7164 Cloudwatch log groups are protected by KMS @maisenhe #956
• @rtcms made their first contribution in Fix broken link in README.md @rtcms #966
• @sectoramen made their first contribution in Added -D option to copy to S3 with the initial AWS credentials instead of the assumed as with -B option @sectoramen #974
• @j2clerck made their first contribution in Fix checks with comma issues in checks @j2clerck #975
• @lazize made their first contribution in Add additional action permissions for Glue and Shield Advanced checks @lazize #995

Full Changelog: 2.6.1...2.7

---

This discussion was created from the release Prowler 2.7.0 - Brave.