Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs #5494

Merged
merged 6 commits into from
Nov 4, 2024
Merged

feat(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs #5494

merged 6 commits into from
Nov 4, 2024

Conversation

MrCloudSec
Copy link
Member

Context

This PR adds a new check, cloudwatch_log_group_no_critical_pii_in_logs, to detect critical Personally Identifiable Information (PII) in CloudWatch logs using Microsoft Presidio. The goal is to enhance security by ensuring no sensitive PII (e.g., SSNs, credit card numbers) is logged, reducing the risk of privacy violations and compliance issues.

Description

  • New Check: cloudwatch_log_group_no_critical_pii_in_logs detects critical PII such as Social Security Numbers (SSNs), credit card numbers, and email addresses.

Checklist

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@MrCloudSec MrCloudSec requested review from a team as code owners October 21, 2024 20:39
@github-actions GitHub Actions
Copy link
Contributor

You can check the documentation for this PR here -> Prowler Documentation

@github-actions github-actions bot added the provider/aws Issues/PRs related with the AWS provider label Oct 21, 2024
@github-actions GitHub Actions
Copy link
Contributor

You can check the documentation for this PR here -> Prowler Documentation

@codecov Codecov
Copy link

codecov bot commented Oct 21, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 98.30508% with 1 line in your changes missing coverage. Please review.

Project coverage is 89.72%. Comparing base (b87e6d2) to head (3dbfc23).
Report is 20 commits behind head on master.

Files with missing lines Patch % Lines
...gs/cloudwatch_log_group_no_critical_pii_in_logs.py 98.30% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #5494      +/-   ##
==========================================
+ Coverage   89.69%   89.72%   +0.03%     
==========================================
  Files        1096     1102       +6     
  Lines       34034    34251     +217     
==========================================
+ Hits        30526    30733     +207     
- Misses       3508     3518      +10

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

puchy22
puchy22 requested changes Oct 30, 2024
View reviewed changes
...log_group_no_critical_pii_in_logs/cloudwatch_log_group_no_critical_pii_in_logs.metadata.json Outdated Show resolved Hide resolved
...log_group_no_critical_pii_in_logs/cloudwatch_log_group_no_critical_pii_in_logs.metadata.json Outdated Show resolved Hide resolved
...loudwatch_log_group_no_secrets_in_logs/cloudwatch_log_group_no_secrets_in_logs.metadata.json Outdated Show resolved Hide resolved
...cloudwatch_log_group_no_critical_pii_in_logs/cloudwatch_log_group_no_critical_pii_in_logs.py Outdated Show resolved Hide resolved
...cloudwatch_log_group_no_critical_pii_in_logs/cloudwatch_log_group_no_critical_pii_in_logs.py Outdated Show resolved Hide resolved
...cloudwatch_log_group_no_critical_pii_in_logs/cloudwatch_log_group_no_critical_pii_in_logs.py Outdated Show resolved Hide resolved
@github-actions GitHub Actions
Copy link
Contributor

You can check the documentation for this PR here -> Prowler Documentation

1 similar comment
@github-actions GitHub Actions
Copy link
Contributor

You can check the documentation for this PR here -> Prowler Documentation

@puchy22 puchy22 force-pushed the PRWLR-5074-create-check-cloudwatch-log-group-no-critical-pii-in-logs branch from 22265e7 to aae8f25 Compare October 30, 2024 16:05
@github-actions GitHub Actions
Copy link
Contributor

You can check the documentation for this PR here -> Prowler Documentation

1 similar comment
@github-actions GitHub Actions
Copy link
Contributor

You can check the documentation for this PR here -> Prowler Documentation

@MrCloudSec MrCloudSec force-pushed the PRWLR-5074-create-check-cloudwatch-log-group-no-critical-pii-in-logs branch from 55b0980 to 3dbfc23 Compare October 30, 2024 17:19
@github-actions GitHub Actions
Copy link
Contributor

You can check the documentation for this PR here -> Prowler Documentation

@MrCloudSec MrCloudSec changed the title fix(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs feat(aws): add new check cloudwatch_log_group_no_critical_pii_in_logs Oct 30, 2024
puchy22
puchy22 approved these changes Nov 4, 2024
View reviewed changes
Copy link
Member

@puchy22 puchy22 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome job! 💯

@MrCloudSec MrCloudSec merged commit e3104ae into master Nov 4, 2024
12 checks passed
@MrCloudSec MrCloudSec deleted the PRWLR-5074-create-check-cloudwatch-log-group-no-critical-pii-in-logs branch November 4, 2024 15:20
jfagoagas
jfagoagas reviewed Nov 11, 2024
View reviewed changes
...cloudwatch_log_group_no_critical_pii_in_logs/cloudwatch_log_group_no_critical_pii_in_logs.py
findings = []

# Initialize the PII Analyzer engine
analyzer = AnalyzerEngine()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this can be done after line 20 at least not to get anything if no logs.

...cloudwatch_log_group_no_critical_pii_in_logs/cloudwatch_log_group_no_critical_pii_in_logs.py
return findings


class SecretsDict(dict[int, Set[str]]):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the purpose of this class?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jfagoagas jfagoagas jfagoagas left review comments

@puchy22 puchy22 puchy22 approved these changes

Assignees
No one assigned
Labels
documentation provider/aws Issues/PRs related with the AWS provider
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@MrCloudSec @jfagoagas @puchy22