feat(aws): add apigateway_domain_name_pqc_tls_enabled check - #11316
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
✅ All necessary |
Compliance Mapping ReviewThis PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements. New checks already mapped in this PR
Use the |
|
✅ Conflict Markers Resolved All conflict markers have been successfully resolved in this pull request. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11316 +/- ##
===========================================
- Coverage 94.12% 8.11% -86.01%
===========================================
Files 247 976 +729
Lines 36541 34194 -2347
===========================================
- Hits 34393 2774 -31619
- Misses 2148 31420 +29272
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
101ebb2 to
48256d8
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a new Prowler check ChangesAPI Gateway Post-Quantum TLS Check
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py (1)
27-156:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUse
motofor AWS Check Tests to Match Repository StandardThese AWS check tests currently rely only on
MagicMock.
As per coding guidelines, "Tests: AWS uses moto@mock_aws+ set_mocked_aws_provider; Azure/GCP/K8s/other providers use MagicMock (NO moto)."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py` around lines 27 - 156, The test class `Test_apigateway_domain_name_pqc_tls_enabled` needs to be refactored to use moto's `@mock_aws` decorator in addition to the existing `MagicMock` setup to follow AWS check testing standards. Import `mock_aws` from the moto library and apply it as a decorator to the test class, then verify that all test methods (test_no_domains, test_pq_policy, test_legacy_tls_1_2, test_missing_security_policy, and test_configurable_allowlist) continue to work with the combined moto and MagicMock mocking approach.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 58: The newly documented configurable check mapping for
`apigateway_domain_name_pqc_tls_enabled` to
`apigateway_pqc_tls_allowed_policies` is missing a Version Badge component.
Locate the section header or title that introduces this new configuration
mapping and add a VersionBadge component on its own line immediately after the
header using the format `<VersionBadge version="X.Y.Z" />` where X.Y.Z is the
appropriate version number when this feature was introduced in Prowler.
In
`@prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py`:
- Line 18: The execute method is missing a docstring which is required for all
public methods in Python. Add a docstring immediately after the method
definition of execute that clearly describes what the method does, its
parameters if any, and its return type (list[Check_Report_AWS]). The docstring
should follow the project's documentation conventions and provide clear context
about the method's purpose and behavior.
- Around line 20-27: The code retrieves pqc_policies from audit_config using a
get method that could return null or a non-iterable value if misconfigured in
the audit settings. Before the membership check `if domain.security_policy in
pqc_policies` on line 26, add validation to ensure pqc_policies is actually
iterable (a list or set). If the value is null or not iterable, either assign it
to a default empty list or the PQC_APIGATEWAY_POLICIES_DEFAULT constant to
prevent a TypeError when the in operator is executed.
In `@prowler/providers/aws/services/apigateway/apigateway_service.py`:
- Line 24: Add Google-style docstrings to the `_get_domain_names` method and to
the class/definition at line 281. Each docstring should follow Google's
documentation format, including a brief summary of what the method/class does, a
description of parameters (Args), return value (Returns), and any exceptions
(Raises) if applicable. Place the docstring immediately after the method/class
definition line, enclosed in triple quotes.
---
Outside diff comments:
In
`@tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py`:
- Around line 27-156: The test class
`Test_apigateway_domain_name_pqc_tls_enabled` needs to be refactored to use
moto's `@mock_aws` decorator in addition to the existing `MagicMock` setup to
follow AWS check testing standards. Import `mock_aws` from the moto library and
apply it as a decorator to the test class, then verify that all test methods
(test_no_domains, test_pq_policy, test_legacy_tls_1_2,
test_missing_security_policy, and test_configurable_allowlist) continue to work
with the combined moto and MagicMock mocking approach.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: cdf3e5fa-fedc-4290-bbbc-6c0996e1096f
⛔ Files ignored due to path filters (14)
prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ccc_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/csa_ccm_4.0_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ens_rd2022_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/fedramp_moderate_revision_4_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ffiec_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/gxp_21_cfr_part_11_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/iso27001_2013_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_korean_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_171_revision_2_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_53_revision_5_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/rbi_cyber_security_framework_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/secnumcloud_3.2_aws.jsonis excluded by!prowler/compliance/**/*.json
📒 Files selected for processing (13)
contrib/k8s/helm/prowler-api/values.yamldocs/user-guide/cli/tutorials/configuration_file.mdxpermissions/prowler-additions-policy.jsonpermissions/templates/cloudformation/prowler-scan-role.ymlprowler/CHANGELOG.mdprowler/config/config.yamlprowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/__init__.pyprowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.metadata.jsonprowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.pyprowler/providers/aws/services/apigateway/apigateway_service.pytests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/__init__.pytests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.pytests/providers/aws/services/apigateway/apigateway_service_test.py
- Normalize configurable PQC policy allowlist - Add focused tests and SDK docstrings - Add version badge for configurable check docs
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
prowler/providers/aws/services/apigateway/apigateway_service.py (1)
47-47:⚠️ Potential issue | 🟡 MinorFix tags field wrapping inconsistency in DomainName and RestAPI initialization.
Line 47 wraps the tags dict in a list:
tags=[item.get("tags", {})], producing[{}]when tags are missing. This conflicts with theDomainNamemodel defaulttags: Optional[list] = []. Similarly, line 71 usestags=[apigw.get("tags")]for RestAPI, producing[None]when tags are absent. The Stage model (line ~173) has the same issue.AWS API responses provide tags as a dict (or absent entirely), not a list. The wrapping creates inconsistent data: missing tags should be
[]per the model default, not[{}]or[None].Change line 47 to
tags=item.get("tags")and line 71 totags=apigw.get("tags")to pass the value directly, allowing Pydantic to apply the model default when tags areNone.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@prowler/providers/aws/services/apigateway/apigateway_service.py` at line 47, Remove the list wrapping around the tags field in the DomainName, RestAPI, and Stage model initializations. In the DomainName initialization at line 47, change tags=[item.get("tags", {})] to tags=item.get("tags") to pass the tags dict directly instead of wrapping it in a list. Similarly, update line 71 in the RestAPI initialization from tags=[apigw.get("tags")] to tags=apigw.get("tags"), and apply the same fix to the Stage model initialization around line 173. This allows Pydantic to apply the model default of an empty list when tags are absent or None, rather than creating inconsistent data structures like [{}] or [None].
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py`:
- Around line 11-15: The _get_allowed_policies helper function parameter
`configured_policies` is missing a type annotation. Add an explicit type hint
`Any` to the `configured_policies` parameter to clarify that this helper
function accepts any type before validating it with isinstance. This improves
code clarity and aligns with coding guidelines for type hints.
---
Outside diff comments:
In `@prowler/providers/aws/services/apigateway/apigateway_service.py`:
- Line 47: Remove the list wrapping around the tags field in the DomainName,
RestAPI, and Stage model initializations. In the DomainName initialization at
line 47, change tags=[item.get("tags", {})] to tags=item.get("tags") to pass the
tags dict directly instead of wrapping it in a list. Similarly, update line 71
in the RestAPI initialization from tags=[apigw.get("tags")] to
tags=apigw.get("tags"), and apply the same fix to the Stage model initialization
around line 173. This allows Pydantic to apply the model default of an empty
list when tags are absent or None, rather than creating inconsistent data
structures like [{}] or [None].
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 938561e2-1672-456b-b9b4-a70501ee7b91
📒 Files selected for processing (4)
docs/user-guide/cli/tutorials/configuration_file.mdxprowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.pyprowler/providers/aws/services/apigateway/apigateway_service.pytests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py
- Resolve CSA CCM compliance catalog conflict by keeping master removal - Add requested helper parameter type annotation
Context
To mitigate "harvest now, decrypt later" attacks, API Gateway offers enhanced TLS security policies that add hybrid post-quantum (ML-KEM) key exchange for REST API custom domain names. Prowler had no check surfacing whether a custom domain uses one.
Description
Adds the
apigateway_domain_name_pqc_tls_enabledcheck. It evaluates thesecurityPolicyof every REST API custom domain name against a configurable allowlist (apigateway_pqc_tls_allowed_policies, default:SecurityPolicy_TLS13_1_3_2025_09). Theapigatewayservice is extended to list custom domain names. Severity: low.Note: API Gateway HTTP and WebSocket APIs only support the legacy
TLS_1_2policy today, so they cannot use post-quantum TLS and are out of scope for this check.Steps to review
prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/prowler/providers/aws/services/apigateway/apigateway_service.pypoetry run pytest tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/ tests/providers/aws/services/apigateway/apigateway_service_test.py -vprowler aws --check apigateway_domain_name_pqc_tls_enabledChecklist
Community Checklist
SDK/CLI
apigateway:GETonarn:*:apigateway:*::/domainnames/*to bothpermissions/prowler-additions-policy.jsonand the CloudFormation scan-role template, required to read custom domain names.License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit
apigateway_domain_name_pqc_tls_enabledcheck for API Gateway custom domains to ensure they use an approved post-quantum TLS security policy.apigateway_pqc_tls_allowed_policies(default allowlist) to control which policies are considered valid.