feat(aws): add acmpca service and pqc key algorithm check - #11318
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
✅ All necessary |
Compliance Mapping ReviewThis PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements. New checks not mapped to any compliance framework in this PR
Use the |
|
✅ Conflict Markers Resolved All conflict markers have been successfully resolved in this pull request. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11318 +/- ##
===========================================
- Coverage 94.12% 7.37% -86.76%
===========================================
Files 247 980 +733
Lines 36541 34280 -2261
===========================================
- Hits 34393 2527 -31866
- Misses 2148 31753 +29605
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
099647f to
82a62d9
Compare
82a62d9 to
67c3a5c
Compare
67c3a5c to
82a62d9
Compare
|
Sorry for the noise I introduced in the PR. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughA new ChangesAWS ACMPCA Post-Quantum Key Algorithm Check
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 58: The documentation entry for the
acmpca_certificate_authority_pqc_key_algorithm configuration parameter at line
58 is missing a Version Badge component that indicates when this feature was
introduced in Prowler. Add a Version Badge component to the documentation to
clearly specify the version when this new configurable check entry was
introduced, following the established pattern for new feature documentation in
the mdx file.
In
`@prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py`:
- Line 19: The execute() method lacks a required Google-style docstring. Add a
docstring immediately after the method definition that describes the method's
purpose, notes that it takes no explicit parameters beyond self, and documents
that it returns a list of Check_Report_AWS findings. The docstring should be
concise and follow Google documentation conventions with sections for
description and Returns.
In `@prowler/providers/aws/services/acmpca/acmpca_service.py`:
- Around line 10-18: The ACMPCA class and its methods are missing required type
hints and Google-style docstrings. Add type hints to the __init__ method
(specifying the provider parameter type and return type) and the
_list_certificate_authorities method (specifying the regional_client parameter
type and return type). Add Google-style docstrings to the ACMPCA class
describing its purpose, the __init__ method describing initialization and
parameters, the _list_certificate_authorities method describing its
functionality, and the CertificateAuthority class (also mentioned at line 48-57)
describing its structure and attributes. Follow Google documentation style
format with proper sections for Args, Returns, and descriptions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1b7d7f6d-5216-4bd9-944f-70b3cba32dfd
📒 Files selected for processing (14)
contrib/k8s/helm/prowler-api/values.yamldocs/user-guide/cli/tutorials/configuration_file.mdxprowler/CHANGELOG.mdprowler/config/config.yamlprowler/providers/aws/services/acmpca/__init__.pyprowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/__init__.pyprowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.metadata.jsonprowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.pyprowler/providers/aws/services/acmpca/acmpca_client.pyprowler/providers/aws/services/acmpca/acmpca_service.pytests/providers/aws/services/acmpca/__init__.pytests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/__init__.pytests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm_test.pytests/providers/aws/services/acmpca/acmpca_service_test.py
- Populate certificate authority tags - Add focused service test coverage - Add SDK documentation and docs version badge
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 60: The VersionBadge component is currently placed inline within the
acmpca_certificate_authority_pqc_key_algorithm table cell, but according to the
style guidelines it must be removed from the table and placed on its own line
immediately after a section header or feature title instead. Remove the
VersionBadge component from the table row, then position it on its own line
after the appropriate section header with a blank line following it before the
table content begins.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c92671b1-563c-42d7-a4f6-6093a80af6dc
📒 Files selected for processing (4)
docs/user-guide/cli/tutorials/configuration_file.mdxprowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.pyprowler/providers/aws/services/acmpca/acmpca_service.pytests/providers/aws/services/acmpca/acmpca_service_test.py
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 63: The table row containing the
acmpca_certificate_authority_pqc_key_algorithm entry is positioned out of
alphabetical order in the configuration file table. Move this row from its
current location at line 63 to its correct alphabetical position, which should
be immediately after the acm_certificates_expiration_check row (around line 26)
to maintain the established alphabetical sorting by check name.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c914a4e2-7b0e-4bb5-a121-adcc8ee5d20a
📒 Files selected for processing (1)
docs/user-guide/cli/tutorials/configuration_file.mdx
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/user-guide/cli/tutorials/configuration_file.mdx (1)
19-19:⚠️ Potential issue | 🔴 CriticalAdd a subsection-level Version Badge for the acmpca check at 5.31.0.
The section-level badge (5.28.0) marks when "Configurable Checks" was introduced but does not indicate that the
acmpca_certificate_authority_pqc_key_algorithmcheck was added in version 5.31.0. Per the coding guidelines, Version Badges must be applied when documenting new security checks. Add a subsection-level badge immediately before the table row or create a subsection header for this check with the 5.31.0 badge, following the subsection badge pattern used elsewhere in the documentation (e.g.,prowler-app-lighthouse-multi-llm.mdx).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/user-guide/cli/tutorials/configuration_file.mdx` at line 19, The documentation for the acmpca_certificate_authority_pqc_key_algorithm check is missing a subsection-level Version Badge indicating when it was introduced in version 5.31.0. Add a VersionBadge component with version="5.31.0" immediately before the table row containing the acmpca_certificate_authority_pqc_key_algorithm check, or create a subsection header with the badge following the same pattern used in other documentation files like prowler-app-lighthouse-multi-llm.mdx, to ensure the badge clearly marks when this specific security check was added.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 19: The documentation for the
acmpca_certificate_authority_pqc_key_algorithm check is missing a
subsection-level Version Badge indicating when it was introduced in version
5.31.0. Add a VersionBadge component with version="5.31.0" immediately before
the table row containing the acmpca_certificate_authority_pqc_key_algorithm
check, or create a subsection header with the badge following the same pattern
used in other documentation files like prowler-app-lighthouse-multi-llm.mdx, to
ensure the badge clearly marks when this specific security check was added.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9fe7be60-2943-48ef-ace7-944f5dd3b22b
📒 Files selected for processing (4)
contrib/k8s/helm/prowler-api/values.yamldocs/user-guide/cli/tutorials/configuration_file.mdxprowler/CHANGELOG.mdprowler/config/config.yaml
💤 Files with no reviewable changes (1)
- prowler/config/config.yaml
Context
RSA and ECC signatures can be forged by a cryptographically relevant quantum computer. AWS Private CA now supports ML-DSA (NIST FIPS 204), a quantum-resistant signature algorithm, so customers can begin migrating their PKI. Prowler had no AWS Private CA service.
Description
Introduces the AWS Private CA (
acmpca) service and theacmpca_certificate_authority_pqc_key_algorithmcheck. The check evaluates each certificate authority'sKeyAlgorithmagainst a configurable allowlist (acmpca_pqc_key_algorithms, defaults:ML_DSA_44,ML_DSA_65,ML_DSA_87). Deleted CAs are skipped. Severity: low.Steps to review
prowler/providers/aws/services/acmpca/(acmpca_service.py,acmpca_client.py)prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/poetry run pytest tests/providers/aws/services/acmpca/ -vprowler aws --check acmpca_certificate_authority_pqc_key_algorithmChecklist
Community Checklist
SDK/CLI
acm-pca:ListCertificateAuthorities/acm-pca:DescribeCertificateAuthorityare already covered by the AWS managedSecurityAuditpolicy.License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit
Release Notes
New Features
Configuration
Documentation
Tests