Skip to content

feat(aws): add acmpca service and pqc key algorithm check - #11318

Merged
HugoPBrito merged 10 commits into
masterfrom
feat/acmpca-certificate-authority-pqc-key-algorithm
Jun 22, 2026
Merged

feat(aws): add acmpca service and pqc key algorithm check#11318
HugoPBrito merged 10 commits into
masterfrom
feat/acmpca-certificate-authority-pqc-key-algorithm

Conversation

@pedrooot

@pedrooot pedrooot commented May 21, 2026

Copy link
Copy Markdown
Member

Context

RSA and ECC signatures can be forged by a cryptographically relevant quantum computer. AWS Private CA now supports ML-DSA (NIST FIPS 204), a quantum-resistant signature algorithm, so customers can begin migrating their PKI. Prowler had no AWS Private CA service.

Description

Introduces the AWS Private CA (acmpca) service and the acmpca_certificate_authority_pqc_key_algorithm check. The check evaluates each certificate authority's KeyAlgorithm against a configurable allowlist (acmpca_pqc_key_algorithms, defaults: ML_DSA_44, ML_DSA_65, ML_DSA_87). Deleted CAs are skipped. Severity: low.

Steps to review

  1. New service: prowler/providers/aws/services/acmpca/ (acmpca_service.py, acmpca_client.py)
  2. Check implementation: prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/
  3. Run the tests: poetry run pytest tests/providers/aws/services/acmpca/ -v
  4. Optionally run against a real environment: prowler aws --check acmpca_certificate_authority_pqc_key_algorithm

Checklist

Community Checklist
  • This feature/issue is listed in here or roadmap.prowler.com
  • Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

SDK/CLI

  • Are there new checks included in this PR? Yes
    • No new permissions needed: acm-pca:ListCertificateAuthorities/acm-pca:DescribeCertificateAuthority are already covered by the AWS managed SecurityAudit policy.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Summary by CodeRabbit

Release Notes

  • New Features

    • Added a new AWS ACMPCA configurable check to verify Private CA certificate authorities use approved post-quantum (ML-DSA) key algorithms.
  • Configuration

    • Introduced configurable “Post-Quantum TLS” allowlist settings for ML-DSA algorithms (default: ML_DSA_44, ML_DSA_65, ML_DSA_87).
  • Documentation

    • Updated the CLI configuration guide to include the new configurable check and remediation details.
  • Tests

    • Added unit tests covering pass/fail behavior, skipping deleted CAs, and allowlist overrides.

@pedrooot
pedrooot requested a review from a team as a code owner May 21, 2026 22:19
@github-actions github-actions Bot added documentation provider/aws Issues/PRs related with the AWS provider metadata-review labels May 21, 2026
@mintlify

mintlify Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
prowler 🟢 Ready View Preview May 21, 2026, 10:25 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

✅ All necessary CHANGELOG.md files have been updated.

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Compliance Mapping Review

This PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements.

New checks not mapped to any compliance framework in this PR

  • acmpca_certificate_authority_pqc_key_algorithm (aws)

Please review whether these checks should be added to compliance framework requirements in prowler/compliance/<provider>/. Each compliance JSON has a Checks array inside each requirement — add the check ID there if it satisfies that requirement.

Use the no-compliance-check label to skip this check.

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

@codecov

codecov Bot commented May 21, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.62500% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 7.37%. Comparing base (30d737c) to head (793f90c).
⚠️ Report is 7 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (30d737c) and HEAD (793f90c). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (30d737c) HEAD (793f90c)
api 1 0
Additional details and impacted files
@@             Coverage Diff             @@
##           master   #11318       +/-   ##
===========================================
- Coverage   94.12%    7.37%   -86.76%     
===========================================
  Files         247      980      +733     
  Lines       36541    34280     -2261     
===========================================
- Hits        34393     2527    -31866     
- Misses       2148    31753    +29605     
Flag Coverage Δ
api ?
prowler-py3.10-aws 2.17% <90.62%> (?)
prowler-py3.10-config 7.37% <90.62%> (?)
prowler-py3.10-external 7.29% <90.62%> (?)
prowler-py3.11-aws 2.17% <90.62%> (?)
prowler-py3.11-config 7.37% <90.62%> (?)
prowler-py3.11-external 7.29% <90.62%> (?)
prowler-py3.12-aws 2.17% <90.62%> (?)
prowler-py3.12-config 7.37% <90.62%> (?)
prowler-py3.12-external 7.29% <90.62%> (?)
prowler-py3.13-aws 2.17% <90.62%> (?)
prowler-py3.13-config 7.37% <90.62%> (?)
prowler-py3.13-external 7.29% <90.62%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Δ
prowler 7.26% <39.45%> (∅)
api ∅ <ø> (∅)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Security Scan

Image: prowler:ae8f533
Last scan: 2026-06-22 16:00:24 UTC

✅ No Vulnerabilities Detected

The container image passed all security checks. No known CVEs were found.

📋 Resources:

@pedrooot
pedrooot force-pushed the feat/acmpca-certificate-authority-pqc-key-algorithm branch from 099647f to 82a62d9 Compare May 21, 2026 22:29
@HugoPBrito
HugoPBrito force-pushed the feat/acmpca-certificate-authority-pqc-key-algorithm branch from 82a62d9 to 67c3a5c Compare June 2, 2026 12:06
@HugoPBrito
HugoPBrito requested a review from a team as a code owner June 2, 2026 12:06
@github-actions github-actions Bot added github_actions Pull requests that update GitHub Actions code and removed documentation provider/aws Issues/PRs related with the AWS provider metadata-review labels Jun 2, 2026
@HugoPBrito
HugoPBrito force-pushed the feat/acmpca-certificate-authority-pqc-key-algorithm branch from 67c3a5c to 82a62d9 Compare June 2, 2026 12:08
@github-actions github-actions Bot added documentation provider/aws Issues/PRs related with the AWS provider metadata-review and removed github_actions Pull requests that update GitHub Actions code labels Jun 2, 2026
@HugoPBrito
HugoPBrito removed the request for review from a team June 2, 2026 12:11
Comment thread tests/providers/aws/services/acmpca/__init__.py Outdated
Comment thread prowler/providers/aws/services/acmpca/acmpca_service.py Outdated
@HugoPBrito

Copy link
Copy Markdown
Member

Sorry for the noise I introduced in the PR.

@coderabbitai

coderabbitai Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

A new acmpca AWS service is introduced with an ACMPCA class that paginates ListCertificateAuthorities, a CertificateAuthority Pydantic model, and a singleton client. A new check (acmpca_certificate_authority_pqc_key_algorithm) evaluates each non-deleted CA's key algorithm against a configurable ML-DSA allowlist. Default configuration, Helm values, metadata, unit tests, and documentation are added.

Changes

AWS ACMPCA Post-Quantum Key Algorithm Check

Layer / File(s) Summary
ACMPCA service, data model, and client singleton
prowler/providers/aws/services/acmpca/acmpca_service.py, prowler/providers/aws/services/acmpca/acmpca_client.py, prowler/config/config.yaml, contrib/k8s/helm/prowler-api/values.yaml
ACMPCA(AWSService) paginates list_certificate_authorities and stores results as CertificateAuthority Pydantic models keyed by ARN; acmpca_client singleton is wired; default acmpca_pqc_key_algorithms list (ML_DSA_44, ML_DSA_65, ML_DSA_87) added to both config.yaml and Helm values.
PQC key algorithm check and metadata
prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py, prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.metadata.json
acmpca_certificate_authority_pqc_key_algorithm(Check) loads the allowlist from audit_config or falls back to PQC_PCA_KEY_ALGORITHMS_DEFAULT, skips DELETED CAs, and emits PASS/FAIL per CA; metadata JSON provides severity, description, and ML-DSA remediation guidance.
Service and check unit tests
tests/providers/aws/services/acmpca/acmpca_service_test.py, tests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm_test.py
Service tests assert acm-pca service name and correct CertificateAuthority field values via botocore mock; check tests cover no CAs, ML_DSA_65 pass, RSA_2048 fail, DELETED skip, and configurable allowlist via audit_config.
Documentation and changelog
docs/user-guide/cli/tutorials/configuration_file.mdx, prowler/CHANGELOG.md
Adds acmpca_pqc_key_algorithms to the configurable checks table with version badge, and a changelog entry for the new check and service.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

  • danibarranqueroo
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 23.08% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: introducing the AWS ACMPCA service and a PQC key algorithm check.
Description check ✅ Passed The PR description covers all key sections: context, description, steps to review, and a completed checklist. It provides clear motivation, implementation scope, and testing instructions.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/acmpca-certificate-authority-pqc-key-algorithm

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 58: The documentation entry for the
acmpca_certificate_authority_pqc_key_algorithm configuration parameter at line
58 is missing a Version Badge component that indicates when this feature was
introduced in Prowler. Add a Version Badge component to the documentation to
clearly specify the version when this new configurable check entry was
introduced, following the established pattern for new feature documentation in
the mdx file.

In
`@prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py`:
- Line 19: The execute() method lacks a required Google-style docstring. Add a
docstring immediately after the method definition that describes the method's
purpose, notes that it takes no explicit parameters beyond self, and documents
that it returns a list of Check_Report_AWS findings. The docstring should be
concise and follow Google documentation conventions with sections for
description and Returns.

In `@prowler/providers/aws/services/acmpca/acmpca_service.py`:
- Around line 10-18: The ACMPCA class and its methods are missing required type
hints and Google-style docstrings. Add type hints to the __init__ method
(specifying the provider parameter type and return type) and the
_list_certificate_authorities method (specifying the regional_client parameter
type and return type). Add Google-style docstrings to the ACMPCA class
describing its purpose, the __init__ method describing initialization and
parameters, the _list_certificate_authorities method describing its
functionality, and the CertificateAuthority class (also mentioned at line 48-57)
describing its structure and attributes. Follow Google documentation style
format with proper sections for Args, Returns, and descriptions.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1b7d7f6d-5216-4bd9-944f-70b3cba32dfd

📥 Commits

Reviewing files that changed from the base of the PR and between cf9beb8 and ca1d7c9.

📒 Files selected for processing (14)
  • contrib/k8s/helm/prowler-api/values.yaml
  • docs/user-guide/cli/tutorials/configuration_file.mdx
  • prowler/CHANGELOG.md
  • prowler/config/config.yaml
  • prowler/providers/aws/services/acmpca/__init__.py
  • prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/__init__.py
  • prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.metadata.json
  • prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py
  • prowler/providers/aws/services/acmpca/acmpca_client.py
  • prowler/providers/aws/services/acmpca/acmpca_service.py
  • tests/providers/aws/services/acmpca/__init__.py
  • tests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/__init__.py
  • tests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm_test.py
  • tests/providers/aws/services/acmpca/acmpca_service_test.py

Comment thread docs/user-guide/cli/tutorials/configuration_file.mdx Outdated
Comment thread prowler/providers/aws/services/acmpca/acmpca_service.py
- Populate certificate authority tags

- Add focused service test coverage

- Add SDK documentation and docs version badge

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 60: The VersionBadge component is currently placed inline within the
acmpca_certificate_authority_pqc_key_algorithm table cell, but according to the
style guidelines it must be removed from the table and placed on its own line
immediately after a section header or feature title instead. Remove the
VersionBadge component from the table row, then position it on its own line
after the appropriate section header with a blank line following it before the
table content begins.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c92671b1-563c-42d7-a4f6-6093a80af6dc

📥 Commits

Reviewing files that changed from the base of the PR and between ca1d7c9 and 69fb52c.

📒 Files selected for processing (4)
  • docs/user-guide/cli/tutorials/configuration_file.mdx
  • prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py
  • prowler/providers/aws/services/acmpca/acmpca_service.py
  • tests/providers/aws/services/acmpca/acmpca_service_test.py

Comment thread docs/user-guide/cli/tutorials/configuration_file.mdx Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 63: The table row containing the
acmpca_certificate_authority_pqc_key_algorithm entry is positioned out of
alphabetical order in the configuration file table. Move this row from its
current location at line 63 to its correct alphabetical position, which should
be immediately after the acm_certificates_expiration_check row (around line 26)
to maintain the established alphabetical sorting by check name.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c914a4e2-7b0e-4bb5-a121-adcc8ee5d20a

📥 Commits

Reviewing files that changed from the base of the PR and between 69fb52c and d9d8478.

📒 Files selected for processing (1)
  • docs/user-guide/cli/tutorials/configuration_file.mdx

Comment thread docs/user-guide/cli/tutorials/configuration_file.mdx Outdated
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jun 19, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
docs/user-guide/cli/tutorials/configuration_file.mdx (1)

19-19: ⚠️ Potential issue | 🔴 Critical

Add a subsection-level Version Badge for the acmpca check at 5.31.0.

The section-level badge (5.28.0) marks when "Configurable Checks" was introduced but does not indicate that the acmpca_certificate_authority_pqc_key_algorithm check was added in version 5.31.0. Per the coding guidelines, Version Badges must be applied when documenting new security checks. Add a subsection-level badge immediately before the table row or create a subsection header for this check with the 5.31.0 badge, following the subsection badge pattern used elsewhere in the documentation (e.g., prowler-app-lighthouse-multi-llm.mdx).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/user-guide/cli/tutorials/configuration_file.mdx` at line 19, The
documentation for the acmpca_certificate_authority_pqc_key_algorithm check is
missing a subsection-level Version Badge indicating when it was introduced in
version 5.31.0. Add a VersionBadge component with version="5.31.0" immediately
before the table row containing the
acmpca_certificate_authority_pqc_key_algorithm check, or create a subsection
header with the badge following the same pattern used in other documentation
files like prowler-app-lighthouse-multi-llm.mdx, to ensure the badge clearly
marks when this specific security check was added.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 19: The documentation for the
acmpca_certificate_authority_pqc_key_algorithm check is missing a
subsection-level Version Badge indicating when it was introduced in version
5.31.0. Add a VersionBadge component with version="5.31.0" immediately before
the table row containing the acmpca_certificate_authority_pqc_key_algorithm
check, or create a subsection header with the badge following the same pattern
used in other documentation files like prowler-app-lighthouse-multi-llm.mdx, to
ensure the badge clearly marks when this specific security check was added.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9fe7be60-2943-48ef-ace7-944f5dd3b22b

📥 Commits

Reviewing files that changed from the base of the PR and between 9b463d4 and 4abb5af.

📒 Files selected for processing (4)
  • contrib/k8s/helm/prowler-api/values.yaml
  • docs/user-guide/cli/tutorials/configuration_file.mdx
  • prowler/CHANGELOG.md
  • prowler/config/config.yaml
💤 Files with no reviewable changes (1)
  • prowler/config/config.yaml

@HugoPBrito
HugoPBrito merged commit bdd44a0 into master Jun 22, 2026
40 of 42 checks passed
@HugoPBrito
HugoPBrito deleted the feat/acmpca-certificate-authority-pqc-key-algorithm branch June 22, 2026 16:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation metadata-review new-check provider/aws Issues/PRs related with the AWS provider

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants