Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
checker = SecurityGroupsChecker(account=account,
restricted_ports=config.sg.restricted_ports)
if checker.check(ids=ids):
for sg in checker.groups:
processed = sg.restrict(RestrictionStatus.OpenCompletely)
if processed == 0:
result = "skipped"
elif processed is None:
result = "failed"
else:
result = "remediated"
response[security_feature][sg.id] = result
return response
else:
return server_error(text="Failed to check insecure services")
}
checker = S3BucketsAclChecker(account=account)
if checker.check(buckets=ids):
for bucket in checker.buckets:
if not bucket.public_by_acl:
result = "skipped"
else:
if bucket.restrict_acl():
result = "remediated"
else:
result = "failed"
response[security_feature][bucket.name] = result
return response
else:
return server_error(text="Failed to check S3 ACL")
result.append({
'id': volume.id,
'name': volume.name,
'state': volume.state,
})
response = {
security_feature: result,
'checked_volumes': volumes,
}
if ids:
response.setdefault("filterby", {})["ids"] = ids
if tags:
response.setdefault("filterby", {})["tags"] = tags
return response
else:
return server_error(text="Failed to check EBS unencrypted volumes")
continue
buckets.append(f"{bucket.name}")
if bucket.public:
result.append({
'name': bucket.name,
'public_acls': bucket.get_public_acls(),
})
response = {
security_feature: result,
'checked_buckets': buckets,
}
if ids:
response.setdefault("filterby", {})["ids"] = ids
return response
else:
return server_error(text="Failed to check S3 public acls")
}
checker = S3EncryptionChecker(account=account)
if checker.check(buckets=ids):
for bucket in checker.buckets:
if bucket.encrypted:
result = "skipped"
else:
if bucket.encrypt_bucket():
result = "remediated"
else:
result = "failed"
response[security_feature][bucket.name] = result
return response
else:
return server_error(text="Failed to check S3 encryption")
def identify(security_feature, account, config, ids, tags):
checker = RdsEncryptionChecker(account=account)
result = []
if checker.check():
for instance in checker.instances:
result.append({
'name': instance.name,
'id': instance.id,
'engine': instance.engine,
})
response = {
security_feature: result
}
return response
else:
return server_error(text="Failed to check RDS instance un-encryption")
if checker.check(ids=ids, tags=tags):
snapshots = []
for snapshot in checker.snapshots:
snapshots.append(f"{snapshot.id}")
if snapshot.public:
result.append({
'id': snapshot.id,
'volume_id': snapshot.volume_id,
})
response = {
security_feature: result,
'checked_snapshots': snapshots,
}
return response
else:
return server_error(text="Failed to check EBS public snapshots")
'id': sg.id,
'name': sg.name,
'status': sg.status.value,
'permissions': permissions,
})
response = {
security_feature: result,
'checked_groups': groups,
}
if ids:
response.setdefault("filterby", {})["ids"] = ids
if tags:
response.setdefault("filterby", {})["tags"] = tags
return response
else:
return server_error(text="Failed to check insecure services")
def identify(security_feature, account, config, ids, tags):
checker = RdsSnapshotsChecker(account=account)
result = []
if checker.check():
for snapshot in checker.snapshots:
result.append({
'name': snapshot.name,
'db': snapshot.db,
'engine': snapshot.engine,
})
response = {
security_feature: result
}
return response
else:
return server_error(text="Failed to check RDS public snapshots")
continue
buckets.append(f"{bucket.name}")
if bucket.public:
result.append({
'name': bucket.name,
'policy': bucket.policy,
})
response = {
security_feature: result,
'checked_buckets': buckets,
}
if ids:
response.setdefault("filterby", {})["ids"] = ids
return response
else:
return server_error(text="Failed to check S3 public policies")