Skip to content

feat(config): add compliance guardrails for the SDK config #11667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pedrooot wants to merge 9 commits into from
Closed

feat(config): add compliance guardrails for the SDK config #11667

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
1a450aa
feat(config): add SDK config's validator
jfagoagas May 13, 2026
ed17dc4
feat(sdk): scan configuration schema and validation for Prowler Cloud
pedrooot Jun 9, 2026
88926cc
chore(changelog): update with latest changes
pedrooot Jun 9, 2026
510da01
chore(merge): master
pedrooot Jun 9, 2026
1673bdf
chore(revision): solve comments
pedrooot Jun 18, 2026
ff7ec1f
chore(revision): solve comments
pedrooot Jun 18, 2026
edcffca
feat(config): add compliance guardrails for the SDK config
pedrooot Jun 23, 2026
8050797
chore: merge master
pedrooot Jun 23, 2026
7f24936
chore(changelog): update with latest changes
pedrooot Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions prowler/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
- `acmpca_certificate_authority_pqc_key_algorithm` check and new `acmpca` service for AWS provider to verify AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm [(#11318)](https://github.com/prowler-cloud/prowler/pull/11318)
- `rolesanywhere_trust_anchor_pqc_pki` check and new `rolesanywhere` service for AWS provider to verify IAM Roles Anywhere trust anchors are backed by a post-quantum (ML-DSA) PKI [(#11319)](https://github.com/prowler-cloud/prowler/pull/11319)
- Kubernetes core checks for container CPU limits, CPU requests, memory limits, memory requests, fixed image tags, liveness probes, and readiness probes [(#11373)](https://github.com/prowler-cloud/prowler/pull/11373)
- Per-requirement configuration validation for compliance frameworks via `ConfigRequirements`, so a requirement is reported as FAIL when its configurable checks ran with a configuration too loose to satisfy it (applied across all compliance outputs: CSV, OCSF, and console tables) [(#11667)](https://github.com/prowler-cloud/prowler/pull/11667)

### 🔄 Changed

Expand Down
24 changes: 24 additions & 0 deletions prowler/compliance/alibabacloud/cis_2.0_alibabacloud.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,14 @@
],
"Checks": [
"ram_user_console_access_unused"
],
"ConfigRequirements": [
{
"Check": "ram_user_console_access_unused",
"ConfigKey": "max_console_access_days",
"Operator": "lte",
"Value": 90
}
]
},
{
Expand Down Expand Up @@ -841,6 +849,14 @@
],
"Checks": [
"sls_logstore_retention_period"
],
"ConfigRequirements": [
{
"Check": "sls_logstore_retention_period",
"ConfigKey": "min_log_retention_days",
"Operator": "gte",
"Value": 365
}
]
},
{
Expand Down Expand Up @@ -1353,6 +1369,14 @@
],
"Checks": [
"rds_instance_sql_audit_retention"
],
"ConfigRequirements": [
{
"Check": "rds_instance_sql_audit_retention",
"ConfigKey": "min_rds_audit_retention_days",
"Operator": "gte",
"Value": 180
}
]
},
{
Expand Down
16 changes: 16 additions & 0 deletions prowler/compliance/alibabacloud/prowler_threatscore_alibabacloud.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,14 @@
"Checks": [
"ram_user_console_access_unused"
],
"ConfigRequirements": [
{
"Check": "ram_user_console_access_unused",
"ConfigKey": "max_console_access_days",
"Operator": "lte",
"Value": 90
}
],
"Attributes": [
{
"Title": "Inactive users disabled for console access",
Expand Down Expand Up @@ -695,6 +703,14 @@
"Checks": [
"rds_instance_sql_audit_retention"
],
"ConfigRequirements": [
{
"Check": "rds_instance_sql_audit_retention",
"ConfigKey": "min_rds_audit_retention_days",
"Operator": "gte",
"Value": 180
}
],
"Attributes": [
{
"Title": "RDS SQL audit retention configured",
Expand Down
24 changes: 24 additions & 0 deletions prowler/compliance/aws/asd_essential_eight_aws.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,14 @@
"config_recorder_all_regions_enabled",
"inspector2_is_enabled"
],
"ConfigRequirements": [
{
"Check": "config_recorder_all_regions_enabled",
"ConfigKey": "mute_non_default_regions",
"Operator": "eq",
"Value": false
}
],
"Attributes": [
{
"Section": "1 Patch applications",
Expand Down Expand Up @@ -260,6 +268,14 @@
"config_recorder_all_regions_enabled",
"inspector2_is_enabled"
],
"ConfigRequirements": [
{
"Check": "config_recorder_all_regions_enabled",
"ConfigKey": "mute_non_default_regions",
"Operator": "eq",
"Value": false
}
],
"Attributes": [
{
"Section": "2 Patch operating systems",
Expand Down Expand Up @@ -742,6 +758,14 @@
"accessanalyzer_enabled",
"accessanalyzer_enabled_without_findings"
],
"ConfigRequirements": [
{
"Check": "accessanalyzer_enabled",
"ConfigKey": "mute_non_default_regions",
"Operator": "eq",
"Value": false
}
],
"Attributes": [
{
"Section": "4 Restrict administrative privileges",
Expand Down
Loading
Loading