prowler icon indicating copy to clipboard operation
prowler copied to clipboard

fix(apigateway): retrieve correct `logingLevel` status

Open bota4go opened this issue 1 month ago • 4 comments

Context

If AWS API Gateway logs were previously enabled and the logging level was set in the stage properties, but then later changed to logging_level = "OFF", Prowler will not detect this in the current logic. This is because it only checks for the presence of the logging property, not its actual value. Therefore, Prowler needs an additional validation to ensure that logging is truly enabled.

Description

This PR adds a single additional condition to the existing if logic.

Steps to review

Review the changes in the modified logic.

Checklist

Are there new checks included in this PR? No

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

bota4go avatar Nov 25 '25 01:11 bota4go

Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

github-actions[bot] avatar Nov 25 '25 01:11 github-actions[bot]

Hi @bota4go,

Thanks for this contribution! Feel free to solve the comments. In case you don't want to I'll handle it myself as soon as possible.

HugoPBrito avatar Nov 25 '25 10:11 HugoPBrito

Codecov Report

:white_check_mark: All modified and coverable lines are covered by tests. :white_check_mark: Project coverage is 3.06%. Comparing base (0e9ba4b) to head (75f7026). :warning: Report is 6 commits behind head on master.

:exclamation: There is a different number of reports uploaded between BASE (0e9ba4b) and HEAD (75f7026). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (0e9ba4b) HEAD (75f7026)
api 1 0
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #9304       +/-   ##
==========================================
- Coverage   92.39%   3.06%   -89.34%     
==========================================
  Files         157     830      +673     
  Lines       22290   23443     +1153     
==========================================
- Hits        20595     718    -19877     
- Misses       1695   22725    +21030     
Flag Coverage Δ
api ?
prowler-py3.10-aws 3.06% <100.00%> (?)
prowler-py3.11-aws 3.06% <100.00%> (?)
prowler-py3.12-aws 3.06% <100.00%> (?)
prowler-py3.9-aws 3.06% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Δ
prowler 3.06% <100.00%> (∅)
api ∅ <ø> (∅)
:rocket: New features to boost your workflow:
  • :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codecov[bot] avatar Nov 25 '25 11:11 codecov[bot]

Hi @bota4go,

Thanks for this contribution! Feel free to solve the comments. In case you don't want to I'll handle it myself as soon as possible.

Hey, mate.

  1. Changelog added. Pls have a look.

  2. Do You have any case testing examples handy? I can provide screenshots for API gateway stage with loggingLevel turned off and Prowler active alert on that, but I am not sure if it is a right way?

bota4go avatar Nov 26 '25 08:11 bota4go

Hi @bota4go,

Sorry for the big delay on the reply. Yes, the screenshots you're referring to should be enough. In addition to that, we can verify it trough boto3: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/apigateway/client/get_stages.html

Since I didn't reply to you quickly, the changelog is now outdated. I'll update it for you to merge this right away.

Sorry again for the late response.

HugoPBrito avatar Dec 12 '25 12:12 HugoPBrito

Thank you very much @bota4go for your contribution! 🚀 ❤️

HugoPBrito avatar Dec 12 '25 12:12 HugoPBrito

💚 All backports created successfully

Status Branch Result
v5.15

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

prowler-bot avatar Dec 12 '25 12:12 prowler-bot