prowler-sdk-check

检查结构

prowler/providers/{provider}/services/{service}/{check_name}/
├── __init__.py
├── {check_name}.py
└── {check_name}.metadata.json

---

分步创建流程

1. 前提条件

• 确认检查尚不存在：搜索 prowler/providers/{provider}/services/{service}/
• 确保提供程序和服务已存在——如果不存在，请先创建
• 确认服务包含所需方法——可能需要添加或修改服务方法以获取数据

2. 创建检查文件

mkdir -p prowler/providers/{provider}/services/{service}/{check_name}
touch prowler/providers/{provider}/services/{service}/{check_name}/__init__.py
touch prowler/providers/{provider}/services/{service}/{check_name}/{check_name}.py
touch prowler/providers/{provider}/services/{service}/{check_name}/{check_name}.metadata.json

3. 实现检查逻辑

from prowler.lib.check.models import Check, Check_Report_{Provider}
from prowler.providers.{provider}.services.{service}.{service}_client import {service}_client

class {check_name}(Check):
    """Ensure that {resource} meets {security_requirement}."""
    def execute(self) -> list[Check_Report_{Provider}]:
        """Execute the check logic.

        Returns:
            A list of reports containing the result of the check.
        """
        findings = []
        for resource in {service}_client.{resources}:
            report = Check_Report_{Provider}(metadata=self.metadata(), resource=resource)
            report.status = "PASS" if resource.is_compliant else "FAIL"
            report.status_extended = f"Resource {resource.name} compliance status."
            findings.append(report)
        return findings

4. 创建元数据文件

请参阅下方的完整架构和 assets/ 文件夹中的完整模板。 字段的详细文档请参阅 references/metadata-docs.md。

5. 验证检查检测结果

uv run python prowler-cli.py {provider} --list-checks | grep {check_name}

6. 在本地运行检查

uv run python prowler-cli.py {provider} --log-level ERROR --verbose --check {check_name}

7. 创建测试

有关测试模式（PASS、FAIL、无资源、错误处理），请参阅 prowler-test-sdk 技能。

---

检查命名约定

{service}_{resource}_{security_control}

示例：

• ec2_instance_public_ip_disabled
• s3_bucket_encryption_enabled
• iam_user_mfa_enabled

---

元数据架构（完整）

{
  "Provider": "aws",
  "CheckID": "{check_name}",
  "CheckTitle": "Human-readable title",
  "CheckType": [
    "Software and Configuration Checks/AWS Security Best Practices",
    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
  ],
  "ServiceName": "{service}",
  "SubServiceName": "",
  "ResourceIdTemplate": "",
  "Severity": "low|medium|high|critical",
  "ResourceType": "AwsEc2Instance|Other",
  "ResourceGroup": "security|compute|storage|network",
  "Description": "**Bold resource name**. Detailed explanation of what this check evaluates and why it matters.",
  "Risk": "What happens if non-compliant. Explain attack vectors, data exposure risks, compliance impact.",
  "RelatedUrl": "",
  "AdditionalURLs": [
    "https://docs.aws.amazon.com/..."
  ],
  "Remediation": {
    "Code": {
      "CLI": "aws {service} {command} --option value",
      "NativeIaC": "```yaml\nResources:\n  Resource:\n    Type: AWS::{Service}::{Resource}\n    Properties:\n      Key: value  # This line fixes the issue\n```",
      "Other": "1. Console steps\n2. Step by step",
      "Terraform": "```hcl\nresource \"aws_{service}_{resource}\" \"example\" {\n  key = \"value\"  # This line fixes the issue\n}\n```"
    },
    "Recommendation": {
      "Text": "Detailed recommendation for remediation.",
      "Url": "https://hub.prowler.com/check/{check_name}"
    }
  },
  "Categories": [
    "identity-access",
    "encryption",
    "logging",
    "forensics-ready",
    "internet-exposed",
    "trust-boundaries"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}

必填字段

字段	描述
Provider	提供程序名称：aws、azure、gcp、kubernetes、github、m365
CheckID	必须与类名和文件夹名一致
CheckTitle	易于理解的标题
Severity	low、medium、high、critical
ServiceName	被检查的服务
Description	此检查评估的内容
Risk	不合规造成的安全影响
Remediation.Code.CLI	CLI 修复命令
Remediation.Recommendation.Text	修复方法

严重性指南

严重性	使用场景
critical	直接暴露数据、RCE、权限提升
high	重大安全风险、违反合规要求
medium	深度防御、最佳实践
low	信息提示、轻微强化

---

检查报告状态

状态	使用场景
PASS	资源符合要求
FAIL	资源不符合要求
MANUAL	需要人工验证，或无法获取评估该资源所需的数据

权限／可用性错误不是发现项

如果 API 调用失败（缺少权限或作用域、API 未启用、功能未获许可、数据不可用），切勿设置 FAIL。这是扫描配置问题，而非安全问题；将其报告为发现项会产生误导性的高严重性结果。

• 服务：记录错误，并将其与空结果明确区分（使用 None 而非 []、*_error 属性或 *_lookup_failed 集合）。仅对真正的访问错误采用这种处理方式；404／未找到通常表示“未配置”，属于有效的 FAIL；如果 API 是否启用本身就是被审计的控制项（例如 GCP Access Approval），那么已明确禁用的 API 也属于有效的 FAIL。
• 检查：生成一条租户／账户／项目／订阅级别的 MANUAL 发现项（而不是每个资源各生成一条），并在其 status_extended 中说明无法评估此检查，同时指出所需的权限、API 或许可证。
• 不要修改 report.check_metadata.Severity 来隐藏问题。

if <service>_client.<data> is None:
    report = CheckReport<Provider>(metadata=self.metadata(), resource={})
    report.resource_name = "<Tenant-level resource>"
    report.resource_id = "<stable-id>"
    report.status = "MANUAL"
    report.status_extended = "Cannot evaluate <requirement>: <data> could not be retrieved. Verify that <permission> is granted to the scanning identity."
    return [report]

---

常见模式

包含区域资源的 AWS 检查

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client

class s3_bucket_encryption_enabled(Check):
    def execute(self) -> list[Check_Report_AWS]:
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            if bucket.encryption:
                report.status = "PASS"
                report.status_extended = f"S3 bucket {bucket.name} has encryption enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"S3 bucket {bucket.name} does not have encryption enabled."
            findings.append(report)
        return findings

包含多个条件的检查

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client

class ec2_instance_hardened(Check):
    def execute(self) -> list[Check_Report_AWS]:
        findings = []
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)

            issues = []
            if instance.public_ip:
                issues.append("has public IP")
            if not instance.metadata_options.http_tokens == "required":
                issues.append("IMDSv2 not enforced")

            if issues:
                report.status = "FAIL"
                report.status_extended = f"Instance {instance.id} {', '.join(issues)}."
            else:
                report.status = "PASS"
                report.status_extended = f"Instance {instance.id} is properly hardened."

            findings.append(report)
        return findings

---

命令

# Verify detection
uv run python prowler-cli.py {provider} --list-checks | grep {check_name}

# Run check
uv run python prowler-cli.py {provider} --log-level ERROR --verbose --check {check_name}

# Run with specific profile/credentials
uv run python prowler-cli.py aws --profile myprofile --check {check_name}

# Run multiple checks
uv run python prowler-cli.py {provider} --check {check1} {check2} {check3}

资源

• 模板：完整的检查和元数据模板（AWS、Azure、GCP）请参阅 assets/
• 文档：Prowler Developer Guide 官方链接请参阅 references/metadata-docs.md