prowler/tests/providers/gcp/services/accesscontextmanager/accesscontextmanager_service_test.py at 021f9dd2a381fffa07e59cc42d1c5a5a570e3c84 · prowler-cloud/prowler · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
from unittest.mock import MagicMock, patch

from tests.providers.gcp.gcp_fixtures import (
    GCP_PROJECT_ID,
    mock_api_client,
    mock_is_api_active,
    set_mocked_gcp_provider,
)


class TestAccessContextManagerService:
    def test_service(self):
        # Mock cloudresourcemanager_client before importing accesscontextmanager
        mock_crm_client = MagicMock()
        mock_crm_client.organizations = [
            MagicMock(id="123456789", name="Organization 1"),
        ]

        with (
            patch(
                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
                new=mock_is_api_active,
            ),
            patch(
                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
                new=mock_api_client,
            ),
            patch(
                "prowler.providers.common.provider.Provider.get_global_provider",
                return_value=set_mocked_gcp_provider(),
            ),
            patch(
                "prowler.providers.gcp.services.accesscontextmanager.accesscontextmanager_service.cloudresourcemanager_client",
                new=mock_crm_client,
            ),
        ):
            from prowler.providers.gcp.services.accesscontextmanager.accesscontextmanager_service import (
                AccessContextManager,
            )

            accesscontextmanager_client = AccessContextManager(
                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
            )
            assert accesscontextmanager_client.service == "accesscontextmanager"
            assert accesscontextmanager_client.project_ids == [GCP_PROJECT_ID]

            # Should have 2 service perimeters from the first access policy
            assert len(accesscontextmanager_client.service_perimeters) == 2

            # First service perimeter
            assert (
                accesscontextmanager_client.service_perimeters[0].name
                == "accessPolicies/123456/servicePerimeters/perimeter1"
            )
            assert (
                accesscontextmanager_client.service_perimeters[0].title
                == "Test Perimeter 1"
            )
            assert (
                accesscontextmanager_client.service_perimeters[0].perimeter_type
                == "PERIMETER_TYPE_REGULAR"
            )
            assert accesscontextmanager_client.service_perimeters[0].resources == [
                f"projects/{GCP_PROJECT_ID}"
            ]
            assert accesscontextmanager_client.service_perimeters[
                0
            ].restricted_services == [
                "storage.googleapis.com",
                "bigquery.googleapis.com",
            ]
            assert (
                accesscontextmanager_client.service_perimeters[0].policy_name
                == "accessPolicies/123456"
            )

            # Second service perimeter
            assert (
                accesscontextmanager_client.service_perimeters[1].name
                == "accessPolicies/123456/servicePerimeters/perimeter2"
            )
            assert (
                accesscontextmanager_client.service_perimeters[1].title
                == "Test Perimeter 2"
            )
            assert (
                accesscontextmanager_client.service_perimeters[1].perimeter_type
                == "PERIMETER_TYPE_BRIDGE"
            )
            assert accesscontextmanager_client.service_perimeters[1].resources == []
            assert accesscontextmanager_client.service_perimeters[
                1
            ].restricted_services == [
                "compute.googleapis.com",
            ]
            assert (
                accesscontextmanager_client.service_perimeters[1].policy_name
                == "accessPolicies/123456"
            )