-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(aws): remove cloudwatch_log_group_no_critical_pii_in_logs
check
#5736
fix(aws): remove cloudwatch_log_group_no_critical_pii_in_logs
check
#5736
Conversation
You can check the documentation for this PR here -> Prowler Documentation |
cloudwatch_log_group_no_critical_pii_in_logs
check
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We are removing the check cloudwatch_log_group_no_critical_pii_in_logs
for the following reasons:
- It uses the
presidio-analyzer
library which by default loads during runtime the NLP module and other PII recognizers from external sources not defined in the Prowler dependencies. That's something we could not do as a security product taking also into account that Prowler can run in environments with little to zero access to the Internet. - Those dependencies cannot be installed via
poetry
since they are not available inPyPI
and would require adding more steps to our installation procedure to get them. - The NLP module installed,
en-core-web-lg
is a large vector table with ~500k entries with a size of 400MiB. This is a huge package to be donwloaded during runtime. - The installation procedure of the above dependencies adds several lines to our terminal UI with the download process and some logs.
presidio-analyzer
requires a ton of new libraries that we need to review first.
We will work to reintroduce the cloudwatch_log_group_no_critical_pii_in_logs
in a way that all dependencies are explicitly defined, required and verified.
You can check the documentation for this PR here -> Prowler Documentation |
You can check the documentation for this PR here -> Prowler Documentation |
You can check the documentation for this PR here -> Prowler Documentation |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #5736 +/- ##
==========================================
+ Coverage 89.88% 89.91% +0.03%
==========================================
Files 1128 1127 -1
Lines 35182 35123 -59
==========================================
- Hits 31622 31580 -42
+ Misses 3560 3543 -17 ☔ View full report in Codecov by Sentry. |
Description
Remove check
cloudwatch_log_group_no_critical_pii_in_logs
sincepresidio-analyzer
is downloading a package during Prowler execution.Checklist
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.