feat(compliance): add FedRAMP 20x KSI compliance framework #8512

ethanolivertroy · 2025-08-12T13:18:38Z

Context

This PR adds support for FedRAMP 20x Key Security Indicators (KSIs) compliance framework to Prowler. FedRAMP 20x is a modernization initiative aimed at automating the FedRAMP authorization process, focusing on continuous monitoring and cloud-native security principles. The 10 KSIs represent core security areas that cloud service providers must address as part of the FedRAMP 20x Phase One pilot program.

This framework enables organizations pursuing FedRAMP authorization to assess their cloud environments against the FedRAMP 20x requirements using Prowler's existing security checks.

Description

This PR introduces FedRAMP 20x KSI compliance frameworks for AWS, Azure, and GCP providers. The implementation maps Prowler's existing security checks to the 10 Key Security Indicators defined by FedRAMP:

Changes included:

Added 3 new compliance framework JSON files:
- prowler/compliance/aws/fedramp_20x_ksi_aws.json - Maps 96 AWS checks to KSIs
- prowler/compliance/azure/fedramp_20x_ksi_azure.json - Maps 73 Azure checks to KSIs
- prowler/compliance/gcp/fedramp_20x_ksi_gcp.json - Maps 94 GCP checks to KSIs
Added dashboard visualization modules:
- dashboard/compliance/fedramp_20x_ksi_aws.py
- dashboard/compliance/fedramp_20x_ksi_azure.py
- dashboard/compliance/fedramp_20x_ksi_gcp.py
Updated documentation:
- Updated framework counts in docs/tutorials/compliance.md

The 10 KSIs covered:

KSI-CED: Cybersecurity Education
KSI-CMT: Change Management
KSI-CNA: Cloud Native Architecture
KSI-IAM: Identity and Access Management
KSI-INR: Incident Reporting
KSI-MLA: Monitoring, Logging, and Auditing
KSI-PIY: Policy and Inventory
KSI-RPL: Recovery Planning
KSI-SVC: Service Configuration
KSI-TPR: Third-Party Information Resources

Each KSI is mapped to relevant NIST 800-53 controls and existing Prowler checks, following the official FedRAMP 20x documentation structure.

Checklist

Are there new checks included in this PR? No - This PR only adds compliance frameworks that map to existing checks
- If so, do we need to update permissions for the provider? N/A
Review if the code is being covered by tests. (Compliance frameworks follow existing patterns)
Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
Review if backport is needed.
Review if is needed to change the Readme.md
Ensure new entries are added to CHANGELOG.md, if applicable.

API

Verify if API specs need to be regenerated.
Check if version updates are required (e.g., specs, Poetry, etc.).
Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Additional Notes for Reviewers:

Framework structure follows existing Prowler compliance framework patterns
Check mappings are based on official FedRAMP 20x KSI documentation: https://github.com/FedRAMP/docs
Tested locally with GCP provider, achieving expected compliance results
Dashboard modules handle long KSI descriptions appropriately to prevent UI overlap issues

…hecks - Added RESOURCE_CONTROL_POLICY to the list of available organization policy types - Added initial check to verify if RCPs are enabled and attached - Added check for S3 security enforcement via RCPs - Added NIST-aligned checks for encryption, IAM controls, logging/monitoring, and network security

- Created docs/requirements.txt with required MkDocs dependencies - Updated .readthedocs.yaml to use pip for dependency installation - This should fix the ReadTheDocs build failure

…works - Add FedRAMP 20x KSI compliance framework for AWS - Add FedRAMP 20x KSI compliance framework for Azure - Add FedRAMP 20x KSI compliance framework for GCP - Implement all 10 official FedRAMP KSIs based on FedRAMP documentation - Update compliance documentation to include new frameworks - Add comprehensive README for FedRAMP 20x KSI usage The frameworks support FedRAMP 20x Phase One pilot requirements and focus on: - Automation (80%+ automated validation target) - Continuous monitoring - Cloud-native security principles - Zero trust architecture Based on official FedRAMP KSI version 25.05C from: https://github.com/FedRAMP/docs/blob/main/FRMR.KSI.key-security-indicators.json

- Add dashboard modules for AWS, Azure, and GCP FedRAMP 20x KSI display - Fix text overlap issue by shortening long KSI descriptions in dashboard - Enable proper visualization of FedRAMP 20x KSI compliance results

ethanolivertroy · 2025-08-12T13:23:13Z

MrCloudSec · 2025-08-13T07:06:04Z

Thank you for the PR @ethanolivertroy , we will review it soon and get back to you.

MrCloudSec · 2025-08-13T09:22:14Z

@ethanolivertroy can you add the tests for the new checks? You can find the guide here.

…meworks - Add dashboard module tests for AWS, Azure, and GCP KSI visualizations - Add compliance framework JSON validation tests - Fix empty dataframe handling in dashboard modules - Validate all 10 KSI requirements presence and structure - Test NIST control mappings and version consistency - Total: 29 unit tests covering all new functionality Tests cover: - Dashboard visualization functions (get_table) - KSI description shortening logic - Empty data edge cases - Framework JSON structure validation - Requirements completeness checks - Cross-provider consistency Addresses PR prowler-cloud#8512 test requirements

ethanolivertroy · 2025-08-13T16:27:18Z

Tests added @MrCloudSec 👍

MrCloudSec · 2025-08-14T09:28:02Z

Tests added @MrCloudSec 👍

Thanks, please add the corresponding tests for the checks too. Also, add the changelog and run our pre-commit.

…liance

- Added FedRAMP 20x Key Security Indicators compliance frameworks for AWS, Azure, and GCP - Included comprehensive unit tests for all frameworks - Updated CHANGELOG.md with new feature entry - Fixed missing newlines at end of files per pre-commit hooks - Removed RCP (Resource Control Policy) features that belong in separate branch

ethanolivertroy · 2025-08-14T16:18:22Z

Tests added @MrCloudSec 👍

Thanks, please add the corresponding tests for the checks too. Also, add the changelog and run our pre-commit.

All done. Removed the RCP stuff because that from another branch.

This functionality will really help out orgs working toward https://www.fedramp.gov/20x/goals/

Copilot

Pull Request Overview

This PR adds support for FedRAMP 20x Key Security Indicators (KSI) compliance framework to Prowler, enabling organizations pursuing FedRAMP authorization to assess their cloud environments against FedRAMP 20x requirements using existing security checks.

Introduces 3 new compliance framework JSON files mapping existing Prowler checks to 10 KSI requirements across AWS, Azure, and GCP
Adds dashboard visualization modules for each provider to handle long KSI descriptions
Updates documentation with new framework counts and changelog entry

Reviewed Changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`prowler/compliance/aws/fedramp_20x_ksi_aws.json`	Maps 96 AWS checks to FedRAMP 20x KSI requirements
`prowler/compliance/azure/fedramp_20x_ksi_azure.json`	Maps 73 Azure checks to FedRAMP 20x KSI requirements
`prowler/compliance/gcp/fedramp_20x_ksi_gcp.json`	Maps 94 GCP checks to FedRAMP 20x KSI requirements
`dashboard/compliance/fedramp_20x_ksi_*.py`	Dashboard modules that shorten long KSI descriptions for UI display
`tests/lib/compliance/test_fedramp_20x_ksi_frameworks.py`	Framework validation tests
`tests/dashboard/compliance/test_fedramp_20x_ksi_*.py`	Dashboard module tests
`docs/tutorials/compliance.md`	Updated framework counts
`prowler/CHANGELOG.md`	Added changelog entry

Comments suppressed due to low confidence (2)

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

dashboard/compliance/fedramp_20x_ksi_gcp.py

tests/dashboard/compliance/test_fedramp_20x_ksi_gcp.py

tests/dashboard/compliance/test_fedramp_20x_ksi_azure.py

tests/dashboard/compliance/test_fedramp_20x_ksi_aws.py

tests/dashboard/compliance/test_fedramp_20x_ksi_gcp.py

codecov · 2025-08-15T13:28:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.19%. Comparing base (dfdd45e) to head (c8d2e2d).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8512      +/-   ##
==========================================
- Coverage   75.81%   75.19%   -0.63%     
==========================================
  Files          98       72      -26     
  Lines        5616     4725     -891     
==========================================
- Hits         4258     3553     -705     
+ Misses       1358     1172     -186

Flag	Coverage Δ
prowler	`75.19% <ø> (-0.63%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	`75.19% <ø> (-0.63%)`	⬇️
api	`∅ <ø> (∅)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Fixed incorrect KSI identifier codes in dashboard test files to align with official FedRAMP 20x KSI schema and our compliance framework files: - Changed ksi-mon to ksi-mla (Monitoring, Logging, and Auditing) - Changed ksi-pol to ksi-piy (Policy and Inventory) - Changed ksi-rec to ksi-rpl (Recovery Planning) This resolves the issues identified by GitHub Copilot in PR prowler-cloud#8512.

- Fixed ksi-inc to ksi-inr in Azure test file - Removed hardcoded string slice in dashboard modules for accurate matching - Aligns with official FedRAMP 20x KSI schema Addresses all issues from GitHub Copilot review in PR prowler-cloud#8512

ethanolivertroy · 2025-08-18T07:08:33Z

Made some changes in the tests and checks to address the correct KSI control names in https://github.com/FedRAMP/docs/blob/main/FRMR.KSI.key-security-indicators.json

pedrooot

Thanks for this, please review my comments and remember to add the needed changes in __main__.py in order to generate the output for the new compliance frameworks that you're adding. See how it's done here: https://github.com/prowler-cloud/prowler/blob/bb07cf9147cde9b911273dc1b5518d28f677a992/prowler/__main__.py#L436C13-L448C47

pedrooot · 2025-08-18T10:25:25Z

prowler/compliance/aws/fedramp_20x_ksi_aws.json

+        {
+          "ItemId": "ksi-ced",
+          "Section": "Cybersecurity Education",
+          "NistControls": "at-2, at-2.2, at-2.3, at-4",


Where does this attribute comes from? NistControls

If you need to add this attribute for this new compliance framework, you have to add a new model and class inside: https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/outputs/

Maybe you can add the needed changes to match the generic one: https://github.com/prowler-cloud/prowler/blob/master/prowler/lib/outputs/compliance/generic/generic.py

ethanolivertroy and others added 7 commits March 12, 2025 18:43

fix: update ReadTheDocs configuration to use pip instead of Poetry

c23df45

- Created docs/requirements.txt with required MkDocs dependencies - Updated .readthedocs.yaml to use pip for dependency installation - This should fix the ReadTheDocs build failure

Merge branch 'prowler-cloud:master' into master

ff53a7d

Merge branch 'prowler-cloud:master' into master

ae54280

Merge branch 'prowler-cloud:master' into master

1993294

feat: Add dashboard compliance modules for FedRAMP 20x KSI frameworks

f9a6203

- Add dashboard modules for AWS, Azure, and GCP FedRAMP 20x KSI display - Fix text overlap issue by shortening long KSI descriptions in dashboard - Enable proper visualization of FedRAMP 20x KSI compliance results

Copilot AI review requested due to automatic review settings August 12, 2025 13:18

ethanolivertroy requested review from a team as code owners August 12, 2025 13:18

github-actions bot added documentation provider/aws Issues/PRs related with the AWS provider compliance Issues/PRs related with the Compliance Frameworks labels Aug 12, 2025

This comment was marked as outdated.

Sign in to view

Remove FEDRAMP_20X_KSI_README.md - not needed for main repo

68f8f39

MrCloudSec changed the title ~~Feature/fedramp 20x ksi compliance~~ feat(compliance): add FedRAMP 20x KSI compliance framework Aug 13, 2025

MrCloudSec self-assigned this Aug 13, 2025

ethanolivertroy and others added 2 commits August 14, 2025 08:09

Merge branch 'prowler-cloud:master' into feature/fedramp-20x-ksi-comp…

60f7aba

…liance

chore: revision

b07d179

MrCloudSec requested a review from Copilot August 15, 2025 13:25

Copilot AI reviewed Aug 15, 2025

View reviewed changes

ethanolivertroy added 2 commits August 18, 2025 02:17

pedrooot requested changes Aug 18, 2025

View reviewed changes

feat(compliance): add FedRAMP 20x KSI compliance framework #8512

Are you sure you want to change the base?

feat(compliance): add FedRAMP 20x KSI compliance framework #8512

Uh oh!

Conversation

ethanolivertroy commented Aug 12, 2025

Context

Description

Checklist

API

License

Uh oh!

This comment was marked as outdated.

Uh oh!

ethanolivertroy commented Aug 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MrCloudSec commented Aug 13, 2025

Uh oh!

MrCloudSec commented Aug 13, 2025

Uh oh!

ethanolivertroy commented Aug 13, 2025

Uh oh!

MrCloudSec commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ethanolivertroy commented Aug 14, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ethanolivertroy commented Aug 18, 2025

Uh oh!

pedrooot left a comment

Choose a reason for hiding this comment

Uh oh!

pedrooot Aug 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ethanolivertroy commented Aug 12, 2025 •

edited

Loading

MrCloudSec commented Aug 14, 2025 •

edited

Loading

codecov bot commented Aug 15, 2025 •

edited

Loading