feat(iac): add IaC to Prowler App #8751

andoniaf · 2025-09-24T07:40:36Z

Context

Adapt the Infrastructure as Code (IaC) provider to be fully integrated with the Prowler App, enabling users to scan remote repositories for IaC security issues through the web application.

Description

Implements full IaC provider support across the Prowler App:

SDK/Prowler Changes:

Fix findings format to pass API validations
Add special handling in scan.py to pass API validations
- As we use an external tool, we do not have services or checks.
Added TYPE_CHECKING imports to resolve flake8 linting issues
Improved progress bar handling to detect TTY environments (fixes Celery worker compatibility)
Added test_connection() static method to IaC provider for repository connectivity validation

API Changes:

Added IaC to Provider.ProviderChoices with database migration (0050_iac_provider.py)
Implemented validate_iac_uid() for repository URL validation
Created IaCProviderSecret serializer with repository_url and access_token fields
Extended provider utilities to support IacProvider initialization and connection testing
Updated OpenAPI spec (v1.yaml) with IaC provider schemas
Added test coverage for IaC provider in API tests

UI Changes:

Created IacProviderBadge component with IaC icon
Implemented IacCredentialsForm for repository URL and optional access token input
Integrated IaC provider into:
- Provider selector and radio group components
- Provider filters and overview components
- Credential builder and validation logic
Added IaC-specific external documentation URLs

Infrastructure:

Updated API Dockerfile to install Trivy binary (required for IaC scanning)
Added Trivy installation from GitHub releases

Steps to review

Migration: Review api/migrations/0050_iac_provider.py - verify IaC enum added correctly after migration 0049
SDK Provider: Check prowler/providers/iac/iac_provider.py:480-573 - verify test_connection() implementation with OAuth/PAT support
SDK Progress Bars: Check prowler/providers/iac/iac_provider.py:250,327 - verify sys.stdout.isatty() checks for Celery compatibility
API Models: Check api/models.py:validate_iac_uid() - verify repository URL validation logic
API Serializers: Review api/serializers.py:IaCProviderSecret - verify repository_url and access_token fields
API Utils: Check api/utils.py:97-137 - verify IaC provider initialization and connection test handling
UI Forms: Review ui/components/providers/workflow/forms/via-credentials/iac-credentials-form.tsx - verify form fields and validation
UI Integration: Check IaC provider integration in enhanced-provider-selector.tsx, custom-provider-inputs.tsx, and radio-group-provider.tsx
Docker: Review api/Dockerfile:19-37 - verify Trivy installation process
OpenAPI Spec: Review regenerated api/specs/v1.yaml - verify IaC in provider type enums and schemas
Test: Create/update/delete IaC provider via API, test repository URL validation, test connection with public/private repos

Checklist

Are there new checks included in this PR? Yes / No
- If so, do we need to update permissions for the provider? Please review this carefully.
Review if the code is being covered by tests.
Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
Review if backport is needed.
Review if is needed to change the Readme.md
Ensure new entries are added to CHANGELOG.md, if applicable.

API

Verify if API specs need to be regenerated.
Check if version updates are required (e.g., specs, Poetry, etc.).
Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

github-actions · 2025-10-22T08:39:16Z

✅ All necessary CHANGELOG.md files have been updated.

codecov · 2025-10-22T09:08:30Z

Codecov Report

❌ Patch coverage is 36.52695% with 106 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.20%. Comparing base (4a364d9) to head (3b4a2c3).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8751      +/-   ##
==========================================
- Coverage   92.55%   88.20%   -4.36%     
==========================================
  Files         118      231     +113     
  Lines        2822    24598   +21776     
==========================================
+ Hits         2612    21696   +19084     
- Misses        210     2902    +2692

Flag	Coverage Δ
api	`94.24% <70.00%> (?)`
prowler-py3.10-gcp	`?`
prowler-py3.10-iac	`55.03% <25.27%> (?)`
prowler-py3.10-lib	`69.31% <29.19%> (?)`
prowler-py3.11-gcp	`?`
prowler-py3.11-iac	`55.03% <25.27%> (?)`
prowler-py3.11-lib	`69.31% <29.19%> (?)`
prowler-py3.12-gcp	`?`
prowler-py3.12-iac	`55.03% <25.27%> (?)`
prowler-py3.12-lib	`69.31% <29.19%> (?)`
prowler-py3.9-gcp	`?`
prowler-py3.9-iac	`55.03% <25.27%> (?)`
prowler-py3.9-lib	`69.31% <29.19%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	`69.31% <29.19%> (-23.25%)`	⬇️
api	`94.24% <78.60%> (∅)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2025-10-22T09:09:45Z

🔒 Container Security Scan

Image: prowler-api:e66b563
Last scan: 2025-10-31 13:03:48 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	4
Total	4

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

Review the detailed scan results
Update affected packages to patched versions
Consider using a different base image if updates are unavailable

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

github-actions · 2025-10-23T08:31:36Z

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

prowler/lib/scan/scan.py

api/CHANGELOG.md

api/Dockerfile

prowler/lib/scan/scan.py

github-actions · 2025-10-29T11:07:47Z

🔒 Container Security Scan

Image: prowler-ui:e66b563
Last scan: 2025-10-31 13:05:37 UTC

✅ No Vulnerabilities Detected

The container image passed all security checks. No known CVEs were found.

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

github-actions · 2025-10-29T11:17:38Z

🔒 Container Security Scan

Image: prowler:e66b563
Last scan: 2025-10-31 13:08:11 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	2
Total	2

2 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

Review the detailed scan results
Update affected packages to patched versions
Consider using a different base image if updates are unavailable

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

pedrooot · 2025-10-31T11:52:18Z

prowler/providers/iac/iac_provider.py

+                        return Connection(
+                            is_connected=False,
+                            error="Authentication failed. Please check your access token.",
+                        )
+                    elif "404" in error_msg or "not found" in error_msg.lower():
+                        return Connection(
+                            is_connected=False,
+                            error="Repository not found or not accessible.",
+                        )
+                    else:
+                        return Connection(
+                            is_connected=False,
+                            error=f"Failed to connect to repository: {error_msg}",
+                        )


non-blocking: For future improvements we should add specific exceptions for the IAC provider, as it is done for the others. I'll create a ticket to address this 🚀

alejandrobailo

Nice work!

andoniaf added 12 commits September 12, 2025 10:36

wip

ae22001

wip: do not use progress bar in Celery workers

5c2b867

wip

ff22d19

wip: add IaC to API

dbff605

wip: fix IaC scan mapping

27f5c95

wip: add IaC to UI

75390c0

wip: set defaults

06cf9ed

chore: update trivy

f76847d

chore: update comments

d09adb3

remove: commit local dev changes, revert after sending PR

d47ff10

refactor: scan IaC skip validations

a5fe98b

chore: update with new branch

861f969

github-actions bot added component/ui component/api review-django-migrations This PR contains changes in Django migrations provider/iac Issues/PRs related with the IaC provider labels Sep 24, 2025

Merge branch 'master' into DEVREL-91-add-ia-c-to-the-app

23a77b7

andoniaf added 3 commits October 22, 2025 10:44

fix: rename iac provider migration

4ce625a

fix: solve linter issues

6349f20

chore: update CHANGELOG

5a13701

chore: move load compliance frameworks into conditional

2a87120

andoniaf force-pushed the DEVREL-91-add-ia-c-to-the-app branch from 109179c to 2a87120 Compare October 23, 2025 08:49

andoniaf marked this pull request as ready for review October 23, 2025 08:53

andoniaf requested review from a team as code owners October 23, 2025 08:53

andoniaf added 4 commits October 27, 2025 10:46

fix(iac): remove duplicate repository URL input for IaC provider

0a3b9c1

fix(iac): return IaC findings in batchs to avoid possible memory issues

1693f7a

chore(iac): move lazy imports to top of the file

c1213ac

Merge branch 'master' into DEVREL-91-add-ia-c-to-the-app

a9e5068

AdriiiPRodri requested changes Oct 27, 2025

View reviewed changes

andoniaf added 8 commits October 27, 2025 14:37

chore(iac): move lazy imports to top of the file

6c97f6d

chore(iac): move version to top of the file

113d1ce

chore: update CHANGELOG format

5307bf4

fix(iac): filter findings by status

b5e13da

Merge branch 'master' into DEVREL-91-add-ia-c-to-the-app

59a7002

chore(iac): improve error handling flow

782b698

Merge branch 'master' into DEVREL-91-add-ia-c-to-the-app

a997f0b

docs: update providers table

843c1ae

github-actions bot added the documentation label Oct 29, 2025

fix(iac): solve next typecheck

6204e1b

andoniaf requested a review from AdriiiPRodri October 29, 2025 11:12

andoniaf added 2 commits October 29, 2025 13:11

fix(iac): solve migration order

6a11df4

Merge branch 'master' into DEVREL-91-add-ia-c-to-the-app

c3e395c

pedrooot previously approved these changes Oct 31, 2025

View reviewed changes

andoniaf dismissed pedrooot’s stale review via c3e395c October 31, 2025 11:55

fix(iac): solve indentation

957342f

andoniaf force-pushed the DEVREL-91-add-ia-c-to-the-app branch from 942ade6 to 957342f Compare October 31, 2025 12:05

andoniaf added 3 commits October 31, 2025 13:57

fix(iac): solve migration order, yes, again

8e19c74

Merge branch 'master' into DEVREL-91-add-ia-c-to-the-app

9b9af9b

fix(iac): solve migration order, yes, again, nowyes

3b4a2c3

alejandrobailo approved these changes Oct 31, 2025

View reviewed changes

jfagoagas approved these changes Oct 31, 2025

View reviewed changes

AdriiiPRodri approved these changes Oct 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(iac): add IaC to Prowler App #8751

feat(iac): add IaC to Prowler App #8751

Uh oh!

andoniaf commented Sep 24, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 22, 2025 •

edited

Loading

Uh oh!

codecov bot commented Oct 22, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 22, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 23, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 29, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 29, 2025 •

edited

Loading

Uh oh!

pedrooot Oct 31, 2025

Uh oh!

alejandrobailo left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

feat(iac): add IaC to Prowler App #8751

Are you sure you want to change the base?

feat(iac): add IaC to Prowler App #8751

Uh oh!

Conversation

andoniaf commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Description

SDK/Prowler Changes:

API Changes:

UI Changes:

Steps to review

Checklist

API

License

Uh oh!

github-actions bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

📊 Vulnerability Summary

⚠️ Action Required

Uh oh!

github-actions bot commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

✅ No Vulnerabilities Detected

The container image passed all security checks. No known CVEs were found.

Uh oh!

github-actions bot commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

📊 Vulnerability Summary

⚠️ Action Required

Uh oh!

pedrooot Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

alejandrobailo left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

andoniaf commented Sep 24, 2025 •

edited

Loading

github-actions bot commented Oct 22, 2025 •

edited

Loading

codecov bot commented Oct 22, 2025 •

edited

Loading

github-actions bot commented Oct 22, 2025 •

edited

Loading

github-actions bot commented Oct 23, 2025 •

edited

Loading

github-actions bot commented Oct 29, 2025 •

edited

Loading

github-actions bot commented Oct 29, 2025 •

edited

Loading