feat(sns): Add Amazon SNS integration for email alerts #9733
Conversation
Add complete Amazon SNS integration to Prowler that allows sending security
findings as email alerts via SNS topics. The integration supports comprehensive
filtering by severity, provider, region, resource name, and resource tags.
Features:
- SNS topic-based email alerting system
- AWS credential authentication (access keys, roles, session tokens)
- Support for filtering findings before dispatch
- Async task processing with Celery
- Full CRUD operations for SNS integrations
- Connection testing and validation
SNS Client (prowler/lib):
- SNS class for publishing finding alerts to topics
- Email-formatted messages with comprehensive finding details
- Support for remediation recommendations and code examples
- Exception handling with custom error classes
- Connection testing with topic validation
Backend API (api/src):
- IntegrationSNSFindingsFilter with severity, region, provider, and resource filtering
- IntegrationSNSDispatchSerializer for dispatch validation
- IntegrationSNSViewSet with RBAC permissions
- SNS integration task (sns_integration_task)
- Job logic (send_findings_to_sns) for batch processing
Models & Serializers:
- Added SNS to Integration.IntegrationChoices
- SNSConfigSerializer with topic_arn validation
- Uses AWSCredentialSerializer for AWS authentication
- Connection testing integrated into utils
Email Alert Format:
- Subject: [Prowler Alert] SEVERITY - CHECK_ID - RESOURCE_NAME
- Body: Comprehensive text format with:
- Finding details (severity, status, check info)
- Resource information (name, type, UID, region, account, provider)
- Risk description
- Remediation recommendations with URLs
- Remediation code (CLI, Terraform, Other)
- Resource tags
- Compliance framework mappings
- Link back to Prowler UI
API Endpoints:
- POST /api/v1/integrations (create SNS integration)
- POST /api/v1/integrations/{id}/connection (test SNS topic)
- POST /api/v1/integrations/{id}/sns/dispatches (send filtered findings)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
github-actions
bot
added
provider/aws
|
Please add an entry to the corresponding |
github-actions
bot
added
the
has-conflicts
|
This pull request contains unresolved conflict markers in the following files:
Please resolve these conflicts by:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
|
|
||
| def initialize_prowler_integration(integration: Integration) -> Jira: | ||
| def initialize_prowler_integration(integration: Integration): |
Check notice
Code scanning / CodeQL
Explicit returns mixed with implicit (fall through) returns Note
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 16 days ago
In general, to fix “explicit mixed with implicit returns,” ensure that every control flow path in the function ends with an explicit return statement, even if returning None or raising an error. For this function, the best fix without changing existing behavior for supported types is to make the “no matching integration type” path explicit. The two existing branches already return a client object or raise an error after updating DB state; the only problematic path is when integration.integration_type is neither JIRA nor SNS.
The minimal, behavior-preserving change is to add a final return None at the end of initialize_prowler_integration. This keeps the current observable behavior (unsupported integration types still yield None) but makes it explicit and silences the CodeQL warning about mixed returns. No new imports or helpers are required. All edits are in api/src/backend/api/utils.py within the shown function, adding one line at the end of the function body.
| @@ -437,3 +437,4 @@ | ||
| integration.connection_last_checked_at = datetime.now(tz=timezone.utc) | ||
| integration.save() | ||
| raise sns_error | ||
| return None |
🔒 Container Security ScanImage: 📊 Vulnerability Summary
10 package(s) affected
|
🔒 Container Security ScanImage: 📊 Vulnerability Summary
3 package(s) affected
|
Add complete UI implementation for Amazon SNS integration with comprehensive management interface for sending email alerts. Features: - SNS integration form with topic ARN configuration - AWS credentials support (access keys, role ARN, session tokens) - Custom credentials toggle for tenant/integration-level auth - CRUD operations (create, edit, delete, toggle enable/disable) - Connection testing with real-time feedback - Integration manager with pagination support - Filter support (severity, provider, region, resource name/tags) UI Components: - sns-integration-form.tsx: Form component with AWS credentials config - sns-integration-card.tsx: Card for main integrations page - sns-integrations-manager.tsx: Manager with list view and actions - sns/page.tsx: Dedicated SNS integrations management page Updates: - Add SNS schemas to ui/types/integrations.ts with Zod validation - Export SNS components from ui/components/integrations/index.ts - Add SNS card to main integrations page - Fix IntegrationType to use const-based approach per AGENTS.md line 13 - Fix Jira email validation to use correct Zod v4 syntax (z.email) - Use proper TypeScript types (removed any types per AGENTS.md) - Fix session_duration to use z.coerce.number() for string-to-number conversion 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
| >(null); | ||
| const [isDeleting, setIsDeleting] = useState<string | null>(null); | ||
| const [isTesting, setIsTesting] = useState<string | null>(null); | ||
| const [isOperationLoading, setIsOperationLoading] = useState(false); |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 16 days ago
In general, to fix an unused state variable in React, either (a) remove the state hook if it truly isn’t used, or (b) start actually using it (e.g., wiring it into UI or logic). To avoid changing existing behavior, the safest fix is to remove only genuinely unused state, since it currently has no observable effect on the component.
Here, the best fix is to remove the isOperationLoading state line on line 45 entirely and leave all other state hooks intact. No other code in the shown snippet refers to isOperationLoading, so removing that line does not change runtime behavior. No new imports or methods are required.
Concretely:
- Edit
ui/components/integrations/sns/sns-integrations-manager.tsx. - Delete the line:
const [isOperationLoading, setIsOperationLoading] = useState(false); - Keep all surrounding code and imports unchanged.
| @@ -42,7 +42,6 @@ | ||
| >(null); | ||
| const [isDeleting, setIsDeleting] = useState<string | null>(null); | ||
| const [isTesting, setIsTesting] = useState<string | null>(null); | ||
| const [isOperationLoading, setIsOperationLoading] = useState(false); | ||
| const [isDeleteOpen, setIsDeleteOpen] = useState(false); | ||
| const [integrationToDelete, setIntegrationToDelete] = | ||
| useState<IntegrationProps | null>(null); |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #9733 +/- ##
==========================================
- Coverage 92.46% 89.03% -3.44%
==========================================
Files 160 1058 +898
Lines 22814 29412 +6598
==========================================
+ Hits 21096 26187 +5091
- Misses 1718 3225 +1507
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
|
I'm closing this as requested. We'll work on this once prioritised. |
Context
Prowler currently supports various integrations for sending findings, but lacks an email notification system. Many teams rely on email alerts for immediate notification of critical security findings. This PR adds a complete Amazon SNS integration that allows users to send Prowler findings as formatted email alerts via SNS topics.
Description
This PR implements a full-featured Amazon SNS integration that sends security findings as email alerts. The integration uses AWS credentials for authentication and provides comprehensive filtering capabilities similar to other integrations.
Key Features:
Amazon SNS Client:
API Integration:
"sns"Filtering Capabilities:
Email Alert Format:
[Prowler Alert] SEVERITY - CHECK_ID - RESOURCE_NAMEChanges Include:
New Backend Files:
prowler/providers/aws/lib/sns/sns.py- Main SNS client class (~550 lines)prowler/providers/aws/lib/sns/exceptions/exceptions.py- Custom exception classesprowler/providers/aws/lib/sns/__init__.py- Package exportsprowler/providers/aws/lib/sns/exceptions/__init__.py- Exception exportsModified Backend Files:
api/src/backend/api/models.py- Add SNS to Integration choicesapi/src/backend/api/filters.py- Add IntegrationSNSFindingsFilter with comprehensive filteringapi/src/backend/api/utils.py- Add SNS integration initialization and connection testingapi/src/backend/api/v1/serializer_utils/integrations.py- Add SNS serializersapi/src/backend/api/v1/serializers.py- Add SNS dispatch serializer and validationapi/src/backend/api/v1/urls.py- Add SNS integration routingapi/src/backend/api/v1/views.py- Add IntegrationSNSViewSetapi/src/backend/tasks/tasks.py- Add sns_integration_taskapi/src/backend/tasks/jobs/integrations.py- Add send_findings_to_sns jobAPI Endpoints
Create SNS Integration:
Test Connection:
Send Findings to SNS:
Steps to Review
Review SNS Client (
prowler/providers/aws/lib/sns/sns.py):Review Backend Integration:
api/models.pyapi/v1/serializer_utils/integrations.pyapi/v1/views.pyapi/v1/urls.pyReview Filtering:
api/filters.pyReview Async Tasks:
tasks/tasks.pytasks/jobs/integrations.pyapi/utils.pyReview Security:
Testing Checklist
Backend:
Checklist
API
Implementation Summary
Backend (~950 lines added):
Total: 9 files modified, 4 files created, ~950 lines added
Next Steps
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.