fix(aws): resolve regions and the global region in the ISO partitions

Three assumptions in the provider broke as soon as a partition was not
one of the four the region matrix used to carry.

get_available_aws_service_regions indexed the matrix directly, so an
unknown service or partition raised a KeyError rather than reporting the
service as unavailable. It now yields an empty set, the same outcome a
service explicitly recorded as unavailable already produced.

generate_regional_clients swallowed that KeyError, logged it and fell
through without returning, so it handed back None while promising a dict.
Callers then failed with "'NoneType' object has no attribute 'values'",
with the real cause left behind in a log line. It now returns an empty
dict and the service is simply not scanned.

get_global_region returned the string "aws-iso-global" for anything
matching "aws-iso". That is a botocore pseudo endpoint rather than a
region, and matching on a substring collapsed the four ISO partitions
into a single answer. It now reads the partition's global STS region from
the botocore endpoints data, which returns exactly the values the
hardcoded branches did for the existing partitions and a real region for
each ISO one.

Author: StylusFrost

prowler/changelog.d/aws-iso-partitions.fixed.md

@@ -0,0 +1 @@
+`get_global_region()` now returns a real region for the ISO partitions (`us-iso-east-1`, `us-isob-east-1`, `eu-isoe-west-1`, `us-isof-east-1`) instead of the `aws-iso-global` pseudo endpoint, which also collapsed the four ISO partitions into one

prowler/changelog.d/aws-regional-clients-empty-dict.fixed.md

@@ -0,0 +1 @@
+`AwsProvider.generate_regional_clients()` returns an empty dict instead of `None` when the regional clients cannot be built, and `AwsProvider.get_available_aws_service_regions()` returns an empty set for an unknown service or partition instead of raising, so a service unavailable in the audited partition is skipped rather than raising `AttributeError: 'NoneType' object has no attribute 'values'`

prowler/providers/aws/aws_provider.py

@@ -908,6 +908,9 @@ def generate_regional_clients(
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
+            # Return an empty dict, as promised by the signature, so the service
+            # is simply not scanned instead of the callers failing later on a None
+            return {}
 
     @staticmethod
     def get_available_aws_service_regions(
@@ -923,9 +926,13 @@ def get_available_aws_service_regions(
 
         Returns:
             - A set of strings representing the available regions for the given service and partition.
+              A service or a partition not present in the regions file yields an empty set, the same
+              outcome as a service explicitly recorded as unavailable in the partition.
         """
         data = read_aws_regions_file()
-        json_regions = set(data["services"][service]["regions"][partition])
+        json_regions = set(
+            data["services"].get(service, {}).get("regions", {}).get(partition, [])
+        )
         if audited_regions:
             # Get common regions between input and json
             regions = json_regions.intersection(audited_regions)
@@ -1132,16 +1139,14 @@ def get_global_region(self) -> str:
         Example:
             global_region = get_global_region()a
         """
-        global_region = "us-east-1"
-        if self._identity.partition == "aws-cn":
-            global_region = "cn-north-1"
-        elif self._identity.partition == "aws-eusc":
-            global_region = "eusc-de-east-1"
-        elif self._identity.partition == "aws-us-gov":
-            global_region = "us-gov-east-1"
-        elif "aws-iso" in self._identity.partition:
-            global_region = "aws-iso-global"
-        return global_region
+        # The first region of the partition is the one of its global STS endpoint,
+        # which is always a real region, never a pseudo endpoint like "aws-iso-global"
+        partition_regions = get_botocore_partition_regions().get(
+            self._identity.partition
+        )
+        if partition_regions:
+            return partition_regions[0]
+        return "us-east-1"
 
     @staticmethod
     def input_role_mfa_token_and_code() -> AWSMFAInfo:

tests/providers/aws/aws_provider_test.py

@@ -59,7 +59,6 @@
     AWS_REGION_GOV_CLOUD_US_EAST_1,
     AWS_REGION_ISO_B_EAST_1,
     AWS_REGION_ISO_EAST_1,
-    AWS_REGION_ISO_GLOBAL,
     AWS_REGION_ISO_WEST_1,
     AWS_REGION_US_EAST_1,
     AWS_REGION_US_EAST_2,
@@ -1185,6 +1184,13 @@ def test_get_default_region_non_global_service_unaffected(self):
             == AWS_REGION_EU_WEST_1
         )
 
+    @mock_aws
+    def test_aws_get_global_region(self):
+        aws_provider = AwsProvider()
+        aws_provider._identity.partition = AWS_COMMERCIAL_PARTITION
+
+        assert aws_provider.get_global_region() == AWS_REGION_US_EAST_1
+
     @mock_aws
     def test_aws_gov_get_global_region(self):
         aws_provider = AwsProvider()
@@ -1204,7 +1210,21 @@ def test_aws_iso_get_global_region(self):
         aws_provider = AwsProvider()
         aws_provider._identity.partition = AWS_ISO_PARTITION
 
-        assert aws_provider.get_global_region() == AWS_REGION_ISO_GLOBAL
+        assert aws_provider.get_global_region() == AWS_REGION_ISO_EAST_1
+
+    @mock_aws
+    def test_aws_iso_b_get_global_region(self):
+        aws_provider = AwsProvider()
+        aws_provider._identity.partition = AWS_ISO_B_PARTITION
+
+        assert aws_provider.get_global_region() == AWS_REGION_ISO_B_EAST_1
+
+    @mock_aws
+    def test_get_global_region_for_an_unknown_partition(self):
+        aws_provider = AwsProvider()
+        aws_provider._identity.partition = "aws-unknown"
+
+        assert aws_provider.get_global_region() == AWS_REGION_US_EAST_1
 
     @mock_aws
     def test_aws_eusc_get_global_region(self):
@@ -1292,6 +1312,27 @@ def test_get_available_aws_service_regions_with_all_regions_audited(self):
                 len(aws_provider.get_available_aws_service_regions("ec2", "aws")) == 17
             )
 
+    @mock_aws
+    def test_get_available_aws_service_regions_commercial_and_gov_cloud(self):
+        aws_provider = AwsProvider()
+
+        assert AWS_REGION_US_EAST_1 in aws_provider.get_available_aws_service_regions(
+            "ec2", AWS_COMMERCIAL_PARTITION
+        )
+        assert (
+            AWS_REGION_GOV_CLOUD_US_EAST_1
+            in aws_provider.get_available_aws_service_regions(
+                "ec2", AWS_GOV_CLOUD_PARTITION
+            )
+        )
+        # A service recorded as unavailable in the partition yields an empty set
+        assert (
+            aws_provider.get_available_aws_service_regions(
+                "bedrock-agent", AWS_CHINA_PARTITION
+            )
+            == set()
+        )
+
     @mock_aws
     def test_get_available_aws_service_regions_iso_partitions(self):
         aws_provider = AwsProvider()
@@ -1313,6 +1354,46 @@ def test_get_available_aws_service_regions_iso_partitions(self):
             == set()
         )
 
+    @mock_aws
+    def test_get_available_aws_service_regions_unknown_partition(self):
+        aws_provider = AwsProvider()
+
+        assert (
+            aws_provider.get_available_aws_service_regions("ec2", "aws-unknown")
+            == set()
+        )
+
+    @mock_aws
+    def test_get_available_aws_service_regions_unknown_service(self):
+        aws_provider = AwsProvider()
+
+        assert (
+            aws_provider.get_available_aws_service_regions(
+                "unknown-service", AWS_COMMERCIAL_PARTITION
+            )
+            == set()
+        )
+
+    @mock_aws
+    def test_generate_regional_clients_service_not_in_partition(self):
+        aws_provider = AwsProvider()
+        aws_provider._identity.partition = AWS_ISO_PARTITION
+
+        response = aws_provider.generate_regional_clients("bedrock")
+
+        assert response == {}
+
+    @mock_aws
+    def test_generate_regional_clients_returns_empty_dict_on_error(self):
+        aws_provider = AwsProvider()
+
+        with patch.object(
+            AwsProvider,
+            "get_available_aws_service_regions",
+            side_effect=Exception("boom"),
+        ):
+            assert aws_provider.generate_regional_clients("ec2") == {}
+
     @mock_aws
     def test_get_tagged_resources(self):
         ec2_client = client("ec2", region_name=AWS_REGION_EU_CENTRAL_1)

tests/providers/aws/utils.py

@@ -54,7 +54,6 @@
 AWS_REGION_GOV_CLOUD_US_EAST_1 = "us-gov-east-1"
 
 # Iso Regions
-AWS_REGION_ISO_GLOBAL = "aws-iso-global"
 AWS_REGION_ISO_EAST_1 = "us-iso-east-1"
 AWS_REGION_ISO_WEST_1 = "us-iso-west-1"
 AWS_REGION_ISO_B_EAST_1 = "us-isob-east-1"