StackIT Provider

Documentation Index

Fetch the complete documentation index at: https://docs.prowler.com/llms.txt

Use this file to discover all available pages before exploring further.

​

StackIT Provider Classes Architecture

​

StackitProvider (Main Class)

• Location: prowler/providers/stackit/stackit_provider.py
• Base Class: Inherits from Provider (see base class details).
• Purpose: Central orchestrator for StackIT-specific logic, API authentication, credential validation, and configuration.
• Key StackIT Responsibilities:
  • Initializes StackIT SDK authentication via a service account key file or inline service account key JSON. The SDK mints and refreshes access tokens internally.
  • Validates the service account credentials and project ID (UUID format validation).
  • Loads and manages configuration, mutelist, and fixer settings.
  • Provides properties and methods for downstream StackIT service classes to access credentials, identity, and configuration data.

​

Data Models

• Location: prowler/providers/stackit/models.py
• Purpose: Define structured data for StackIT identity and output configuration.
• Key StackIT Models:
  • StackITIdentityInfo: Holds StackIT identity metadata, including project ID and project name (fetched automatically from Resource Manager API).
  • StackITOutputOptions: Customizes default output filenames so StackIT reports include the audited project ID.
  • IaaS resource models such as SecurityGroup and SecurityGroupRule are defined in the IaaS service module.

​

StackIT Services

• Location: prowler/providers/stackit/services/
• Purpose: Implement StackIT service clients and resource collection logic following the generic service pattern.
• Current Implementation: The IaaSService collects security groups, rules, and network interface usage across supported StackIT regions.

​

Exception Handling

• Location: prowler/providers/stackit/exceptions/exceptions.py
• Purpose: Custom exception classes for StackIT-specific error handling, such as credential validation, API connection, and configuration errors.
• Key Exception Classes:
  • StackITBaseException: Base exception for all StackIT provider errors.
  • StackITCredentialsError: Raised when credentials are invalid or missing.
  • StackITInvalidProjectIdError: Raised when project ID is invalid or not in UUID format.
  • StackITAPIError: Raised when StackIT API calls fail.

​

Authentication

​

Service Account Creation and Key Generation

​

Creating a Service Account Key

​

Method 1: Via StackIT Portal

1. Navigate to Service Accounts
   • Go to the StackIT Portal
   • Select your project
   • Click on Service Accounts in the left sidebar
2. Create or Select Service Account
   • If you don’t have a service account, click Create Service Account
   • Provide a name and description
   • Assign necessary permissions:
     • For IaaS security checks: iaas.viewer or project.owner
     • For comprehensive audits: project.owner
3. Generate Service Account Key
   • Select your service account
   • Navigate to Service Account Keys
   • Click Create key
   • Choose one of the following options:
     • STACKIT-generated key pair (Recommended): Let STACKIT automatically generate an RSA key-pair
     • User-provided key pair: Upload your own RSA 2048 public key
4. Download and Save the Key
   • Download the generated service account key file (JSON format)
   • Important: Save the key securely - it contains your private key and will only be available once
   • Store the key file in a secure location (e.g., ~/.stackit/sa_key.json)

​

Method 2: Via StackIT CLI

# Install STACKIT CLI (if not already installed)
# Follow instructions at: https://github.com/stackitcloud/stackit-cli

# Create service account key (STACKIT-generated)
stackit service-account key create --email my-service-account@example.com

# Or create with your own RSA 2048 public key
# First, generate your RSA key pair:
openssl genrsa -out private-key.pem 2048
openssl rsa -in private-key.pem -pubout -out public-key.pem

# Then create the key with your public key:
stackit service-account key create \
  --email my-service-account@example.com \
  --public-key "$(cat public-key.pem)"

​

Finding Your Project ID

1. In the StackIT Portal URL when viewing your project: https://portal.stackit.cloud/projects/{PROJECT_ID}/...
2. In the project settings page
3. Using the StackIT CLI: stackit project list

​

Passing the Service Account Key to Prowler

​

Option 1: Key File Path (key persisted on disk)

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"
export STACKIT_PROJECT_ID="12345678-1234-1234-1234-123456789abc"

prowler stackit

prowler stackit \
  --stackit-service-account-key-path ~/.stackit/sa-key.json \
  --stackit-project-id 12345678-1234-1234-1234-123456789abc

​

Option 2: Inline Key Content (CI/CD, secret managers)

export STACKIT_SERVICE_ACCOUNT_KEY="$(vault kv get -field=key stackit/sa)"
export STACKIT_PROJECT_ID="12345678-1234-1234-1234-123456789abc"

prowler stackit

​

Credential Lookup Order

1. Command-line arguments:
   • --stackit-service-account-key
   • --stackit-service-account-key-path
   • --stackit-project-id
2. Environment variables:
   • STACKIT_SERVICE_ACCOUNT_KEY
   • STACKIT_SERVICE_ACCOUNT_KEY_PATH
   • STACKIT_PROJECT_ID

​

Configuration

​

Command-Line Arguments

​

Input Validation

• Service Account Credentials:
  • At least one of service_account_key_path (file path) or service_account_key (inline JSON) must be supplied; both empty raises StackITNonExistentTokenError
  • When both are provided the inline content takes precedence
  • The key file path is logged as-is; the inline content is redacted in the credentials box
• Project ID:
  • Must not be empty
  • Must be a valid UUID format (e.g., 12345678-1234-1234-1234-123456789abc)
  • Validated using Python’s UUID constructor

​

Available Services

​

IaaS (Infrastructure as a Service)

• Service Class: IaaSService
• Location: prowler/providers/stackit/services/iaas/iaas_service.py
• SDK: Uses the stackit-iaas Python SDK
• Purpose: Manages IaaS resources including security groups, servers, and network interfaces.

• Security Groups and Rules
• Servers (Virtual Machines)
• Network Interfaces (NICs)

• Automatic discovery of all security groups in the project
• Security rule parsing with support for unrestricted access detection
• Network interface analysis to determine whether security groups are in use
• By default, reports only security groups attached to at least one NIC; --scan-unused-services includes unused security groups too

​

Available Checks

​

1. iaas_security_group_ssh_unrestricted

• Severity: High
• Description: Detects security groups that allow unrestricted SSH access (port 22) from the internet.
• Risk: Unrestricted SSH access increases the attack surface and risk of brute-force attacks.
• Detection Logic:
  • Checks for ingress rules allowing TCP port 22
  • Flags rules with ip_range=None or ip_range="0.0.0.0/0" or ip_range="::/0"
  • Reports security groups attached to NICs by default, or all security groups when --scan-unused-services is enabled

​

2. iaas_security_group_rdp_unrestricted

• Severity: High
• Description: Detects security groups that allow unrestricted RDP access (port 3389) from the internet.
• Risk: Unrestricted RDP access enables potential unauthorized remote desktop access.
• Detection Logic:
  • Checks for ingress rules allowing TCP port 3389
  • Flags unrestricted IP ranges (None, 0.0.0.0/0, ::/0)
  • Reports security groups attached to NICs by default, or all security groups when --scan-unused-services is enabled

​

3. iaas_security_group_database_unrestricted

• Severity: High
• Description: Detects security groups that allow unrestricted access to common database ports.
• Monitored Ports:
  • MySQL: 3306
  • PostgreSQL: 5432
  • MongoDB: 27017
  • Redis: 6379
  • SQL Server: 1433
  • CouchDB: 5984
• Risk: Unrestricted database access can lead to data breaches and unauthorized data access.

​

4. iaas_security_group_all_traffic_unrestricted

• Severity: Critical
• Description: Detects security groups that allow all traffic from the internet.
• Detection Logic:
  • Checks for rules with port_range=None (all ports)
  • Checks for rules with port range covering 0-65535 or 1-65535
  • Flags unrestricted IP ranges
  • Critical security misconfiguration requiring immediate remediation

​

Important Implementation Notes

• With description: 'Allow SSH from office' (sgr-abc123)
• Without description: 'sgr-abc123'

1. Default behavior: Report security groups attached to at least one NIC.
2. --scan-unused-services: Report every security group, including unused ones.
3. FAIL logic: Internet exposure is driven by security group rules that allow unrestricted source ranges, not by the presence of a public IP on the NIC.

• ip_range=null: No IP restriction specified (implicit unrestricted)
• ip_range="0.0.0.0/0" or "::/0": Explicitly configured to allow all IPs

​

Requirements

​

Python Version

• Minimum: Python 3.10+
• Reason: The StackIT SDK requires Python 3.10 or higher

​

Dependencies

• stackit-core (v0.2.0): Core SDK for StackIT API authentication and configuration
• stackit-iaas (v1.4.0): IaaS service SDK for managing compute resources
• stackit-resourcemanager (v0.8.0): Resource Manager SDK for fetching project metadata (e.g., project names)

poetry install

​

Region Support

​

Supported Regions

• Available Regions: eu01 (Germany South) and eu02 (Austria West)
• Default: All scans use both eu01 and eu02 regions by default.

​

Multi-Region Scanning

​

CLI Argument

# Scan only eu01
prowler stackit --stackit-region eu01

# Scan both eu01 and eu02
prowler stackit --stackit-region eu01 eu02

​

Implementation Details

• Regional Clients: Prowler generates a separate API client for each audited region.
• Service Iteration: Each service (e.g., IaaS) iterates through the regional clients to fetch and audit resources.
• Identity Tracking: The audited_regions are stored in the identity model for reporting.

​

Future Enhancements

​

Command Examples

​

Scan Specific Regions

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"

prowler stackit \
  --stackit-project-id "your-project-id" \
  --stackit-region eu01

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"

prowler stackit \
  --stackit-project-id "your-project-id" \
  --stackit-region eu01 eu02

​

Scan Specific Checks

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"

prowler stackit \
  --stackit-project-id "your-project-id" \
  --checks iaas_security_group_ssh_unrestricted

​

Scan All Security Group Checks

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"

prowler stackit \
  --stackit-project-id "your-project-id" \
  --services iaas

​

Output Formats

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"

prowler stackit \
  --stackit-project-id "your-project-id" \
  --output-formats json

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"

prowler stackit \
  --stackit-project-id "your-project-id" \
  --output-formats html

​

Known Limitations

​

Current Limitations

1. Single Project Scope: Only one project can be scanned at a time
2. Service Coverage: Only the IaaS service is currently implemented
3. Check Coverage: Limited to security group network security checks (4 checks total)
4. No Compliance Frameworks: Compliance framework mappings are not yet implemented

​

Planned Enhancements

• Multi-project scanning capability
• Additional IaaS checks (volume encryption, server public IP exposure, backup status)
• Compliance framework mappings (CIS, custom StackIT best practices)
• StackIT CLI remediation examples in metadata

​

Troubleshooting

​

Authentication Errors

1. Re-issue the service account key in the StackIT Portal
2. Verify the service account key file or inline JSON content is complete
3. Check that the service account has the necessary permissions (iaas.viewer or project.owner)
4. Ensure the service account key is provided through STACKIT_SERVICE_ACCOUNT_KEY_PATH, STACKIT_SERVICE_ACCOUNT_KEY, or the matching CLI arguments

1. Ensure the project ID and one service account credential source are provided
2. Check that credentials are set via environment variables or command-line arguments
3. Verify there are no extra spaces or newlines in the credentials

1. Verify the project ID is a valid UUID format: 12345678-1234-1234-1234-123456789abc
2. Copy the project ID directly from the StackIT Portal
3. Ensure there are no extra spaces or quotes around the UUID

​

API Connection Errors

1. Check your internet connection
2. Verify the StackIT API endpoint is accessible from your network
3. Check if there are any firewall rules blocking HTTPS connections
4. Review the full error message for specific API error codes

1. Verify the service account has the correct permissions
2. Ensure the project ID is correct and you have access to it
3. Check that the service account is enabled (not disabled or expired)
4. Verify the service account key has not been revoked

1. Verify the project ID exists and is correct
2. Check that the IaaS service is enabled in your project
3. Ensure you’re using the correct region (eu01)

​

Empty Results

1. Verify that security groups exist in your project
2. Check that the IaaS service is properly configured
3. Ensure the service account has iaas.viewer permission
4. Check Prowler logs for any API errors (use --log-level DEBUG)

​

Debug Mode

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"

prowler stackit \
  --stackit-project-id "your-project-id" \
  --log-level DEBUG

• API authentication details (with inline service account keys redacted)
• Resource discovery progress
• Security rule parsing details
• Any API errors or warnings

​

Specific Patterns in StackIT Services

• Directly in the code, in location prowler/providers/stackit/services/
• In the Prowler Hub for a more human-readable view.

​

StackIT Service Common Patterns

• Services communicate with StackIT using the StackIT Python SDK, you can find the documentation here.
• Service constructors receive a StackitProvider instance and use it to access credentials, identity, and configuration.
• The provider builds StackIT SDK Configuration objects from the service account key path or inline key content.
• Resource containers must be initialized in the constructor, typically as lists or dictionaries.
• Do not manipulate os.environ for credentials inside services. Use the provider session and SDK configuration helpers.
• All StackIT resources are represented as Pydantic BaseModel classes, providing type safety and structured access to resource attributes.
• StackIT SDK calls are wrapped in try/except blocks, with specific handling for API errors, always logging errors.
• Centralized Error Handling: Use provider.handle_api_error(exception) for consistent authentication error detection across all services.
• SDK Warning Suppression: StackIT SDK prints deprecation warnings to stderr - use the suppress_stderr() context manager during SDK initialization and API calls.
• Unrestricted Access Detection: In StackIT API, None values mean “allow all” (more permissive than explicit 0.0.0.0/0).
  • protocol=None → All protocols allowed
  • ip_range=None → All source IPs allowed (unrestricted!)
  • port_range=None → All ports allowed
  • remote_security_group_id set → Only allows traffic from the same security group (not unrestricted!)

​

IaaS Service Specific Patterns

# List all security groups
security_groups = client.list_security_groups(
    project_id=self.project_id,
    region=region,
)

# List network interfaces to determine security group usage
nics = client.list_project_nics(
    project_id=self.project_id,
    region=region,
)

# Checks report in-use security groups by default. Use --scan-unused-services
# to include security groups that are not attached to any NIC.

def _handle_api_call(self, api_function, *args, **kwargs):
    """Wrapper for API calls with centralized error handling."""
    try:
        with suppress_stderr():  # Suppress SDK warnings
            return api_function(*args, **kwargs)
    except Exception as e:
        # Use centralized error handler from provider
        self.provider.handle_api_error(e)  # Detects 401 and raises StackITInvalidTokenError

def is_unrestricted(rule):
    """Check if a rule allows unrestricted access."""
    # Filter out self-referencing rules
    if rule.remote_security_group_id is not None:
        return False
    # Check for unrestricted IP ranges
    return rule.ip_range is None or rule.ip_range in ["0.0.0.0/0", "::/0"]

def is_tcp(rule):
    """Check if a rule applies to TCP protocol."""
    # None means all protocols (including TCP)
    return rule.protocol is None or rule.protocol.lower() in ["tcp", "all"]

def includes_port(rule, port):
    """Check if a rule includes a specific port."""
    # None means all ports
    if rule.port_range is None:
        return True
    return rule.port_range.min <= port <= rule.port_range.max

​

Specific Patterns in StackIT Checks

• Directly in the code, within each service folder, each check has its own folder named after the name of the check. (e.g. prowler/providers/stackit/services/iaas/iaas_security_group_ssh_unrestricted/)
• In the Prowler Hub for a more human-readable view.

​

Check Report Class

​

Purpose

​

Constructor and Attribute Population

• resource_id:
  • Uses resource.id if present.
  • Otherwise, uses resource.resource_id if present.
  • Defaults to an empty string if none are available.
• resource_name:
  • Uses resource.name if present.
  • Defaults to an empty string if not available.
• project_id:
  • Uses resource.project_id if present.
  • Defaults to an empty string if not available (should be set in check logic).
• location:
  • Uses resource.region if present.
  • Otherwise, uses resource.location if present.
  • Defaults to an empty string if not available.

​

Example Usage

from prowler.lib.check.models import CheckReportStackIT

report = CheckReportStackIT(
    metadata=self.metadata(),
    resource=security_group
)
report.status = "FAIL"
report.status_extended = f"Security group {security_group.name} allows unrestricted SSH access from the internet."
report.resource_id = security_group.id
report.resource_name = security_group.name
report.project_id = security_group.project_id
report.location = security_group.region

​

Common Check Pattern

from prowler.lib.check.models import Check, CheckReportStackIT
from prowler.providers.stackit.services.iaas.iaas_client import iaas_client

class iaas_security_group_ssh_unrestricted(Check):
    """Check if IaaS security groups allow unrestricted SSH access."""

    def execute(self):
        findings = []

        for security_group in iaas_client.security_groups:
            if not (iaas_client.scan_unused_services or security_group.in_use):
                continue

            report = CheckReportStackIT(
                metadata=self.metadata(),
                resource=security_group
            )
            report.status = "PASS"
            report.status_extended = f"Security group {security_group.name} does not allow unrestricted SSH access."

            # Check each rule
            for rule in security_group.rules:
                if (rule.is_ingress() and
                    rule.is_tcp() and
                    rule.includes_port(22) and
                    rule.is_unrestricted()):
                    report.status = "FAIL"
                    report.status_extended = f"Security group {security_group.name} allows unrestricted SSH access from the internet."
                    break

            findings.append(report)

        return findings

​

Resources

​

Official StackIT Documentation

• StackIT Portal: https://portal.stackit.cloud/
• StackIT Documentation: https://docs.stackit.cloud/
• StackIT API Documentation: https://docs.api.eu01.stackit.cloud/

​

Python SDK

• StackIT Python SDK (GitHub): https://github.com/stackitcloud/stackit-sdk-python
• stackit-core (PyPI): https://pypi.org/project/stackit-core/
• stackit-iaas (PyPI): https://pypi.org/project/stackit-iaas/
• IaaS Models: https://github.com/stackitcloud/stackit-sdk-python/tree/main/services/iaas/src/stackit/iaas/models

​

Prowler Resources

• Provider Implementation: prowler/providers/stackit/
• IaaS Service: prowler/providers/stackit/services/iaas/
• Prowler Hub: https://hub.prowler.com/
• GitHub Issues: https://github.com/prowler-cloud/prowler/issues

​

Contributing

1. Add New Checks: Follow the check creation guide and use existing StackIT checks as templates
2. Enhance Services: Implement additional IaaS resource discovery or add new services
3. Improve Documentation: Add metadata enhancements, CLI remediation examples, or Terraform code samples
4. Report Issues: Submit bug reports or feature requests on GitHub

​

Quick Start for Contributors

1. Install dependencies: poetry install (includes stackit-core and stackit-iaas)
2. Set credentials: Export STACKIT_SERVICE_ACCOUNT_KEY_PATH and STACKIT_PROJECT_ID
3. Run checks: prowler stackit
4. View code: Start in prowler/providers/stackit/
5. Add checks: Create new check directories under services/iaas/
6. Run tests: poetry run pytest tests/providers/stackit/ -v

​

Code Quality Standards

• Keep service and check logic covered by unit tests.
• Redact inline service account keys from generated output.
• Keep documentation aligned with the implemented services and checks.
• Follow existing provider, service, and check patterns before adding StackIT-specific abstractions.