Repository: prowler-cloud/prowler

Issue:
[Bug]: The check 'Potential secret found in EC2 instance * User Data.' does not include the line numbers where the secrets were found
### Steps to Reproduce

The check 'Potential secret found in EC2 instance * User Data.' does not show the line numbers, whereas 'Potential secret found in variables of ECS task definition' does. Why is it so?

The results of check without precise pointing at the line are frustrating: you do not know where exactly the scanner found the secret and how many secrets were found.

Same issue will rise if you need to troubleshoot the scanner.

### Expected behavior

Numbers of lines with secrets are included in issue description.

### Actual Result with Screenshots or Logs

-

### How did you install Prowler?

Docker (docker pull toniblyx/prowler)

### Environment Resource

Fargate

### OS used

--

### Prowler version

3

### Pip version

--

### Context

_No response_


Discussion:
I update the code for some of the checks to give the line number and secret type, but i must've missed this one. Thanks for pointing it out. 

Resolving patch:
diff --git a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py
--- a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py
+++ b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py
@@ -38,9 +38,19 @@ def execute(self):
                     with default_settings():
                         secrets.scan_file(temp_user_data_file.name)
 
-                    if secrets.json():
+                    detect_secrets_output = secrets.json()
+                    if detect_secrets_output:
+                        secrets_string = ", ".join(
+                            [
+                                f"{secret['type']} on line {secret['line_number']}"
+                                for secret in detect_secrets_output[
+                                    temp_user_data_file.name
+                                ]
+                            ]
+                        )
                         report.status = "FAIL"
-                        report.status_extended = f"Potential secret found in EC2 instance {instance.id} User Data."
+                        report.status_extended = f"Potential secret found in EC2 instance {instance.id} User Data -> {secrets_string}."
+
                     else:
                         report.status = "PASS"
                         report.status_extended = (


Test patch:
diff --git a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py
--- a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py
+++ b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py
@@ -101,6 +101,12 @@ def test_one_ec2_with_no_secrets(self):
                 == f"No secrets found in EC2 instance {instance.id} User Data."
             )
             assert result[0].resource_id == instance.id
+            assert (
+                result[0].resource_arn
+                == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
+            )
+            assert result[0].resource_tags is None
+            assert result[0].region == AWS_REGION
 
     @mock_ec2
     def test_one_ec2_with_secrets(self):
@@ -134,13 +140,15 @@ def test_one_ec2_with_secrets(self):
             assert result[0].status == "FAIL"
             assert (
                 result[0].status_extended
-                == f"Potential secret found in EC2 instance {instance.id} User Data."
+                == f"Potential secret found in EC2 instance {instance.id} User Data -> Secret Keyword on line 1."
             )
             assert result[0].resource_id == instance.id
             assert (
                 result[0].resource_arn
                 == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
             )
+            assert result[0].resource_tags is None
+            assert result[0].region == AWS_REGION
 
     @mock_ec2
     def test_one_ec2_file_with_secrets(self):
@@ -177,13 +185,15 @@ def test_one_ec2_file_with_secrets(self):
             assert result[0].status == "FAIL"
             assert (
                 result[0].status_extended
-                == f"Potential secret found in EC2 instance {instance.id} User Data."
+                == f"Potential secret found in EC2 instance {instance.id} User Data -> Secret Keyword on line 1, Hex High Entropy String on line 3, Secret Keyword on line 3, Secret Keyword on line 4."
             )
             assert result[0].resource_id == instance.id
             assert (
                 result[0].resource_arn
                 == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
             )
+            assert result[0].resource_tags is None
+            assert result[0].region == AWS_REGION
 
     @mock_ec2
     def test_one_launch_configurations_without_user_data(self):
@@ -221,3 +231,5 @@ def test_one_launch_configurations_without_user_data(self):
                 result[0].resource_arn
                 == f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
             )
+            assert result[0].resource_tags is None
+            assert result[0].region == AWS_REGION