refactor(check): add docstrings and improve report handling (#7113)

prowler/providers/aws/services/rds/rds_instance_event_subscription_parameter_groups/rds_instance_event_subscription_parameter_groups.py

@@ -3,28 +3,45 @@ from prowler.providers.aws.services.rds.rds_client import rds_client
 
 
 class rds_instance_event_subscription_parameter_groups(Check):
+    """Ensure RDS parameter group event categories of configuration change are subscribed.
+
+    This check is useful to ensure we receive notification of events that may affect the security, availability, and reliability of the RDS database instances associated with these parameter groups.
+    """
+
     def execute(self):
+        """Execute the RDS Parameter Group events are subscribed check.
+
+        Iterates through the RDS DB event subscriptions and checks if the event source is DB parameter group and the event list is empty (so it's suscribe to all categories) or contains only configuration change.
+
+        Returns:
+            List[Check_Report_AWS]: A list of reports for each RDS DB event subscription.
+        """
         findings = []
         if rds_client.provider.scan_unused_services or rds_client.db_instances:
             for db_event in rds_client.db_event_subscriptions:
-                report = Check_Report_AWS(metadata=self.metadata(), resource=db_event)
+                report = Check_Report_AWS(metadata=self.metadata(), resource={})
                 report.status = "FAIL"
                 report.status_extended = "RDS parameter group event categories of configuration change is not subscribed."
                 report.resource_id = rds_client.audited_account
                 report.resource_arn = rds_client._get_rds_arn_template(db_event.region)
                 report.region = db_event.region
-                report.resource_tags = []
-                if db_event.source_type == "db-parameter-group" and db_event.enabled:
-                    if db_event.event_list == [] or db_event.event_list == [
-                        "configuration change",
-                    ]:
-                        report = Check_Report_AWS(
-                            metadata=self.metadata(), resource=db_event
-                        )
+                if db_event.source_type == "db-parameter-group":
+                    report = Check_Report_AWS(
+                        metadata=self.metadata(), resource=db_event
+                    )
+                    if db_event.enabled and (
+                        db_event.event_list == []
+                        or db_event.event_list
+                        == [
+                            "configuration change",
+                        ]
+                    ):
                         report.status = "PASS"
                         report.status_extended = (
                             "RDS parameter group events are subscribed."
                         )
+                    else:
+                        report.status = "FAIL"
+                        report.status_extended = "RDS parameter group event category of configuration change is not subscribed."
                 findings.append(report)
-
         return findings

tests/providers/aws/services/rds/rds_instance_event_subscription_parameter_groups/rds_instance_event_subscription_parameter_groups_test.py

@@ -47,6 +47,7 @@ class Test_rds_instance__no_event_subscriptions:
                 assert result[0].resource_id == AWS_ACCOUNT_NUMBER
                 assert result[0].resource_arn == RDS_ACCOUNT_ARN
                 assert result[0].resource_tags == []
+                assert result[0].resource == {}
 
     @mock_aws
     def test_rds_no_events_ignoring(self):
@@ -190,3 +191,61 @@ class Test_rds_instance__no_event_subscriptions:
                     == f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:es:TestSub"
                 )
                 assert result[0].resource_tags == []
+
+    @mock_aws
+    def test_rds_parameter_event_subscription_not_parameter_group(self):
+        conn = client("rds", region_name=AWS_REGION_US_EAST_1)
+        conn.create_db_parameter_group(
+            DBParameterGroupName="test",
+            DBParameterGroupFamily="default.aurora-postgresql14",
+            Description="test parameter group",
+        )
+        conn.create_db_instance(
+            DBInstanceIdentifier="db-master-1",
+            AllocatedStorage=10,
+            Engine="aurora-postgresql",
+            DBName="aurora-postgres",
+            DBInstanceClass="db.m1.small",
+            DBParameterGroupName="test",
+            DBClusterIdentifier="db-cluster-1",
+        )
+        conn.create_event_subscription(
+            SubscriptionName="TestSub",
+            SnsTopicArn=f"arn:aws:sns:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:test",
+            SourceType="db-instance",
+            Enabled=True,
+            Tags=[
+                {"Key": "test", "Value": "testing"},
+            ],
+        )
+        from prowler.providers.aws.services.rds.rds_service import RDS
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.rds.rds_instance_event_subscription_parameter_groups.rds_instance_event_subscription_parameter_groups.rds_client",
+                new=RDS(aws_provider),
+            ):
+                # Test Check
+                from prowler.providers.aws.services.rds.rds_instance_event_subscription_parameter_groups.rds_instance_event_subscription_parameter_groups import (
+                    rds_instance_event_subscription_parameter_groups,
+                )
+
+                check = rds_instance_event_subscription_parameter_groups()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert (
+                    result[0].status_extended
+                    == "RDS parameter group event categories of configuration change is not subscribed."
+                )
+                assert result[0].region == AWS_REGION_US_EAST_1
+                assert result[0].resource_id == AWS_ACCOUNT_NUMBER
+                assert result[0].resource_arn == RDS_ACCOUNT_ARN
+                assert result[0].resource_tags == []
+                assert result[0].resource == {}