From 0b94f2929d52b237478cf29cd9fef9222bc7a2a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Wed, 19 Nov 2025 13:49:57 +0100 Subject: [PATCH] chore(aws): enhance metadata for `documentdb` service (#8862) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...entdb_cluster_backup_enabled.metadata.json | 37 +++++++++++------- ...luster_cloudwatch_log_export.metadata.json | 36 ++++++++++------- ..._cluster_deletion_protection.metadata.json | 37 +++++++++++------- ...tdb_cluster_multi_az_enabled.metadata.json | 32 ++++++++------- ...ntdb_cluster_public_snapshot.metadata.json | 30 +++++++++----- ...db_cluster_storage_encrypted.metadata.json | 39 ++++++++++++------- 7 files changed, 137 insertions(+), 75 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 51c47e3dd5..101d8e5995 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -57,6 +57,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Raise ASFF output error for non-AWS providers [(#9225)](https://github.com/prowler-cloud/prowler/pull/9225) - Update AWS ECR service metadata to new format [(#8872)](https://github.com/prowler-cloud/prowler/pull/8872) - Update AWS ECS service metadata to new format [(#8888)](https://github.com/prowler-cloud/prowler/pull/8888) +- Update AWS DocumentDB service metadata to new format [(#8862)](https://github.com/prowler-cloud/prowler/pull/8862) --- diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json index eb8b780511..0ee1edebc7 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json @@ -1,29 +1,40 @@ { "Provider": "aws", "CheckID": "documentdb_cluster_backup_enabled", - "CheckTitle": "Check if DocumentDB Clusters have backup enabled.", - "CheckType": [], + "CheckTitle": "DocumentDB cluster has automated backups enabled with retention period of at least 7 days", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" + ], "ServiceName": "documentdb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", - "Description": "Check if DocumentDB Clusters have backup enabled.", - "Risk": "Ensure that your Amazon DocumentDB database clusters have set a minimum backup retention period in order to achieve compliance requirements in your organization.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-2", + "Description": "**Amazon DocumentDB clusters** are evaluated for **automated backups** and an adequate **backup retention period**. Clusters should have `backup_retention_period` set to at least the configured minimum (default `7` days). Values of `0` indicate backups are disabled; values below the threshold are considered insufficient.", + "Risk": "Without adequate backups, clusters can't be reliably restored. Accidental deletes, logical corruption, or ransomware may cause irreversible data loss once a short retention window expires, leading to prolonged outages, missed RPO/RTO, and limited ability to roll back malicious or erroneous changes.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.amazonaws.cn/en_us/documentdb/latest/developerguide/what-is.html", + "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#", + "https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/aws-enabledocdbclusterbackupretentionperiod.html" + ], "Remediation": { "Code": { - "CLI": "aws docdb modify-db-cluster --region --db-cluster-identifier --backup-retention-period 7 --apply-immediately", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#" + "CLI": "aws docdb modify-db-cluster --db-cluster-identifier --backup-retention-period 7 --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: Set DocumentDB backup retention to at least 7 days\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n BackupRetentionPeriod: 7 # CRITICAL: enables automated backups and sets retention to >=7 days\n```", + "Other": "1. Open the Amazon DocumentDB console\n2. Go to Clusters and select \n3. Click Modify\n4. Set Backup retention period to 7 (or higher)\n5. Check Apply immediately\n6. Click Continue and then Modify cluster", + "Terraform": "```hcl\n# Terraform: Ensure DocumentDB backup retention is at least 7 days\nresource \"aws_docdb_cluster\" \"\" {\n cluster_identifier = \"\"\n backup_retention_period = 7 # CRITICAL: enables automated backups and sets retention to >=7 days\n}\n```" }, "Recommendation": { - "Text": "Enable automated backup for production data. Define a retention period and periodically test backup restoration. A Disaster Recovery process should be in place to govern Data Protection approach.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-2" + "Text": "Enable **automated backups** and set retention to meet RPO/RTO (typically `7-35` days).\n- Regularly test point-in-time restores\n- Apply **least privilege** to backup/snapshot management\n- Protect backup artifacts and define stable backup windows\n- Include restores in a tested **disaster recovery** plan", + "Url": "https://hub.prowler.com/check/documentdb_cluster_backup_enabled" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json index 5341ee202f..7debb166f9 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json @@ -1,29 +1,39 @@ { "Provider": "aws", "CheckID": "documentdb_cluster_cloudwatch_log_export", - "CheckTitle": "Check if DocumentDB clusters are using the log export feature.", - "CheckType": [], + "CheckTitle": "DocumentDB cluster exports audit and profiler logs to CloudWatch Logs", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "documentdb", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", - "Description": "Check if DocumentDB clusters are using the log export feature.", - "Risk": "Ensure that all your Amazon DocumentDB clusters are using the Log Exports feature in order to publish audit logs directly to CloudWatch Logs. The events recorded by Log Exports include events such as successful and failed authentication attempts, creating indexes, or dropping collections in DocumentDB databases.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4", + "Description": "Amazon DocumentDB clusters are evaluated for exporting `audit` and `profiler` logs to **CloudWatch Logs**.\nClusters missing one or both log types are identified as lacking complete log export configuration.", + "Risk": "Missing **audit** and/or **profiler** exports reduces observability of authentication, authorization, and data definition activity.\nAttacks like brute-force logins, privilege abuse, or destructive schema changes can go unnoticed, degrading **confidentiality** and **integrity** and delaying incident response.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DocumentDB/enable-profiler.html", + "https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-cluster.html" + ], "Remediation": { "Code": { - "CLI": "aws docdb modify-db-cluster --region --db-cluster-identifier --db-cluster-parameter-group-name --cloudwatch-logs-export-configuration '{EnableLogTypes:[profiler]}' --apply-immediately", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/enable-profiler.html", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/enable-profiler.html", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/enable-profiler.html" + "CLI": "aws docdb modify-db-cluster --db-cluster-identifier --cloudwatch-logs-export-configuration '{\"EnableLogTypes\":[\"audit\",\"profiler\"]}' --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: enable DocumentDB log exports\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n EnableCloudwatchLogsExports:\n - audit # Critical: export audit logs to CloudWatch Logs\n - profiler # Critical: export profiler logs to CloudWatch Logs\n```", + "Other": "1. In AWS Console, go to Amazon DocumentDB > Clusters\n2. Select the cluster and choose Actions > Modify\n3. In Log exports, check Audit and Profiler\n4. Check Apply immediately and click Modify cluster", + "Terraform": "```hcl\n# Enable DocumentDB log exports\nresource \"aws_docdb_cluster\" \"\" {\n enabled_cloudwatch_logs_exports = [\"audit\", \"profiler\"] # Critical: export both logs to CloudWatch Logs\n}\n```" }, "Recommendation": { - "Text": "Enabled DocumentDB Log export functionality to analyze, monitor, and archive auditing events for security and compliance requirements.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4" + "Text": "Enable export of both `audit` and `profiler` logs to **CloudWatch Logs** for all clusters and centralize analysis.\nApply **least privilege** to log access, define retention and immutability, integrate with alerting, and use **separation of duties** to protect and regularly review logs for **defense in depth**.", + "Url": "https://hub.prowler.com/check/documentdb_cluster_cloudwatch_log_export" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json index 2ae338a208..c9df9532d4 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json @@ -1,29 +1,40 @@ { "Provider": "aws", "CheckID": "documentdb_cluster_deletion_protection", - "CheckTitle": "Check if DocumentDB Clusters has deletion protection enabled.", - "CheckType": [], + "CheckTitle": "DocumentDB cluster has deletion protection enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "documentdb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", - "Description": "Check if DocumentDB Clusters has deletion protection enabled.", - "Risk": "Enabling cluster deletion protection offers an additional layer of protection against accidental database deletion or deletion by an unauthorized user. A DocumentDB cluster can't be deleted while deletion protection is enabled. You must first disable deletion protection before a delete request can succeed.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5", + "Description": "**Amazon DocumentDB clusters** are evaluated for the `deletion_protection` setting on the cluster configuration.\n\nThe finding highlights clusters where this protection is not enabled.", + "Risk": "Without **deletion protection**, clusters can be deleted by mistake or misuse, causing sudden outage and loss of recovery points, impacting **availability** and **data integrity**.\n\nCompromised accounts or faulty automation can remove databases or skip final snapshots, hindering restoration.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000233689-ensure-documentdb-clusters-has-deletion-protection-enabled", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DocumentDB/deletion-protection.html", + "https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-delete.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5" + ], "Remediation": { "Code": { - "CLI": "aws aws docdb modify-db-cluster --region --db-cluster-identifier --deletion-protection --apply-immediately", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/deletion-protection.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/deletion-protection.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/deletion-protection.html#" + "CLI": "aws docdb modify-db-cluster --db-cluster-identifier --deletion-protection --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: Enable deletion protection on a DocumentDB cluster\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n MasterUsername: \"\"\n MasterUserPassword: \"\"\n DeletionProtection: true # CRITICAL: Prevents cluster deletion until disabled\n```", + "Other": "1. In the AWS Console, go to Amazon DocumentDB > Clusters\n2. Select the target cluster and click Modify\n3. Enable Deletion protection\n4. Check Apply immediately and click Save changes", + "Terraform": "```hcl\n# Terraform: Enable deletion protection on a DocumentDB cluster\nresource \"aws_docdb_cluster\" \"\" {\n master_username = \"\"\n master_password = \"\"\n deletion_protection = true # CRITICAL: Prevents cluster deletion until disabled\n}\n```" }, "Recommendation": { - "Text": "Enable deletion protection for production DocumentDB Clusters.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5" + "Text": "Enable **deletion protection** on all non-ephemeral clusters, prioritizing production.\n\nEnforce **least privilege** for delete and modify actions, require change control to toggle protection, and implement **defense in depth** with automation that continuously enforces this setting. *Before decommissioning*, take a final snapshot.", + "Url": "https://hub.prowler.com/check/documentdb_cluster_deletion_protection" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json index 0f3d519070..76f98e77b8 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json @@ -1,30 +1,36 @@ { "Provider": "aws", "CheckID": "documentdb_cluster_multi_az_enabled", - "CheckTitle": "Ensure DocumentDB Cluster have Multi-AZ enabled.", - "CheckType": [], + "CheckTitle": "DocumentDB cluster has Multi-AZ enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "documentdb", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", - "Description": "Ensure DocumentDB Cluster have Multi-AZ enabled.", - "Risk": "Ensure that your Amazon DocumentDB Clusters are using Multi-AZ deployment configurations to provide High Availability (HA) through automatic failover to standby replicas in the event of a failure such as an Availability Zone (AZ) outage, an internal hardware or network outage, a software failure or in case of a planned maintenance session.", - "RelatedUrl": "https://docs.aws.amazon.com/documentdb/latest/developerguide/failover.html", + "Description": "**Amazon DocumentDB clusters** with **Multi-AZ** (`multi_az`) indicate deployment of a primary and one or more replicas across Availability Zones.", + "Risk": "Without Multi-AZ, the cluster depends on a single AZ/instance. An AZ or node failure-or maintenance-can stop reads and writes, causing downtime, timeouts, and SLA breaches. Availability degrades, RTO rises, and applications may experience failed or retried transactions until replacement capacity is created.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/documentdb/latest/developerguide/failover.html", + "https://support.icompaas.com/support/solutions/articles/62000233690-ensure-documentdb-cluster-have-multi-az-enabled" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws docdb create-db-instance --db-instance-identifier --db-cluster-identifier --db-instance-class --engine docdb --availability-zone ", + "NativeIaC": "```yaml\n# CloudFormation: add a replica to enable Multi-AZ for an existing DocumentDB cluster\nResources:\n DocDBReplica:\n Type: AWS::DocDB::DBInstance\n Properties:\n DBClusterIdentifier: \"\" # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ\n DBInstanceClass: \"\"\n AvailabilityZone: \"\" # CRITICAL: place in a different AZ to provide Multi-AZ failover\n```", + "Other": "1. In the AWS Console, go to Amazon DocumentDB and open your cluster\n2. Click Create instance\n3. Set Instance class and choose an Availability Zone different from the primary\n4. Click Create to add the replica\n5. Verify the cluster now shows Multi-AZ enabled", + "Terraform": "```hcl\n# Add a replica to enable Multi-AZ for an existing DocumentDB cluster\nresource \"aws_docdb_cluster_instance\" \"\" {\n cluster_identifier = \"\" # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ\n instance_class = \"\"\n availability_zone = \"\" # CRITICAL: different AZ ensures Multi-AZ failover\n}\n```" }, "Recommendation": { - "Text": "Enable Multi-AZ for all DocumentDB Clusters.", - "Url": "https://docs.aws.amazon.com/documentdb/latest/developerguide/failover.html" + "Text": "Enable **Multi-AZ** for DocumentDB and distribute instances across distinct AZs.\n- Maintain at least one replica\n- Set promotion priorities to guide failover\n- Test failover regularly and use resilient client retries\n\nThis builds **fault tolerance** and preserves service availability.", + "Url": "https://hub.prowler.com/check/documentdb_cluster_multi_az_enabled" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json index 46c214d8e9..4beaa85ace 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json @@ -1,26 +1,36 @@ { "Provider": "aws", "CheckID": "documentdb_cluster_public_snapshot", - "CheckTitle": "Check if DocumentDB manual cluster snapshot is public.", - "CheckType": [], + "CheckTitle": "DocumentDB manual cluster snapshot is not shared publicly", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure", + "TTPs/Initial Access" + ], "ServiceName": "documentdb", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsRdsDbClusterSnapshot", - "Description": "Check if DocumentDB manual cluster snapshot is public.", - "Risk": "If you share an unencrypted manual snapshot as public, the snapshot is available to all AWS accounts. Public snapshots may result in unintended data exposure.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/docdb-cluster-snapshot-public-prohibited.html", + "Description": "**Amazon DocumentDB** manual cluster snapshot visibility is evaluated to detect snapshots marked as **public** instead of limited to specified AWS accounts.", + "Risk": "**Public snapshots** weaken **confidentiality**: any AWS account can restore and read database contents, enabling data exfiltration.\n\nThey also aid **lateral movement** by revealing embedded secrets/config and reduce accountability when restores occur outside your account.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-share_cluster_snapshots.html#backup_restore-share_snapshots", + "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-3", + "https://docs.aws.amazon.com/config/latest/developerguide/docdb-cluster-snapshot-public-prohibited.html" + ], "Remediation": { "Code": { - "CLI": "aws docdb modify-db-snapshot-attribute --db-snapshot-identifier --attribute-name restore --values-to-remove all", + "CLI": "aws docdb modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier --attribute-name restore --values-to-remove all", "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-3", + "Other": "1. Open the Amazon DocumentDB console and go to Snapshots\n2. Select the public manual cluster snapshot\n3. Click Actions > Share\n4. Set DB snapshot visibility to Private (remove \"all\" if listed)\n5. Click Save", "Terraform": "" }, "Recommendation": { - "Text": "To remove public access from a manual snapshot, follow the Sharing a snapshot tutorial.", - "Url": "https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-share_cluster_snapshots.html#backup_restore-share_snapshots" + "Text": "Keep snapshot visibility `Private` and share only with trusted accounts under **least privilege**. Prefer **CMEK encryption** to enforce key-based access and prevent public sharing. Periodically review sharing lists, restrict IAM permissions that alter visibility, and monitor for exposure as **defense in depth**.", + "Url": "https://hub.prowler.com/check/documentdb_cluster_public_snapshot" } }, "Categories": [ diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json index 8e26bf67df..bf3af04b2a 100644 --- a/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json +++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json @@ -1,31 +1,44 @@ { "Provider": "aws", "CheckID": "documentdb_cluster_storage_encrypted", - "CheckTitle": "Check if DocumentDB cluster storage is encrypted.", + "CheckTitle": "DocumentDB cluster storage is encrypted at rest", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS", + "Software and Configuration Checks/Industry and Regulatory Standards/HIPAA Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls", + "Effects/Data Exposure" ], "ServiceName": "documentdb", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", - "Description": "Check if DocumentDB cluster storage is encrypted.", - "Risk": "Ensure that encryption of data at rest is enabled for your Amazon DocumentDB (with MongoDB compatibility) database clusters for additional data security and regulatory compliance.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-1", + "Description": "**Amazon DocumentDB clusters** are assessed for **storage encryption at rest** via the cluster's `encrypted` setting.\n\nIt identifies clusters where data volumes, automated backups, and snapshots aren't protected by AWS KMS-managed encryption.", + "Risk": "Without at-rest encryption, cluster data, snapshots, and backups can be read in plaintext if copies are leaked, mis-shared, or underlying storage is accessed. This harms **confidentiality**, enables offline analysis and data exfiltration, and widens the blast radius of insider or backup repository compromise.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-1", + "https://docs.aws.amazon.com/documentdb/latest/developerguide/elastic-encryption.html", + "https://docs.aws.amazon.com/documentdb/latest/developerguide/encryption-at-rest.html" + ], "Remediation": { "Code": { - "CLI": "aws docdb create-db-cluster --db-cluster-identifier --port --engine docdb --master-username --master-user-password --storage-encrypted", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_28/", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_28#fix-buildtime" + "CLI": "aws docdb create-db-cluster --db-cluster-identifier --engine docdb --master-username --master-user-password --storage-encrypted", + "NativeIaC": "```yaml\n# CloudFormation: Create an encrypted DocumentDB cluster\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n Engine: docdb\n MasterUsername: \n MasterUserPassword: \n StorageEncrypted: true # Critical: enables encryption at rest to pass the check\n```", + "Other": "1. In the AWS Console, go to Amazon DocumentDB\n2. Click Create cluster\n3. Expand Show advanced settings\n4. In Encryption-at-rest, select Enable encryption\n5. Choose or keep the default KMS key\n6. Click Create cluster\n\nTo replace an existing unencrypted cluster:\n1. Select the unencrypted cluster > Actions > Take snapshot\n2. After the snapshot completes, select it > Actions > Restore snapshot\n3. In Encryption-at-rest, select Enable encryption and restore as a new cluster\n4. Update your applications to use the new cluster endpoint", + "Terraform": "```hcl\n# Terraform: Encrypted DocumentDB cluster\nresource \"aws_docdb_cluster\" \"\" {\n master_username = \"\"\n master_password = \"\"\n storage_encrypted = true # Critical: enables encryption at rest to pass the check\n}\n```" }, "Recommendation": { - "Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-1" + "Text": "Enable **storage encryption at rest** for all DocumentDB clusters and prefer **customer-managed KMS keys** for control over access, rotation, and revocation. Apply **least privilege** to key usage, enforce **separation of duties**, and monitor key and snapshot access. *If a cluster isn't encrypted*, migrate to a new encrypted cluster.", + "Url": "https://hub.prowler.com/check/documentdb_cluster_storage_encrypted" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": ""