chore(revision): change logic

prowler/changelog.d/rds-certificate-expiration-neptune-fp.fixed.md

@@ -1 +1 @@
-`rds_instance_certificate_expiration` no longer reports false positives on Neptune resources, which are now excluded from the RDS inventory, or on instances whose CA certificate could not be retrieved, which are reported as MANUAL instead of a critical failure
+`rds_instance_certificate_expiration` no longer reports false positives on Neptune resources, which are now excluded from the RDS inventory, or on instances with no CA certificate, which now PASS instead of failing as expired; instances whose declared CA certificate could not be retrieved are skipped, since there is no data to evaluate

prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.py

@@ -17,14 +17,14 @@ class rds_instance_certificate_expiration(Check):
         for db_instance in rds_client.db_instances.values():
             report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
 
-            # An empty certificate list means the CA certificate could not be
-            # retrieved, not that the certificate is expired. Reporting it as a
-            # failure would be a false positive, so it is flagged for manual review.
+            # No certificate data: PASS if the instance has no CA certificate,
+            # no finding if it has one that could not be retrieved.
             if not db_instance.cert:
-                report.status = "MANUAL"
-                report.check_metadata.Severity = Severity.informational
-                report.status_extended = f"RDS Instance {db_instance.id} certificate expiration could not be determined because no CA certificate information was retrieved."
-                findings.append(report)
+                if not db_instance.ca_cert:
+                    report.status = "PASS"
+                    report.check_metadata.Severity = Severity.informational
+                    report.status_extended = f"RDS Instance {db_instance.id} does not use a CA certificate."
+                    findings.append(report)
                 continue
 
             report.status = "FAIL"

prowler/providers/aws/services/rds/rds_service.py

@@ -8,10 +8,8 @@ from prowler.lib.logger import logger
 from prowler.lib.scan_filters.scan_filters import is_resource_filtered
 from prowler.providers.aws.lib.service.service import AWSService
 
-# Engines that are returned by the RDS API but belong to a different AWS service.
-# DocumentDB and Neptune share the RDS control plane, so their resources show up in
-# describe_db_* calls even though RDS checks do not apply to them. Each one has its
-# own dedicated Prowler service (docdb, neptune) that audits them properly.
+# DocumentDB and Neptune share the RDS control plane, so their resources are returned
+# by describe_db_* calls. Each one has its own dedicated Prowler service.
 NON_RDS_ENGINES = ["docdb", "neptune"]
 
 

tests/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration_test.py

@@ -851,11 +851,11 @@ class Test_rds_instance_certificate_expiration:
             result = check.execute()
 
             assert len(result) == 1
-            assert result[0].status == "MANUAL"
+            assert result[0].status == "PASS"
             assert result[0].check_metadata.Severity == "informational"
             assert (
                 result[0].status_extended
-                == "RDS Instance db-master-1 certificate expiration could not be determined because no CA certificate information was retrieved."
+                == "RDS Instance db-master-1 does not use a CA certificate."
             )
             assert result[0].resource_id == "db-master-1"
             assert result[0].region == AWS_REGION
@@ -885,8 +885,7 @@ class Test_rds_instance_certificate_expiration:
                 username="test",
                 iam_auth=False,
                 region=AWS_REGION,
-                # The instance reports a CA identifier but DescribeCertificates raised
-                # CertificateNotFound, so no certificate could be collected.
+                # DescribeCertificates failed, so no certificate was collected.
                 ca_cert="rds-ca-rsa2048-g1",
                 endpoint={},
                 cert=[],
@@ -911,10 +910,4 @@ class Test_rds_instance_certificate_expiration:
             check = rds_instance_certificate_expiration()
             result = check.execute()
 
-            assert len(result) == 1
-            assert result[0].status == "MANUAL"
-            assert result[0].check_metadata.Severity == "informational"
-            assert (
-                result[0].status_extended
-                == "RDS Instance db-master-1 certificate expiration could not be determined because no CA certificate information was retrieved."
-            )
+            assert len(result) == 0

tests/providers/aws/services/rds/rds_service_test.py

@@ -146,8 +146,7 @@ class Test_RDS_Service:
         assert db_instance.copy_tags_to_snapshot
         assert db_instance.port == 5432
 
-    # Neptune shares the RDS control plane, so its resources are returned by the RDS
-    # API. They must be skipped because they are audited by the neptune service.
+    # Neptune resources are returned by the RDS API but audited by the neptune service.
     @mock_aws
     def test_neptune_resources_are_excluded(self):
         conn = client("rds", region_name=AWS_REGION_US_EAST_1)