From 109664515a94fd79f2243ea73ac98544bdde2353 Mon Sep 17 00:00:00 2001 From: pedrooot Date: Wed, 5 Aug 2026 10:05:46 +0200 Subject: [PATCH] chore(revision): change logic --- ...rds-certificate-expiration-neptune-fp.fixed.md | 2 +- .../rds_instance_certificate_expiration.py | 14 +++++++------- prowler/providers/aws/services/rds/rds_service.py | 6 ++---- .../rds_instance_certificate_expiration_test.py | 15 ++++----------- .../aws/services/rds/rds_service_test.py | 3 +-- 5 files changed, 15 insertions(+), 25 deletions(-) diff --git a/prowler/changelog.d/rds-certificate-expiration-neptune-fp.fixed.md b/prowler/changelog.d/rds-certificate-expiration-neptune-fp.fixed.md index 3995d8451b..c8806c4ded 100644 --- a/prowler/changelog.d/rds-certificate-expiration-neptune-fp.fixed.md +++ b/prowler/changelog.d/rds-certificate-expiration-neptune-fp.fixed.md @@ -1 +1 @@ -`rds_instance_certificate_expiration` no longer reports false positives on Neptune resources, which are now excluded from the RDS inventory, or on instances whose CA certificate could not be retrieved, which are reported as MANUAL instead of a critical failure +`rds_instance_certificate_expiration` no longer reports false positives on Neptune resources, which are now excluded from the RDS inventory, or on instances with no CA certificate, which now PASS instead of failing as expired; instances whose declared CA certificate could not be retrieved are skipped, since there is no data to evaluate diff --git a/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.py b/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.py index 194edcbde0..e85db17c5a 100644 --- a/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.py +++ b/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.py @@ -17,14 +17,14 @@ class rds_instance_certificate_expiration(Check): for db_instance in rds_client.db_instances.values(): report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance) - # An empty certificate list means the CA certificate could not be - # retrieved, not that the certificate is expired. Reporting it as a - # failure would be a false positive, so it is flagged for manual review. + # No certificate data: PASS if the instance has no CA certificate, + # no finding if it has one that could not be retrieved. if not db_instance.cert: - report.status = "MANUAL" - report.check_metadata.Severity = Severity.informational - report.status_extended = f"RDS Instance {db_instance.id} certificate expiration could not be determined because no CA certificate information was retrieved." - findings.append(report) + if not db_instance.ca_cert: + report.status = "PASS" + report.check_metadata.Severity = Severity.informational + report.status_extended = f"RDS Instance {db_instance.id} does not use a CA certificate." + findings.append(report) continue report.status = "FAIL" diff --git a/prowler/providers/aws/services/rds/rds_service.py b/prowler/providers/aws/services/rds/rds_service.py index e0fc93be3f..0e2befd328 100644 --- a/prowler/providers/aws/services/rds/rds_service.py +++ b/prowler/providers/aws/services/rds/rds_service.py @@ -8,10 +8,8 @@ from prowler.lib.logger import logger from prowler.lib.scan_filters.scan_filters import is_resource_filtered from prowler.providers.aws.lib.service.service import AWSService -# Engines that are returned by the RDS API but belong to a different AWS service. -# DocumentDB and Neptune share the RDS control plane, so their resources show up in -# describe_db_* calls even though RDS checks do not apply to them. Each one has its -# own dedicated Prowler service (docdb, neptune) that audits them properly. +# DocumentDB and Neptune share the RDS control plane, so their resources are returned +# by describe_db_* calls. Each one has its own dedicated Prowler service. NON_RDS_ENGINES = ["docdb", "neptune"] diff --git a/tests/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration_test.py b/tests/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration_test.py index 6503795b2d..03e0096578 100644 --- a/tests/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration_test.py +++ b/tests/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration_test.py @@ -851,11 +851,11 @@ class Test_rds_instance_certificate_expiration: result = check.execute() assert len(result) == 1 - assert result[0].status == "MANUAL" + assert result[0].status == "PASS" assert result[0].check_metadata.Severity == "informational" assert ( result[0].status_extended - == "RDS Instance db-master-1 certificate expiration could not be determined because no CA certificate information was retrieved." + == "RDS Instance db-master-1 does not use a CA certificate." ) assert result[0].resource_id == "db-master-1" assert result[0].region == AWS_REGION @@ -885,8 +885,7 @@ class Test_rds_instance_certificate_expiration: username="test", iam_auth=False, region=AWS_REGION, - # The instance reports a CA identifier but DescribeCertificates raised - # CertificateNotFound, so no certificate could be collected. + # DescribeCertificates failed, so no certificate was collected. ca_cert="rds-ca-rsa2048-g1", endpoint={}, cert=[], @@ -911,10 +910,4 @@ class Test_rds_instance_certificate_expiration: check = rds_instance_certificate_expiration() result = check.execute() - assert len(result) == 1 - assert result[0].status == "MANUAL" - assert result[0].check_metadata.Severity == "informational" - assert ( - result[0].status_extended - == "RDS Instance db-master-1 certificate expiration could not be determined because no CA certificate information was retrieved." - ) + assert len(result) == 0 diff --git a/tests/providers/aws/services/rds/rds_service_test.py b/tests/providers/aws/services/rds/rds_service_test.py index f22baea651..92bc43dbe8 100644 --- a/tests/providers/aws/services/rds/rds_service_test.py +++ b/tests/providers/aws/services/rds/rds_service_test.py @@ -146,8 +146,7 @@ class Test_RDS_Service: assert db_instance.copy_tags_to_snapshot assert db_instance.port == 5432 - # Neptune shares the RDS control plane, so its resources are returned by the RDS - # API. They must be skipped because they are audited by the neptune service. + # Neptune resources are returned by the RDS API but audited by the neptune service. @mock_aws def test_neptune_resources_are_excluded(self): conn = client("rds", region_name=AWS_REGION_US_EAST_1)