mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 12:31:54 +00:00
fix(rds): use correct API call for cluster parameters (#4150)
This commit is contained in:
Sergio Garcia
@@ -26,6 +26,7 @@ class RDS(AWSService):
|
||||
self.__threading_call__(self.__describe_db_snapshots__)
|
||||
self.__threading_call__(self.__describe_db_snapshot_attributes__)
|
||||
self.__threading_call__(self.__describe_db_clusters__)
|
||||
self.__threading_call__(self.__describe_db_cluster_parameters__)
|
||||
self.__threading_call__(self.__describe_db_cluster_snapshots__)
|
||||
self.__threading_call__(self.__describe_db_cluster_snapshot_attributes__)
|
||||
self.__threading_call__(self.__describe_db_engine_versions__)
|
||||
@@ -237,54 +238,6 @@ class RDS(AWSService):
|
||||
)
|
||||
# We must use a unique value as the dict key to have unique keys
|
||||
self.db_clusters[db_cluster_arn] = db_cluster
|
||||
|
||||
# Get DB Cluster Parameters
|
||||
describe_db_parameters_paginator = (
|
||||
regional_client.get_paginator(
|
||||
"describe_db_parameters"
|
||||
)
|
||||
)
|
||||
try:
|
||||
for (
|
||||
page
|
||||
) in describe_db_parameters_paginator.paginate(
|
||||
DBParameterGroupName=cluster[
|
||||
"DBClusterParameterGroup"
|
||||
]
|
||||
):
|
||||
try:
|
||||
for parameter in page["Parameters"]:
|
||||
if (
|
||||
parameter["ParameterName"]
|
||||
== "rds.force_ssl"
|
||||
):
|
||||
db_cluster.force_ssl = (
|
||||
parameter["ParameterValue"]
|
||||
)
|
||||
if (
|
||||
parameter["ParameterName"]
|
||||
== "require_secure_transport"
|
||||
):
|
||||
db_cluster.require_secure_transport = parameter[
|
||||
"ParameterValue"
|
||||
]
|
||||
|
||||
except Exception as error:
|
||||
logger.error(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
except ClientError as error:
|
||||
if (
|
||||
error.response["Error"]["Code"]
|
||||
== "DBParameterGroupNotFound"
|
||||
):
|
||||
logger.warning(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
except Exception as error:
|
||||
logger.error(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
except Exception as error:
|
||||
logger.error(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
@@ -298,6 +251,51 @@ class RDS(AWSService):
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
|
||||
def __describe_db_cluster_parameters__(self, regional_client):
|
||||
logger.info("RDS - Describe DB Cluster Parameters...")
|
||||
try:
|
||||
for cluster in self.db_clusters.values():
|
||||
if cluster.region == regional_client.region:
|
||||
try:
|
||||
describe_db_cluster_parameters_paginator = (
|
||||
regional_client.get_paginator(
|
||||
"describe_db_cluster_parameters"
|
||||
)
|
||||
)
|
||||
for page in describe_db_cluster_parameters_paginator.paginate(
|
||||
DBClusterParameterGroupName=cluster.parameter_group
|
||||
):
|
||||
for parameter in page["Parameters"]:
|
||||
if parameter["ParameterName"] == "rds.force_ssl":
|
||||
cluster.force_ssl = parameter["ParameterValue"]
|
||||
if (
|
||||
parameter["ParameterName"]
|
||||
== "require_secure_transport"
|
||||
):
|
||||
cluster.require_secure_transport = parameter[
|
||||
"ParameterValue"
|
||||
]
|
||||
except ClientError as error:
|
||||
if (
|
||||
error.response["Error"]["Code"]
|
||||
== "DBClusterParameterGroupName"
|
||||
):
|
||||
logger.warning(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
else:
|
||||
logger.error(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
except Exception as error:
|
||||
logger.error(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
except Exception as error:
|
||||
logger.error(
|
||||
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
|
||||
)
|
||||
|
||||
def __describe_db_cluster_snapshots__(self, regional_client):
|
||||
logger.info("RDS - Describe Cluster Snapshots...")
|
||||
try:
|
||||
@@ -436,8 +434,8 @@ class DBCluster(BaseModel):
|
||||
auto_minor_version_upgrade: bool
|
||||
multi_az: bool
|
||||
parameter_group: str
|
||||
force_ssl: Optional[bool]
|
||||
require_secure_transport: Optional[str]
|
||||
force_ssl: str = "0"
|
||||
require_secure_transport: str = "OFF"
|
||||
region: str
|
||||
tags: Optional[list] = []
|
||||
|
||||
|
||||
+12
-24
@@ -11,6 +11,9 @@ from tests.providers.aws.utils import (
|
||||
)
|
||||
|
||||
make_api_call = botocore.client.BaseClient._make_api_call
|
||||
cluster_arn = (
|
||||
f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1"
|
||||
)
|
||||
|
||||
|
||||
def mock_make_api_call(self, operation_name, kwarg):
|
||||
@@ -160,10 +163,7 @@ class Test_rds_instance_transport_encrypted:
|
||||
)
|
||||
assert result[0].resource_id == "db-cluster-1"
|
||||
assert result[0].region == AWS_REGION_US_EAST_1
|
||||
assert (
|
||||
result[0].resource_arn
|
||||
== f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1"
|
||||
)
|
||||
assert result[0].resource_arn == cluster_arn
|
||||
assert result[0].resource_tags == []
|
||||
|
||||
@mock_aws
|
||||
@@ -433,16 +433,6 @@ class Test_rds_instance_transport_encrypted:
|
||||
MasterUserPassword="password",
|
||||
Tags=[],
|
||||
)
|
||||
conn.modify_db_parameter_group(
|
||||
DBParameterGroupName="test",
|
||||
Parameters=[
|
||||
{
|
||||
"ParameterName": "rds.force_ssl",
|
||||
"ParameterValue": "1",
|
||||
"ApplyMethod": "immediate",
|
||||
},
|
||||
],
|
||||
)
|
||||
from prowler.providers.aws.services.rds.rds_service import RDS
|
||||
|
||||
aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
|
||||
@@ -454,12 +444,14 @@ class Test_rds_instance_transport_encrypted:
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted.rds_client",
|
||||
new=RDS(aws_provider),
|
||||
):
|
||||
) as rds_client:
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted import (
|
||||
rds_instance_transport_encrypted,
|
||||
)
|
||||
|
||||
# Change DB Cluster parameter group to support SSL since Moto does not support it
|
||||
rds_client.db_clusters[cluster_arn].require_secure_transport = "ON"
|
||||
check = rds_instance_transport_encrypted()
|
||||
result = check.execute()
|
||||
|
||||
@@ -471,10 +463,7 @@ class Test_rds_instance_transport_encrypted:
|
||||
)
|
||||
assert result[0].resource_id == "db-cluster-1"
|
||||
assert result[0].region == AWS_REGION_US_EAST_1
|
||||
assert (
|
||||
result[0].resource_arn
|
||||
== f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1"
|
||||
)
|
||||
assert result[0].resource_arn == cluster_arn
|
||||
assert result[0].resource_tags == []
|
||||
|
||||
@mock_aws
|
||||
@@ -517,12 +506,14 @@ class Test_rds_instance_transport_encrypted:
|
||||
with mock.patch(
|
||||
"prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted.rds_client",
|
||||
new=RDS(aws_provider),
|
||||
):
|
||||
) as rds_client:
|
||||
# Test Check
|
||||
from prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted import (
|
||||
rds_instance_transport_encrypted,
|
||||
)
|
||||
|
||||
# Change DB Cluster parameter group to support SSL since Moto does not support it
|
||||
rds_client.db_clusters[cluster_arn].require_secure_transport = "ON"
|
||||
check = rds_instance_transport_encrypted()
|
||||
result = check.execute()
|
||||
|
||||
@@ -534,8 +525,5 @@ class Test_rds_instance_transport_encrypted:
|
||||
)
|
||||
assert result[0].resource_id == "db-cluster-1"
|
||||
assert result[0].region == AWS_REGION_US_EAST_1
|
||||
assert (
|
||||
result[0].resource_arn
|
||||
== f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1"
|
||||
)
|
||||
assert result[0].resource_arn == cluster_arn
|
||||
assert result[0].resource_tags == []
|
||||
|
||||
@@ -211,8 +211,8 @@ class Test_RDS_Service:
|
||||
def test__describe_db_clusters__(self):
|
||||
conn = client("rds", region_name=AWS_REGION_US_EAST_1)
|
||||
cluster_id = "db-master-1"
|
||||
conn.create_db_parameter_group(
|
||||
DBParameterGroupName="test",
|
||||
conn.create_db_cluster_parameter_group(
|
||||
DBClusterParameterGroupName="test",
|
||||
DBParameterGroupFamily="default.postgres9.3",
|
||||
Description="test parameter group",
|
||||
)
|
||||
@@ -260,6 +260,8 @@ class Test_RDS_Service:
|
||||
{"Key": "test", "Value": "test"},
|
||||
]
|
||||
assert rds.db_clusters[db_cluster_arn].parameter_group == "test"
|
||||
assert rds.db_clusters[db_cluster_arn].force_ssl == "0"
|
||||
assert rds.db_clusters[db_cluster_arn].require_secure_transport == "OFF"
|
||||
|
||||
# Test RDS Describe DB Cluster Snapshots
|
||||
@mock_aws
|
||||
|
||||
Reference in New Issue
Block a user