diff --git a/prowler/providers/aws/services/rds/rds_service.py b/prowler/providers/aws/services/rds/rds_service.py index 53434471e6..3689253d63 100644 --- a/prowler/providers/aws/services/rds/rds_service.py +++ b/prowler/providers/aws/services/rds/rds_service.py @@ -26,6 +26,7 @@ class RDS(AWSService): self.__threading_call__(self.__describe_db_snapshots__) self.__threading_call__(self.__describe_db_snapshot_attributes__) self.__threading_call__(self.__describe_db_clusters__) + self.__threading_call__(self.__describe_db_cluster_parameters__) self.__threading_call__(self.__describe_db_cluster_snapshots__) self.__threading_call__(self.__describe_db_cluster_snapshot_attributes__) self.__threading_call__(self.__describe_db_engine_versions__) @@ -237,54 +238,6 @@ class RDS(AWSService): ) # We must use a unique value as the dict key to have unique keys self.db_clusters[db_cluster_arn] = db_cluster - - # Get DB Cluster Parameters - describe_db_parameters_paginator = ( - regional_client.get_paginator( - "describe_db_parameters" - ) - ) - try: - for ( - page - ) in describe_db_parameters_paginator.paginate( - DBParameterGroupName=cluster[ - "DBClusterParameterGroup" - ] - ): - try: - for parameter in page["Parameters"]: - if ( - parameter["ParameterName"] - == "rds.force_ssl" - ): - db_cluster.force_ssl = ( - parameter["ParameterValue"] - ) - if ( - parameter["ParameterName"] - == "require_secure_transport" - ): - db_cluster.require_secure_transport = parameter[ - "ParameterValue" - ] - - except Exception as error: - logger.error( - f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" - ) - except ClientError as error: - if ( - error.response["Error"]["Code"] - == "DBParameterGroupNotFound" - ): - logger.warning( - f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" - ) - except Exception as error: - logger.error( - f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" - ) except Exception as error: logger.error( f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" @@ -298,6 +251,51 @@ class RDS(AWSService): f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + def __describe_db_cluster_parameters__(self, regional_client): + logger.info("RDS - Describe DB Cluster Parameters...") + try: + for cluster in self.db_clusters.values(): + if cluster.region == regional_client.region: + try: + describe_db_cluster_parameters_paginator = ( + regional_client.get_paginator( + "describe_db_cluster_parameters" + ) + ) + for page in describe_db_cluster_parameters_paginator.paginate( + DBClusterParameterGroupName=cluster.parameter_group + ): + for parameter in page["Parameters"]: + if parameter["ParameterName"] == "rds.force_ssl": + cluster.force_ssl = parameter["ParameterValue"] + if ( + parameter["ParameterName"] + == "require_secure_transport" + ): + cluster.require_secure_transport = parameter[ + "ParameterValue" + ] + except ClientError as error: + if ( + error.response["Error"]["Code"] + == "DBClusterParameterGroupName" + ): + logger.warning( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + else: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + def __describe_db_cluster_snapshots__(self, regional_client): logger.info("RDS - Describe Cluster Snapshots...") try: @@ -436,8 +434,8 @@ class DBCluster(BaseModel): auto_minor_version_upgrade: bool multi_az: bool parameter_group: str - force_ssl: Optional[bool] - require_secure_transport: Optional[str] + force_ssl: str = "0" + require_secure_transport: str = "OFF" region: str tags: Optional[list] = [] diff --git a/tests/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted_test.py b/tests/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted_test.py index fd07dffae6..5c5cdbb0e6 100644 --- a/tests/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted_test.py +++ b/tests/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted_test.py @@ -11,6 +11,9 @@ from tests.providers.aws.utils import ( ) make_api_call = botocore.client.BaseClient._make_api_call +cluster_arn = ( + f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1" +) def mock_make_api_call(self, operation_name, kwarg): @@ -160,10 +163,7 @@ class Test_rds_instance_transport_encrypted: ) assert result[0].resource_id == "db-cluster-1" assert result[0].region == AWS_REGION_US_EAST_1 - assert ( - result[0].resource_arn - == f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1" - ) + assert result[0].resource_arn == cluster_arn assert result[0].resource_tags == [] @mock_aws @@ -433,16 +433,6 @@ class Test_rds_instance_transport_encrypted: MasterUserPassword="password", Tags=[], ) - conn.modify_db_parameter_group( - DBParameterGroupName="test", - Parameters=[ - { - "ParameterName": "rds.force_ssl", - "ParameterValue": "1", - "ApplyMethod": "immediate", - }, - ], - ) from prowler.providers.aws.services.rds.rds_service import RDS aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) @@ -454,12 +444,14 @@ class Test_rds_instance_transport_encrypted: with mock.patch( "prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted.rds_client", new=RDS(aws_provider), - ): + ) as rds_client: # Test Check from prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted import ( rds_instance_transport_encrypted, ) + # Change DB Cluster parameter group to support SSL since Moto does not support it + rds_client.db_clusters[cluster_arn].require_secure_transport = "ON" check = rds_instance_transport_encrypted() result = check.execute() @@ -471,10 +463,7 @@ class Test_rds_instance_transport_encrypted: ) assert result[0].resource_id == "db-cluster-1" assert result[0].region == AWS_REGION_US_EAST_1 - assert ( - result[0].resource_arn - == f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1" - ) + assert result[0].resource_arn == cluster_arn assert result[0].resource_tags == [] @mock_aws @@ -517,12 +506,14 @@ class Test_rds_instance_transport_encrypted: with mock.patch( "prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted.rds_client", new=RDS(aws_provider), - ): + ) as rds_client: # Test Check from prowler.providers.aws.services.rds.rds_instance_transport_encrypted.rds_instance_transport_encrypted import ( rds_instance_transport_encrypted, ) + # Change DB Cluster parameter group to support SSL since Moto does not support it + rds_client.db_clusters[cluster_arn].require_secure_transport = "ON" check = rds_instance_transport_encrypted() result = check.execute() @@ -534,8 +525,5 @@ class Test_rds_instance_transport_encrypted: ) assert result[0].resource_id == "db-cluster-1" assert result[0].region == AWS_REGION_US_EAST_1 - assert ( - result[0].resource_arn - == f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:cluster:db-cluster-1" - ) + assert result[0].resource_arn == cluster_arn assert result[0].resource_tags == [] diff --git a/tests/providers/aws/services/rds/rds_service_test.py b/tests/providers/aws/services/rds/rds_service_test.py index 0695249ac7..4d1ad27150 100644 --- a/tests/providers/aws/services/rds/rds_service_test.py +++ b/tests/providers/aws/services/rds/rds_service_test.py @@ -211,8 +211,8 @@ class Test_RDS_Service: def test__describe_db_clusters__(self): conn = client("rds", region_name=AWS_REGION_US_EAST_1) cluster_id = "db-master-1" - conn.create_db_parameter_group( - DBParameterGroupName="test", + conn.create_db_cluster_parameter_group( + DBClusterParameterGroupName="test", DBParameterGroupFamily="default.postgres9.3", Description="test parameter group", ) @@ -260,6 +260,8 @@ class Test_RDS_Service: {"Key": "test", "Value": "test"}, ] assert rds.db_clusters[db_cluster_arn].parameter_group == "test" + assert rds.db_clusters[db_cluster_arn].force_ssl == "0" + assert rds.db_clusters[db_cluster_arn].require_secure_transport == "OFF" # Test RDS Describe DB Cluster Snapshots @mock_aws