diff --git a/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.py b/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.py index 430956a79a..75e2ad8f46 100644 --- a/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.py +++ b/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.py @@ -16,7 +16,10 @@ class rds_instance_event_subscription_security_groups(Check): ) report.region = db_event.region if db_event.source_type == "db-security-group" and db_event.enabled: - if db_event.event_list == []: + if db_event.event_list == [] or set(db_event.event_list) == { + "failure", + "configuration change", + }: report.resource_id = db_event.id report.resource_arn = db_event.arn report.status = "PASS" diff --git a/tests/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups_test.py b/tests/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups_test.py index b82cad3487..f907a324bd 100644 --- a/tests/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups_test.py +++ b/tests/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups_test.py @@ -349,3 +349,63 @@ class Test_rds_instance__no_event_subscriptions: assert result[0].region == AWS_REGION_US_EAST_1 assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert result[0].resource_arn == RDS_ACCOUNT_ARN + + @mock_aws + def test_rds_security_event_subscription_both_enabled(self): + conn = client("rds", region_name=AWS_REGION_US_EAST_1) + conn.create_db_parameter_group( + DBParameterGroupName="test", + DBParameterGroupFamily="default.aurora-postgresql14", + Description="test parameter group", + ) + conn.create_db_instance( + DBInstanceIdentifier="db-master-1", + AllocatedStorage=10, + Engine="aurora-postgresql", + DBName="aurora-postgres", + DBInstanceClass="db.m1.small", + DBParameterGroupName="test", + DBClusterIdentifier="db-cluster-1", + ) + conn.create_event_subscription( + SubscriptionName="TestSub", + SnsTopicArn=f"arn:aws:sns:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:test", + SourceType="db-security-group", + EventCategories=["configuration change", "failure"], + Enabled=True, + Tags=[ + {"Key": "test", "Value": "testing"}, + ], + ) + from prowler.providers.aws.services.rds.rds_service import RDS + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ): + with mock.patch( + "prowler.providers.aws.services.rds.rds_instance_event_subscription_security_groups.rds_instance_event_subscription_security_groups.rds_client", + new=RDS(aws_provider), + ): + # Test Check + from prowler.providers.aws.services.rds.rds_instance_event_subscription_security_groups.rds_instance_event_subscription_security_groups import ( + rds_instance_event_subscription_security_groups, + ) + + check = rds_instance_event_subscription_security_groups() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "RDS security group events are subscribed." + ) + assert result[0].resource_id == "TestSub" + assert result[0].region == AWS_REGION_US_EAST_1 + assert ( + result[0].resource_arn + == f"arn:aws:rds:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:es:TestSub" + )