feat(codebuild): add new check to ensure Domain has at least three master nodes

prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.metadata.json

@@ -0,0 +1,32 @@
+{
+  "Provider": "aws",
+  "CheckID": "opensearch_domain_master_nodes_fault_tolerant",
+  "CheckTitle": "OpenSearch Service Domain should have at least three dedicated master nodes",
+  "CheckType": [],
+  "ServiceName": "opensearch",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "arn:partition:es:region:account-id:domain/resource-id",
+  "Severity": "medium",
+  "ResourceType": "AwsOpenSearchServiceDomain",
+  "Description": "OpenSearch Service uses dedicated master nodes to increase cluster stability. A minimum of three dedicated master nodes is recommended to ensure high availability.",
+  "Risk": "If a master node fails, the cluster may become unavailable.",
+  "RelatedUrl": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-dedicatedmasternodes.html#dedicatedmasternodes-number",
+  "Remediation": {
+    "Code": {
+      "CLI": "aws es update-elasticsearch-domain-config --region <region> --domain-name <name> --elasticsearch-cluster-config DedicatedMasterEnabled=true,DedicatedMasterType='<instance_type>',DedicatedMasterCount=3",
+      "NativeIaC": "",
+      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-11",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure that your OpenSearch Service domain has at least three dedicated master nodes",
+      "Url": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-dedicatedmasternodes.html#dedicatedmasternodes-number"
+    }
+  },
+  "Categories": [
+    "redundancy"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.py

@@ -0,0 +1,26 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.opensearch.opensearch_client import (
+    opensearch_client,
+)
+
+
+class opensearch_domain_master_nodes_fault_tolerant(Check):
+    def execute(self):
+        findings = []
+        for domain in opensearch_client.opensearch_domains:
+            if getattr(domain, "dedicated_master_enabled", False):
+                report = Check_Report_AWS(self.metadata())
+                report.resource_id = domain.name
+                report.resource_arn = domain.arn
+                report.region = domain.region
+                report.resource_tags = domain.tags
+                report.status = "PASS"
+                report.status_extended = f"Opensearch domain {domain.name} has {domain.dedicated_master_count} dedicated master nodes, which guarantees fault tolerance on the master nodes."
+
+                if domain.dedicated_master_count < 3:
+                    report.status = "FAIL"
+                    report.status_extended = f"Opensearch domain {domain.name} does not have at least 3 dedicated master nodes."
+
+                findings.append(report)
+
+        return findings