From 50b54d9222b7ce6c2dc8b87137097d8e6f2f8fdf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?=
 <rubendltv22@gmail.com>
Date: Mon, 14 Oct 2024 12:56:13 +0200
Subject: [PATCH] feat(codebuild): add new check to ensure Domain has at least
 three master nodes

---
 .../__init__.py                               |  0
 ..._master_nodes_fault_tolerant.metadata.json | 32 +++++++++++++++++++
 ...arch_domain_master_nodes_fault_tolerant.py | 26 +++++++++++++++
 3 files changed, 58 insertions(+)
 create mode 100644 prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/__init__.py
 create mode 100644 prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.metadata.json
 create mode 100644 prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.py

diff --git a/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/__init__.py b/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.metadata.json b/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.metadata.json
new file mode 100644
index 0000000000..412079d342
--- /dev/null
+++ b/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.metadata.json
@@ -0,0 +1,32 @@
+{
+  "Provider": "aws",
+  "CheckID": "opensearch_domain_master_nodes_fault_tolerant",
+  "CheckTitle": "OpenSearch Service Domain should have at least three dedicated master nodes",
+  "CheckType": [],
+  "ServiceName": "opensearch",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "arn:partition:es:region:account-id:domain/resource-id",
+  "Severity": "medium",
+  "ResourceType": "AwsOpenSearchServiceDomain",
+  "Description": "OpenSearch Service uses dedicated master nodes to increase cluster stability. A minimum of three dedicated master nodes is recommended to ensure high availability.",
+  "Risk": "If a master node fails, the cluster may become unavailable.",
+  "RelatedUrl": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-dedicatedmasternodes.html#dedicatedmasternodes-number",
+  "Remediation": {
+    "Code": {
+      "CLI": "aws es update-elasticsearch-domain-config --region <region> --domain-name <name> --elasticsearch-cluster-config DedicatedMasterEnabled=true,DedicatedMasterType='<instance_type>',DedicatedMasterCount=3",
+      "NativeIaC": "",
+      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html#opensearch-11",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure that your OpenSearch Service domain has at least three dedicated master nodes",
+      "Url": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-dedicatedmasternodes.html#dedicatedmasternodes-number"
+    }
+  },
+  "Categories": [
+    "redundancy"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.py b/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.py
new file mode 100644
index 0000000000..420f635ed0
--- /dev/null
+++ b/prowler/providers/aws/services/opensearch/opensearch_domain_master_nodes_fault_tolerant/opensearch_domain_master_nodes_fault_tolerant.py
@@ -0,0 +1,26 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.opensearch.opensearch_client import (
+    opensearch_client,
+)
+
+
+class opensearch_domain_master_nodes_fault_tolerant(Check):
+    def execute(self):
+        findings = []
+        for domain in opensearch_client.opensearch_domains:
+            if getattr(domain, "dedicated_master_enabled", False):
+                report = Check_Report_AWS(self.metadata())
+                report.resource_id = domain.name
+                report.resource_arn = domain.arn
+                report.region = domain.region
+                report.resource_tags = domain.tags
+                report.status = "PASS"
+                report.status_extended = f"Opensearch domain {domain.name} has {domain.dedicated_master_count} dedicated master nodes, which guarantees fault tolerance on the master nodes."
+
+                if domain.dedicated_master_count < 3:
+                    report.status = "FAIL"
+                    report.status_extended = f"Opensearch domain {domain.name} does not have at least 3 dedicated master nodes."
+
+                findings.append(report)
+
+        return findings