From 51c2158563a0ecfee4b5309f793ec8f6527deff2 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Thu, 12 Dec 2024 17:47:11 +0100 Subject: [PATCH] fix(rds): add invalid SG to status_extended (#6170) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Pedro Martín --- .../rds_instance_no_public_access.py | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py b/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py index ca0e1b3beb..dffa850693 100644 --- a/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py +++ b/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.py @@ -37,18 +37,21 @@ class rds_instance_no_public_access(Check): ): report.status_extended = f"RDS Instance {db_instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) has {db_instance.engine} port {db_instance_port} open to the Internet at endpoint {db_instance.endpoint.get('Address')} but is not in a public subnet." public_sg = True + if db_instance.subnet_ids: + for subnet_id in db_instance.subnet_ids: + if ( + subnet_id in vpc_client.vpc_subnets + and vpc_client.vpc_subnets[ + subnet_id + ].public + ): + report.status = "FAIL" + report.status_extended = f"RDS Instance {db_instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) has {db_instance.engine} port {db_instance_port} open to the Internet at endpoint {db_instance.endpoint.get('Address')} in a public subnet {subnet_id}." + break + if public_sg: break if public_sg: break - if db_instance.subnet_ids: - for subnet_id in db_instance.subnet_ids: - if ( - subnet_id in vpc_client.vpc_subnets - and vpc_client.vpc_subnets[subnet_id].public - ): - report.status = "FAIL" - report.status_extended = f"RDS Instance {db_instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) has {db_instance.engine} port {db_instance_port} open to the Internet at endpoint {db_instance.endpoint.get('Address')} in a public subnet {subnet_id}." - break findings.append(report)