From 589f6518f829f41e0d3f457134107eb7678ca773 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 25 Aug 2025 07:51:39 +0200 Subject: [PATCH] chore: change the reference URLs ti new field called AdditionalURLs --- .../neptune_cluster_backup_enabled.metadata.json | 8 +++++++- .../neptune_cluster_copy_tags_to_snapshots.metadata.json | 8 +++++++- .../neptune_cluster_deletion_protection.metadata.json | 5 ++++- ...ptune_cluster_iam_authentication_enabled.metadata.json | 8 +++++++- ...tune_cluster_integration_cloudwatch_logs.metadata.json | 8 +++++++- .../neptune_cluster_multi_az.metadata.json | 6 +++++- .../neptune_cluster_public_snapshot.metadata.json | 6 +++++- .../neptune_cluster_snapshot_encrypted.metadata.json | 8 ++++++-- .../neptune_cluster_storage_encrypted.metadata.json | 6 +++++- .../neptune_cluster_uses_public_subnet.metadata.json | 6 +++++- 10 files changed, 58 insertions(+), 11 deletions(-) diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.metadata.json index f95a8fbc9c..10dc6541d8 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_backup_enabled/neptune_cluster_backup_enabled.metadata.json @@ -12,7 +12,13 @@ "ResourceType": "AwsRdsDbCluster", "Description": "*Neptune DB cluster* automated backup is enabled and retention days are more than the required minimum retention period (default to 7 days).", "Risk": "**Insufficient backup retention** reduces the ability to recover from data corruption, accidental deletion, or ransomware, impacting **availability** and **integrity**.\n\n- Prevents point-in-time recovery to required dates\n- Increases downtime, irreversible data loss, and compliance violations", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-5,https://trendmicro.com/cloudoneconformity/knowledge-base/aws/Neptune/sufficient-backup-retention-period.html,https://support.icompaas.com/support/solutions/articles/62000233327-check-for-neptune-clusters-backup-retention-period,https://asecure.cloud/a/p_configrule_neptune_cluster_backup_retention_check/", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_backup_enabled", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-5", + "https://trendmicro.com/cloudoneconformity/knowledge-base/aws/Neptune/sufficient-backup-retention-period.html", + "https://support.icompaas.com/support/solutions/articles/62000233327-check-for-neptune-clusters-backup-retention-period", + "https://asecure.cloud/a/p_configrule_neptune_cluster_backup_retention_check/" + ], "Remediation": { "Code": { "CLI": "aws neptune modify-db-cluster --db-cluster-identifier --backup-retention-period 7 --apply-immediately", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.metadata.json index ebd199998e..1e3fb81158 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_copy_tags_to_snapshots/neptune_cluster_copy_tags_to_snapshots.metadata.json @@ -12,7 +12,13 @@ "ResourceType": "AwsRdsDbCluster", "Description": "*Neptune DB cluster* is configured to copy all tags to snapshots when snapshots are created.", "Risk": "**Missing snapshot tags** weakens governance across confidentiality, integrity, and availability.\n\n- **Access control**: tag-based IAM conditions may not apply to snapshots, enabling unauthorized restore or copy\n- **Operational**: recovery, retention, and cost tracking can fail due to unidentifiable or orphaned snapshots", - "RelatedUrl": "https://docs.aws.amazon.com/neptune/latest/userguide/tagging.html#tagging-overview,https://www.cloudanix.com/docs/aws/audit/rdsmonitoring/rules/neptune_cluster_copy_tags_to_snapshot_enabled,https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-8,https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_copy_tags_to_snapshots", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/neptune/latest/userguide/tagging.html#tagging-overview", + "https://www.cloudanix.com/docs/aws/audit/rdsmonitoring/rules/neptune_cluster_copy_tags_to_snapshot_enabled", + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-8", + "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/bc-aws-2-60" + ], "Remediation": { "Code": { "CLI": "aws neptune modify-db-cluster --db-cluster-identifier --copy-tags-to-snapshot --apply-immediately", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.metadata.json index d0b03792cb..4820b3e059 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.metadata.json @@ -14,7 +14,10 @@ "ResourceType": "Other", "Description": "*Neptune DB cluster* has **deletion protection** enabled.", "Risk": "Absence of **deletion protection** weakens *availability* and *integrity*: clusters can be removed by accidental admin actions, rogue automation, or compromised credentials.\n\nCluster deletion causes immediate service outage, potential permanent data loss, and extended recovery time if backups or restores are insufficient.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-4", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_deletion_protection", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-4" + ], "Remediation": { "Code": { "CLI": "aws neptune modify-db-cluster --db-cluster-identifier --deletion-protection --apply-immediately", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.metadata.json index 0aa1756ffb..9856bad9ae 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_iam_authentication_enabled/neptune_cluster_iam_authentication_enabled.metadata.json @@ -14,7 +14,13 @@ "ResourceType": "AwsRdsDbCluster", "Description": "*Neptune DB clusters* are evaluated for **IAM database authentication**. \n\nIf this setting is enabled, the cluster supports IAM-based authentication.\nIf disabled, the cluster requires traditional database credentials instead.", "Risk": "**Disabled IAM database authentication** weakens confidentiality and integrity of the database.\n\n- Static or embedded DB credentials can be stolen or reused, enabling unauthorized queries and data exfiltration\n- Attackers may bypass centralized access controls, escalate privileges, and move laterally without IAM-based audit trails", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-7,https://docs.aws.amazon.com/config/latest/developerguide/neptune-cluster-iam-database-authentication.html,https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Neptune/iam-db-authentication.html#,https://hub.steampipe.io/plugins/turbot/terraform/queries/neptune/neptune_cluster_iam_authentication_enabled", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_iam_authentication_enabled", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-7", + "https://docs.aws.amazon.com/config/latest/developerguide/neptune-cluster-iam-database-authentication.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Neptune/iam-db-authentication.html#", + "https://hub.steampipe.io/plugins/turbot/terraform/queries/neptune/neptune_cluster_iam_authentication_enabled" + ], "Remediation": { "Code": { "CLI": "aws neptune modify-db-cluster --db-cluster-identifier --enable-iam-database-authentication --apply-immediately", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.metadata.json index 0c0c6fbd15..6fac027cb5 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_integration_cloudwatch_logs/neptune_cluster_integration_cloudwatch_logs.metadata.json @@ -13,7 +13,13 @@ "ResourceType": "Other", "Description": "*Neptune DB cluster* is inspected for CloudWatch export of **audit** events. The finding indicates whether the cluster publishes `audit` logs to CloudWatch; a *FAIL* means the `audit` export is not enabled and audit records are not being forwarded to CloudWatch for centralized logging and review.", "Risk": "Missing **audit logs** reduces **detectability** and **accountability**: \n\n- investigators cannot reconstruct queries, client origins, or timeline\n- unauthorized queries, data exfiltration, or privilege misuse may go undetected\n\nThis degrades confidentiality and integrity and slows incident response.", - "RelatedUrl": "https://docs.aws.amazon.com/neptune/latest/userguide/auditing.html,https://docs.aws.amazon.com/neptune/latest/userguide/cloudwatch-logs.html,https://cloudanix.com/docs/aws/audit/rdsmonitoring/rules/neptune_cluster_cloudwatch_log_export_enabled_remediation,https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-2", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_integration_cloudwatch_logs", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/neptune/latest/userguide/auditing.html", + "https://docs.aws.amazon.com/neptune/latest/userguide/cloudwatch-logs.html", + "https://cloudanix.com/docs/aws/audit/rdsmonitoring/rules/neptune_cluster_cloudwatch_log_export_enabled_remediation", + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-2" + ], "Remediation": { "Code": { "CLI": "aws neptune modify-db-cluster --db-cluster-identifier --cloudwatch-logs-export-configuration '{\"EnableLogTypes\":[\"audit\"]}'", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.metadata.json index 7dfb928d0e..751d7bb138 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_multi_az/neptune_cluster_multi_az.metadata.json @@ -14,7 +14,11 @@ "ResourceType": "AwsRdsDbCluster", "Description": "*Amazon Neptune DB clusters* are evaluated for `Multi-AZ` deployment by checking whether the cluster has read-replica instances distributed across multiple Availability Zones.\n\nA failing result indicates the cluster is deployed in a single AZ and lacks read-replicas that enable automatic promotion and cross‑AZ failover.", "Risk": "**Single-AZ deployment** creates a clear availability single point of failure.\n\n- **Availability**: AZ outage or maintenance can cause prolonged downtime until the primary is rebuilt.\n- **Integrity/Recovery**: Manual recovery increases risk of configuration errors and longer RTOs, impacting operations and compliance.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-9,https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Neptune/multi-az.html#", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_multi_az", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-9", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Neptune/multi-az.html#" + ], "Remediation": { "Code": { "CLI": "", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.metadata.json index 4b85548ed4..3d623b8725 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_public_snapshot/neptune_cluster_public_snapshot.metadata.json @@ -14,7 +14,11 @@ "ResourceType": "AwsRdsDbClusterSnapshot", "Description": "*Neptune DB manual cluster snapshot* is evaluated to determine if its restore attributes allow access to *all AWS accounts* (public).\n\nA **FAIL** means the snapshot is publicly shared and can be copied or restored by any AWS account; **PASS** means it is not shared publicly.", "Risk": "**Public snapshots** compromise confidentiality of stored data and metadata.\n\nAttackers or third parties can:\n- Copy or restore snapshots to external accounts.\n- Access sensitive data contained in the snapshot.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-3,https://docs.aws.amazon.com/config/latest/developerguide/neptune-cluster-snapshot-public-prohibited.html", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_public_snapshot", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-3", + "https://docs.aws.amazon.com/config/latest/developerguide/neptune-cluster-snapshot-public-prohibited.html" + ], "Remediation": { "Code": { "CLI": "aws neptune modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier --attribute-name restore --values-to-remove all", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.metadata.json index 1c182928d6..804116ebfa 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_snapshot_encrypted/neptune_cluster_snapshot_encrypted.metadata.json @@ -12,9 +12,13 @@ "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbClusterSnapshot", - "Description": "*Neptune DB cluster snapshot* is encryoted at rest. The evaluation looks at whether each snapshot’s encrypted attribute is enabled, confirming that the data is protected while stored.", + "Description": "*Neptune DB cluster snapshot* is encryoted at rest. The evaluation looks at whether each snapshot's encrypted attribute is enabled, confirming that the data is protected while stored.", "Risk": "**Unencrypted Neptune snapshots** undermine data confidentiality. If accessed or shared due to compromised credentials or misconfiguration, attackers can restore or download snapshot contents, enabling **data exfiltration**, and exposure of sensitive records. This weakens overall data protection posture.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-6,https://docs.aws.amazon.com/neptune/latest/userguide/backup-restore-share-snapshot.html", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_snapshot_encrypted", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-6", + "https://docs.aws.amazon.com/neptune/latest/userguide/backup-restore-share-snapshot.html" + ], "Remediation": { "Code": { "CLI": "aws rds copy-db-cluster-snapshot --source-db-cluster-snapshot-identifier --target-db-cluster-snapshot-identifier --kms-key-id ", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.metadata.json index a034493f30..ccb5da2807 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_storage_encrypted/neptune_cluster_storage_encrypted.metadata.json @@ -13,7 +13,11 @@ "ResourceType": "Other", "Description": "*Neptune DB cluster* is evaluated for **encryption at rest**. Indicating the cluster's underlying storage is not encrypted.", "Risk": "**Unencrypted Neptune storage** reduces confidentiality of stored data and metadata and increases attack surface.\n\nPossible impacts:\n- Unauthorized access or data exfiltration from underlying volumes or snapshots\n- Greater blast radius from leaked or shared snapshots", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-1,https://docs.aws.amazon.com/neptune/latest/userguide/encrypt.html", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_storage_encrypted", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-1", + "https://docs.aws.amazon.com/neptune/latest/userguide/encrypt.html" + ], "Remediation": { "Code": { "CLI": "", diff --git a/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.metadata.json b/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.metadata.json index 47a9d243f5..aefdd970f1 100644 --- a/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.metadata.json +++ b/prowler/providers/aws/services/neptune/neptune_cluster_uses_public_subnet/neptune_cluster_uses_public_subnet.metadata.json @@ -13,7 +13,11 @@ "ResourceType": "AwsRdsDbCluster", "Description": "*Neptune cluster* is associated with one or more **public subnets**.", "Risk": "A *Neptune cluster* in a **public subnet** increases exposure across the CIA triad:\n\n- **Confidentiality**: direct access enables credential attacks and data exfiltration\n- **Integrity**: attackers may modify or inject graph data\n- **Availability**: public reachability allows DDoS or remote exploitation, causing downtime", - "RelatedUrl": "https://docs.aws.amazon.com/neptune/latest/userguide/get-started-vpc.html,https://docs.aws.amazon.com/neptune/latest/userguide/feature-overview-endpoints.html", + "RelatedUrl": "https://hub.prowler.com/check/neptune_cluster_uses_public_subnet", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/neptune/latest/userguide/get-started-vpc.html", + "https://docs.aws.amazon.com/neptune/latest/userguide/feature-overview-endpoints.html" + ], "Remediation": { "Code": { "CLI": "",