ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(rds): Check Aurora clusters properly for backup plan (#5594)

Browse Source 
Co-authored-by: Sergio <sergio@prowler.com>
This commit is contained in:
sansns-aws
2024-11-04 13:20:22 -05:00
committed by GitHub
parent 694cee1afb
commit 6c818cbcc3
1 changed files with 27 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.py
+27 -19
View File
@@ -7,26 +7,34 @@ class rds_instance_protected_by_backup_plan(Check):
def execute(self):
findings = []
for db_instance_arn, db_instance in rds_client.db_instances.items():
report = Check_Report_AWS(self.metadata())
report.region = db_instance.region
report.resource_id = db_instance.id
report.resource_arn = db_instance_arn
report.resource_tags = db_instance.tags
report.status = "FAIL"
report.status_extended = (
f"RDS Instance {db_instance.id} is not protected by a backup plan."
)
if (
db_instance_arn in backup_client.protected_resources
or f"arn:{rds_client.audited_partition}:rds:*:*:instance:*"
in backup_client.protected_resources
or "*" in backup_client.protected_resources
):
report.status = "PASS"
# Makes sure the instance is not running with an Aurora engine
# Aurora backup plans require enabling it separately from RDS
if db_instance.engine not in [
"aurora-mysql",
"aurora",
"aurora-postgresql",
]:
report = Check_Report_AWS(self.metadata())
report.region = db_instance.region
report.resource_id = db_instance.id
report.resource_arn = db_instance_arn
report.resource_tags = db_instance.tags
report.status = "FAIL"
report.status_extended = (
f"RDS Instance {db_instance.id} is protected by a backup plan."
f"RDS Instance {db_instance.id} is not protected by a backup plan."
)
findings.append(report)
if (
db_instance_arn in backup_client.protected_resources
or f"arn:{rds_client.audited_partition}:rds:*:*:instance:*"
in backup_client.protected_resources
or "*" in backup_client.protected_resources
):
report.status = "PASS"
report.status_extended = (
f"RDS Instance {db_instance.id} is protected by a backup plan."
)
findings.append(report)
return findings