From 6c818cbcc32acbf1af421bdf69d4f27acb7e0b13 Mon Sep 17 00:00:00 2001
From: sansns-aws <107269923+sansns@users.noreply.github.com>
Date: Mon, 4 Nov 2024 13:20:22 -0500
Subject: [PATCH] fix(rds): Check Aurora clusters properly for backup plan
 (#5594)

Co-authored-by: Sergio <sergio@prowler.com>
---
 .../rds_instance_protected_by_backup_plan.py  | 46 +++++++++++--------
 1 file changed, 27 insertions(+), 19 deletions(-)

diff --git a/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.py b/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.py
index 435413e6ca..948e9cc7fe 100644
--- a/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.py
+++ b/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.py
@@ -7,26 +7,34 @@ class rds_instance_protected_by_backup_plan(Check):
     def execute(self):
         findings = []
         for db_instance_arn, db_instance in rds_client.db_instances.items():
-            report = Check_Report_AWS(self.metadata())
-            report.region = db_instance.region
-            report.resource_id = db_instance.id
-            report.resource_arn = db_instance_arn
-            report.resource_tags = db_instance.tags
-            report.status = "FAIL"
-            report.status_extended = (
-                f"RDS Instance {db_instance.id} is not protected by a backup plan."
-            )
-
-            if (
-                db_instance_arn in backup_client.protected_resources
-                or f"arn:{rds_client.audited_partition}:rds:*:*:instance:*"
-                in backup_client.protected_resources
-                or "*" in backup_client.protected_resources
-            ):
-                report.status = "PASS"
+            # Makes sure the instance is not running with an Aurora engine
+            # Aurora backup plans require enabling it separately from RDS
+            if db_instance.engine not in [
+                "aurora-mysql",
+                "aurora",
+                "aurora-postgresql",
+            ]:
+                report = Check_Report_AWS(self.metadata())
+                report.region = db_instance.region
+                report.resource_id = db_instance.id
+                report.resource_arn = db_instance_arn
+                report.resource_tags = db_instance.tags
+                report.status = "FAIL"
                 report.status_extended = (
-                    f"RDS Instance {db_instance.id} is protected by a backup plan."
+                    f"RDS Instance {db_instance.id} is not protected by a backup plan."
                 )
 
-            findings.append(report)
+                if (
+                    db_instance_arn in backup_client.protected_resources
+                    or f"arn:{rds_client.audited_partition}:rds:*:*:instance:*"
+                    in backup_client.protected_resources
+                    or "*" in backup_client.protected_resources
+                ):
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"RDS Instance {db_instance.id} is protected by a backup plan."
+                    )
+
+                findings.append(report)
+
         return findings