From b905d73b8276aa7d1986a22e222cdca93e3c2bb5 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Fri, 31 May 2024 16:01:01 +0200 Subject: [PATCH] fix(rds): Handle DBParameterGroupNotFound (#4148) Co-authored-by: Sergio --- .../providers/aws/services/rds/rds_service.py | 140 ++++++++++++------ 1 file changed, 92 insertions(+), 48 deletions(-) diff --git a/prowler/providers/aws/services/rds/rds_service.py b/prowler/providers/aws/services/rds/rds_service.py index 392d02ce2e..53434471e6 100644 --- a/prowler/providers/aws/services/rds/rds_service.py +++ b/prowler/providers/aws/services/rds/rds_service.py @@ -198,57 +198,101 @@ class RDS(AWSService): "describe_db_clusters" ) for page in describe_db_clusters_paginator.paginate(): - for cluster in page["DBClusters"]: - db_cluster_arn = f"arn:{self.audited_partition}:rds:{regional_client.region}:{self.audited_account}:cluster:{cluster['DBClusterIdentifier']}" - if not self.audit_resources or ( - is_resource_filtered(db_cluster_arn, self.audit_resources) - ): - if cluster["Engine"] != "docdb": - describe_db_parameters_paginator = ( - regional_client.get_paginator("describe_db_parameters") - ) - db_cluster = DBCluster( - id=cluster["DBClusterIdentifier"], - arn=db_cluster_arn, - endpoint=cluster.get("Endpoint"), - engine=cluster["Engine"], - status=cluster["Status"], - public=cluster.get("PubliclyAccessible", False), - encrypted=cluster["StorageEncrypted"], - auto_minor_version_upgrade=cluster.get( - "AutoMinorVersionUpgrade", False - ), - backup_retention_period=cluster.get( - "BackupRetentionPeriod" - ), - cloudwatch_logs=cluster.get( - "EnabledCloudwatchLogsExports" - ), - deletion_protection=cluster["DeletionProtection"], - parameter_group=cluster["DBClusterParameterGroup"], - multi_az=cluster["MultiAZ"], - region=regional_client.region, - tags=cluster.get("TagList", []), - ) - for page in describe_db_parameters_paginator.paginate( - DBParameterGroupName=cluster["DBClusterParameterGroup"] + try: + for cluster in page["DBClusters"]: + try: + db_cluster_arn = f"arn:{self.audited_partition}:rds:{regional_client.region}:{self.audited_account}:cluster:{cluster['DBClusterIdentifier']}" + if not self.audit_resources or ( + is_resource_filtered( + db_cluster_arn, self.audit_resources + ) ): - for parameter in page["Parameters"]: - if parameter["ParameterName"] == "rds.force_ssl": - db_cluster.force_ssl = parameter[ - "ParameterValue" - ] - if ( - parameter["ParameterName"] - == "require_secure_transport" - ): - db_cluster.require_secure_transport = parameter[ - "ParameterValue" - ] + if cluster["Engine"] != "docdb": + db_cluster = DBCluster( + id=cluster["DBClusterIdentifier"], + arn=db_cluster_arn, + endpoint=cluster.get("Endpoint"), + engine=cluster["Engine"], + status=cluster["Status"], + public=cluster.get("PubliclyAccessible", False), + encrypted=cluster["StorageEncrypted"], + auto_minor_version_upgrade=cluster.get( + "AutoMinorVersionUpgrade", False + ), + backup_retention_period=cluster.get( + "BackupRetentionPeriod" + ), + cloudwatch_logs=cluster.get( + "EnabledCloudwatchLogsExports" + ), + deletion_protection=cluster[ + "DeletionProtection" + ], + parameter_group=cluster[ + "DBClusterParameterGroup" + ], + multi_az=cluster["MultiAZ"], + region=regional_client.region, + tags=cluster.get("TagList", []), + ) + # We must use a unique value as the dict key to have unique keys + self.db_clusters[db_cluster_arn] = db_cluster - # We must use a unique value as the dict key to have unique keys - self.db_clusters[db_cluster_arn] = db_cluster + # Get DB Cluster Parameters + describe_db_parameters_paginator = ( + regional_client.get_paginator( + "describe_db_parameters" + ) + ) + try: + for ( + page + ) in describe_db_parameters_paginator.paginate( + DBParameterGroupName=cluster[ + "DBClusterParameterGroup" + ] + ): + try: + for parameter in page["Parameters"]: + if ( + parameter["ParameterName"] + == "rds.force_ssl" + ): + db_cluster.force_ssl = ( + parameter["ParameterValue"] + ) + if ( + parameter["ParameterName"] + == "require_secure_transport" + ): + db_cluster.require_secure_transport = parameter[ + "ParameterValue" + ] + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except ClientError as error: + if ( + error.response["Error"]["Code"] + == "DBParameterGroupNotFound" + ): + logger.warning( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) except Exception as error: logger.error( f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"