ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(rds): solve TypeError and make Certificate class (#4122)

Browse Source
This commit is contained in:
Sergio Garcia
2024-05-29 03:12:31 -04:00
committed by GitHub
parent 98f6003069
commit bd1fcdd68a
3 changed files with 137 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.py
+30 -22
View File
@@ -1,6 +1,6 @@
from datetime import datetime
from dateutil import parser, relativedelta
from dateutil import relativedelta
from pytz import utc
from prowler.lib.check.models import Check, Check_Report_AWS
@@ -28,33 +28,44 @@ class rds_instance_certificate_expiration(Check):
# Check only RDS DB instances that support parameter group encryption
for cert in db_instance.cert:
if cert["CustomerOverride"] == 0:
valid_till = parser.parse(cert["ValidTill"])
if valid_till > datetime.now(utc) + relativedelta.relativedelta(
months=6
):
if not cert.customer_override:
if cert.valid_till > datetime.now(
utc
) + relativedelta.relativedelta(months=6):
report.status = "PASS"
report.check_metadata.Severity = "informational"
report.status_extended = f"RDS Instance {db_instance.id} certificate has over 6 months of validity left."
elif valid_till < datetime.now(utc) + relativedelta.relativedelta(
elif cert.valid_till < datetime.now(
utc
) + relativedelta.relativedelta(
months=6
) and valid_till > datetime.now(utc) + relativedelta.relativedelta(
) and cert.valid_till > datetime.now(
utc
) + relativedelta.relativedelta(
months=3
):
report.status = "PASS"
report.check_metadata.Severity = "low"
report.status_extended = f"RDS Instance {db_instance.id} certificate has between 3 and 6 months of validity."
elif valid_till < datetime.now(utc) + relativedelta.relativedelta(
elif cert.valid_till < datetime.now(
utc
) + relativedelta.relativedelta(
months=3
) and valid_till > datetime.now(utc) + relativedelta.relativedelta(
) and cert.valid_till > datetime.now(
utc
) + relativedelta.relativedelta(
months=1
):
report.status = "FAIL"
report.check_metadata.Severity = "medium"
report.status_extended = f"RDS Instance {db_instance.id} certificate less than 3 months of validity."
elif valid_till < datetime.now(utc) + relativedelta.relativedelta(
elif cert.valid_till < datetime.now(
utc
) + relativedelta.relativedelta(
months=1
) and valid_till > datetime.now(utc):
) and cert.valid_till > datetime.now(
utc
):
report.status = "FAIL"
report.check_metadata.Severity = "high"
report.status_extended = f"RDS Instance {db_instance.id} certificate less than 1 month of validity."
@@ -65,20 +76,17 @@ class rds_instance_certificate_expiration(Check):
f"RDS Instance {db_instance.id} certificate has expired."
)
else:
customer_override_valid_till = parser.parse(
cert["CustomerOverrideValidTill"]
)
if customer_override_valid_till > datetime.now(
if cert.valid_till > datetime.now(
utc
) + relativedelta.relativedelta(months=6):
report.status = "PASS"
report.check_metadata.Severity = "informational"
report.status_extended = f"RDS Instance {db_instance.id} custom certificate has over 6 months of validity left."
elif customer_override_valid_till < datetime.now(
elif cert.valid_till < datetime.now(
utc
) + relativedelta.relativedelta(
months=6
) and customer_override_valid_till > datetime.now(
) and cert.valid_till > datetime.now(
utc
) + relativedelta.relativedelta(
months=3
@@ -86,11 +94,11 @@ class rds_instance_certificate_expiration(Check):
report.status = "PASS"
report.check_metadata.Severity = "low"
report.status_extended = f"RDS Instance {db_instance.id} custom certificate has between 3 and 6 months of validity."
elif customer_override_valid_till < datetime.now(
elif cert.valid_till < datetime.now(
utc
) + relativedelta.relativedelta(
months=3
) and customer_override_valid_till > datetime.now(
) and cert.valid_till > datetime.now(
utc
) + relativedelta.relativedelta(
months=1
@@ -98,11 +106,11 @@ class rds_instance_certificate_expiration(Check):
report.status = "FAIL"
report.check_metadata.Severity = "medium"
report.status_extended = f"RDS Instance {db_instance.id} custom certificate less than 3 months of validity."
elif customer_override_valid_till < datetime.now(
elif cert.valid_till < datetime.now(
utc
) + relativedelta.relativedelta(
months=1
) and customer_override_valid_till > datetime.now(
) and cert.valid_till > datetime.now(
utc
):
report.status = "FAIL"
prowler/providers/aws/services/rds/rds_service.py
+25 -2
View File
@@ -1,3 +1,4 @@
from datetime import datetime
from typing import Optional
from botocore.client import ClientError
@@ -122,7 +123,19 @@ class RDS(AWSService):
CertificateIdentifier=instance.ca_cert
):
for certificate in page["Certificates"]:
instance.cert.append(certificate)
instance.cert.append(
Certificate(
id=certificate["CertificateIdentifier"],
arn=certificate["CertificateArn"],
type=certificate["CertificateType"],
valid_from=certificate["ValidFrom"],
valid_till=certificate["ValidTill"],
customer_override=certificate["CustomerOverride"],
customer_override_valid_till=certificate.get(
"CustomerOverrideValidTill"
),
)
)
except Exception as error:
logger.error(
@@ -327,6 +340,16 @@ class RDS(AWSService):
)
class Certificate(BaseModel):
id: str
arn: str
type: str
valid_from: datetime
valid_till: datetime
customer_override: bool
customer_override_valid_till: Optional[datetime]
class DBInstance(BaseModel):
id: str
# arn:{partition}:rds:{region}:{account}:db:{resource_id}
@@ -352,7 +375,7 @@ class DBInstance(BaseModel):
tags: Optional[list] = []
replica_source: Optional[str]
ca_cert: Optional[str]
cert: list[dict] = []
cert: list[Certificate] = []
class DBCluster(BaseModel):
tests/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration_test.py
+82 -73
View File
@@ -6,7 +6,7 @@ from dateutil import relativedelta
from moto import mock_aws
from pytz import utc
from prowler.providers.aws.services.rds.rds_service import DBInstance
from prowler.providers.aws.services.rds.rds_service import Certificate, DBInstance
AWS_ACCOUNT_NUMBER_CON = "123456789012"
AWS_REGION = "us-east-1"
@@ -79,14 +79,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": False,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=False,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -147,14 +148,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": False,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=False,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -214,14 +216,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": False,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=False,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -281,14 +284,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": False,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=False,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -348,14 +352,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": True,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=True,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -415,14 +420,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": True,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=True,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -482,14 +488,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": True,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=True,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -549,14 +556,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": True,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=True,
customer_override_valid_till=customer_override_valid,
)
],
)
]
@@ -616,14 +624,15 @@ class Test_rds_instance_certificate_expiration:
region=AWS_REGION,
ca_cert="rds-ca-rsa2048-g1",
cert=[
{
"CertificateIdentifier": "rds-ca-rsa2048-g1",
"CertificateType": "CA",
"ValidFrom": f"{valid_from}",
"ValidTill": f"{valid_till}",
"CustomerOverride": True,
"CustomerOverrideValidTill": f"{customer_override_valid}",
}
Certificate(
id="rds-ca-rsa2048-g1",
arn=f"arn:aws:rds:{AWS_REGION}::cert:rds-ca-2019",
type="CA",
valid_from=valid_from,
valid_till=valid_till,
customer_override=True,
customer_override_valid_till=customer_override_valid,
)
],
)
]