From eecb1dd8c350d4ac9a62dc07972703bbed344b30 Mon Sep 17 00:00:00 2001 From: Kay Agahd Date: Wed, 18 Jan 2023 17:19:03 +0100 Subject: [PATCH] fix(extra7131): exclude DocumentDB since AutoMinorVersionUpgrade is only for relational databases (#1714) --- checks/check_extra7131 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/checks/check_extra7131 b/checks/check_extra7131 index af4bc42938..340101aaaf 100644 --- a/checks/check_extra7131 +++ b/checks/check_extra7131 @@ -18,15 +18,15 @@ CHECK_SEVERITY_extra7131="Low" CHECK_ASFF_RESOURCE_TYPE_extra7131="AwsRdsDbInstance" CHECK_ALTERNATE_check7131="extra7131" CHECK_SERVICENAME_extra7131="rds" -CHECK_RISK_extra7131='Auto Minor Version Upgrade is a feature that you can enable to have your database automatically upgraded when a new minor database engine version is available. Minor version upgrades often patch security vulnerabilities and fix bugs; and therefor should be applied.' -CHECK_REMEDIATION_extra7131='Enable auto minor version upgrade for all databases and environments.' +CHECK_RISK_extra7131='Auto Minor Version Upgrade is a feature that you can enable to have your relational database automatically upgraded when a new minor database engine version is available. Minor version upgrades often patch security vulnerabilities and fix bugs; and therefor should be applied.' +CHECK_REMEDIATION_extra7131='Enable auto minor version upgrade for all relational databases and environments.' CHECK_DOC_extra7131='https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/' CHECK_CAF_EPIC_extra7131='Infrastructure Security' extra7131(){ for regx in $REGIONS; do # LIST_OF_RDS_PUBLIC_INSTANCES=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --query 'DBInstances[?PubliclyAccessible==`true` && DBInstanceStatus==`"available"`].[DBInstanceIdentifier,Endpoint.Address]' --output text) - LIST_OF_RDS_INSTANCES=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --query 'DBInstances[*].[DBInstanceIdentifier,AutoMinorVersionUpgrade]' --output text 2>&1) + LIST_OF_RDS_INSTANCES=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --query "DBInstances[?Engine != 'docdb'].[DBInstanceIdentifier,AutoMinorVersionUpgrade]" --output text 2>&1) if [[ $(echo "$LIST_OF_RDS_INSTANCES" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then textInfo "$regx: Access Denied trying to describe DB instances" "$regx" continue