From 4fe575030ba5f2448cbd3b4d0ff788df6cb37a51 Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Tue, 18 Feb 2020 10:07:39 +0200 Subject: [PATCH 1/2] Filter for only available rds instances (cherry picked from commit 5a7356be3cd137e08161b3dc0d7b8f1b2267c304) --- checks/check_extra78 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/checks/check_extra78 b/checks/check_extra78 index 681b4d0b..4c0d6115 100644 --- a/checks/check_extra78 +++ b/checks/check_extra78 @@ -22,7 +22,8 @@ extra78(){ # "Ensure there are no Public Accessible RDS instances (Not Scored) (Not part of CIS benchmark)" textInfo "Looking for RDS instances in all regions... " for regx in $REGIONS; do - LIST_OF_RDS_PUBLIC_INSTANCES=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --query 'DBInstances[?PubliclyAccessible==`true`].[DBInstanceIdentifier,Endpoint.Address]' --output text) + LIST_OF_RDS_PUBLIC_INSTANCES=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --query 'DBInstances[?PubliclyAccessible==`true` && DBInstanceStatus=="available"].[DBInstanceIdentifier,Endpoint.Address]' --output text) + echo $LIST_OF_RDS_PUBLIC_INSTANCES if [[ $LIST_OF_RDS_PUBLIC_INSTANCES ]];then while read -r rds_instance;do RDS_NAME=$(echo $rds_instance | awk '{ print $1; }') From e41e77ed78b29afe72502d1cdbc8952663629e68 Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Tue, 18 Feb 2020 11:57:52 +0200 Subject: [PATCH 2/2] Remove unnecessary print (cherry picked from commit 72bb29f13cabf5bd85af3c5539a46eacd34538ae) --- checks/check_extra78 | 1 - 1 file changed, 1 deletion(-) diff --git a/checks/check_extra78 b/checks/check_extra78 index 4c0d6115..9bea1a3d 100644 --- a/checks/check_extra78 +++ b/checks/check_extra78 @@ -23,7 +23,6 @@ extra78(){ textInfo "Looking for RDS instances in all regions... " for regx in $REGIONS; do LIST_OF_RDS_PUBLIC_INSTANCES=$($AWSCLI rds describe-db-instances $PROFILE_OPT --region $regx --query 'DBInstances[?PubliclyAccessible==`true` && DBInstanceStatus=="available"].[DBInstanceIdentifier,Endpoint.Address]' --output text) - echo $LIST_OF_RDS_PUBLIC_INSTANCES if [[ $LIST_OF_RDS_PUBLIC_INSTANCES ]];then while read -r rds_instance;do RDS_NAME=$(echo $rds_instance | awk '{ print $1; }')