ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 06:45:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(rds): new check rds_instance_deprecated_engine_version (#2298)

Browse Source 
Co-authored-by: Sergio Garcia <sergargar1@gmail.com>
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>
This commit is contained in:
Pedro Martín
2023-05-10 14:48:12 +02:00
committed by GitHub
parent 88445820ed
commit a53bc2bc2e
8 changed files with 295 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/__init__.py Normal file
View File

30
prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.metadata.json Normal file
View File

@@ -0,0 +1,30 @@
{
"Provider": "aws",
"CheckID": "rds_instance_deprecated_engine_version",
"CheckTitle": "Check if RDS instance is using a supported engine version",
"CheckType": [],
"ServiceName": "rds",
"SubServiceName": "",
"ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance",
"Severity": "medium",
"ResourceType": "AwsRdsDbInstance",
"Description": "Check if RDS is using a supported engine version for MariaDB, MySQL and PostgreSQL",
"Risk": "If not enabled RDS instances may be vulnerable to security issues",
"RelatedUrl": "",
"Remediation": {
"Code": {
"CLI": "aws rds describe-db-engine-versions --engine <my_engine>'",
"NativeIaC": "",
"Other": "https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html",
"Terraform": ""
},
"Recommendation": {
"Text": "",
"Url": ""
}
},
"Categories": [],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
}

28
prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.py Normal file
View File

@@ -0,0 +1,28 @@
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client
class rds_instance_deprecated_engine_version(Check):
def execute(self):
findings = []
for instance in rds_client.db_instances:
report = Check_Report_AWS(self.metadata())
report.region = instance.region
report.status = "FAIL"
report.resource_id = instance.id
report.resource_tags = instance.tags
report.status_extended = f"RDS instance {instance.id} is using a deprecated engine {instance.engine} with version {instance.engine_version}."
if (
instance.engine_version
in rds_client.db_engines[instance.region][
instance.engine
].engine_versions
):
report.status = "PASS"
report.status_extended = f"RDS instance {instance.id} is not using a deprecated engine {instance.engine} with version {instance.engine_version}."
findings.append(report)
return findings

1
prowler/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted.py
View File

@@ -10,6 +10,7 @@ class rds_instance_transport_encrypted(Check):
report = Check_Report_AWS(self.metadata())
report.region = db_instance.region
report.resource_id = db_instance.id
report.resource_tags = db_instance.tags
report.status = "FAIL"
report.status_extended = (
f"RDS Instance {db_instance.id} connections are not encrypted."

41
prowler/providers/aws/services/rds/rds_service.py
View File

@@ -20,6 +20,7 @@ class RDS:
self.db_instances = []
self.db_clusters = {}
self.db_snapshots = []
self.db_engines = {}
self.db_cluster_snapshots = []
self.__threading_call__(self.__describe_db_instances__)
self.__threading_call__(self.__describe_db_parameters__)
@@ -28,6 +29,7 @@ class RDS:
self.__threading_call__(self.__describe_db_clusters__)
self.__threading_call__(self.__describe_db_cluster_snapshots__)
self.__threading_call__(self.__describe_db_cluster_snapshot_attributes__)
self.__threading_call__(self.__describe_db_engine_versions__)
def __get_session__(self):
return self.session
@@ -60,6 +62,7 @@ class RDS:
id=instance["DBInstanceIdentifier"],
endpoint=instance.get("Endpoint"),
engine=instance["Engine"],
engine_version=instance["EngineVersion"],
status=instance["DBInstanceStatus"],
public=instance["PubliclyAccessible"],
encrypted=instance["StorageEncrypted"],
@@ -249,11 +252,42 @@ class RDS:
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
def __describe_db_engine_versions__(self, regional_client):
logger.info("RDS - Describe Engine Versions...")
try:
describe_db_engine_versions_paginator = regional_client.get_paginator(
"describe_db_engine_versions"
)
for page in describe_db_engine_versions_paginator.paginate():
for engine in page["DBEngineVersions"]:
if regional_client.region not in self.db_engines:
self.db_engines[regional_client.region] = {}
if engine["Engine"] not in self.db_engines[regional_client.region]:
db_engine = DBEngine(
region=regional_client.region,
engine=engine["Engine"],
engine_versions=[engine["EngineVersion"]],
engine_description=engine["DBEngineDescription"],
)
self.db_engines[regional_client.region][
engine["Engine"]
] = db_engine
else:
self.db_engines[regional_client.region][
engine["Engine"]
].engine_versions.append(engine["EngineVersion"])
except Exception as error:
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
class DBInstance(BaseModel):
id: str
endpoint: Optional[dict]
engine: str
engine_version: str
status: str
public: bool
encrypted: bool
@@ -301,3 +335,10 @@ class ClusterSnapshot(BaseModel):
public: bool = False
region: str
tags: Optional[list] = []
class DBEngine(BaseModel):
region: str
engine: str
engine_versions: list[str]
engine_description: str

161
tests/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version_test.py Normal file
View File

@@ -0,0 +1,161 @@
from unittest import mock
from unittest.mock import patch
import botocore
from boto3 import client, session
from moto import mock_rds
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION = "us-east-1"
make_api_call = botocore.client.BaseClient._make_api_call
def mock_make_api_call(self, operation_name, kwarg):
if operation_name == "DescribeDBEngineVersions":
return {
"DBEngineVersions": [
{
"Engine": "mysql",
"EngineVersion": "8.0.32",
"DBEngineDescription": "description",
"DBEngineVersionDescription": "description",
},
]
}
return make_api_call(self, operation_name, kwarg)
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
class Test_rds_instance_deprecated_engine_version:
# Mocked Audit Info
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
region_name=AWS_REGION,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=AWS_REGION,
credentials=None,
assumed_role_info=None,
audited_regions=[AWS_REGION],
organizations_metadata=None,
audit_resources=None,
)
return audit_info
@mock_rds
def test_rds_no_instances(self):
from prowler.providers.aws.services.rds.rds_service import RDS
audit_info = self.set_mocked_audit_info()
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
new=audit_info,
):
with mock.patch(
"prowler.providers.aws.services.rds.rds_instance_deprecated_engine_version.rds_instance_deprecated_engine_version.rds_client",
new=RDS(audit_info),
):
# Test Check
from prowler.providers.aws.services.rds.rds_instance_deprecated_engine_version.rds_instance_deprecated_engine_version import (
rds_instance_deprecated_engine_version,
)
check = rds_instance_deprecated_engine_version()
result = check.execute()
assert len(result) == 0
@mock_rds
def test_rds_instance_no_deprecated_engine_version(self):
conn = client("rds", region_name=AWS_REGION)
conn.create_db_instance(
DBInstanceIdentifier="db-master-1",
AllocatedStorage=10,
Engine="mysql",
EngineVersion="8.0.32",
DBName="staging-mysql",
DBInstanceClass="db.m1.small",
)
from prowler.providers.aws.services.rds.rds_service import RDS
audit_info = self.set_mocked_audit_info()
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
new=audit_info,
):
with mock.patch(
"prowler.providers.aws.services.rds.rds_instance_deprecated_engine_version.rds_instance_deprecated_engine_version.rds_client",
new=RDS(audit_info),
):
# Test Check
from prowler.providers.aws.services.rds.rds_instance_deprecated_engine_version.rds_instance_deprecated_engine_version import (
rds_instance_deprecated_engine_version,
)
check = rds_instance_deprecated_engine_version()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "RDS instance db-master-1 is not using a deprecated engine mysql with version 8.0.32."
)
assert result[0].resource_id == "db-master-1"
assert result[0].resource_tags == []
@mock_rds
def test_rds_instance_deprecated_engine_version(self):
conn = client("rds", region_name=AWS_REGION)
conn.create_db_instance(
DBInstanceIdentifier="db-master-2",
AllocatedStorage=10,
Engine="mysql",
EngineVersion="8.0.23",
DBName="staging-mysql",
DBInstanceClass="db.m1.small",
)
from prowler.providers.aws.services.rds.rds_service import RDS
audit_info = self.set_mocked_audit_info()
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
new=audit_info,
):
with mock.patch(
"prowler.providers.aws.services.rds.rds_instance_deprecated_engine_version.rds_instance_deprecated_engine_version.rds_client",
new=RDS(audit_info),
):
# Test Check
from prowler.providers.aws.services.rds.rds_instance_deprecated_engine_version.rds_instance_deprecated_engine_version import (
rds_instance_deprecated_engine_version,
)
check = rds_instance_deprecated_engine_version()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "RDS instance db-master-2 is using a deprecated engine mysql with version 8.0.23."
)
assert result[0].resource_id == "db-master-2"
assert result[0].resource_tags == []

2
tests/providers/aws/services/rds/rds_instance_multi_az/rds_instance_multi_az_test.py
View File

@@ -163,6 +163,7 @@ class Test_rds_instance_multi_az:
id="test-instance",
endpoint="",
engine="aurora",
engine_version="1.0.0",
status="available",
public=False,
encrypted=False,
@@ -223,6 +224,7 @@ class Test_rds_instance_multi_az:
id="test-instance",
endpoint="",
engine="aurora",
engine_version="1.0.0",
status="available",
public=False,
encrypted=False,

33
tests/providers/aws/services/rds/rds_service_test.py
View File

@@ -1,3 +1,6 @@
from unittest.mock import patch
import botocore
from boto3 import client, session
from moto import mock_rds
@@ -7,7 +10,25 @@ from prowler.providers.aws.services.rds.rds_service import RDS
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION = "us-east-1"
make_api_call = botocore.client.BaseClient._make_api_call
def mock_make_api_call(self, operation_name, kwarg):
if operation_name == "DescribeDBEngineVersions":
return {
"DBEngineVersions": [
{
"Engine": "mysql",
"EngineVersion": "8.0.32",
"DBEngineDescription": "description",
"DBEngineVersionDescription": "description",
},
]
}
return make_api_call(self, operation_name, kwarg)
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
class Test_RDS_Service:
# Mocked Audit Info
def set_mocked_audit_info(self):
@@ -26,7 +47,7 @@ class Test_RDS_Service:
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
audited_regions=[AWS_REGION],
organizations_metadata=None,
audit_resources=None,
)
@@ -249,3 +270,13 @@ class Test_RDS_Service:
assert rds.db_cluster_snapshots[0].cluster_id == "db-primary-1"
assert rds.db_cluster_snapshots[0].region == AWS_REGION
assert not rds.db_cluster_snapshots[0].public
# Test RDS describe db engine versions
@mock_rds
def test__describe_db_engine_versions__(self):
# RDS client for this test class
audit_info = self.set_mocked_audit_info()
rds = RDS(audit_info)
assert "mysql" in rds.db_engines[AWS_REGION]
assert rds.db_engines[AWS_REGION]["mysql"].engine_versions == ["8.0.32"]
assert rds.db_engines[AWS_REGION]["mysql"].engine_description == "description"