ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-12 07:45:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(rds): new check rds_instance_deprecated_engine_version (#2298)

Browse Source 
Co-authored-by: Sergio Garcia <sergargar1@gmail.com>
Co-authored-by: Sergio Garcia <38561120+sergargar@users.noreply.github.com>
This commit is contained in:
Pedro Martín
2023-05-10 14:48:12 +02:00
committed by GitHub
parent 88445820ed
commit a53bc2bc2e
8 changed files with 295 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/__init__.py Normal file
View File

30
prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.metadata.json Normal file
View File

@@ -0,0 +1,30 @@
{
"Provider": "aws",
"CheckID": "rds_instance_deprecated_engine_version",
"CheckTitle": "Check if RDS instance is using a supported engine version",
"CheckType": [],
"ServiceName": "rds",
"SubServiceName": "",
"ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance",
"Severity": "medium",
"ResourceType": "AwsRdsDbInstance",
"Description": "Check if RDS is using a supported engine version for MariaDB, MySQL and PostgreSQL",
"Risk": "If not enabled RDS instances may be vulnerable to security issues",
"RelatedUrl": "",
"Remediation": {
"Code": {
"CLI": "aws rds describe-db-engine-versions --engine <my_engine>'",
"NativeIaC": "",
"Other": "https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html",
"Terraform": ""
},
"Recommendation": {
"Text": "",
"Url": ""
}
},
"Categories": [],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
}

28
prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.py Normal file
View File

@@ -0,0 +1,28 @@
from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client
class rds_instance_deprecated_engine_version(Check):
def execute(self):
findings = []
for instance in rds_client.db_instances:
report = Check_Report_AWS(self.metadata())
report.region = instance.region
report.status = "FAIL"
report.resource_id = instance.id
report.resource_tags = instance.tags
report.status_extended = f"RDS instance {instance.id} is using a deprecated engine {instance.engine} with version {instance.engine_version}."
if (
instance.engine_version
in rds_client.db_engines[instance.region][
instance.engine
].engine_versions
):
report.status = "PASS"
report.status_extended = f"RDS instance {instance.id} is not using a deprecated engine {instance.engine} with version {instance.engine_version}."
findings.append(report)
return findings

1
prowler/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted.py
View File

@@ -10,6 +10,7 @@ class rds_instance_transport_encrypted(Check):
report = Check_Report_AWS(self.metadata())
report.region = db_instance.region
report.resource_id = db_instance.id
report.resource_tags = db_instance.tags
report.status = "FAIL"
report.status_extended = (
f"RDS Instance {db_instance.id} connections are not encrypted."

41
prowler/providers/aws/services/rds/rds_service.py
View File

@@ -20,6 +20,7 @@ class RDS:
self.db_instances = []
self.db_clusters = {}
self.db_snapshots = []
self.db_engines = {}
self.db_cluster_snapshots = []
self.__threading_call__(self.__describe_db_instances__)
self.__threading_call__(self.__describe_db_parameters__)
@@ -28,6 +29,7 @@ class RDS:
self.__threading_call__(self.__describe_db_clusters__)
self.__threading_call__(self.__describe_db_cluster_snapshots__)
self.__threading_call__(self.__describe_db_cluster_snapshot_attributes__)
self.__threading_call__(self.__describe_db_engine_versions__)
def __get_session__(self):
return self.session
@@ -60,6 +62,7 @@ class RDS:
id=instance["DBInstanceIdentifier"],
endpoint=instance.get("Endpoint"),
engine=instance["Engine"],
engine_version=instance["EngineVersion"],
status=instance["DBInstanceStatus"],
public=instance["PubliclyAccessible"],
encrypted=instance["StorageEncrypted"],
@@ -249,11 +252,42 @@ class RDS:
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
def __describe_db_engine_versions__(self, regional_client):
logger.info("RDS - Describe Engine Versions...")
try:
describe_db_engine_versions_paginator = regional_client.get_paginator(
"describe_db_engine_versions"
)
for page in describe_db_engine_versions_paginator.paginate():
for engine in page["DBEngineVersions"]:
if regional_client.region not in self.db_engines:
self.db_engines[regional_client.region] = {}
if engine["Engine"] not in self.db_engines[regional_client.region]:
db_engine = DBEngine(
region=regional_client.region,
engine=engine["Engine"],
engine_versions=[engine["EngineVersion"]],
engine_description=engine["DBEngineDescription"],
)
self.db_engines[regional_client.region][
engine["Engine"]
] = db_engine
else:
self.db_engines[regional_client.region][
engine["Engine"]
].engine_versions.append(engine["EngineVersion"])
except Exception as error:
logger.error(
f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
)
class DBInstance(BaseModel):
id: str
endpoint: Optional[dict]
engine: str
engine_version: str
status: str
public: bool
encrypted: bool
@@ -301,3 +335,10 @@ class ClusterSnapshot(BaseModel):
public: bool = False
region: str
tags: Optional[list] = []
class DBEngine(BaseModel):
region: str
engine: str
engine_versions: list[str]
engine_description: str