diff --git a/assets/queries/ansible/aws/rds_with_backup_disabled/query.rego b/assets/queries/ansible/aws/rds_with_backup_disabled/query.rego index 52da445a24e..e8480e1148c 100644 --- a/assets/queries/ansible/aws/rds_with_backup_disabled/query.rego +++ b/assets/queries/ansible/aws/rds_with_backup_disabled/query.rego @@ -5,24 +5,6 @@ import data.generic.common as common_lib modules := {"community.aws.rds_instance", "rds_instance"} -CxPolicy[result] { - task := ansLib.tasks[id][t] - instance := task[modules[m]] - ansLib.checkState(instance) - - not common_lib.valid_key(instance, "backup_retention_period") - - result := { - "documentId": id, - "resourceType": modules[m], - "resourceName": task.name, - "searchKey": sprintf("name={{%s}}.{{%s}}", [task.name, modules[m]]), - "issueType": "MissingAttribute", - "keyExpectedValue": "rds_instance should have the property 'backup_retention_period' greater than 0", - "keyActualValue": "rds_instance has the property 'backup_retention_period' unassigned", - } -} - CxPolicy[result] { task := ansLib.tasks[id][t] instance := task[modules[m]] diff --git a/assets/queries/ansible/aws/rds_with_backup_disabled/test/negative.yaml b/assets/queries/ansible/aws/rds_with_backup_disabled/test/negative.yaml index e48bd759467..83343d13548 100644 --- a/assets/queries/ansible/aws/rds_with_backup_disabled/test/negative.yaml +++ b/assets/queries/ansible/aws/rds_with_backup_disabled/test/negative.yaml @@ -7,3 +7,11 @@ username: '{{ username }}' cluster_id: ansible-test-cluster # This cluster must exist - see rds_cluster to manage it backup_retention_period: 5 +- name: create minimal aurora instance in default VPC and default subnet group2 + community.aws.rds_instance: + engine: aurora + db_instance_identifier: ansible-test-aurora-db-instance + instance_type: db.t2.small + password: '{{ password }}' + username: '{{ username }}' + cluster_id: ansible-test-cluster # This cluster must exist - see rds_cluster to manage it diff --git a/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive.yaml b/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive.yaml index 02d4fb1533c..ec43f978fed 100644 --- a/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive.yaml +++ b/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive.yaml @@ -8,11 +8,3 @@ username: "{{ username }}" cluster_id: ansible-test-cluster # This cluster must exist - see rds_cluster to manage it backup_retention_period: 0 -- name: create minimal aurora instance in default VPC and default subnet group2 - community.aws.rds_instance: - engine: aurora - db_instance_identifier: ansible-test-aurora-db-instance - instance_type: db.t2.small - password: "{{ password }}" - username: "{{ username }}" - cluster_id: ansible-test-cluster # This cluster must exist - see rds_cluster to manage it diff --git a/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive_expected_result.json b/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive_expected_result.json index 5c9a55b8ebf..61f421b9d95 100644 --- a/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive_expected_result.json +++ b/assets/queries/ansible/aws/rds_with_backup_disabled/test/positive_expected_result.json @@ -3,10 +3,5 @@ "queryName": "RDS With Backup Disabled", "severity": "MEDIUM", "line": 10 - }, - { - "queryName": "RDS With Backup Disabled", - "severity": "MEDIUM", - "line": 12 } ] diff --git a/assets/queries/terraform/aws/rds_with_backup_disabled/query.rego b/assets/queries/terraform/aws/rds_with_backup_disabled/query.rego index 95a0db79435..029f7eb4ed4 100644 --- a/assets/queries/terraform/aws/rds_with_backup_disabled/query.rego +++ b/assets/queries/terraform/aws/rds_with_backup_disabled/query.rego @@ -3,45 +3,6 @@ package Cx import data.generic.common as common_lib import data.generic.terraform as tf_lib -CxPolicy[result] { - db := input.document[i].resource.aws_db_instance[name] - - not common_lib.valid_key(db, "backup_retention_period") - - result := { - "documentId": input.document[i].id, - "resourceType": "aws_db_instance", - "resourceName": tf_lib.get_resource_name(db, name), - "searchKey": sprintf("aws_db_instance[%s]", [name]), - "issueType": "MissingAttribute", - "keyExpectedValue": "'backup_retention_period' exists", - "keyActualValue": "'backup_retention_period' is missing", - "searchLine": common_lib.build_search_line(["resource", "aws_db_instance", name], []), - "remediation": "backup_retention_period = 12", - "remediationType": "addition", - } -} - -CxPolicy[result] { - module := input.document[i].module[name] - keyToCheck := common_lib.get_module_equivalent_key("aws", module.source, "aws_db_instance", "backup_retention_period") - - not common_lib.valid_key(module, keyToCheck) - - result := { - "documentId": input.document[i].id, - "resourceType": "n/a", - "resourceName": "n/a", - "searchKey": sprintf("module[%s]", [name]), - "issueType": "MissingAttribute", - "keyExpectedValue": "'backup_retention_period' exists", - "keyActualValue": "'backup_retention_period' is missing", - "searchLine": common_lib.build_search_line(["module", name], []), - "remediation": sprintf("%s = 12",[keyToCheck]), - "remediationType": "addition", - } -} - CxPolicy[result] { db := input.document[i].resource.aws_db_instance[name] db.backup_retention_period == 0 diff --git a/assets/queries/terraform/aws/rds_with_backup_disabled/test/negative3.tf b/assets/queries/terraform/aws/rds_with_backup_disabled/test/negative3.tf new file mode 100644 index 00000000000..5700cfa5cee --- /dev/null +++ b/assets/queries/terraform/aws/rds_with_backup_disabled/test/negative3.tf @@ -0,0 +1,12 @@ +//some comments (used just for resource offset) + +resource "aws_db_instance" "negative1" { + allocated_storage = 20 + storage_type = "gp2" + engine = "mysql" + engine_version = "5.7" + instance_class = "db.t2.micro" + name = "mydb" + username = "foo" + password = "foobarbaz" +} diff --git a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive3.tf b/assets/queries/terraform/aws/rds_with_backup_disabled/test/negative4.tf similarity index 97% rename from assets/queries/terraform/aws/rds_with_backup_disabled/test/positive3.tf rename to assets/queries/terraform/aws/rds_with_backup_disabled/test/negative4.tf index 06a3465d2c7..409ecc9a0b4 100644 --- a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive3.tf +++ b/assets/queries/terraform/aws/rds_with_backup_disabled/test/negative4.tf @@ -9,8 +9,6 @@ module "db" { instance_class = "db.t2.large" allocated_storage = 5 auto_minor_version_upgrade = true - backup_retention_period = 0 - name = "demodb" username = "user" diff --git a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive1.tf b/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive1.tf index f3d96c7a26a..f8e3370a61e 100644 --- a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive1.tf +++ b/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive1.tf @@ -11,15 +11,3 @@ resource "aws_db_instance" "positive1" { password = "foobarbaz" backup_retention_period = 0 } - - -resource "aws_db_instance" "positive2" { - allocated_storage = 20 - storage_type = "gp2" - engine = "mysql" - engine_version = "5.7" - instance_class = "db.t2.micro" - name = "mydb" - username = "foo" - password = "foobarbaz" -} \ No newline at end of file diff --git a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive2.tf b/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive2.tf index 409ecc9a0b4..06a3465d2c7 100644 --- a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive2.tf +++ b/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive2.tf @@ -9,6 +9,8 @@ module "db" { instance_class = "db.t2.large" allocated_storage = 5 auto_minor_version_upgrade = true + backup_retention_period = 0 + name = "demodb" username = "user" diff --git a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive_expected_result.json b/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive_expected_result.json index 8af10cc36a3..1ab9aab1b6f 100644 --- a/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive_expected_result.json +++ b/assets/queries/terraform/aws/rds_with_backup_disabled/test/positive_expected_result.json @@ -1,26 +1,14 @@ [ - { - "queryName": "RDS With Backup Disabled", - "severity": "MEDIUM", - "line": 16, - "fileName": "positive1.tf" - }, { "queryName": "RDS With Backup Disabled", "severity": "MEDIUM", "line": 12, "fileName": "positive1.tf" }, - { - "queryName": "RDS With Backup Disabled", - "severity": "MEDIUM", - "line": 1, - "fileName": "positive2.tf" - }, { "queryName": "RDS With Backup Disabled", "severity": "MEDIUM", "line": 12, - "fileName": "positive3.tf" + "fileName": "positive2.tf" } ]