pmh_only/bp-check
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check whether retentionInDays is set or not

Browse Source
This commit is contained in:
skyuecx0630 2024-08-08 11:27:06 +09:00
parent f85c15f31d
commit 142352f1ee
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
services/cloudwatch.py
View File

@ -11,11 +11,13 @@ def cw_loggroup_retention_period_check():
non_compliant_resources = [] non_compliant_resources = []
log_groups = logs_client.describe_log_groups()["logGroups"] log_groups = logs_client.describe_log_groups()["logGroups"]
# This rule should check if `retentionInDays` is less than n days.
# But, instead of that, this will check if the retention setting is set to "Never expire" or not
for log_group in log_groups: for log_group in log_groups:
if "retentionInDays" in log_group and log_group["retentionInDays"] < 365: if "retentionInDays" in log_group:
non_compliant_resources.append(log_group["logGroupArn"])
else:
compliant_resources.append(log_group["logGroupArn"]) compliant_resources.append(log_group["logGroupArn"])
else:
non_compliant_resources.append(log_group["logGroupArn"])
return RuleCheckResult( return RuleCheckResult(
passed=not non_compliant_resources, passed=not non_compliant_resources,