pmh_only/bp-check
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check DB clusters including the DocDB engine

Browse Source
This commit is contained in:
skyuecx0630 2024-08-10 15:03:46 +09:00
parent 43007660d1
commit bc9cd3574f
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
services/rds.py
View File

@ -72,7 +72,7 @@ def rds_cluster_auto_minor_version_upgrade_enable():
clusters = client.describe_db_clusters()["DBClusters"] clusters = client.describe_db_clusters()["DBClusters"]
for cluster in clusters: for cluster in clusters:
if cluster.get("AutoMinorVersionUpgrade", None) == True: if cluster["Engine"] == "docdb" or cluster.get("AutoMinorVersionUpgrade"):
compliant_resources.append(cluster["DBClusterArn"]) compliant_resources.append(cluster["DBClusterArn"])
else: else:
non_compliant_resources.append(cluster["DBClusterArn"]) non_compliant_resources.append(cluster["DBClusterArn"])
@ -144,7 +144,7 @@ def rds_cluster_iam_authentication_enabled():
clusters = client.describe_db_clusters()["DBClusters"] clusters = client.describe_db_clusters()["DBClusters"]
for cluster in clusters: for cluster in clusters:
if cluster.get("IAMDatabaseAuthenticationEnabled", None) == True: if cluster["Engine"] == "docdb" or cluster.get("IAMDatabaseAuthenticationEnabled"):
compliant_resources.append(cluster["DBClusterArn"]) compliant_resources.append(cluster["DBClusterArn"])
else: else:
non_compliant_resources.append(cluster["DBClusterArn"]) non_compliant_resources.append(cluster["DBClusterArn"])
@ -258,8 +258,14 @@ def rds_logging_enabled():
non_compliant_resources = [] non_compliant_resources = []
clusters = client.describe_db_clusters()["DBClusters"] clusters = client.describe_db_clusters()["DBClusters"]
logs_for_engine = {
"aurora-mysql": ["audit", "error", "general", "slowquery"],
"aurora-postgresql": ["postgresql"],
"docdb": ["audit", "profiler"]
}
for cluster in clusters: for cluster in clusters:
if sorted(cluster["EnabledCloudwatchLogsExports"]) == ["audit", "error", "general", "slowquery"]: if sorted(cluster["EnabledCloudwatchLogsExports"]) == logs_for_engine.get(cluster["Engine"]):
compliant_resources.append(cluster["DBClusterArn"]) compliant_resources.append(cluster["DBClusterArn"])
else: else:
non_compliant_resources.append(cluster["DBClusterArn"]) non_compliant_resources.append(cluster["DBClusterArn"])