fix(cloudformation): resolve DedicatedMasterEnabled parsing issue (a…

…quasecurity#6439)
DmitriyLewen · Apr 2, 2024 · 74e4c6e · 74e4c6e
1 parent 245c120
commit 74e4c6e
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 4 deletions.
diff --git a/pkg/iac/adapters/cloudformation/aws/elasticsearch/domain.go b/pkg/iac/adapters/cloudformation/aws/elasticsearch/domain.go
@@ -16,9 +16,7 @@ func getDomains(ctx parser.FileContext) (domains []elasticsearch.Domain) {
 			Metadata:       r.Metadata(),
 			DomainName:     r.GetStringProperty("DomainName"),
 			AccessPolicies: r.GetStringProperty("AccessPolicies"),
-			// TODO: ElasticsearchClusterConfig changed to ClusterConfig
-			DedicatedMasterEnabled: r.GetBoolProperty("ElasticsearchClusterConfig.DedicatedMasterEnabled"),
-			VpcId:                  iacTypes.String("", r.Metadata()),
+			VpcId:          iacTypes.String("", r.Metadata()),
 			LogPublishing: elasticsearch.LogPublishing{
 				Metadata:              r.Metadata(),
 				AuditEnabled:          iacTypes.BoolDefault(false, r.Metadata()),
@@ -46,6 +44,12 @@ func getDomains(ctx parser.FileContext) (domains []elasticsearch.Domain) {
 			},
 		}
 
+		if r.Type() == "AWS::OpenSearchService::Domain" {
+			domain.DedicatedMasterEnabled = r.GetBoolProperty("ClusterConfig.DedicatedMasterEnabled")
+		} else {
+			domain.DedicatedMasterEnabled = r.GetBoolProperty("ElasticsearchClusterConfig.DedicatedMasterEnabled")
+		}
+
 		if prop := r.GetProperty("LogPublishingOptions"); prop.IsNotNil() {
 			domain.LogPublishing = elasticsearch.LogPublishing{
 				Metadata:              prop.Metadata(),

diff --git a/pkg/iac/adapters/cloudformation/aws/elasticsearch/elasticsearch_test.go b/pkg/iac/adapters/cloudformation/aws/elasticsearch/elasticsearch_test.go
@@ -22,6 +22,8 @@ Resources:
     Type: AWS::OpenSearchService::Domain
     Properties:
       DomainName: 'test'
+      ClusterConfig:
+        DedicatedMasterEnabled: true
       NodeToNodeEncryptionOptions:
         Enabled: true
       EncryptionAtRestOptions:
@@ -47,7 +49,8 @@ Resources:
 			expected: elasticsearch.Elasticsearch{
 				Domains: []elasticsearch.Domain{
 					{
-						DomainName: types.StringTest("test"),
+						DomainName:             types.StringTest("test"),
+						DedicatedMasterEnabled: types.BoolTest(true),
 						LogPublishing: elasticsearch.LogPublishing{
 							AuditEnabled:          types.BoolTest(true),
 							CloudWatchLogGroupArn: types.StringTest("arn:aws:logs:us-east-1:123456789012:log-group:/aws/opensearch/domains/opensearch-application-logs"),
@@ -78,6 +81,24 @@ Resources:
 				Domains: []elasticsearch.Domain{{}},
 			},
 		},
+		{
+			name: "Elasticsearch",
+			source: `AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  ElasticsearchDomain:
+    Type: AWS::Elasticsearch::Domain
+    Properties:
+      ElasticsearchClusterConfig:
+        DedicatedMasterEnabled: true
+  `,
+			expected: elasticsearch.Elasticsearch{
+				Domains: []elasticsearch.Domain{
+					{
+						DedicatedMasterEnabled: types.BoolTest(true),
+					},
+				},
+			},
+		},
 	}
 
 	for _, tt := range tests {