-
Notifications
You must be signed in to change notification settings - Fork 42
/
instance_at_rest_encrypted.go
91 lines (82 loc) · 2.41 KB
/
instance_at_rest_encrypted.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
package rds
import (
"fmt"
"github.com/Zeus-Labs/ZeusCloud/rules/types"
"github.com/neo4j/neo4j-go-driver/v4/neo4j"
)
type InstanceAtRestEncrypted struct{}
func (InstanceAtRestEncrypted) UID() string {
return "rds/instance_at_rest_encrypted"
}
func (InstanceAtRestEncrypted) Description() string {
return "RDS instances should have at rest encryption enabled."
}
func (InstanceAtRestEncrypted) Severity() types.Severity {
return types.High
}
func (InstanceAtRestEncrypted) RiskCategories() types.RiskCategoryList {
return []types.RiskCategory{
types.PoorEncryption,
types.DataAccess,
}
}
func (InstanceAtRestEncrypted) Execute(tx neo4j.Transaction) ([]types.Result, error) {
records, err := tx.Run(
`MATCH (a:AWSAccount{inscope: true})-[:RESOURCE]->(r:RDSInstance)
RETURN r.arn as resource_id,
'RDSInstance' as resource_type,
a.id as account_id,
CASE
WHEN r.storage_encrypted THEN 'passed'
ELSE 'failed'
END as status,
CASE
WHEN r.storage_encrypted THEN 'Instance is at rest encrypted.'
ELSE 'Instance is not at rest encrypted.'
END as context`,
nil,
)
if err != nil {
return nil, err
}
var results []types.Result
for records.Next() {
record := records.Record()
resourceID, _ := record.Get("resource_id")
resourceIDStr, ok := resourceID.(string)
if !ok {
return nil, fmt.Errorf("resource_id %v should be of type string", resourceID)
}
resourceType, _ := record.Get("resource_type")
resourceTypeStr, ok := resourceType.(string)
if !ok {
return nil, fmt.Errorf("resource_type %v should be of type string", resourceType)
}
accountID, _ := record.Get("account_id")
accountIDStr, ok := accountID.(string)
if !ok {
return nil, fmt.Errorf("account_id %v should be of type string", accountID)
}
status, _ := record.Get("status")
statusStr, ok := status.(string)
if !ok {
return nil, fmt.Errorf("status %v should be of type string", status)
}
context, _ := record.Get("context")
contextStr, ok := context.(string)
if !ok {
return nil, fmt.Errorf("context %v should be of type string", context)
}
results = append(results, types.Result{
ResourceID: resourceIDStr,
ResourceType: resourceTypeStr,
AccountID: accountIDStr,
Status: statusStr,
Context: contextStr,
})
}
return results, nil
}
func (InstanceAtRestEncrypted) ProduceRuleGraph(tx neo4j.Transaction, resourceId string) (neo4j.Result, error) {
return nil, nil
}