Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't generate redshift findings for default parameter groups #803

Merged
merged 2 commits into from Jun 27, 2020

Conversation

gebailey
Copy link
Contributor

AWS Redshift generates default parameter groups (e.g. "default.redshift-1.0")
that have certain parameters that can generate findings, such as
"enable_user_activity_logging" == "false", and "require_ssl" == "false".

The user is unable to modify these parameters, so in cases where a default
parameter group exists, findings will be generated which the user has no
ability to remediate.

The "redshift-parameter-group-logging-disabled" and
"redshift-parameter-group-ssl-not-required" rules are modified to only apply to
non-default parameter groups for which the user can be expected to remediate.

Description

Make sure the PR is against the develop branch (see Contributing).

Please include a summary of the change(s) and which issue(s) it addresses. Please also include relevant motivation and context.

Fixes # (issue)

Type of change

Select the relevant option(s):

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works (optional)
  • New and existing unit tests pass locally with my changes

AWS Redshift generates default parameter groups (e.g. "default.redshift-1.0")
that have certain parameters that can generate findings, such as
"enable_user_activity_logging" == "false", and "require_ssl" == "false".

The user is unable to modify these parameters, so in cases where a default
parameter group exists, findings will be generated which the user has no
ability to remediate.

The "redshift-parameter-group-logging-disabled" and
"redshift-parameter-group-ssl-not-required" rules are modified to only apply to
non-default parameter groups for which the user can be expected to remediate.
@gebailey gebailey added the component-provider-aws Affects AWS provider label Jun 26, 2020
Copy link
Contributor

@ramimac ramimac left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me! Thanks

@x4v13r64 x4v13r64 added this to the 5.10 milestone Jun 27, 2020
@x4v13r64 x4v13r64 removed this from the 5.10 milestone Jun 27, 2020
@x4v13r64
Copy link
Collaborator

Thanks @gebailey, I've updated the note in the first rule.

@x4v13r64 x4v13r64 merged commit 0adacd6 into develop Jun 27, 2020
@x4v13r64 x4v13r64 deleted the redshift-skip-default-parameter-groups branch June 27, 2020 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component-provider-aws Affects AWS provider
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants