feat(aws): Add new RDS check to verify that cluster minor version upgrade is enabled

prowler-cloud / prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

Apache License 2.0

10.76k stars 1.53k forks source link

Context

This new check assesses whether automatic minor version upgrades are enabled for Amazon RDS Multi-AZ DB clusters. Enabling automatic upgrades ensures that the database clusters are promptly updated with the latest minor versions, which may include new features, bug fixes, security patches, and performance improvements.

This check is already done for instances but it should be done for both because enabling this on clusters only verify that new instances created will have by default this option enabled, if an instance belongs to a cluster with minor upgrades enabled but it has minor upgrades disabled it won’t be updated so both checks are needed.

Also, Moto doesn’t support the parameter MultiAZ when creating a new cluster so I’ll be using Magic Mock for the test unit of the check.

Description

I added rds_cluster_minor_version_upgrade_enabled with his respective unit test.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 89.15%. Comparing base (abb28af) to head (bed6762). Report is 11 commits behind head on master.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #4725 +/- ## ========================================== + Coverage 89.10% 89.15% +0.05% ========================================== Files 913 919 +6 Lines 27913 28107 +194 ========================================== + Hits 24871 25058 +187 - Misses 3042 3049 +7 ```

prowler-cloud / prowler