feat(aws): Add new RDS check to verify that db instances copy tags to snapshots

prowler-cloud / prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

Apache License 2.0

10.53k stars 1.51k forks source link

Context

This new check ensure that Amazon RDS DB instances are configured to automatically copy all tags to snapshots upon their creation. Consistent tagging between DB instances and their snapshots aids in asset identification and inventory management, which is essential for robust governance and security measures.

In this check, all instances except for Aurora ones are not heritable. This means that instances within a cluster can have settings that differ from the cluster. According to the AWS API:

CopyTagsToSnapshot (boolean) –
Indicates whether tags are copied from the DB instance to snapshots of the DB instance.
This setting doesn’t apply to Amazon Aurora DB instances. Copying tags to snapshots is managed by the DB cluster. 
Setting this value for an Aurora DB instance has no effect on the DB cluster setting.

Therefore, this check scans every instance except for Aurora ones, because those instances will be covered in a future by the cluster check.

Description

Added new check rds_instance_copy_tags with its unit test

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 89.13%. Comparing base (0fcf424) to head (3d4372d). Report is 29 commits behind head on master.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #4806 +/- ## ========================================== - Coverage 89.13% 89.13% -0.01% ========================================== Files 921 930 +9 Lines 28157 28484 +327 ========================================== + Hits 25099 25390 +291 - Misses 3058 3094 +36 ```

prowler-cloud / prowler