feat(aws): Add new RDS check to ensure db instances are protected by a backup plan
Context
This new check verifies whether Amazon RDS DB instances are covered by a comprehensive backup plan, crucial for ensuring data resilience and recovery. A backup plan is essential for protecting RDS instances against data loss or corruption. The control passes if an instance is included in an AWS Backup plan. Additionally, if the backupVaultLockCheck parameter is set to true, it requires that the backup be stored in a locked vault.
The parameter mentioned could have allowed this check to be configurable, verifying whether the backup plan is stored in a locked backup vault if set to true. However, I felt this was not the main goal of the check and could be confusing for users. Therefore, I decided to solely verify if RDS instances are covered by a backup plan. If it is considered best practice to have backup plans stored in locked vaults, perhaps this should be addressed in a new check applicable to all backup plans, not just those for RDS instances.
Additionally, implementing this check required modifications to the backup service due to the addition of a new call to the AWS API. This call allows to iterate over all resources protected by backup plans, ensuring that the instance being scanned is included.
Description
Added new rds_instance_protected_by_backup_plan check with its unit test and modify backup_serviceand its test.
Checklist
- Are there new checks included in this PR? Yes / No
- If so, do we need to update permissions for the provider? Please review this carefully.
- [ ] Review if the code is being covered by tests.
- [ ] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:
Project coverage is 88.89%. Comparing base (
d62e748) to head (0b8b068). Report is 1208 commits behind head on master.
Additional details and impacted files
@@ Coverage Diff @@
## master #4879 +/- ##
==========================================
+ Coverage 88.83% 88.89% +0.05%
==========================================
Files 941 942 +1
Lines 28897 28932 +35
==========================================
+ Hits 25672 25720 +48
+ Misses 3225 3212 -13
| Components | Coverage Δ | |
|---|---|---|
| prowler | 88.89% <100.00%> (+0.05%) |
:arrow_up: |
| api | ∅ <ø> (∅) |