feature/AKRF-11: Added AWS 'Neptune IAM Database Authentication Enabled' plugin and te…

collectors/aws/collector.js

@@ -539,6 +539,13 @@ var calls = {
             paginateReqProp: 'Marker'
         }
     },
+    Neptune: {
+        describeDBClusters: {
+            property: 'DBClusters',
+            paginate: 'Marker',
+            MaxRecords: 100
+        }
+    },
     Organizations: {
         describeOrganization: {
             property: 'Organization',

exports.js

@@ -231,6 +231,8 @@ module.exports = {
         'kmsDefaultKeyUsage'            : require(__dirname + '/plugins/aws/kms/kmsDefaultKeyUsage.js'),
         'kmsAppTierCmk'                 : require(__dirname + '/plugins/aws/kms/kmsAppTierCmk.js'),
 
+        'iamDbAuthenticationEnabled'    : require(__dirname + '/plugins/aws/neptune/iamDbAuthenticationEnabled.js'),
+
         'rdsAutomatedBackups'           : require(__dirname + '/plugins/aws/rds/rdsAutomatedBackups.js'),
         'rdsEncryptionEnabled'          : require(__dirname + '/plugins/aws/rds/rdsEncryptionEnabled.js'),
         'rdsCmkEncryptionEnabled'       : require(__dirname + '/plugins/aws/rds/rdsCmkEncryptionEnabled.js'),

helpers/aws/regions.js

@@ -123,5 +123,6 @@ module.exports = {
     xray: ['us-east-1', 'us-east-2', 'us-west-2', 'us-west-1',
         'ca-central-1', 'eu-central-1', 'eu-west-1', 'eu-west-2', 'eu-west-3', 'eu-north-1',
         'ap-northeast-1', 'ap-northeast-2',
-        'ap-southeast-1', 'ap-southeast-2', 'ap-south-1', 'sa-east-1', 'ap-east-1']
+        'ap-southeast-1', 'ap-southeast-2', 'ap-south-1', 'sa-east-1', 'ap-east-1'],
+    neptune: regions
 };

helpers/aws/regions_china.js

@@ -70,5 +70,6 @@ module.exports = {
     wafv2: [],
     workspaces: ['cn-northwest-1'],
     xray: regions,
-    resourcegroupstaggingapi: regions
+    resourcegroupstaggingapi: regions,
+    neptune: regions
 };

helpers/aws/regions_gov.js

@@ -70,5 +70,6 @@ module.exports = {
     wafv2: regions,
     workspaces: ['us-gov-west-1'],
     xray: [],
-    resourcegroupstaggingapi: regions
+    resourcegroupstaggingapi: regions,
+    neptune: regions
 };

plugins/aws/neptune/iamDbAuthenticationEnabled.js

@@ -0,0 +1,52 @@
+var async = require('async');
+var helpers = require('../../../helpers/aws');
+
+module.exports = {
+    title: 'Neptune IAM Database Authentication Enabled',
+    category: 'Neptune',
+    description: 'Ensures IAM Database Authentication is enabled for Neptune database clusters to manage database access',
+    more_info: 'AWS Identity and Access Management (IAM) can used to authenticate to your Neptune DB instance or DB cluster.',
+    link: 'https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html',
+    recommended_action: 'Modify the Neptune cluster to enable deletion protection.',
+    apis: ['Neptune:describeDBClusters'],
+
+    run: function(cache, settings, callback) {
+        var results = [];
+        var source = {};
+        var regions = helpers.regions(settings);
+
+        async.each(regions.neptune, function(region, rcb) {
+            var describeDBClusters = helpers.addSource(cache, source,
+                ['neptune', 'describeDBClusters', region]);
+
+            if (!describeDBClusters) return rcb();
+
+            if (describeDBClusters.err || !describeDBClusters.data) {
+                helpers.addResult(results, 3,
+                    `Unable to query for Neptune clusters: ${helpers.addError(describeDBClusters)}`, region);
+                return rcb();
+            }
+
+            if (!describeDBClusters.data.length) {
+                helpers.addResult(results, 0, 'No Neptune clusters found', region);
+                return rcb();
+            }
+
+            describeDBClusters.data.forEach(cluster => {
+                if (!cluster.DBClusterArn) return;
+
+                if (cluster.IAMDatabaseAuthenticationEnabled) {
+                    helpers.addResult(results, 0,
+                        'DB cluster has IAM Database Authentication enabled', region, cluster.DBClusterArn);
+                } else {
+                    helpers.addResult(results, 2,
+                        'DB cluster does not have IAM Database Authentication enabled', region, cluster.DBClusterArn);
+                }
+            });
+
+            rcb();
+        }, function() {
+            callback(null, results, source);
+        });
+    }
+};

plugins/aws/neptune/iamDbAuthenticationEnabled.spec.js

@@ -0,0 +1,102 @@
+const expect = require('chai').expect;
+var iamDbAuthenticationEnabled = require('./iamDbAuthenticationEnabled');
+
+const describeDBClusters = [
+    {
+        "MasterUsername": "admin",
+        "PreferredBackupWindow": "08:37-09:07",
+        "HostedZoneId": "ZUFXD4SLT2LS7",
+        "StorageEncrypted": false,
+        "DbClusterResourceId": "cluster-H4KOO22AIJUW5I7YRZ4MBSIHKQ",
+        "DBClusterArn": "arn:aws:rds:us-east-1:112233445566:cluster:cluster-1",
+        "IAMDatabaseAuthenticationEnabled": true,
+        "DeletionProtection": true
+    },
+    {
+        "MasterUsername": "admin",
+        "PreferredBackupWindow": "08:37-09:07",
+        "HostedZoneId": "ZUFXD4SLT2LS7",
+        "StorageEncrypted": false,
+        "DbClusterResourceId": "cluster-H4KOO22AIJUW5I7YRZ4MBSIHKQ",
+        "DBClusterArn": "arn:aws:rds:us-east-1:112233445566:cluster:cluster-1",
+        "IAMDatabaseAuthenticationEnabled": false,
+        "DeletionProtection": true
+    }
+];
+
+const createCache = (clusterData, clusterErr) => {
+    return {
+        neptune: {
+            describeDBClusters: {
+                'us-east-1': {
+                    data: clusterData,
+                    err: clusterErr
+                }
+            }
+        }
+    };
+};
+
+const createNullCache = () => {
+    return {
+        neptune: {
+            describeDBClusters: {
+                'us-east-1': null
+            }
+        }
+    };
+};
+
+describe('iamDbAuthenticationEnabled', function () {
+    describe('run', function () {
+
+        it('should PASS if DB cluster has IAM Database Authentication enabled', function (done) {
+            const cache = createCache([describeDBClusters[0]]);
+            iamDbAuthenticationEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].region).to.equal('us-east-1');
+                done();
+            });
+        });
+
+        it('should FAIL if DB cluster does not have IAM Database Authentication enabled', function (done) {
+            const cache = createCache([describeDBClusters[1]]);
+            iamDbAuthenticationEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(2);
+                expect(results[0].region).to.equal('us-east-1');
+                done();
+            });
+        });
+
+        it('should PASS if no Neptune clusters found', function (done) {
+            const cache = createCache([]);
+            iamDbAuthenticationEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].region).to.equal('us-east-1');
+                done();
+            });
+        });
+
+        it('should UNKNOWN if unable to describe DB clusters', function (done) {
+            const cache = createCache([], { message: 'Unable to describe clusters' });
+            iamDbAuthenticationEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(3);
+                expect(results[0].region).to.equal('us-east-1');
+                done();
+            });
+        });
+
+
+        it('should not return anything if describe DB clusters response not found', function (done) {
+            const cache = createNullCache();
+            iamDbAuthenticationEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(0);
+                done();
+            });
+        });
+    });
+});