diff --git a/internal/adapters/cloud/aws/documentdb/adapt.go b/internal/adapters/cloud/aws/documentdb/adapt.go index b61fe5fad..409f1bed0 100644 --- a/internal/adapters/cloud/aws/documentdb/adapt.go +++ b/internal/adapters/cloud/aws/documentdb/adapt.go @@ -102,11 +102,12 @@ func (a *adapter) adaptCluster(cluster types.DBCluster) (*documentdb.Cluster, er } return &documentdb.Cluster{ - Metadata: metadata, - Identifier: defsecTypes.String(identifier, metadata), - EnabledLogExports: logExports, - Instances: instances, - StorageEncrypted: defsecTypes.Bool(cluster.StorageEncrypted, metadata), - KMSKeyID: defsecTypes.String(kmsKeyId, metadata), + Metadata: metadata, + Identifier: defsecTypes.String(identifier, metadata), + EnabledLogExports: logExports, + Instances: instances, + StorageEncrypted: defsecTypes.Bool(cluster.StorageEncrypted, metadata), + KMSKeyID: defsecTypes.String(kmsKeyId, metadata), + BackupRetentionPeriod: defsecTypes.Int(int(*cluster.BackupRetentionPeriod), metadata), }, nil } diff --git a/internal/adapters/cloudformation/aws/documentdb/cluster.go b/internal/adapters/cloudformation/aws/documentdb/cluster.go index bc35a837b..33e56ba81 100644 --- a/internal/adapters/cloudformation/aws/documentdb/cluster.go +++ b/internal/adapters/cloudformation/aws/documentdb/cluster.go @@ -12,12 +12,13 @@ func getClusters(ctx parser.FileContext) (clusters []documentdb.Cluster) { for _, r := range clusterResources { cluster := documentdb.Cluster{ - Metadata: r.Metadata(), - Identifier: r.GetStringProperty("DBClusterIdentifier"), - EnabledLogExports: getLogExports(r), - Instances: nil, - StorageEncrypted: r.GetBoolProperty("StorageEncrypted"), - KMSKeyID: r.GetStringProperty("KmsKeyId"), + Metadata: r.Metadata(), + Identifier: r.GetStringProperty("DBClusterIdentifier"), + EnabledLogExports: getLogExports(r), + Instances: nil, + BackupRetentionPeriod: r.GetIntProperty("BackupRetentionPeriod"), + StorageEncrypted: r.GetBoolProperty("StorageEncrypted"), + KMSKeyID: r.GetStringProperty("KmsKeyId"), } updateInstancesOnCluster(&cluster, ctx) diff --git a/internal/adapters/terraform/aws/documentdb/adapt.go b/internal/adapters/terraform/aws/documentdb/adapt.go index f034d17e7..104ef836d 100644 --- a/internal/adapters/terraform/aws/documentdb/adapt.go +++ b/internal/adapters/terraform/aws/documentdb/adapt.go @@ -52,11 +52,12 @@ func adaptCluster(resource *terraform.Block, module *terraform.Module) documentd KMSKeyIDVal := KMSKeyIDAttr.AsStringValueOrDefault("", resource) return documentdb.Cluster{ - Metadata: resource.GetMetadata(), - Identifier: identifierVal, - EnabledLogExports: enabledLogExports, - Instances: instances, - StorageEncrypted: storageEncryptedVal, - KMSKeyID: KMSKeyIDVal, + Metadata: resource.GetMetadata(), + Identifier: identifierVal, + EnabledLogExports: enabledLogExports, + BackupRetentionPeriod: resource.GetAttribute("backup_retention_period").AsIntValueOrDefault(0, resource), + Instances: instances, + StorageEncrypted: storageEncryptedVal, + KMSKeyID: KMSKeyIDVal, } } diff --git a/pkg/providers/aws/documentdb/documentdb.go b/pkg/providers/aws/documentdb/documentdb.go index f6e0e77e1..0a6c2940e 100755 --- a/pkg/providers/aws/documentdb/documentdb.go +++ b/pkg/providers/aws/documentdb/documentdb.go @@ -14,12 +14,13 @@ const ( ) type Cluster struct { - Metadata defsecTypes.Metadata - Identifier defsecTypes.StringValue - EnabledLogExports []defsecTypes.StringValue - Instances []Instance - StorageEncrypted defsecTypes.BoolValue - KMSKeyID defsecTypes.StringValue + Metadata defsecTypes.Metadata + Identifier defsecTypes.StringValue + EnabledLogExports []defsecTypes.StringValue + BackupRetentionPeriod defsecTypes.IntValue + Instances []Instance + StorageEncrypted defsecTypes.BoolValue + KMSKeyID defsecTypes.StringValue } type Instance struct { diff --git a/pkg/rego/schemas/cloud.json b/pkg/rego/schemas/cloud.json index d6e80f1cd..da460a74c 100644 --- a/pkg/rego/schemas/cloud.json +++ b/pkg/rego/schemas/cloud.json @@ -820,6 +820,10 @@ "github.com.aquasecurity.defsec.pkg.providers.aws.documentdb.Cluster": { "type": "object", "properties": { + "backupretentionperiod": { + "type": "object", + "$ref": "#/definitions/github.com.aquasecurity.defsec.pkg.types.IntValue" + }, "enabledlogexports": { "type": "array", "items": {