feat(elasticache): add check elasticache_redis_cluster_auth_enabled

prowler/providers/aws/services/elasticache/elasticache_redis_cluster_multi_az_enabled/elasticache_redis_cluster_multi_az_enabled.metadata.json

@@ -1,14 +1,14 @@
 {
   "Provider": "aws",
   "CheckID": "elasticache_redis_cluster_multi_az_enabled",
-  "CheckTitle": "Ensure Elasticache Elasticache Redis cache cluster has Multi-AZ enabled.",
+  "CheckTitle": "Ensure Elasticache Redis cache cluster has Multi-AZ enabled.",
   "CheckType": [],
   "ServiceName": "elasticache",
   "SubServiceName": "",
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
   "Severity": "medium",
   "ResourceType": "AWSElastiCacheClusters",
-  "Description": "Ensure Elasticache Elasticache Redis cache cluster has Multi-AZ enabled.",
+  "Description": "Ensure Elasticache Redis cache cluster has Multi-AZ enabled.",
   "Risk": "Ensure that your Amazon ElastiCache Redis cache clusters has Multi-AZ enabled.",
   "RelatedUrl": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/ElastiCache/elasticache-multi-az.html#",
   "Remediation": {
@@ -19,7 +19,7 @@
       "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-aws-elasticache-redis-cluster-with-multi-az-automatic-failover-feature-set-to-enabled/"
     },
     "Recommendation": {
-      "Text": "Ensure Elasticache Elasticache Redis cache cluster has Multi-AZ enabled.",
+      "Text": "Ensure Elasticache Redis cache cluster has Multi-AZ enabled.",
       "Url": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/ElastiCache/elasticache-multi-az.html#"
     }
   },

prowler/providers/aws/services/elasticache/elasticache_redis_replication_group_auth_enabled/elasticache_redis_replication_group_auth_enabled.metadata.json

@@ -0,0 +1,34 @@
+{
+  "Provider": "aws",
+  "CheckID": "elasticache_redis_replication_group_auth_enabled",
+  "CheckTitle": "Ensure Elasticache Elasticache Redis replication groups of earlier versions should have Redis OSS AUTH enabled.",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "NIST 800-53 Controls "
+  ],
+  "ServiceName": "elasticache",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+  "Severity": "medium",
+  "ResourceType": "AWSElastiCacheReplicationGroup",
+  "Description": "Ensure Elasticache Redis replication groups of earlier versions use Redis OSS AUTH.",
+  "Risk": "Without Redis AUTH enabled, your ElastiCache (Redis) instance is vulnerable to unauthorized access and potential data breaches.",
+  "RelatedUrl": "https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth.html",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/elasticache-controls.html#elasticache-6",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable Redis AUTH to require authentication before accessing your Redis instance, and for Redis 6.0 and later, consider implementing Role-Based Access Control (RBAC) for enhanced security.",
+      "Url": "https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth.html#auth-modifyng-token"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/aws/services/elasticache/elasticache_redis_replication_group_auth_enabled/elasticache_redis_replication_group_auth_enabled.py

@@ -0,0 +1,34 @@
+from packaging import version
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.elasticache.elasticache_client import (
+    elasticache_client,
+)
+
+
+class elasticache_redis_replication_group_auth_enabled(Check):
+    def execute(self):
+        findings = []
+        for repl_group in elasticache_client.replication_groups.values():
+            report = Check_Report_AWS(self.metadata())
+            report.region = repl_group.region
+            report.resource_id = repl_group.id
+            report.resource_arn = repl_group.arn
+            report.resource_tags = repl_group.tags
+
+            for cluster in repl_group.member_clusters:
+                if version.parse(cluster.engine_version) < version.parse("6.0"):
+                    if not cluster.auth_token_enabled:
+                        report.status = "FAIL"
+                        report.status_extended = f"Elasticache Redis replication group {repl_group.id}(v{cluster.engine_version}) does not have AUTH enabled."
+
+                    else:
+                        report.status = "PASS"
+                        report.status_extended = f"Elasticache Redis replication group {repl_group.id}(v{cluster.engine_version}) does have AUTH enabled."
+                else:
+                    report.status = "MANUAL"
+                    report.status_extended = f"Elasticache Redis replication group {repl_group.id}(v{cluster.engine_version}) does not have to use AUTH, but it should have Redis ACL configured."
+
+            findings.append(report)
+
+        return findings

prowler/providers/aws/services/elasticache/elasticache_service.py

@@ -41,6 +41,10 @@
                             auto_minor_version_upgrade=cache_cluster.get(
                                 "AutoMinorVersionUpgrade", False
                             ),
+                            engine_version=cache_cluster.get("EngineVersion", "0.0"),
+                            auth_token_enabled=cache_cluster.get(
+                                "AuthTokenEnabled", False
+                            ),
                         )
                 except Exception as error:
                     logger.error(
@@ -85,35 +89,53 @@
             for repl_group in regional_client.describe_replication_groups()[
                 "ReplicationGroups"
             ]:
-                try:
-                    replication_arn = repl_group["ARN"]
-                    if not self.audit_resources or (
-                        is_resource_filtered(replication_arn, self.audit_resources)
-                    ):
-                        self.replication_groups[replication_arn] = ReplicationGroup(
-                            id=repl_group["ReplicationGroupId"],
-                            arn=replication_arn,
-                            region=regional_client.region,
-                            status=repl_group["Status"],
-                            snapshot_retention=repl_group.get(
-                                "SnapshotRetentionLimit", 0
-                            ),
-                            encrypted=repl_group.get("AtRestEncryptionEnabled", False),
-                            transit_encryption=repl_group.get(
-                                "TransitEncryptionEnabled", False
-                            ),
-                            multi_az=repl_group.get("MultiAZ", "disabled"),
-                            auto_minor_version_upgrade=repl_group.get(
-                                "AutoMinorVersionUpgrade", False
-                            ),
-                            automatic_failover=repl_group.get(
-                                "AutomaticFailoverStatus", "disabled"
-                            ),
+                replication_arn = repl_group["ARN"]
+                if not self.audit_resources or (
+                    is_resource_filtered(replication_arn, self.audit_resources)
+                ):
+                    try:
+                        replication_arn = repl_group["ARN"]
+                        if not self.audit_resources or (
+                            is_resource_filtered(replication_arn, self.audit_resources)
+                        ):
+                            member_clusters = repl_group.get("MemberClusters", [])
+                            cluster_list = []
+                            for cluster in member_clusters:
+                                cluster_list.append(
+                                    self.clusters[
+                                        f"arn:aws:elasticache:{regional_client.region}:{self.audited_account}:cluster:{cluster}"
+                                    ]
+                                )
+                            self.replication_groups[replication_arn] = ReplicationGroup(
+                                id=repl_group["ReplicationGroupId"],
+                                arn=replication_arn,
+                                region=regional_client.region,
+                                status=repl_group["Status"],
+                                snapshot_retention=repl_group.get(
+                                    "SnapshotRetentionLimit", 0
+                                ),
+                                encrypted=repl_group.get(
+                                    "AtRestEncryptionEnabled", False
+                                ),
+                                transit_encryption=repl_group.get(
+                                    "TransitEncryptionEnabled", False
+                                ),
+                                multi_az=repl_group.get("MultiAZ", "disabled"),
+                                auto_minor_version_upgrade=repl_group.get(
+                                    "AutoMinorVersionUpgrade", False
+                                ),
+                                auth_token_enabled=repl_group.get(
+                                    "AuthTokenEnabled", False
+                                ),
+                                automatic_failover=repl_group.get(
+                                    "AutomaticFailoverStatus", "disabled"
+                                ),
+                                member_clusters=cluster_list,
+                            )
+                    except Exception as error:
+                        logger.error(
+                            f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                         )
-                except Exception as error:
-                    logger.error(
-                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                    )
         except Exception as error:
             logger.error(
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -167,6 +189,8 @@
     subnets: list = []
     tags: Optional[list]
     auto_minor_version_upgrade: bool = False
+    engine_version: Optional[str]
+    auth_token_enabled: Optional[bool]
 
 
 class ReplicationGroup(BaseModel):
@@ -179,5 +203,7 @@
     transit_encryption: bool
     multi_az: str
     tags: Optional[list]
-    auto_minor_version_upgrade: bool
+    auto_minor_version_upgrade: bool = False
+    auth_token_enabled: Optional[bool]
     automatic_failover: str
+    member_clusters: Optional[list[Cluster]]