cloudsploit/plugins/aws/neptune/neptuneAuditLoggingEnabled.spec.js at 1a748fbca97ccd49ae69835ffd27669b1a736b47 · aquasecurity/cloudsploit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
var expect = require('chai').expect;
var neptuneAuditLoggingEnabled = require('./neptuneAuditLoggingEnabled');

const describeDBClusters = [
    {
        AvailabilityZones: [],
        BackupRetentionPeriod: 1,
        DBClusterArn: 'arn:aws:rds:us-east-1:000011112222:cluster:neptune-cluster-1',
        DBClusterIdentifier: 'neptune-cluster-1',
        DBClusterParameterGroup: 'default.neptune1',
        DBSubnetGroup: 'default-vpc-99de2fe4',
        Status: 'available',
        Engine: 'neptune',
        EnabledCloudwatchLogsExports: [ "audit", "error"]
    },
    {
        AvailabilityZones: [],
        BackupRetentionPeriod: 10,
        DBClusterArn: 'arn:aws:rds:us-east-1:000011112223:cluster:neptune-cluster-2',
        DBClusterIdentifier: 'neptune-cluster-2',
        DBClusterParameterGroup: 'default.neptune1',
        DBSubnetGroup: 'default-vpc-99de2fe4',
        Status: 'available',
        Engine: 'neptune',
        EnabledCloudwatchLogsExports: [ "error"]
    },
    {
        AvailabilityZones: [],
        BackupRetentionPeriod: 10,
        DBClusterArn: 'arn:aws:rds:us-east-1:000011112224:cluster:neptune-cluster-3',
        DBClusterIdentifier: 'neptune-cluster-3',
        DBClusterParameterGroup: 'default.neptune1',
        DBSubnetGroup: 'default-vpc-99de2fe4',
        Status: 'available',
        Engine: 'neptune',
        EnabledCloudwatchLogsExports: []
    },
    {
        AvailabilityZones: [],
        BackupRetentionPeriod: 10,
        DBClusterArn: 'arn:aws:rds:us-east-1:000011112225:cluster:neptune-cluster-4',
        DBClusterIdentifier: 'neptune-cluster-4',
        DBClusterParameterGroup: 'default.neptune1',
        DBSubnetGroup: 'default-vpc-99de2fe4',
        Status: 'available',
        Engine: 'neptune'
    }
];

const createCache = (clusters, clustersErr) => {
    return {
        neptune: {
            describeDBClusters: {
                'us-east-1': {
                    err: clustersErr,
                    data: clusters
                },
            },
        }
    };
};

describe('neptuneAuditLoggingEnabled', function () {
    describe('run', function () {
        it('should PASS if Neptune cluster has audit logging enabled', function (done) {
            const cache = createCache([describeDBClusters[0]]);
            neptuneAuditLoggingEnabled.run(cache, {}, (err, results) => {
                expect(results.length).to.equal(1);
                expect(results[0].status).to.equal(0);
                expect(results[0].message).to.include('Neptune database cluster has audit logging enabled');
                expect(results[0].region).to.equal('us-east-1');
                done();
            });
        });

        it('should FAIL if Neptune cluster does not have audit logging enabled', function (done) {
            const cache = createCache([describeDBClusters[1]]);
            neptuneAuditLoggingEnabled.run(cache, {}, (err, results) => {
                expect(results.length).to.equal(1);
                expect(results[0].status).to.equal(2);
                expect(results[0].message).to.include('Neptune database cluster does not have audit logging enabled');
                expect(results[0].region).to.equal('us-east-1');
                done();
            });
        });

        it('should FAIL if Neptune cluster has empty EnabledCloudwatchLogsExports', function (done) {
            const cache = createCache([describeDBClusters[2]]);
            neptuneAuditLoggingEnabled.run(cache, {}, (err, results) => {
                expect(results.length).to.equal(1);
                expect(results[0].status).to.equal(2);
                expect(results[0].message).to.include('Neptune database cluster does not have audit logging enabled');
                expect(results[0].region).to.equal('us-east-1');
                done();
            });
        });

        it('should FAIL if Neptune cluster does not have EnabledCloudwatchLogsExports property', function (done) {
            const cache = createCache([describeDBClusters[3]]);
            neptuneAuditLoggingEnabled.run(cache, {}, (err, results) => {
                expect(results.length).to.equal(1);
                expect(results[0].status).to.equal(2);
                expect(results[0].message).to.include('Neptune database cluster does not have audit logging enabled');
                expect(results[0].region).to.equal('us-east-1');
                done();
            });
        });

        it('should PASS if no Neptune clusters found', function (done) {
            const cache = createCache([]);
            neptuneAuditLoggingEnabled.run(cache, {}, (err, results) => {
                expect(results.length).to.equal(1);
                expect(results[0].status).to.equal(0);
                expect(results[0].message).to.include('No Neptune database clusters found');
                expect(results[0].region).to.equal('us-east-1');
                done();
            });
        });

        it('should UNKNOWN if unable to list Neptune clusters', function (done) {
            const cache = createCache(null,  { message: "Unable to list Neptune clusters" });
            neptuneAuditLoggingEnabled.run(cache, {}, (err, results) => {
                expect(results.length).to.equal(1);
                expect(results[0].status).to.equal(3);
                expect(results[0].message).to.include('Unable to list Neptune database clusters:');
                expect(results[0].region).to.equal('us-east-1');
                done();
            });
        });
    });
});