prowler 5.16.1__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/aws/services/organizations/organizations_tags_policies_enabled_and_attached/organizations_tags_policies_enabled_and_attached.metadata.json

@@ -1,26 +1,32 @@
 {
   "Provider": "aws",
   "CheckID": "organizations_tags_policies_enabled_and_attached",
-  "CheckTitle": "Check if an AWS Organization has tags policies enabled and attached.",
-  "CheckType": [],
+  "CheckTitle": "AWS Organization has tag policies enabled and attached",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
   "ServiceName": "organizations",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service::account-id:organization/organization-id",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
   "ResourceType": "Other",
-  "Description": "Check if an AWS Organization has tags policies enabled and attached.",
-  "Risk": "If an AWS Organization tags policies are not enabled and attached, it is not possible to enforce tags on AWS resources.",
+  "ResourceGroup": "governance",
+  "Description": "**AWS Organizations** tag policies are evaluated for their presence and attachment to organization targets (accounts or OUs), distinguishing between no policies, policies defined but not attached, and policies attached to at least one target.",
+  "Risk": "Absent or unattached tag policies cause inconsistent or missing tags, undermining:\n- **Confidentiality** via bypassed tag-based access conditions\n- **Integrity** through misclassified resources and drift\n- **Availability** when automation, cost routing, or incident scoping that rely on tags break",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: Create and attach a Tag Policy\nResources:\n  TagPolicy:\n    Type: AWS::Organizations::Policy\n    Properties:\n      Name: <example_resource_name>\n      Type: TAG_POLICY  # Critical: defines a Tag Policy type\n      Content:\n        tags:\n          Environment:\n            tag_key:\n              \"@@assign\": \"Environment\"\n      TargetIds:\n        - <example_resource_id>  # Critical: attaches the policy to an account/OU/root\n```",
+      "Other": "1. Sign in to the AWS Management Console with the organization management account\n2. Open AWS Organizations > Policies > Tag policies\n3. If prompted, click Enable tag policies\n4. Click Create policy, enter a name, add minimal valid content (e.g., define one tag key), and create the policy\n5. Select the policy and click Attach\n6. Choose the Root, an OU, or at least one account and confirm\n7. The check passes when a tag policy exists and is attached to a target",
+      "Terraform": "```hcl\n# Create a Tag Policy\nresource \"aws_organizations_policy\" \"<example_resource_name>\" {\n  name    = \"<example_resource_name>\"\n  type    = \"TAG_POLICY\"  # Critical: defines a Tag Policy type\n  content = jsonencode({\n    tags = {\n      Environment = {\n        tag_key = { \"@@assign\" = \"Environment\" }\n      }\n    }\n  })\n}\n\n# Attach the Tag Policy to a target (Root/OU/Account)\nresource \"aws_organizations_policy_attachment\" \"<example_resource_name>\" {\n  policy_id = aws_organizations_policy.<example_resource_name>.id\n  target_id = \"<example_resource_id>\"  # Critical: attaches the policy to an account/OU/root\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable and attach AWS Organizations tags policies.",
-      "Url": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html"
+      "Text": "Enable **tag policies** and attach them to relevant roots/OUs/accounts. Define mandatory keys (e.g., `Environment`, `CostCenter`) with allowed values. Apply **defense in depth** by using tags in IAM conditions and SCPs. Start with validation-only, then enforce, and continuously monitor compliance across accounts.",
+      "Url": "https://hub.prowler.com/check/organizations_tags_policies_enabled_and_attached"
     }
   },
   "Categories": [],

prowler/providers/aws/services/rds/rds_cluster_backtrack_enabled/rds_cluster_backtrack_enabled.metadata.json

@@ -1,29 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_backtrack_enabled",
-  "CheckTitle": "Check if RDS Aurora MySQL Clusters have backtrack enabled.",
-  "CheckType": [],
+  "CheckTitle": "RDS Aurora MySQL cluster has Backtrack enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Ensure that the Backtrack feature is enabled for your Amazon Aurora (with MySQL compatibility) database clusters in order to backtrack your clusters to a specific time, without using backups. Backtrack is an Amazon RDS feature that allows you to specify the amount of time that an Aurora MySQL database cluster needs to retain change records, in order to have a fast way to recover from user errors, such as dropping the wrong table or deleting the wrong row by moving your MySQL database to a prior point in time without the need to restore from a recent backup.",
-  "Risk": "Once the Backtrack feature is enabled, Amazon RDS can quickly 'rewind' your Aurora MySQL database cluster to a point in time that you specify. In contrast to the backup and restore method, with Backtrack you can easily undo a destructive action, such as a DELETE query without a WHERE clause, with minimal downtime, you can rewind your Aurora cluster in just few minutes, and you can repeatedly backtrack a database cluster back and forth in time to help determine when a particular data change occurred.",
-  "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-14",
+  "ResourceGroup": "database",
+  "Description": "**Aurora MySQL DB clusters** have **Backtrack** configured with a non-zero `BacktrackWindow`, retaining change records to allow rewinding to a consistent earlier time. *Applies to `aurora-mysql` engines only.*",
+  "Risk": "Without **Backtrack**, destructive queries or admin mistakes can't be quickly undone, forcing snapshot/point-in-time restores. This increases recovery time, disrupts availability, and risks data **integrity** from partial restores or rollbacks.\n\nAdversaries who alter data can cause longer impact windows before containment.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/config/latest/developerguide/aurora-mysql-backtracking-enabled.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-14",
+    "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Managing.Backtrack.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds restore-db-cluster-to-point-in-time --region <REGION> --source-db-cluster-identifier <SOURCE_DB_CLUSTER_ID> --db-cluster-identifier <DB_CLUSTER_ID> --restore-type copy-on-write --use-latest-restorable-time --backtrack-window 86400",
-      "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#",
-      "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#"
+      "CLI": "aws rds restore-db-cluster-to-point-in-time --source-db-cluster-identifier <SOURCE_DB_CLUSTER_ID> --db-cluster-identifier <DB_CLUSTER_ID> --use-latest-restorable-time --backtrack-window 3600",
+      "NativeIaC": "```yaml\n# CloudFormation: Create Aurora MySQL cluster with Backtrack enabled\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      Engine: aurora-mysql\n      MasterUsername: \"<MASTER_USERNAME>\"\n      MasterUserPassword: \"<MASTER_PASSWORD>\"\n      BacktrackWindow: 3600  # CRITICAL: Enables Backtrack (seconds) so the check passes\n```",
+      "Other": "1. In the AWS Console, go to RDS > Databases and select the Aurora MySQL cluster\n2. Click Actions > Restore to point in time\n3. Choose Use latest restorable time\n4. Set Backtrack window (seconds) to a value > 0 (e.g., 3600)\n5. Enter a new DB cluster identifier and click Restore DB cluster\n6. Cut over applications to the new cluster",
+      "Terraform": "```hcl\n# Terraform: Aurora MySQL cluster with Backtrack enabled\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  engine          = \"aurora-mysql\"\n  master_username = \"<MASTER_USERNAME>\"\n  master_password = \"<MASTER_PASSWORD>\"\n  backtrack_window = 3600  # CRITICAL: Enables Backtrack (seconds) so the check passes\n}\n```"
     },
     "Recommendation": {
-      "Text": "Backups help you to recover more quickly from a security incident. They also strengthens the resilience of your systems. Aurora backtracking reduces the time to recover a database to a point in time. It does not require a database restore to do so. You cannot enable backtracking on an existing cluster. Instead, you can create a clone that has backtracking enabled.",
-      "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-14"
+      "Text": "Enable **Backtrack** on Aurora MySQL clusters and set `BacktrackWindow` to meet RTO while balancing cost and workload. Use it with automated backups for **defense in depth** and resilience.\n\n*For clusters without Backtrack*, provision a clone or new cluster with it enabled; monitor usage and adjust the window as change rates evolve.",
+      "Url": "https://hub.prowler.com/check/rds_cluster_backtrack_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "resilience"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_cluster_copy_tags_to_snapshots/rds_cluster_copy_tags_to_snapshots.metadata.json

@@ -1,26 +1,33 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_copy_tags_to_snapshots",
-  "CheckTitle": "Check if RDS DB clusters have copy tags to snapshots enabled",
-  "CheckType": [],
+  "CheckTitle": "RDS DB cluster has copy tags to snapshots enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+  "ResourceIdTemplate": "",
   "Severity": "low",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Check if RDS DB clusters have copy tags to snapshots enabled, Aurora instances do not support this feature at instance level so those who are clustered will be scan by this check.",
-  "Risk": "If RDS clusters are not configured to copy tags to snapshots, it could lead to compliance issues as the snapshots will not inherit necessary metadata such as environment, owner, or purpose tags. This could result in inefficient tracking and management of RDS resources and their snapshots.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.CopyTags",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB clusters** are evaluated for the `CopyTagsToSnapshot` setting that propagates cluster tags to their DB snapshots.\n\n*Aurora tagging is configured at the cluster level; instance-level copying isn't supported.*",
+  "Risk": "**Missing tag propagation** leaves snapshots without consistent metadata, weakening **ABAC**, ownership tracking, and retention controls. This can allow overly broad access to backups, hinder incident scoping, and inflate costs-impacting **confidentiality** and operational governance.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-16",
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.CopyTags"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <cluster-identifier> --copy-tags-to-snapshot",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-16",
-      "Terraform": ""
+      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <example_resource_id> --copy-tags-to-snapshot",
+      "NativeIaC": "```yaml\n# CloudFormation: enable copying tags to snapshots on an RDS DB cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      CopyTagsToSnapshot: true  # CRITICAL: ensures cluster tags are copied to snapshots\n```",
+      "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB cluster and choose Modify\n3. Check Copy tags to snapshots\n4. Click Continue, then Apply changes",
+      "Terraform": "```hcl\n# Terraform: enable copying tags to snapshots on an RDS DB cluster\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  copy_tags_to_snapshot = true  # CRITICAL: ensures cluster tags are copied to snapshots\n}\n```"
     },
     "Recommendation": {
-      "Text": "Ensure that the `CopyTagsToSnapshot` setting is enabled for all RDS clusters to propagate cluster tags to their snapshots for improved tracking and compliance.",
-      "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.CopyTags"
+      "Text": "Enable `CopyTagsToSnapshot` on all applicable **RDS/Aurora clusters**.\n- Standardize required tags (owner, environment, data class)\n- Use **least privilege** and **ABAC** based on tags\n- Automate tagging and periodic audits so snapshots inherit metadata and lifecycle policies",
+      "Url": "https://hub.prowler.com/check/rds_cluster_copy_tags_to_snapshots"
     }
   },
   "Categories": [],

prowler/providers/aws/services/rds/rds_cluster_critical_event_subscription/rds_cluster_critical_event_subscription.metadata.json

@@ -1,31 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_critical_event_subscription",
-  "CheckTitle": "Check if RDS Cluster critical events are subscribed.",
+  "CheckTitle": "RDS cluster event subscription is enabled for maintenance and failure categories",
   "CheckType": [
-    "Software and Configuration Checks, AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices"
   ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:account",
-  "Severity": "low",
-  "ResourceType": "AwsAccount",
-  "Description": "Ensure that Amazon RDS event notification subscriptions are enabled for database cluster events, particularly maintenance and failure.",
-  "Risk": "Without event subscriptions for critical events, such as maintenance and failures, you may not be aware of issues affecting your RDS clusters, leading to downtime or security vulnerabilities.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "AwsRdsEventSubscription",
+  "ResourceGroup": "database",
+  "Description": "**RDS event subscriptions** for the `db-cluster` source type are enabled and cover critical cluster event categories: **`maintenance`** and **`failure`** (or all cluster events).",
+  "Risk": "Without notifications for **cluster maintenance** and **failure**, teams may miss engine updates, failovers, or node crashes, impacting **availability** and increasing MTTR. Prolonged degraded states can cause replication lag and potential **data integrity** issues, hindering timely containment.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html",
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Subscribing.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-19"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds create-event-subscription --source-type db-cluster --event-categories 'failure' 'maintenance' --sns-topic-arn <sns-topic-arn>",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-19",
-      "Terraform": ""
+      "CLI": "aws rds create-event-subscription --subscription-name <example_resource_name> --sns-topic-arn <example_resource_arn> --source-type db-cluster --event-categories maintenance failure --enabled",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::EventSubscription\n    Properties:\n      SnsTopicArn: <example_resource_arn>       # Critical: SNS topic to receive notifications\n      SourceType: db-cluster                    # Critical: Scope to DB clusters\n      EventCategories:                          # Critical: Subscribe to required categories only\n        - maintenance\n        - failure\n      Enabled: true                             # Critical: Must be enabled to pass\n```",
+      "Other": "1. In the AWS Console, go to RDS > Event subscriptions > Create event subscription\n2. Name: enter <example_resource_name>\n3. Send notifications to: Choose existing Amazon SNS ARN and select <example_resource_arn>\n4. Source type: select Clusters\n5. Event categories: select only Maintenance and Failure (unselect others)\n6. Ensure Enabled is on\n7. Click Create",
+      "Terraform": "```hcl\nresource \"aws_db_event_subscription\" \"<example_resource_name>\" {\n  name            = \"<example_resource_name>\"\n  sns_topic       = \"<example_resource_arn>\"           # Critical: SNS topic ARN\n  source_type     = \"db-cluster\"                        # Critical: Scope to clusters\n  event_categories = [\"maintenance\", \"failure\"]        # Critical: Required categories\n  enabled         = true                                  # Critical: Must be enabled\n}\n```"
     },
     "Recommendation": {
-      "Text": "To subscribe to RDS cluster event notifications, see Subscribing to Amazon RDS event notification in the Amazon RDS User Guide.",
-      "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Subscribing.html"
+      "Text": "Enable **event subscriptions** for RDS clusters that include `maintenance` and `failure`, delivered via **SNS** to monitored channels.\n- Enforce **least privilege** on topics\n- Separate topics per environment\n- Integrate with on-call/IR playbooks and test alerts\n- Add multiple recipients and escalation for **defense in depth**",
+      "Url": "https://hub.prowler.com/check/rds_cluster_critical_event_subscription"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_cluster_default_admin/rds_cluster_default_admin.metadata.json

@@ -1,29 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_default_admin",
-  "CheckTitle": "Ensure that your Amazon RDS clusters are not using the default master username.",
-  "CheckType": [],
+  "CheckTitle": "RDS cluster master username is not admin or postgres",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "TTPs/Initial Access",
+    "TTPs/Credential Access"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Ensure that your Amazon RDS clusters are not using the default master username.",
-  "Risk": "Since admin is the Amazon's example for the RDS database master username and postgres is the default PostgreSQL master username. Many AWS customers will use this username for their RDS database instances in production. Malicious users can use this information to their advantage and frequently try to use default master username during brute-force attacks.",
-  "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-24",
+  "ResourceGroup": "database",
+  "Description": "RDS DB clusters are evaluated for use of a **custom administrator username**, flagging clusters that use defaults such as `admin` or `postgres`.",
+  "Risk": "Using a well-known admin username simplifies **credential stuffing** and **brute-force** attempts. Attackers can focus on password guessing, increasing chances of compromise. A successful login enables data theft (**confidentiality**), unauthorized changes (**integrity**), and destructive operations or outages (**availability**).",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-24"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
-      "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#",
-      "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#"
+      "NativeIaC": "```yaml\n# Create an RDS DB cluster with a custom admin username\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      Engine: aurora-mysql\n      MasterUsername: <custom_admin_username>  # CRITICAL: use a non-default username (not \"admin\" or \"postgres\")\n      MasterUserPassword: <example_password>\n```",
+      "Other": "1. In the AWS console, go to RDS > Databases > Create database\n2. Choose Amazon Aurora and the same engine family as your current cluster\n3. Under Settings, set Master username to a custom value that is not \"admin\" or \"postgres\" (CRITICAL)\n4. Create the new cluster, migrate your workload to it, update application connections, then delete the old cluster",
+      "Terraform": "```hcl\n# Create an RDS DB cluster with a custom admin username\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  cluster_identifier = \"<example_resource_id>\"\n  engine             = \"aurora-mysql\"\n  master_username    = \"<custom_admin_username>\" # CRITICAL: non-default username (not admin/postgres)\n  master_password    = \"<example_password>\"\n}\n```"
     },
     "Recommendation": {
-      "Text": "To change the master username configured for your Amazon RDS database clusters you must re-create them and migrate the existing data.",
-      "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-24"
+      "Text": "Create databases with a **unique, non-default admin username** that doesn't reveal environment or org. Apply **least privilege** by using separate, non-admin accounts for applications. Prefer **IAM database authentication** and manage secrets centrally with rotation. Restrict admin access and monitor login attempts.",
+      "Url": "https://hub.prowler.com/check/rds_cluster_default_admin"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_cluster_deletion_protection/rds_cluster_deletion_protection.metadata.json

@@ -1,29 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_deletion_protection",
-  "CheckTitle": "Check if RDS clusters have deletion protection enabled.",
-  "CheckType": [],
+  "CheckTitle": "RDS cluster has deletion protection enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Data Destruction"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
-  "Severity": "low",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Check if RDS clusters have deletion protection enabled.",
-  "Risk": "You can only delete clusters that do not have deletion protection enabled.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB clusters** have **deletion protection** enabled (`deletion_protection=true`).",
+  "Risk": "Without **deletion protection**, a cluster can be removed by error or misuse, causing sudden **availability** loss and potential **data loss** if backups are outdated. Compromised identities or faulty automation can trigger destructive deletes, degrading **recoverability** and data **integrity**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --deletion-protection --apply-immediately",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7",
-      "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled#terraform"
+      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --deletion-protection",
+      "NativeIaC": "```yaml\n# CloudFormation: Enable deletion protection on an RDS DB Cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      Engine: aurora-mysql\n      DeletionProtection: true  # Critical: prevents cluster deletion and passes the check\n```",
+      "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB cluster (type: DB cluster)\n3. Click Modify\n4. Enable Deletion protection\n5. Choose Apply immediately and click Modify cluster",
+      "Terraform": "```hcl\n# Enable deletion protection on an existing RDS DB Cluster\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  deletion_protection = true  # Critical: prevents cluster deletion and passes the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable deletion protection using the AWS Management Console for production DB clusters.",
-      "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html"
+      "Text": "Enable **deletion protection** (`deletion_protection=true`) on production and other critical clusters. Enforce via IaC and organizational guardrails; apply **least privilege** to delete/modify actions; require **change control** and approvals. Maintain reliable **backups** to restore when protection must be lifted.",
+      "Url": "https://hub.prowler.com/check/rds_cluster_deletion_protection"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "resilience"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_cluster_iam_authentication_enabled/rds_cluster_iam_authentication_enabled.metadata.json

@@ -1,29 +1,42 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_iam_authentication_enabled",
-  "CheckTitle": "Check if RDS clusters have IAM authentication enabled.",
-  "CheckType": [],
+  "CheckTitle": "RDS cluster has IAM authentication enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Credential Access"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Check if RDS clusters have IAM authentication enabled.",
-  "Risk": "Ensure that the IAM Database Authentication feature is enabled for your RDS database clusters in order to use the Identity and Access Management (IAM) service to manage database access to your MySQL and PostgreSQL database clusters. With this feature enabled, you don't have to use a password when you connect to your MySQL/PostgreSQL database, instead you can use an authentication token. An authentication token is a unique string of characters with a lifetime of 15 minutes that Amazon RDS generates on your request. IAM Database Authentication removes the need of storing user credentials within the database configuration, because authentication is managed externally using Amazon IAM.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB clusters** on supported engines (MySQL/MariaDB/PostgreSQL/Aurora) have **IAM database authentication** enabled for database logins, indicating token-based access managed by IAM instead of static passwords.",
+  "Risk": "Without **IAM DB authentication**, databases depend on long-lived passwords. Stolen or reused creds can enable unauthorized connections, data exfiltration, and tampering, harming **confidentiality** and **integrity**. Lacking short-lived tokens and centralized revocation expands blast radius and weakens **access control**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#",
+    "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.Enabling.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-12"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds modify-db-instance --region <REGION> --db-instance-identifier <DB_CLUSTER_ID> --enable-iam-database-authentication --apply-immediately",
-      "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-12",
-      "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#"
+      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <DB_CLUSTER_ID> --enable-iam-database-authentication --apply-immediately",
+      "NativeIaC": "```yaml\n# CloudFormation: Enable IAM authentication on an existing RDS/Aurora DB Cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      EnableIAMDatabaseAuthentication: true  # Critical: turns on IAM DB auth for the cluster\n```",
+      "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB Cluster (not the instances)\n3. Click Modify\n4. In Database authentication, enable IAM database authentication\n5. Choose Apply immediately and click Modify cluster",
+      "Terraform": "```hcl\n# Enable IAM authentication on an existing RDS/Aurora cluster\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  cluster_identifier                   = \"<example_resource_id>\"\n  iam_database_authentication_enabled = true  # Critical: enables IAM DB auth so the check passes\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable IAM authentication for supported RDS clusters.",
-      "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html"
+      "Text": "Enable **IAM database authentication** on supported clusters and enforce **least privilege**. Grant only necessary `rds-db:connect` permissions to specific principals, prefer role-based access for workloads to obtain short-lived tokens, require **TLS**, and deprecate static DB passwords. Pair with auditing and segmentation for **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/rds_cluster_iam_authentication_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "identity-access"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_cluster_integration_cloudwatch_logs/rds_cluster_integration_cloudwatch_logs.metadata.json

@@ -1,26 +1,35 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_integration_cloudwatch_logs",
-  "CheckTitle": "Check if RDS cluster is integrated with CloudWatch Logs.",
-  "CheckType": [],
+  "CheckTitle": "RDS cluster has CloudWatch Logs export enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Check if RDS cluster is integrated with CloudWatch Logs. The types valid are Aurora MySQL, Aurora PostgreSQL, MySQL, PostgreSQL.",
-  "Risk": "If logs are not enabled, monitoring of service use and threat analysis is not possible.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html",
+  "ResourceGroup": "database",
+  "Description": "**RDS clusters** running Aurora MySQL, Aurora PostgreSQL, MySQL, or PostgreSQL are assessed for **CloudWatch Logs publishing**, confirming that database logs are exported to a CloudWatch Logs group.",
+  "Risk": "Without publishing to CloudWatch, database events lack centralized visibility and retention.\nBrute-force, SQL injection, or privilege misuse may go undetected, hindering forensics and response, risking data confidentiality and integrity and delaying recovery.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html",
+    "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-34"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --cloudwatch-logs-export-configuration {'EnableLogTypes':['audit',error','general','slowquery']} --apply-immediately",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-34",
-      "Terraform": ""
+      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --cloudwatch-logs-export-configuration '{\"EnableLogTypes\":[\"<engine_supported_log_type>\"]}' --apply-immediately",
+      "NativeIaC": "```yaml\n# CloudFormation: Enable CloudWatch Logs export for an RDS/Aurora DB cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      Engine: <engine>\n      MasterUsername: <example_username>\n      MasterUserPassword: <example_password>\n      EnableCloudwatchLogsExports:\n        - <engine_supported_log_type>  # CRITICAL: Enables at least one supported log type (e.g., 'error' for MySQL or 'postgresql' for PostgreSQL) to pass the check\n```",
+      "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select your DB cluster and choose Modify\n3. Under Log exports, check at least one supported log type for your engine (e.g., error/general/slowquery/audit for MySQL, postgresql for PostgreSQL)\n4. Choose Continue, then Apply immediately, and click Modify cluster",
+      "Terraform": "```hcl\n# Terraform: Enable CloudWatch Logs export for an RDS/Aurora DB cluster\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  engine            = \"<engine>\"\n  master_username   = \"<example_username>\"\n  master_password   = \"<example_password>\"\n\n  enabled_cloudwatch_logs_exports = [\n    \"<engine_supported_log_type>\" # CRITICAL: Enables at least one supported log type (e.g., \"error\" for MySQL or \"postgresql\" for PostgreSQL) to pass the check\n  ]\n}\n```"
     },
     "Recommendation": {
-      "Text": "Use CloudWatch Logs to perform real-time analysis of the log data. Create alarms and view metrics.",
-      "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html"
+      "Text": "Publish RDS/Aurora logs to **CloudWatch Logs** and centralize analysis.\nSelect appropriate types (e.g., `error`, `general`, `slowquery`, `audit`), define retention, and create alarms. Limit log access with **least privilege** and integrate with SIEM for defense-in-depth monitoring.",
+      "Url": "https://hub.prowler.com/check/rds_cluster_integration_cloudwatch_logs"
     }
   },
   "Categories": [

prowler/providers/aws/services/rds/rds_cluster_minor_version_upgrade_enabled/rds_cluster_minor_version_upgrade_enabled.metadata.json

@@ -1,29 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_minor_version_upgrade_enabled",
-  "CheckTitle": "Ensure RDS clusters have minor version upgrade enabled.",
-  "CheckType": [],
+  "CheckTitle": "RDS cluster has automatic minor version upgrades enabled",
+  "CheckType": [
+    "Software and Configuration Checks/Patch Management",
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Ensure RDS clusters have minor version upgrade enabled.",
-  "Risk": "Auto Minor Version Upgrade is a feature that you can enable to have your database automatically upgraded when a new minor database engine version is available. Minor version upgrades often patch security vulnerabilities and fix bugs and therefore should be applied.",
-  "RelatedUrl": "https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/",
+  "ResourceGroup": "database",
+  "Description": "**RDS Multi-AZ DB clusters** are configured for **automatic minor engine upgrades** via `auto_minor_version_upgrade`.\n\nThe evaluation checks these clusters to see if this setting is enabled so preferred minor releases are applied during the maintenance window.",
+  "Risk": "Without automatic minor upgrades, clusters can miss **security patches**, enabling exploitation of known flaws (confidentiality). Unfixed defects may corrupt data (**integrity**) or trigger crashes and failovers (**availability**). Emergency patching raises downtime and operational risk.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/modify-multi-az-db-cluster.html",
+    "https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/RDS/Types/CreateDBClusterMessage.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-35"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <db_cluster_id> --auto-minor-version-upgrade --apply-immediately",
-      "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically#cloudformation",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-35",
-      "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically#terraform"
+      "CLI": "aws rds modify-db-cluster --db-cluster-identifier <example_resource_id> --auto-minor-version-upgrade",
+      "NativeIaC": "```yaml\n# CloudFormation snippet to enable automatic minor version upgrades on an RDS DB cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      AutoMinorVersionUpgrade: true  # Critical: enables automatic minor engine version upgrades to pass the check\n```",
+      "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select your Multi-AZ DB cluster\n3. Click Modify\n4. Set Auto minor version upgrade to Enabled\n5. Click Continue, then Modify cluster",
+      "Terraform": "```hcl\n# Terraform snippet to enable automatic minor version upgrades on an RDS DB cluster\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  cluster_identifier         = \"<example_resource_id>\"\n  auto_minor_version_upgrade = true  # Critical: enables automatic minor engine version upgrades to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable auto minor version upgrade for all databases and environments.",
-      "Url": "https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/"
+      "Text": "Enable `auto_minor_version_upgrade` on **RDS Multi-AZ clusters** and align updates with approved maintenance windows. Validate changes in non-production, and document any exceptions with a strict manual patch cadence. This strengthens **defense in depth** and improves **availability**.",
+      "Url": "https://hub.prowler.com/check/rds_cluster_minor_version_upgrade_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_cluster_multi_az/rds_cluster_multi_az.metadata.json

@@ -1,30 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "rds_cluster_multi_az",
-  "CheckTitle": "Check if RDS clusters have multi-AZ enabled.",
-  "CheckType": [],
+  "CheckTitle": "RDS cluster has Multi-AZ enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRdsDbCluster",
-  "Description": "Check if RDS clusters have multi-AZ enabled.",
-  "Risk": "In case of failure, with a single-AZ deployment configuration, should an availability zone specific database failure occur, Amazon RDS can not automatically fail over to the standby availability zone.",
-  "RelatedUrl": "https://aws.amazon.com/rds/features/multi-az/",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB clusters** are assessed for deployment across **multiple Availability Zones** (*Multi-AZ*), verifying that redundant instances exist to support **automatic failover** instead of a single-AZ configuration.",
+  "Risk": "A **single-AZ cluster** is a single point of failure. AZ outages, instance/storage faults, or maintenance can cause extended **downtime**, failed transactions, and worse **RTO/RPO**. Without cross-AZ replicas, recovery may require restores, increasing outage duration and risking service disruption and data consistency impacts.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-15",
+    "https://docs.amazonaws.cn/en_us/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html",
+    "https://aws.amazon.com/rds/features/multi-az/"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds create-db-cluster --db-cluster-identifier <db_cluster_id> --multi-az true",
-      "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_73#cloudformation",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-15",
-      "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_73#terraform"
+      "CLI": "",
+      "NativeIaC": "```yaml\n# CloudFormation: create an RDS Multi-AZ DB cluster (non-Aurora)\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBCluster\n    Properties:\n      Engine: mysql  # CRITICAL: using mysql/postgres with the properties below creates a Multi-AZ DB cluster\n      DBClusterInstanceClass: db.r6g.large  # CRITICAL: required to make it a Multi-AZ DB cluster (creates 1 writer + 2 readers across AZs)\n      AllocatedStorage: 100  # CRITICAL: required for Multi-AZ DB clusters\n      Iops: 1000             # CRITICAL: required for Multi-AZ DB clusters\n      StorageType: io1       # CRITICAL: required for Multi-AZ DB clusters\n      MasterUsername: <USERNAME>\n      MasterUserPassword: <PASSWORD>\n```",
+      "Other": "1. In the AWS console, go to RDS > Databases > Create database\n2. Engine: select MySQL or PostgreSQL\n3. Under Availability and durability, select Multi-AZ DB cluster\n4. Enter DB cluster identifier and master credentials\n5. Choose a DB instance class and create the database\n6. Migrate data to this new Multi-AZ DB cluster and switch your applications to its endpoint",
+      "Terraform": "```hcl\n# Terraform: create an RDS Multi-AZ DB cluster (non-Aurora)\nresource \"aws_rds_cluster\" \"<example_resource_name>\" {\n  cluster_identifier         = \"<example_resource_id>\"\n  engine                     = \"mysql\"           # CRITICAL: mysql/postgres with the lines below creates a Multi-AZ DB cluster\n  db_cluster_instance_class  = \"db.r6g.large\"    # CRITICAL: makes this a Multi-AZ DB cluster (1 writer + 2 readers across AZs)\n  storage_type               = \"io1\"             # CRITICAL: required for Multi-AZ DB clusters\n  allocated_storage          = 100                # CRITICAL: required for Multi-AZ DB clusters\n  iops                       = 1000               # CRITICAL: required for Multi-AZ DB clusters\n  master_username            = \"<USERNAME>\"\n  master_password            = \"<PASSWORD>\"\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable multi-AZ deployment for production databases.",
-      "Url": "https://aws.amazon.com/rds/features/multi-az/"
+      "Text": "Enable **Multi-AZ** for production DB clusters to ensure cross-AZ redundancy and **automatic failover**. Choose a model that meets your SLA (one standby or two readable standbys; Aurora spans 3 AZs). Place subnets in distinct AZs, implement connection retries, and regularly test failover to validate **RTO/RPO** and readiness.",
+      "Url": "https://hub.prowler.com/check/rds_cluster_multi_az"
     }
   },
   "Categories": [
-    "redundancy"
+    "resilience"
   ],
   "DependsOn": [],
   "RelatedTo": [],