Neptune Database Cluster Encryption Disabled
- Query id: 83bf5aca-138a-498e-b9cd-ad5bc5e117b4
- Query name: Neptune Database Cluster Encryption Disabled
- Platform: Crossplane
- Severity: Medium
- Category: Encryption
- URL: Github
Description¶
Neptune database cluster storage should have encryption enabled
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
apiVersion: neptune.aws.crossplane.io/v1alpha1
kind: DBCluster
metadata:
name: sample-cluster3
spec:
forProvider:
region: eu-central-1
applyImmediately: true
backupRetentionPeriod: 5
engine: neptune
enableIAMDatabaseAuthentication: true
deletionProtection: false
preferredBackupWindow: 07:00-09:00
skipFinalSnapshot: true
---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: cluster-aws
labels:
provider: aws
cluster: eks
spec:
compositeTypeRef:
apiVersion: mydev.org/v1alpha1
kind: CompositeCluster
writeConnectionSecretsToNamespace: crossplane-system
patchSets:
- name: metadata
patches:
- fromFieldPath: metadata.labels
resources:
- name: sample-ec2
base:
apiVersion: neptune.aws.crossplane.io/v1alpha1
kind: DBCluster
metadata:
name: sample-cluster4
spec:
forProvider:
region: eu-central-1
applyImmediately: true
backupRetentionPeriod: 5
engine: neptune
enableIAMDatabaseAuthentication: true
deletionProtection: false
preferredBackupWindow: 07:00-09:00
skipFinalSnapshot: true
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
apiVersion: neptune.aws.crossplane.io/v1alpha1
kind: DBCluster
metadata:
name: sample-cluster
spec:
forProvider:
region: eu-central-1
applyImmediately: true
backupRetentionPeriod: 5
engine: neptune
enableIAMDatabaseAuthentication: true
deletionProtection: false
preferredBackupWindow: 07:00-09:00
skipFinalSnapshot: true
storageEncrypted: true
---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: cluster-aws
labels:
provider: aws
cluster: eks
spec:
compositeTypeRef:
apiVersion: mydev.org/v1alpha1
kind: CompositeCluster
writeConnectionSecretsToNamespace: crossplane-system
patchSets:
- name: metadata
patches:
- fromFieldPath: metadata.labels
resources:
- name: sample-ec2
base:
apiVersion: neptune.aws.crossplane.io/v1alpha1
kind: DBCluster
metadata:
name: sample-cluster2
spec:
forProvider:
region: eu-central-1
applyImmediately: true
backupRetentionPeriod: 5
engine: neptune
enableIAMDatabaseAuthentication: true
deletionProtection: false
preferredBackupWindow: 07:00-09:00
skipFinalSnapshot: true
storageEncrypted: true