stelligent#438 Add rule that checks if RDS instance has a backup rete…

…ntion period gr…

* Add rule that checks if RDS instance has a backup retention period greater than 0

* Update template to check for string values as well

* Refactor if statement to check for nil

* Remove blank lines

Co-authored-by: Daniel Pinheiro <[email protected]>

lib/cfn-nag/custom_rules/RDSInstanceBackupRetentionPeriodRule.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class RDSInstanceBackupRetentionPeriodRule < BaseRule
+  def rule_text
+    'RDS instance should have backup retention period greater than 0'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W75'
+  end
+
+  def audit_impl(cfn_model)
+    rds_dbinstances = cfn_model.resources_by_type('AWS::RDS::DBInstance')
+
+    violating_rdsinstances = rds_dbinstances.select do |instance|
+      violating_period(instance.backupRetentionPeriod)
+    end
+
+    violating_rdsinstances.map(&:logical_resource_id)
+  end
+
+  def violating_period(backup_retention_period)
+    if backup_retention_period.nil?
+      false
+    end
+
+    if backup_retention_period.is_a?(Integer) || backup_retention_period.is_a?(String)
+      backup_retention_period.to_i == 0
+    else
+      false
+    end
+  end
+end

spec/custom_rules/RDSInstanceBackupRetentionPeriodRule_spec.rb

@@ -0,0 +1,46 @@
+require 'spec_helper'
+require 'cfn-model'
+require 'cfn-nag/custom_rules/RDSInstanceBackupRetentionPeriodRule'
+
+describe RDSInstanceBackupRetentionPeriodRule do
+  context 'RDS instance with backup period set to zero' do
+    it 'returns offending logical resource id' do
+      cfn_model = CfnParser.new.parse read_test_template(
+        'yaml/rds_dbinstance/rds_dbinstance_with_backup_retention_period_set_to_zero.yaml'
+      )
+
+      actual_logical_resource_ids = RDSInstanceBackupRetentionPeriodRule.new.audit_impl cfn_model
+      expected_logical_resource_ids = %w[RDSDBInstanceWithZeroBackupRetentionPeriod RDSDBInstanceWithStringZeroBackupRetentionPeriod]
+
+      expect(actual_logical_resource_ids).to eq expected_logical_resource_ids
+    end
+  end
+
+  context 'RDS instance without backup period' do
+    it 'returns empty list' do
+      cfn_model = CfnParser.new.parse read_test_template(
+        'yaml/rds_dbinstance/rds_dbinstance_without_backup_retention_period.yaml'
+      )
+
+      # The default for the BackupRetentionPeriod property is 1 (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-backupretentionperiod).
+
+      actual_logical_resource_ids = RDSInstanceBackupRetentionPeriodRule.new.audit_impl cfn_model
+      expected_logical_resource_ids = []
+
+      expect(actual_logical_resource_ids).to eq expected_logical_resource_ids
+    end
+  end
+
+  context 'RDS instance with backup period set to greather than zero' do
+    it 'returns empty list' do
+      cfn_model = CfnParser.new.parse read_test_template(
+        'yaml/rds_dbinstance/rds_dbinstance_with_backup_retention_period.yaml'
+      )
+
+      actual_logical_resource_ids = RDSInstanceBackupRetentionPeriodRule.new.audit_impl cfn_model
+      expected_logical_resource_ids = []
+
+      expect(actual_logical_resource_ids).to eq expected_logical_resource_ids
+    end
+  end
+end

spec/test_templates/yaml/rds_dbinstance/rds_dbinstance_with_backup_retention_period.yaml

@@ -0,0 +1,14 @@
+---
+Resources:
+  RDSDBInstanceWithNonZeroBackupRetentionPeriod:
+    Type: AWS::RDS::DBInstance
+    Properties:
+      DBInstanceClass: db.m5.large
+      Engine: mysql
+      BackupRetentionPeriod: 5
+  RDSDBInstanceWithStringNonZeroBackupRetentionPeriod:
+    Type: AWS::RDS::DBInstance
+    Properties:
+      DBInstanceClass: db.m5.large
+      Engine: mysql
+      BackupRetentionPeriod: "5"

spec/test_templates/yaml/rds_dbinstance/rds_dbinstance_with_backup_retention_period_set_to_zero.yaml

@@ -0,0 +1,19 @@
+---
+Resources:
+  RDSDBInstanceWithoutBackupRetentionPeriod:
+    Type: AWS::RDS::DBInstance
+    Properties:
+      DBInstanceClass: db.m5.large
+      Engine: mysql
+  RDSDBInstanceWithZeroBackupRetentionPeriod:
+    Type: AWS::RDS::DBInstance
+    Properties:
+      DBInstanceClass: db.m5.large
+      Engine: mysql
+      BackupRetentionPeriod: 0
+  RDSDBInstanceWithStringZeroBackupRetentionPeriod:
+    Type: AWS::RDS::DBInstance
+    Properties:
+      DBInstanceClass: db.m5.large
+      Engine: mysql
+      BackupRetentionPeriod: "0"

spec/test_templates/yaml/rds_dbinstance/rds_dbinstance_without_backup_retention_period.yaml

@@ -0,0 +1,7 @@
+---
+Resources:
+  RDSDBInstanceWithoutBackupRetentionPeriod:
+    Type: AWS::RDS::DBInstance
+    Properties:
+      DBInstanceClass: db.m5.large
+      Engine: mysql