---
inputType: "CA10__CaAwsDbCluster__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10__CaAwsDbCluster__c/object.extracts.yaml"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "The cluster is not available."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10__status__c"
        right:
          TEXT: "available"
  - status: "INAPPLICABLE"
    currentStateMessage: "This policy applies only to Aurora MySQL, Aurora PostgreSQL, Amazon DocumentDB, and Amazon Neptune clusters."
    check:
      AND:
        args:
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-mysql"
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-postgresql"
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "docdb"
          - NOT_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "neptune"
  - status: "INCOMPLIANT"
    currentStateMessage: "Aurora MySQL audit logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of audit logs to CloudWatch Logs for the Aurora MySQL cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-mysql"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "audit"
  - status: "COMPLIANT"
    currentStateMessage: "Aurora MySQL audit logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-mysql"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "audit"
  - status: "INCOMPLIANT"
    currentStateMessage: "Aurora PostgreSQL logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of PostgreSQL logs to CloudWatch Logs for the Aurora PostgreSQL cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-postgresql"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "postgresql"
  - status: "COMPLIANT"
    currentStateMessage: "Aurora PostgreSQL logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "aurora-postgresql"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "postgresql"
  - status: "INCOMPLIANT"
    currentStateMessage: "DocumentDB audit logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of audit logs to CloudWatch Logs for the Amazon DocumentDB cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "docdb"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "audit"
  - status: "COMPLIANT"
    currentStateMessage: "DocumentDB audit logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "docdb"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "audit"
  - status: "INCOMPLIANT"
    currentStateMessage: "Neptune audit logs are not exported to CloudWatch Logs."
    remediationMessage: "Enable export of audit logs to CloudWatch Logs for the Amazon Neptune cluster."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "neptune"
          - NOT:
              arg:
                CONTAINS:
                  arg:
                    EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
                  search:
                    TEXT: "audit"
  - status: "COMPLIANT"
    currentStateMessage: "Neptune audit logs are exported to CloudWatch Logs."
    check:
      AND:
        args:
          - IS_EQUAL:
              left:
                EXTRACT: "CA10__engine__c"
              right:
                TEXT: "neptune"
          - CONTAINS:
              arg:
                EXTRACT: "CA10__enabledCloudwatchLogsExports__c"
              search:
                TEXT: "audit"
otherwise:
  status: "UNDETERMINED"
  currentStateMessage: "Unexpected values were found in the engine or CloudWatch log export configuration."