🧠 AWS RDS Instance is publicly accessible and in an unrestricted public subnet - prod.logic.yaml 🟢

• Contextual name: 🧠 prod.logic.yaml 🟢
• ID: /ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/prod.logic.yaml
• Located in: 📝 AWS RDS Instance is publicly accessible and in an unrestricted public subnet 🟢

Flags

• 🟢 Logic test success
• 🟢 Logic with extracts
• 🟢 Logic with test data

Input Type

	Type	API Name	Extracts	Extract Files	Logic Files
🔒	📕 AWS RDS Instance	CA10__CaAwsDbInstance__c	6	1	5

Uses

• 🔌 AWS RDS Instance - object.extracts.yaml
• 🔌 AWS VPC Route - object.extracts.yaml
• 🔌 AWS VPC Route Table Association - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2025-04-24T23:45:06.089519051Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ 99	✔️ isDisappeared(CA10__disappearanceTime__c)	✔️ null
🟢	test2	✔️ 199	✔️ not(extract('CA10__publiclyAccessible__c'))	✔️ null
🟢	test3	✔️ 299	✔️ CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(INCOMPLIANT)	✔️ null
🟢	test4	✔️ 399	✔️ CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(COMPLIANT)	✔️ null
🟢	test5	✔️ 499	✔️ CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)	✔️ null
🟢	test6	✔️ 500	✔️ otherwise	✔️ null

Generation

	File	MD5
Open	/ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/policy.yaml	9A3CC9B1B6FC1879167DAE7DC97C4358
Open	/ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/prod.logic.yaml	F6780C1A4E1183266084529E02DF1845
Open	/ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/test-data.json	A619230932B0669DBE429239C538EA58
Open	/types/CA10__CaAwsDbInstance__c/object.extracts.yaml	FF9B20D94B2A03C8B9A5C755DC5EF3A9
Open	/types/CA10__CaAwsRoute__c/object.extracts.yaml	E4999A9B58375B79BA8254DDA1FC6534
Open	/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml	A7C7920B6078DD78806ADA0DC37D345B

Generate FULL script

java -jar repo-manager.jar policies generate FULL /ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/prod.logic.yaml

Generate DEBUG script

java -jar repo-manager.jar policies generate DEBUG /ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/prod.logic.yaml

Generate CAPTURE_TEST_DATA script

java -jar repo-manager.jar policies generate CAPTURE_TEST_DATA /ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/prod.logic.yaml

Generate TESTS script

java -jar repo-manager.jar policies generate TESTS /ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/prod.logic.yaml

Execute tests

java -jar repo-manager.jar policies test /ce/ca/aws/rds/instance-publicly-accessible-in-public-subnet/prod.logic.yaml

Content

Open File

---
# This policy goes through the same paths as /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
# Check that policy logic for details
inputType: "CA10__CaAwsDbInstance__c"
testData:
 - file: test-data.json
importExtracts:
  - file: /types/CA10__CaAwsDbInstance__c/object.extracts.yaml
conditions:
  - status: "COMPLIANT"
    currentStateMessage: "This RDS Instance is not Publicly Accessible."
    check:
      NOT:
        arg:
          EXTRACT: "CA10__publiclyAccessible__c"
  - status: "INCOMPLIANT"
    currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet."
    remediationMessage: "Consider restricting public access to the instance."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet."
    remediationMessage: "Consider restricting public access to the instance."
    check:
      RELATED_LIST_HAS:
        status: "COMPLIANT"
        relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet."
    remediationMessage: "Consider restricting public access to the instance."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__vpc__r.CA10__routeTables__r"
otherwise:
  status: "INCOMPLIANT"
  currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet."
  remediationMessage: "Consider restricting public access to the instance."
relatedLists:
  - relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
    conditions:
      - status: "INCOMPLIANT"
        currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access."
        remediationMessage: "Consider removing Internet Gateway routes with unrestricted access."
        check:
          RELATED_LIST_HAS:
            status: "INCOMPLIANT"
            relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
      - status: "COMPLIANT"
        currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access."
        check:
          RELATED_LIST_HAS:
            status: "COMPLIANT"
            relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
    otherwise:
      status: "INAPPLICABLE"
      currentStateMessage: "This subnet group doesn't have route table associations."
    relatedLists:
      - relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
        importExtracts:
        - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
        conditions:
          - status: "INCOMPLIANT"
            currentStateMessage: "This subnet route table has an Internet Gateway route with unrestricted access."
            remediationMessage: "Consider removing Internet Gateway routes with unrestricted access."
            check:
              RELATED_LIST_HAS:
                status: "INCOMPLIANT"
                relationshipName: "CA10__routeTable__r.CA10__routes__r"
        otherwise:
          status: "COMPLIANT"
          currentStateMessage: "This subnet is compliant"
        relatedLists:
          - relationshipName: "CA10__routeTable__r.CA10__routes__r"
            conditions:
              - status: "INCOMPLIANT"
                currentStateMessage: "This is an Internet Gateway route with unrestricted access."
                remediationMessage: "Consider removing this route."
                check:
                  AND:
                    args:
                      - STARTS_WITH:
                          arg:
                            EXTRACT: "CA10__gatewayId__c"
                          prefix:
                            TEXT: "igw"
                      - OR:
                          args:
                            - IS_EQUAL:
                                left:
                                  EXTRACT: "CA10__destinationCidrBlock__c"
                                right:
                                  TEXT: "0.0.0.0/0"
                            - IS_EQUAL:
                                left:
                                  EXTRACT: "CA10__destinationIpv6CidrBlock__c"
                                right:
                                  TEXT: "::/0"
            otherwise:
              status: "COMPLIANT"
              currentStateMessage: "This is not an Internet Gateway Route."
  - relationshipName: "CA10__vpc__r.CA10__routeTables__r"
    importExtracts:
      - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
      - file: "/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml"
    conditions:
      - status: "INCOMPLIANT"
        currentStateMessage: "This is a Main Route Table with an Internet Gateway route."
        remediationMessage: "Consider removing this route."
        check:
          AND:
            args:
              - RELATED_LIST_HAS:
                  status: "COMPLIANT"
                  relationshipName: "CA10__routeTableAssociations__r"
              - RELATED_LIST_HAS:
                  status: "INCOMPLIANT"
                  relationshipName: "CA10__routes__r"
    otherwise:
      status: "INAPPLICABLE"
      currentStateMessage: "Custom Route Tables or Main Route Table without Internet Gateway."
    relatedLists:
      - relationshipName: "CA10__routeTableAssociations__r"
        conditions:
          - status: "COMPLIANT"
            currentStateMessage: "This is a Main Route Table."
            check:
              IS_EQUAL:
                left:
                  EXTRACT: "CA10__main__c"
                right:
                  BOOLEAN: true
        otherwise:
          status: "INAPPLICABLE"
          currentStateMessage: "This is not a Main Route Table."
      - relationshipName: "CA10__routes__r"
        conditions:
          - status: "INCOMPLIANT"
            currentStateMessage: "This is an Internet Gateway route."
            remediationMessage: "Consider removing this route."
            check:
              AND:
                args:
                  - STARTS_WITH:
                      arg:
                        EXTRACT: "CA10__gatewayId__c"
                      prefix:
                        TEXT: "igw"
                  - OR:
                      args:
                        - IS_EQUAL:
                            left:
                              EXTRACT: "CA10__destinationCidrBlock__c"
                            right:
                              TEXT: "0.0.0.0/0"
                        - IS_EQUAL:
                            left:
                              EXTRACT: "CA10__destinationIpv6CidrBlock__c"
                            right:
                              TEXT: "::/0"
        otherwise:
          status: "COMPLIANT"
          currentStateMessage: "This is not an Internet Gateway Route."