🧠 AWS RDS Instance is publicly accessible - prod.logic.yaml🟢

Contextual name: 🧠 prod.logic.yaml🟢
ID: /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml
Tags:
- 🟢 Logic test success
- 🟢 Logic with extracts
- 🟢 Logic with test data

Uses

📗 AWS RDS Instance
🔌 AWS VPC Route Table Association - object.extracts.yaml
🔌 AWS VPC Route - object.extracts.yaml
🔌 AWS RDS Instance - object.extracts.yaml
🧪 test-data.json

Test Results 🟢

Generated at: 2026-02-05T22:32:01.692692851Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ `99`	✔️ `isDisappeared(CA10__disappearanceTime__c)`	✔️ `null`
🟢	test2	✔️ `199`	✔️ `not(extract('CA10__publiclyAccessible__c'))`	✔️ `null`
🟢	test3	✔️ `299`	✔️ `CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(INCOMPLIANT)`	✔️ `null`
🟢	test4	✔️ `399`	✔️ `CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r.has(COMPLIANT)`	✔️ `null`
🟢	test5	✔️ `499`	✔️ `CA10__vpc__r.CA10__routeTables__r.has(INCOMPLIANT)`	✔️ `null`
🟢	test6	✔️ `500`	✔️ `otherwise`	✔️ `null`

Generation Bundle

	File	MD5
Open	`/ce/ca/aws/rds/instance-publicly-accessible/policy.yaml`	`F2100A2C67DBF3C331422243101B6C2A`
Open	`/ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml`	`E36A18BF5F04BE64A607C9F8A3F47989`
Open	`/ce/ca/aws/rds/instance-publicly-accessible/test-data.json`	`A619230932B0669DBE429239C538EA58`
Open	`/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml`	`A7C7920B6078DD78806ADA0DC37D345B`
Open	`/types/CA10__CaAwsRoute__c/object.extracts.yaml`	`E4999A9B58375B79BA8254DDA1FC6534`
Open	`/types/CA10__CaAwsDbInstance__c/object.extracts.yaml`	`E3FA5A211AA9AD2418645BB09047D3D3`

Available Commands

repo-manager policies generate FULL /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/rds/instance-publicly-accessible/prod.logic.yaml

Content

Open File

---
# This policy goes through the same paths as /ce/ca/aws/ec2/instance-without-public-ip-in-public-subnet/prod.logic.yaml
# Check that policy logic for details
inputType: "CA10__CaAwsDbInstance__c"
testData:
 - file: test-data.json
importExtracts:
  - file: /types/CA10__CaAwsDbInstance__c/object.extracts.yaml
conditions:
  - status: "COMPLIANT"
    currentStateMessage: "This RDS Instance is not Publicly Accessible."
    check:
      NOT:
        arg:
          EXTRACT: "CA10__publiclyAccessible__c"
  - status: "INCOMPLIANT"
    currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet."
    remediationMessage: "Consider restricting public access to the instance."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet."
    remediationMessage: "Consider restricting public access to the instance."
    check:
      RELATED_LIST_HAS:
        status: "COMPLIANT"
        relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "This RDS Instance is publicly accessible and in a public subnet."
    remediationMessage: "Consider restricting public access to the instance."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__vpc__r.CA10__routeTables__r"
otherwise:
  status: "INCOMPLIANT"
  currentStateMessage: "This RDS Instance is publicly accessible but in a private subnet."
  remediationMessage: "Consider restricting public access to the instance."
relatedLists:
  - relationshipName: "CA10__subnetGroup__r.CA10__AWS_RDS_Subnet_Group_Subnet_Links__r"
    conditions:
      - status: "INCOMPLIANT"
        currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access."
        remediationMessage: "Consider removing Internet Gateway routes with unrestricted access."
        check:
          RELATED_LIST_HAS:
            status: "INCOMPLIANT"
            relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
      - status: "COMPLIANT"
        currentStateMessage: "This Subnet Group has subnet route table with an Internet Gateway route with unrestricted access."
        check:
          RELATED_LIST_HAS:
            status: "COMPLIANT"
            relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
    otherwise:
      status: "INAPPLICABLE"
      currentStateMessage: "This subnet group doesn't have route table associations."
    relatedLists:
      - relationshipName: "CA10__subnet__r.CA10__routeTableAssociations__r"
        importExtracts:
        - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
        conditions:
          - status: "INCOMPLIANT"
            currentStateMessage: "This subnet route table has an Internet Gateway route with unrestricted access."
            remediationMessage: "Consider removing Internet Gateway routes with unrestricted access."
            check:
              RELATED_LIST_HAS:
                status: "INCOMPLIANT"
                relationshipName: "CA10__routeTable__r.CA10__routes__r"
        otherwise:
          status: "COMPLIANT"
          currentStateMessage: "This subnet is compliant"
        relatedLists:
          - relationshipName: "CA10__routeTable__r.CA10__routes__r"
            conditions:
              - status: "INCOMPLIANT"
                currentStateMessage: "This is an Internet Gateway route with unrestricted access."
                remediationMessage: "Consider removing this route."
                check:
                  AND:
                    args:
                      - STARTS_WITH:
                          arg:
                            EXTRACT: "CA10__gatewayId__c"
                          search:
                            TEXT: "igw"
                      - OR:
                          args:
                            - IS_EQUAL:
                                left:
                                  EXTRACT: "CA10__destinationCidrBlock__c"
                                right:
                                  TEXT: "0.0.0.0/0"
                            - IS_EQUAL:
                                left:
                                  EXTRACT: "CA10__destinationIpv6CidrBlock__c"
                                right:
                                  TEXT: "::/0"
            otherwise:
              status: "COMPLIANT"
              currentStateMessage: "This is not an Internet Gateway Route."
  - relationshipName: "CA10__vpc__r.CA10__routeTables__r"
    importExtracts:
      - file: "/types/CA10__CaAwsRoute__c/object.extracts.yaml"
      - file: "/types/CA10__CaAwsRouteTableAssociation__c/object.extracts.yaml"
    conditions:
      - status: "INCOMPLIANT"
        currentStateMessage: "This is a Main Route Table with an Internet Gateway route."
        remediationMessage: "Consider removing this route."
        check:
          AND:
            args:
              - RELATED_LIST_HAS:
                  status: "COMPLIANT"
                  relationshipName: "CA10__routeTableAssociations__r"
              - RELATED_LIST_HAS:
                  status: "INCOMPLIANT"
                  relationshipName: "CA10__routes__r"
    otherwise:
      status: "INAPPLICABLE"
      currentStateMessage: "Custom Route Tables or Main Route Table without Internet Gateway."
    relatedLists:
      - relationshipName: "CA10__routeTableAssociations__r"
        conditions:
          - status: "COMPLIANT"
            currentStateMessage: "This is a Main Route Table."
            check:
              IS_EQUAL:
                left:
                  EXTRACT: "CA10__main__c"
                right:
                  BOOLEAN: true
        otherwise:
          status: "INAPPLICABLE"
          currentStateMessage: "This is not a Main Route Table."
      - relationshipName: "CA10__routes__r"
        conditions:
          - status: "INCOMPLIANT"
            currentStateMessage: "This is an Internet Gateway route."
            remediationMessage: "Consider removing this route."
            check:
              AND:
                args:
                  - STARTS_WITH:
                      arg:
                        EXTRACT: "CA10__gatewayId__c"
                      search:
                        TEXT: "igw"
                  - OR:
                      args:
                        - IS_EQUAL:
                            left:
                              EXTRACT: "CA10__destinationCidrBlock__c"
                            right:
                              TEXT: "0.0.0.0/0"
                        - IS_EQUAL:
                            left:
                              EXTRACT: "CA10__destinationIpv6CidrBlock__c"
                            right:
                              TEXT: "::/0"
        otherwise:
          status: "COMPLIANT"
          currentStateMessage: "This is not an Internet Gateway Route."

Uses​

Test Results 🟢​

Generation Bundle​

Available Commands​

Content​

Uses

Test Results 🟢

Generation Bundle

Available Commands

Content