Project: KICS (Provisioning / Security & Compliance)
File: e649a218-d099-4550-86a4-1231e1fcb60d.md

title: Low RDS Backup Retention Period hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e649a218-d099-4550-86a4-1231e1fcb60d Query name: Low RDS Backup Retention Period Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Backup URL: AWS RDS backup retention policy should be at least 7 days<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="52" AWSTemplateFormatVersion: "2010-09-09" Description: Creates RDS Cluster Parameters: PMDatabaseEngine: Type: String Default: "MySQL" Description: "Database engine, Aurora, MySQL or PostgreSQL" PMRDSSG: Description: "Select the Security Group to use for the ELB" Type: "AWS::EC2::SecurityGroup::Id" PMDatabaseEngineVer: Type: String Description: "Database engine ver" PMDatabaseUsername: NoEcho: 'true' Type: String Description: "Database admin account name" PMDatabasePassword: NoEcho: 'true' Type: String Description: "Database admin account password" PMDBClusterParameterGroupName: Description: "Db Parameter Groupname" Type: String PMDatabaseInstanceClass: Type: String Default: "db.t2.micro" Description: "Database instance class" PMPrivateSubnets: Description: "Subnets to launch instances into" Type: "List<AWS::EC2::Subnet::Id>" PMServerEnv: Description: "Server Environment name." ConstraintDescription: "Choose an Environment from the drop down" Type: String PMDBClusterIdentifier: Description: "Db Cluster Name." Type: String Resources: DatabaseCluster: Type: "AWS::RDS::DBCluster" Properties: VpcSecurityGroupIds: Ref: "PMRDSSG" Engine: !Ref "PMDatabaseEngine" EngineVersion: !Ref "PMDatabaseEngineVer" MasterUsername: !Ref "PMDatabaseUsername" MasterUserPassword: !Ref "PMDatabasePassword" DBClusterParameterGroupName: !Ref "RDSDBClusterParameterGroup" StorageEncrypted: true BackupRetentionPeriod: 3 PreferredBackupWindow: '12:00-13:00' PreferredMaintenanceWindow: 'mon:13:00-mon:14:00' Database1: Type: "AWS::RDS::DBInstance" Properties: Engine: !Ref "PMDatabaseEngine" DBClusterIdentifier: !Ref "DatabaseCluster" DBInstanceClass: !Ref "PMDatabaseInstanceClass" DBSubnetGroupName: !Ref "DbSubnetGroup" DBInstanceIdentifier: !Sub "${PMDBClusterIdentifier}-db1" Database2: Type: "AWS::RDS::DBInstance" Properties: Engine: !Ref "PMDatabaseEngine" DBClusterIdentifier: !Ref "DatabaseCluster" DBInstanceClass: !Ref "PMDatabaseInstanceClass" DBSubnetGroupName: !Ref "DbSubnetGroup" DBInstanceIdentifier: !Sub "${PMDBClusterIdentifier}-db2" DbSubnetGroup: Type: "AWS::RDS::DBSubnetGroup" Properties: DBSubnetGroupDescription: !Sub "${PMServerEnv} RDS DB subnet group" SubnetIds: Ref: "PMPrivateSubnets" RDSDBClusterParameterGroup: Type: "AWS::RDS::DBClusterParameterGroup" Properties: Description: "CloudFormation Sample Aurora Cluster Parameter Group" Family: !Ref "PMDBClusterParameterGroupName" Parameters: time_zone: "UTC" collationconnection: "utf8general_ci" charactersetdatabase: "utf8" Outputs: RdsDbId: Description: "RDS Database Cluster ID" Value: !Ref "DatabaseCluster" RdsEndpointAdd: Description: "RDS Database Endpoint" Value: !GetAtt "DatabaseCluster.Endpoint.Address" RdsReadEndpointAdd: Description: "RDS Read Database Endpoint" Value: !GetAtt "DatabaseCluster.ReadEndpoint.Address" RdsEndpointPort: Description: "RDS Database Port" Value: !GetAtt "DatabaseCluster.Endpoint.Port" DbUser: Description: "RDS Database admin account user" Value: !Ref "PMDatabaseUsername" DbPassword: Description: "RDS Database admin account password" Value: !Ref "PMDatabasePassword" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="35" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyKey: Type: "AWS::KMS::Key" Properties: KeyPolicy: Version: 2012-10-17 Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Join "" - "arn:aws:iam::" !Ref "AWS::AccountId" ":root" Action: "kms:*" Resource: "*" MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: !Ref DBInstanceType SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion KmsKeyId: !Ref MyKey BackupRetentionPeriod: 6 Outputs: InstanceId: Description: InstanceId of the newly created RDS Instance Value: !Ref MyDBSmall ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="22" AWSTemplateFormatVersion: "2010-09-09" Parameters: DBUser: NoEcho: true Description: The database admin account username Type: String MinLength: 1 MaxLength: 16 AllowedPattern: "*" ConstraintDescription: must begin with a letter and contain only alphanumeric characters. DBPassword: NoEcho: true Description: The database admin account password Type: String MinLength: 1 MaxLength: 41 AllowedPattern: "[a-zA-Z0-9]*" ConstraintDescription: must contain only alphanumeric characters. Resources: MyDB: Type: "AWS::RDS::DBInstance" Properties: AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: MySQL EngineVersion: '5.5' MasterUsername: !Ref DBUser MasterUserPassword: !Ref DBPassword DBParameterGroupName: !Ref MyRDSParamGroup MyRDSParamGroup: Type: "AWS::RDS::DBParameterGroup" Properties: Family: MySQL5.5 Description: CloudFormation Sample Database Parameter Group Parameters: autocommit: '1' general_log: '1' old_passwords: '0' ``` <details><summary>Positive test

4 - yaml file</summary> ```yaml hl_lines="43" AWSTemplateFormatVersion: "2010-09-09" Description: Creates RDS Cluster Parameters: PMDatabaseEngine: Type: String Default: "MySQL" Description: "Database engine, Aurora, MySQL or PostgreSQL" PMRDSSG: Description: "Select the Security Group to use for the ELB" Type: "AWS::EC2::SecurityGroup::Id" PMDatabaseEngineVer: Type: String Description: "Database engine ver" PMDatabaseUsername: NoEcho: 'true' Type: String Description: "Database admin account name" PMDatabasePassword: NoEcho: 'true' Type: String Description: "Database admin account password" PMDBClusterParameterGroupName: Description: "Db Parameter Groupname" Type: String PMDatabaseInstanceClass: Type: String Default: "db.t2.micro" Description: "Database instance class" PMPrivateSubnets: Description: "Subnets to launch instances into" Type: "List<AWS::EC2::Subnet::Id>" PMServerEnv: Description: "Server Environment name." ConstraintDescription: "Choose an Environment from the drop down" Type: String PMDBClusterIdentifier: Description: "Db Cluster Name." Type: String Resources: BadDatabaseCluster: Type: "AWS::RDS::DBCluster" Properties: VpcSecurityGroupIds: Ref: "PMRDSSG" Engine: !Ref "PMDatabaseEngine" EngineVersion: !Ref "PMDatabaseEngineVer" MasterUsername: !Ref "PMDatabaseUsername" MasterUserPassword: !Ref "PMDatabasePassword" DBClusterParameterGroupName: !Ref "RDSDBClusterParameterGroup" StorageEncrypted: true PreferredBackupWindow: '12:00-13:00' PreferredMaintenanceWindow: 'mon:13:00-mon:14:00' Database1: Type: "AWS::RDS::DBInstance" Properties: Engine: !Ref "PMDatabaseEngine" DBClusterIdentifier: !Ref "DatabaseCluster" DBInstanceClass: !Ref "PMDatabaseInstanceClass" DBSubnetGroupName: !Ref "DbSubnetGroup" DBInstanceIdentifier: !Sub "${PMDBClusterIdentifier}-db1" Database2: Type: "AWS::RDS::DBInstance" Properties: Engine: !Ref "PMDatabaseEngine" DBClusterIdentifier: !Ref "DatabaseCluster" DBInstanceClass: !Ref "PMDatabaseInstanceClass" DBSubnetGroupName: !Ref "DbSubnetGroup" DBInstanceIdentifier: !Sub "${PMDBClusterIdentifier}-db2" DbSubnetGroup: Type: "AWS::RDS::DBSubnetGroup" Properties: DBSubnetGroupDescription: !Sub "${PMServerEnv} RDS DB subnet group" SubnetIds: Ref: "PMPrivateSubnets" RDSDBClusterParameterGroup: Type: "AWS::RDS::DBClusterParameterGroup" Properties: Description: "CloudFormation Sample Aurora Cluster Parameter Group" Family: !Ref "PMDBClusterParameterGroupName" Parameters: time_zone: "UTC" collationconnection: "utf8general_ci" charactersetdatabase: "utf8" Outputs: RdsDbId: Description: "RDS Database Cluster ID" Value: !Ref "DatabaseCluster" RdsEndpointAdd: Description: "RDS Database Endpoint" Value: !GetAtt "DatabaseCluster.Endpoint.Address" RdsReadEndpointAdd: Description: "RDS Read Database Endpoint" Value: !GetAtt "DatabaseCluster.ReadEndpoint.Address" RdsEndpointPort: Description: "RDS Database Port" Value: !GetAtt "DatabaseCluster.Endpoint.Port" DbUser: Description: "RDS Database admin account user" Value: !Ref "PMDatabaseUsername" DbPassword: Description: "RDS Database admin account password" Value: !Ref "PMDatabasePassword" ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="113" { "Outputs": { "RdsDbId": { "Description": "RDS Database Cluster ID", "Value": "DatabaseCluster" }, "RdsEndpointAdd": { "Description": "RDS Database Endpoint", "Value": "DatabaseCluster.Endpoint.Address" }, "RdsReadEndpointAdd": { "Description": "RDS Read Database Endpoint", "Value": "DatabaseCluster.ReadEndpoint.Address" }, "RdsEndpointPort": { "Description": "RDS Database Port", "Value": "DatabaseCluster.Endpoint.Port" }, "DbUser": { "Description": "RDS Database admin account user", "Value": "PMDatabaseUsername" }, "DbPassword": { "Description": "RDS Database admin account password", "Value": "PMDatabasePassword" } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Creates RDS Cluster", "Parameters": { "PMRDSSG": { "Description": "Select the Security Group to use for the ELB", "Type": "AWS::EC2::SecurityGroup::Id" }, "PMPrivateSubnets": { "Description": "Subnets to launch instances into", "Type": "List\u003cAWS::EC2::Subnet::Id\u003e" }, "PMServerEnv": { "Description": "Server Environment name.", "ConstraintDescription": "Choose an Environment from the drop down", "Type": "String" }, "PMDBClusterIdentifier": { "Type": "String", "Description": "Db Cluster Name." }, "PMDBClusterParameterGroupName": { "Description": "Db Parameter Groupname", "Type": "String" }, "PMDatabaseInstanceClass": { "Type": "String", "Default":

"Description": "Database instance class" }, "PMDatabaseEngine": { "Type": "String", "Default": "MySQL", "Description": "Database engine, Aurora, MySQL or PostgreSQL" }, "PMDatabaseEngineVer": { "Type": "String", "Description": "Database engine ver" }, "PMDatabaseUsername": { "NoEcho": "true", "Type": "String", "Description": "Database admin account name" }, "PMDatabasePassword": { "Description": "Database admin account password", "NoEcho": "true", "Type": "String" } }, "Resources": { "Database2": { "Type": "AWS::RDS::DBInstance", "Properties": { "Engine": "PMDatabaseEngine", "DBClusterIdentifier": "DatabaseCluster", "DBInstanceClass": "PMDatabaseInstanceClass", "DBSubnetGroupName": "DbSubnetGroup", "DBInstanceIdentifier": "${PMDBClusterIdentifier}-db2" } }, "DbSubnetGroup": { "Type": "AWS::RDS::DBSubnetGroup", "Properties": { "DBSubnetGroupDescription": "${PMServerEnv} RDS DB subnet group", "SubnetIds": { "Ref": "PMPrivateSubnets" } } }, "RDSDBClusterParameterGroup": { "Properties": { "Description": "CloudFormation Sample Aurora Cluster Parameter Group", "Family": "PMDBClusterParameterGroupName", "Parameters": { "time_zone": "UTC", "collationconnection": "utf8general_ci", "charactersetdatabase": "utf8" } }, "Type": "AWS::RDS::DBClusterParameterGroup" }, "DatabaseCluster": { "Type": "AWS::RDS::DBCluster", "Properties": { "StorageEncrypted": true, "BackupRetentionPeriod": 3, "MasterUsername": "PMDatabaseUsername", "MasterUserPassword": "PMDatabasePassword", "DBClusterParameterGroupName": "RDSDBClusterParameterGroup", "PreferredBackupWindow": "12:00-13:00", "PreferredMaintenanceWindow": "mon:13:00-mon:14:00", "VpcSecurityGroupIds": [ { "Ref": "PMRDSSG" } ], "Engine": "PMDatabaseEngine", "EngineVersion": "PMDatabaseEngineVer" } }, "Database1": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBInstanceIdentifier": "${PMDBClusterIdentifier}-db1", "Engine": "PMDatabaseEngine", "DBClusterIdentifier": "DatabaseCluster", "DBInstanceClass": "PMDatabaseInstanceClass", "DBSubnetGroupName": "DbSubnetGroup" } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="55" { "Outputs": { "InstanceId": { "Description": "InstanceId of the newly created RDS Instance", "Value": "MyDBSmall" } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "RDS Storage Encrypted", "Parameters": { "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" }, "SourceRegion": { "Type": "String" } }, "Resources": { "MyKey": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Version": "2012-10-17T00:00:00Z", "Id": "key-default-1", "Statement": [ { "Action": "kms:*", "Resource": "*", "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": [ "", [ "arn:aws:iam::", "AWS::AccountId", ":root" ] ] } } ] } } }, "MyDBSmall": { "Type": "AWS::RDS::DBInstance", "Properties": { "SourceDBInstanceIdentifier": "SourceDBInstanceIdentifier", "SourceRegion": "SourceRegion", "KmsKeyId": "MyKey", "BackupRetentionPeriod": 6, "DBInstanceClass": "DBInstanceType" } } } } ``` </details> <details><summary>Positive test num. 7 - json file</summary> ```json hl_lines="26" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "DBUser": { "AllowedPattern": "*", "ConstraintDescription": "must begin with a letter and contain only alphanumeric characters.", "NoEcho": true, "Description": "The database admin account username", "Type": "String", "MinLength": 1, "MaxLength": 16 }, "DBPassword": { "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters.", "NoEcho": true, "Description": "The database admin account password", "Type": "String", "MinLength": 1, "MaxLength": 41 } }, "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "MySQL", "EngineVersion": "5.5", "MasterUsername": "DBUser", "MasterUserPassword": "DBPassword", "DBParameterGroupName": "MyRDSParamGroup" } }, "MyRDSParamGroup": { "Type": "AWS::RDS::DBParameterGroup", "Properties": { "Family": "MySQL5.5", "Description": "CloudFormation Sample Database Parameter Group", "Parameters": { "general_log": "1", "old_passwords": "0", "autocommit": "1" } } } } } ``` </details> <details><summary>Positive test num. 8 - json file</summary> ```json hl_lines="54" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Creates RDS Cluster", "Parameters": { "PMDatabaseEngineVer": { "Type": "String", "Description": "Database engine ver" }, "PMDatabaseUsername": { "NoEcho": "true", "Type": "String", "Description": "Database admin account name" }, "PMDatabasePassword": { "Type": "String", "Description": "Database admin account password", "NoEcho": "true" }, "PMDBClusterParameterGroupName": { "Description": "Db Parameter Groupname", "Type": "String" }, "PMDBClusterIdentifier": { "Description": "Db Cluster Name.", "Type": "String" }, "PMDatabaseEngine": { "Type": "String", "Default": "MySQL", "Description": "Database engine, Aurora, MySQL or PostgreSQL" }, "PMRDSSG": { "Description": "Select the Security Group to use for the ELB", "Type": "AWS::EC2::SecurityGroup::Id" }, "PMDatabaseInstanceClass": { "Type": "String", "Default": "db.t2.micro", "Description": "Database instance class" }, "PMPrivateSubnets": { "Description": "Subnets to launch instances into", "Type": "List\u003cAWS::EC2::Subnet::Id\u003e" }, "PMServerEnv": { "ConstraintDescription": "Choose an Environment from the drop down", "Type": "String", "Description": "Server Environment name." } }, "Resources": { "BadDatabaseCluster": { "Type": "AWS::RDS::DBCluster", "Properties": { "PreferredMaintenanceWindow": "mon:13:00-mon:14:00", "VpcSecurityGroupIds": [ { "Ref": "PMRDSSG" } ], "EngineVersion": "PMDatabaseEngineVer", "MasterUsername": "PMDatabaseUsername", "StorageEncrypted": true, "Engine": "PMDatabaseEngine", "MasterUserPassword": "PMDatabasePassword", "DBClusterParameterGroupName": "RDSDBClusterParameterGroup", "PreferredBackupWindow": "12:00-13:00" } }, "Database1": { "Type": "AWS::RDS::DBInstance", "Properties": { "Engine": "PMDatabaseEngine", "DBClusterIdentifier": "DatabaseCluster", "DBInstanceClass": "PMDatabaseInstanceClass", "DBSubnetGroupName": "DbSubnetGroup", "DBInstanceIdentifier": "${PMDBClusterIdentifier}-db1" } }, "Database2": { "Type": "AWS::RDS::DBInstance", "Properties": { "Engine": "PMDatabaseEngine", "DBClusterIdentifier": "DatabaseCluster", "DBInstanceClass": "PMDatabaseInstanceClass", "DBSubnetGroupName": "DbSubnetGroup", "DBInstanceIdentifier": "${PMDBClusterIdentifier}-db2" } }, "DbSubnetGroup": { "Type": "AWS::RDS::DBSubnetGroup", "Properties": { "DBSubnetGroupDescription": "${PMServerEnv} RDS DB subnet group", "SubnetIds": { "Ref": "PMPrivateSubnets" } } }, "RDSDBClusterParameterGroup": { "Type": "AWS::RDS::DBClusterParameterGroup", "Properties": { "Description": "CloudFormation Sample Aurora Cluster Parameter Group", "Family": "PMDBClusterParameterGroupName", "Parameters": { "collationconnection": "utf8general_ci", "charactersetdatabase": "utf8", "time_zone": "UTC" } } } }, "Outputs": { "RdsReadEndpointAdd": { "Value":

"Description": "RDS Read Database Endpoint" }, "RdsEndpointPort": { "Description": "RDS Database Port", "Value": "DatabaseCluster.Endpoint.Port" }, "DbUser": { "Value": "PMDatabaseUsername", "Description": "RDS Database admin account user" }, "DbPassword": { "Description": "RDS Database admin account password", "Value": "PMDatabasePassword" }, "RdsDbId": { "Description": "RDS Database Cluster ID", "Value": "DatabaseCluster" }, "RdsEndpointAdd": { "Description": "RDS Database Endpoint", "Value": "DatabaseCluster.Endpoint.Address" } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: Creates RDS Cluster Parameters: PMDatabaseEngine: Type: String Default: "MySQL" Description: "Database engine, Aurora, MySQL or PostgreSQL" PMRDSSG: Description: "Select the Security Group to use for the ELB" Type: "AWS::EC2::SecurityGroup::Id" PMDatabaseEngineVer: Type: String Description: "Database engine ver" PMDatabaseUsername: NoEcho: 'true' Type: String Description: "Database admin account name" PMDatabasePassword: NoEcho: 'true' Type: String Description: "Database admin account password" PMDBClusterParameterGroupName: Description: "Db Parameter Groupname" Type: String PMDatabaseInstanceClass: Type: String Default: "db.t2.micro" Description: "Database instance class" PMPrivateSubnets: Description: "Subnets to launch instances into" Type: "List<AWS::EC2::Subnet::Id>" PMServerEnv: Description: "Server Environment name." ConstraintDescription: "Choose an Environment from the drop down" Type: String PMDBClusterIdentifier: Description: "Db Cluster Name." Type: String Resources: DatabaseCluster: Type: "AWS::RDS::DBCluster" Properties: VpcSecurityGroupIds: Ref: "PMRDSSG" Engine: !Ref "PMDatabaseEngine" EngineVersion: !Ref "PMDatabaseEngineVer" MasterUsername: !Ref "PMDatabaseUsername" MasterUserPassword: !Ref "PMDatabasePassword" DBClusterParameterGroupName: !Ref "RDSDBClusterParameterGroup" StorageEncrypted: true BackupRetentionPeriod: 16 PreferredBackupWindow: '12:00-13:00' PreferredMaintenanceWindow: 'mon:13:00-mon:14:00' Database1: Type: "AWS::RDS::DBInstance" Properties: Engine: !Ref "PMDatabaseEngine" DBClusterIdentifier: !Ref "DatabaseCluster" DBInstanceClass: !Ref "PMDatabaseInstanceClass" DBSubnetGroupName: !Ref "DbSubnetGroup" DBInstanceIdentifier: !Sub "${PMDBClusterIdentifier}-db1" Database2: Type: "AWS::RDS::DBInstance" Properties: Engine: !Ref "PMDatabaseEngine" DBClusterIdentifier: !Ref "DatabaseCluster" DBInstanceClass: !Ref "PMDatabaseInstanceClass" DBSubnetGroupName: !Ref "DbSubnetGroup" DBInstanceIdentifier: !Sub "${PMDBClusterIdentifier}-db2" DbSubnetGroup: Type: "AWS::RDS::DBSubnetGroup" Properties: DBSubnetGroupDescription: !Sub "${PMServerEnv} RDS DB subnet group" SubnetIds: Ref: "PMPrivateSubnets" RDSDBClusterParameterGroup: Type: "AWS::RDS::DBClusterParameterGroup" Properties: Description: "CloudFormation Sample Aurora Cluster Parameter Group" Family: !Ref "PMDBClusterParameterGroupName" Parameters: time_zone: "UTC" collationconnection: "utf8general_ci" charactersetdatabase: "utf8" Outputs: RdsDbId: Description: "RDS Database Cluster ID" Value: !Ref "DatabaseCluster" RdsEndpointAdd: Description: "RDS Database Endpoint" Value: !GetAtt "DatabaseCluster.Endpoint.Address" RdsReadEndpointAdd: Description: "RDS Read Database Endpoint" Value: !GetAtt "DatabaseCluster.ReadEndpoint.Address" RdsEndpointPort: Description: "RDS Database Port" Value: !GetAtt "DatabaseCluster.Endpoint.Port" DbUser: Description: "RDS Database admin account user" Value: !Ref "PMDatabaseUsername" DbPassword: Description: "RDS Database admin account password" Value: !Ref "PMDatabasePassword" ``` ```yaml title="Negative test num. 2 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: RDS Storage Encrypted Parameters: SourceDBInstanceIdentifier: Type: String DBInstanceType: Type: String SourceRegion: Type: String Resources: MyKey: Type: "AWS::KMS::Key" Properties: KeyPolicy: Version: 2012-10-17 Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Join "" - "arn:aws:iam::" !Ref "AWS::AccountId" ":root" Action: "kms:*" Resource: "*" MyDBSmall: Type: "AWS::RDS::DBInstance" Properties: DBInstanceClass: !Ref DBInstanceType SourceDBInstanceIdentifier: !Ref SourceDBInstanceIdentifier SourceRegion: !Ref SourceRegion KmsKeyId: !Ref MyKey BackupRetentionPeriod: 7 Outputs: InstanceId: Description: InstanceId of the newly created RDS Instance Value: !Ref MyDBSmall ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Parameters: DBUser: NoEcho: true Description: The database admin account username Type: String MinLength: 1 MaxLength: 16 AllowedPattern: "*" ConstraintDescription: must begin with a letter and contain only alphanumeric characters. DBPassword: NoEcho: true Description: The database admin account password Type: String MinLength: 1 MaxLength: 41 AllowedPattern: "[a-zA-Z0-9]*" ConstraintDescription: must contain only alphanumeric characters. Resources: MyDB: Type: "AWS::RDS::DBInstance" Properties: AllocatedStorage: '5' DBInstanceClass: db.t2.small Engine: MySQL EngineVersion: '5.5' MasterUsername: !Ref DBUser MasterUserPassword: !Ref DBPassword DBParameterGroupName: !Ref MyRDSParamGroup BackupRetentionPeriod: 10 MyRDSParamGroup: Type: "AWS::RDS::DBParameterGroup" Properties: Family: MySQL5.5 Description: CloudFormation Sample Database Parameter Group Parameters: autocommit: '1' general_log: '1' old_passwords: '0' ``` <details><summary>Negative test

4 - json file</summary> ```json { "Parameters": { "PMDatabaseEngineVer": { "Description": "Database engine ver", "Type": "String" }, "PMDatabaseUsername": { "NoEcho": "true", "Type": "String", "Description": "Database admin account name" }, "PMDatabaseInstanceClass": { "Type": "String", "Default": "db.t2.micro", "Description": "Database instance class" }, "PMRDSSG": { "Description": "Select the Security Group to use for the ELB", "Type": "AWS::EC2::SecurityGroup::Id" }, "PMDatabasePassword": { "Description": "Database admin account password", "NoEcho": "true", "Type": "String" }, "PMDBClusterParameterGroupName": { "Type": "String", "Description": "Db Parameter Groupname" }, "PMPrivateSubnets": { "Description": "Subnets to launch instances into", "Type": "List\u003cAWS::EC2::Subnet::Id\u003e" }, "PMServerEnv": { "ConstraintDescription": "Choose an Environment from the drop down", "Type": "String", "Description": "Server Environment name." }, "PMDBClusterIdentifier": { "Type": "String", "Description": "Db Cluster Name." }, "PMDatabaseEngine": { "Type": "String", "Default": "MySQL", "Description": "Database engine, Aurora, MySQL or PostgreSQL" } }, "Resources": { "DatabaseCluster": { "Properties": { "PreferredMaintenanceWindow": "mon:13:00-mon:14:00", "Engine": "PMDatabaseEngine", "StorageEncrypted": true, "MasterUsername": "PMDatabaseUsername", "MasterUserPassword": "PMDatabasePassword", "DBClusterParameterGroupName": "RDSDBClusterParameterGroup", "BackupRetentionPeriod": 16, "PreferredBackupWindow": "12:00-13:00", "VpcSecurityGroupIds": [ { "Ref": "PMRDSSG" } ], "EngineVersion": "PMDatabaseEngineVer" }, "Type": "AWS::RDS::DBCluster" }, "Database1": { "Type": "AWS::RDS::DBInstance", "Properties": { "Engine": "PMDatabaseEngine", "DBClusterIdentifier": "DatabaseCluster", "DBInstanceClass": "PMDatabaseInstanceClass", "DBSubnetGroupName": "DbSubnetGroup", "DBInstanceIdentifier": "${PMDBClusterIdentifier}-db1" } }, "Database2": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBInstanceIdentifier": "${PMDBClusterIdentifier}-db2", "Engine": "PMDatabaseEngine", "DBClusterIdentifier": "DatabaseCluster", "DBInstanceClass": "PMDatabaseInstanceClass", "DBSubnetGroupName": "DbSubnetGroup" } }, "DbSubnetGroup": { "Type": "AWS::RDS::DBSubnetGroup", "Properties": { "DBSubnetGroupDescription": "${PMServerEnv} RDS DB subnet group", "SubnetIds": { "Ref": "PMPrivateSubnets" } } }, "RDSDBClusterParameterGroup": { "Type": "AWS::RDS::DBClusterParameterGroup", "Properties": { "Description": "CloudFormation Sample Aurora Cluster Parameter Group", "Family": "PMDBClusterParameterGroupName", "Parameters": { "time_zone": "UTC", "collationconnection": "utf8general_ci", "charactersetdatabase": "utf8" } } } }, "Outputs": { "RdsEndpointAdd": { "Value": "DatabaseCluster.Endpoint.Address", "Description": "RDS Database Endpoint" }, "RdsReadEndpointAdd": { "Description": "RDS Read Database Endpoint", "Value": "DatabaseCluster.ReadEndpoint.Address" }, "RdsEndpointPort": { "Description": "RDS Database Port", "Value": "DatabaseCluster.Endpoint.Port" }, "DbUser": { "Description": "RDS Database admin account user", "Value": "PMDatabaseUsername" }, "DbPassword": { "Value": "PMDatabasePassword", "Description": "RDS Database admin account password" }, "RdsDbId": { "Description": "RDS Database Cluster ID", "Value": "DatabaseCluster" } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Creates RDS Cluster" } ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "Parameters": { "SourceDBInstanceIdentifier": { "Type": "String" }, "DBInstanceType": { "Type": "String" }, "SourceRegion": { "Type": "String" } }, "Resources": { "MyKey": { "Type": "AWS::KMS::Key", "Properties": { "KeyPolicy": { "Version": "2012-10-17T00:00:00Z", "Id": "key-default-1", "Statement": [ { "Principal": { "AWS": [ "", [ "arn:aws:iam::", "AWS::AccountId", ":root" ] ] }, "Action": "kms:*", "Resource": "*", "Sid": "Enable IAM User Permissions", "Effect": "Allow" } ] } } }, "MyDBSmall": { "Type": "AWS::RDS::DBInstance", "Properties": { "SourceDBInstanceIdentifier": "SourceDBInstanceIdentifier", "SourceRegion": "SourceRegion", "KmsKeyId": "MyKey", "BackupRetentionPeriod": 7, "DBInstanceClass": "DBInstanceType" } } }, "Outputs": { "InstanceId": { "Description": "InstanceId of the newly created RDS Instance", "Value": "MyDBSmall" } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "RDS Storage Encrypted" } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "DBUser": { "MinLength": 1, "MaxLength": 16, "AllowedPattern": "*", "ConstraintDescription": "must begin with a letter and contain only alphanumeric characters.", "NoEcho": true, "Description": "The database admin account username", "Type": "String" }, "DBPassword": { "MinLength": 1, "MaxLength": 41, "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters.", "NoEcho": true, "Description": "The database admin account password", "Type": "String" } }, "Resources": { "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "EngineVersion": "5.5", "MasterUsername": "DBUser", "MasterUserPassword": "DBPassword", "DBParameterGroupName": "MyRDSParamGroup", "BackupRetentionPeriod": 10, "AllocatedStorage": "5", "DBInstanceClass": "db.t2.small", "Engine": "MySQL" } }, "MyRDSParamGroup": { "Type": "AWS::RDS::DBParameterGroup", "Properties": { "Family": "MySQL5.5", "Description": "CloudFormation Sample Database Parameter Group", "Parameters": { "autocommit": "1", "general_log": "1", "old_passwords": "0" } } } } } ``` </details>