Repository: aquasecurity/tfsec
Pull request #1352 (2022-01-17 14:31:37)

convert tfsec to use defsec rds


Patch:
diff --git a/go.mod b/go.mod
index 0e83f67d1..7a3d9d22d 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.17
 
 require (
 	github.com/apparentlymart/go-cidr v1.1.0
-	github.com/aquasecurity/defsec v0.3.16
+	github.com/aquasecurity/defsec v0.3.18
 	github.com/bmatcuk/doublestar v1.3.4
 	github.com/google/go-cmp v0.5.6
 	github.com/google/uuid v1.3.0
diff --git a/go.sum b/go.sum
index 238152de3..a887d7704 100644
--- a/go.sum
+++ b/go.sum
@@ -88,6 +88,10 @@ github.com/aquasecurity/defsec v0.3.13 h1:f2CKlYz/u8oAjbswFOD1L1SQx74D9XvuXtDswI
 github.com/aquasecurity/defsec v0.3.13/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
 github.com/aquasecurity/defsec v0.3.16 h1:qCsnAuu8pEQcSuUj4vMA7SWM+XzoJBFhDNkUE4h7zFc=
 github.com/aquasecurity/defsec v0.3.16/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
+github.com/aquasecurity/defsec v0.3.17 h1:crMKcMqc9mAQ7eFUTcT5lm24qECNG0VqiMO3U10pek4=
+github.com/aquasecurity/defsec v0.3.17/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
+github.com/aquasecurity/defsec v0.3.18 h1:dBU9I3WOMEjdMFnu2hgcn3ImHak4p/HKo681TDGH/xY=
+github.com/aquasecurity/defsec v0.3.18/go.mod h1:+7iLruZRqRy54zcVCBcEw05YKOtOK6Dd+tEWQjfQPEM=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
diff --git a/internal/app/tfsec/adapter/aws/rds/adapt.go b/internal/app/tfsec/adapter/aws/rds/adapt.go
index 5eef12366..f2f886b9a 100644
--- a/internal/app/tfsec/adapter/aws/rds/adapt.go
+++ b/internal/app/tfsec/adapter/aws/rds/adapt.go
@@ -2,9 +2,117 @@ package rds
 
 import (
 	"github.com/aquasecurity/defsec/provider/aws/rds"
+	"github.com/aquasecurity/defsec/types"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 )
 
 func Adapt(modules []block.Module) rds.RDS {
-	return rds.RDS{}
+	return rds.RDS{
+		Instances: getInstances(modules),
+		Clusters:  getClusters(modules),
+		Classic:   getClassic(modules),
+	}
+}
+
+func getInstances(modules []block.Module) (instances []rds.Instance) {
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_db_instance") {
+			instances = append(instances, adaptInstance(resource, module))
+		}
+	}
+
+	return instances
+}
+
+func getClusters(modules []block.Module) (clusters []rds.Cluster) {
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_rds_cluster") {
+			clusters = append(clusters, adaptCluster(resource, module))
+		}
+	}
+
+	return clusters
+}
+
+func getClassic(modules []block.Module) (classic rds.Classic) {
+
+	var classicSecurityGroups []rds.DBSecurityGroup
+
+	for _, module := range modules {
+		for _, resource := range module.GetResourcesByType("aws_db_security_group", "aws_redshift_security_group", "aws_elasticache_security_group") {
+			classicSecurityGroups = append(classicSecurityGroups, adaptClassicDBSecurityGroup(resource))
+		}
+	}
+
+	classic.DBSecurityGroups = classicSecurityGroups
+	return classic
+}
+
+func adaptClusterInstance(resource block.Block, module block.Module) rds.ClusterInstance {
+
+	return rds.ClusterInstance{
+		ClusterIdentifier: resource.GetAttribute("cluster_identfier").AsStringValueOrDefault("", resource),
+		Instance:          adaptInstance(resource, module),
+	}
+}
+
+func adaptClassicDBSecurityGroup(resource block.Block) rds.DBSecurityGroup {
+	return rds.DBSecurityGroup{
+		Metadata: *resource.GetMetadata(),
+	}
+}
+
+func adaptInstance(resource block.Block, module block.Module) rds.Instance {
+	replicaSource := resource.GetAttribute("replicate_source_db")
+	replicaSourceValue := ""
+	if replicaSource.IsNotNil() {
+		if referenced, err := module.GetReferencedBlock(replicaSource, resource); err == nil {
+			replicaSourceValue = referenced.ID()
+
+		}
+	}
+	return rds.Instance{
+		Metadata:                  *resource.GetMetadata(),
+		BackupRetentionPeriodDays: resource.GetAttribute("backup_retention_period").AsIntValueOrDefault(0, resource),
+		ReplicationSourceARN:      types.StringExplicit(replicaSourceValue, *resource.GetMetadata()),
+		PerformanceInsights:       adaptPerformanceInsights(resource),
+		Encryption:                adaptEncryption(resource),
+		PublicAccess:              resource.GetAttribute("publicly_accessible").AsBoolValueOrDefault(false, resource),
+	}
+}
+
+func adaptCluster(resource block.Block, module block.Module) rds.Cluster {
+
+	return rds.Cluster{
+		Metadata:                  *resource.GetMetadata(),
+		BackupRetentionPeriodDays: resource.GetAttribute("backup_retention_period").AsIntValueOrDefault(0, resource),
+		ReplicationSourceARN:      resource.GetAttribute("replicate_source_db").AsStringValueOrDefault("", resource),
+		PerformanceInsights:       adaptPerformanceInsights(resource),
+		Instances:                 getClusterInstances(resource, module),
+		Encryption:                adaptEncryption(resource),
+	}
+}
+
+func getClusterInstances(resource block.Block, module block.Module) (clusterInstances []rds.ClusterInstance) {
+	clusterInstanceResources := module.GetReferencingResources(resource, "aws_rds_cluster_instance", "cluster_identifier")
+
+	for _, ciResource := range clusterInstanceResources {
+		clusterInstances = append(clusterInstances, adaptClusterInstance(ciResource, module))
+	}
+	return clusterInstances
+}
+
+func adaptPerformanceInsights(resource block.Block) rds.PerformanceInsights {
+	return rds.PerformanceInsights{
+		Enabled:  resource.GetAttribute("performance_insights_enabled").AsBoolValueOrDefault(false, resource),
+		KMSKeyID: resource.GetAttribute("performance_insights_kms_key_id").AsStringValueOrDefault("", resource),
+	}
+}
+
+func adaptEncryption(resource block.Block) rds.Encryption {
+	return rds.Encryption{
+		EncryptStorage: resource.GetAttribute("storage_encrypted").AsBoolValueOrDefault(false, resource),
+		KMSKeyID:       resource.GetAttribute("kms_key_id").AsStringValueOrDefault("", resource),
+	}
 }
diff --git a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go
index 63cc33704..911ea1e16 100644
--- a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -69,22 +67,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_rds_cluster", "aws_db_instance"},
 		Base:           rds.CheckBackupRetentionSpecified,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			if resourceBlock.HasChild("replicate_source_db") {
-				return
-			}
-
-			if resourceBlock.MissingChild("backup_retention_period") {
-				results.Add("Resource does not have backup retention explicitly set", resourceBlock)
-				return
-			}
-
-			retentionAttr := resourceBlock.GetAttribute("backup_retention_period")
-			if retentionAttr.LessThanOrEqualTo(1) {
-				results.Add("Resource has backup retention period set to a low value", retentionAttr)
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go
index 38f83bb8f..ffd65839b 100644
--- a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -32,20 +30,5 @@ resource "aws_rds_cluster_instance" "good_example" {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_rds_cluster_instance", "aws_db_instance"},
 		Base:           rds.CheckEnablePerformanceInsights,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.HasChild("performance_insights_enabled") && resourceBlock.GetAttribute("performance_insights_enabled").IsTrue() {
-				if resourceBlock.MissingChild("performance_insights_kms_key_id") {
-					results.Add("Resource defines Performance Insights without encryption key specified.", resourceBlock)
-					return
-				}
-
-				if keyAttr := resourceBlock.GetAttribute("performance_insights_kms_key_id"); keyAttr.IsEmpty() {
-					results.Add("Resource defines Performance Insights without encryption key specified.", keyAttr)
-				}
-			}
-
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go b/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go
index 0e1f356cb..b80f52036 100644
--- a/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/encrypt_cluster_storage_data_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -28,22 +26,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_rds_cluster"},
 		Base:           rds.CheckEncryptClusterStorageData,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			kmsKeyIdAttr := resourceBlock.GetAttribute("kms_key_id")
-			storageEncryptedAttr := resourceBlock.GetAttribute("storage_encrypted")
-
-			//nolint
-			if storageEncryptedAttr.IsNil() {
-				results.Add("Storage encryption is not enabled.", resourceBlock)
-			} else if storageEncryptedAttr.IsFalse() {
-				results.Add("Storage encryption is not enabled.", storageEncryptedAttr)
-			} else if kmsKeyIdAttr.IsNil() {
-				results.Add("Storage encryption does not use a customer-managed key.", resourceBlock)
-			} else if kmsKeyIdAttr.IsEmpty() {
-				results.Add("Storage encryption does not use a customer-managed key.", kmsKeyIdAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go b/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go
index 899121640..ee0b5b6ff 100644
--- a/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/encrypt_instance_storage_data_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -27,18 +25,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_db_instance"},
 		Base:           rds.CheckEncryptInstanceStorageData,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-
-			if resourceBlock.MissingChild("storage_encrypted") {
-				results.Add("Resource has no storage encryption defined.", resourceBlock)
-				return
-			}
-
-			storageEncryptedAttr := resourceBlock.GetAttribute("storage_encrypted")
-			if storageEncryptedAttr.IsFalse() {
-				results.Add("Resource has storage encrypted set to false", storageEncryptedAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go
index d71ceb7d2..47c533a35 100644
--- a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go
+++ b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule.go
@@ -1,9 +1,7 @@
 package rds
 
 import (
-	"github.com/aquasecurity/defsec/rules"
 	"github.com/aquasecurity/defsec/rules/aws/rds"
-	"github.com/aquasecurity/tfsec/internal/app/tfsec/block"
 	"github.com/aquasecurity/tfsec/internal/app/tfsec/scanner"
 	"github.com/aquasecurity/tfsec/pkg/rule"
 )
@@ -27,12 +25,5 @@ func init() {
 		RequiredTypes:  []string{"resource"},
 		RequiredLabels: []string{"aws_db_instance", "aws_dms_replication_instance", "aws_rds_cluster_instance", "aws_redshift_cluster"},
 		Base:           rds.CheckNoPublicDbAccess,
-		CheckTerraform: func(resourceBlock block.Block, _ block.Module) (results rules.Results) {
-			publicAttr := resourceBlock.GetAttribute("publicly_accessible")
-			if publicAttr.IsTrue() {
-				results.Add("Resource is exposed publicly.", publicAttr)
-			}
-			return results
-		},
 	})
 }
diff --git a/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go b/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go
index 834b7d752..e79429b62 100644
--- a/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go
+++ b/vendor/github.com/aquasecurity/defsec/provider/aws/rds/rds.go
@@ -31,7 +31,10 @@ type Instance struct {
 	PublicAccess              types.BoolValue
 }
 
-type ClusterInstance Instance
+type ClusterInstance struct {
+	Instance
+	ClusterIdentifier types.StringValue
+}
 
 type PerformanceInsights struct {
 	Enabled  types.BoolValue
diff --git a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go
index 9f1fd779f..7d3cbacea 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/enable_performance_insights.go
@@ -22,39 +22,44 @@ The encryption key specified in ` + "`" + `performance_insights_kms_key_id` + "`
 		Links: []string{
 			"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.htm",
 		},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformEnablePerformanceInsightsGoodExamples,
-            BadExamples:         terraformEnablePerformanceInsightsBadExamples,
-            Links:               terraformEnablePerformanceInsightsLinks,
-            RemediationMarkdown: terraformEnablePerformanceInsightsRemediationMarkdown,
-        },
-        CloudFormation:   &rules.EngineMetadata{
-            GoodExamples:        cloudFormationEnablePerformanceInsightsGoodExamples,
-            BadExamples:         cloudFormationEnablePerformanceInsightsBadExamples,
-            Links:               cloudFormationEnablePerformanceInsightsLinks,
-            RemediationMarkdown: cloudFormationEnablePerformanceInsightsRemediationMarkdown,
-        },
-        Severity: severity.High,
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformEnablePerformanceInsightsGoodExamples,
+			BadExamples:         terraformEnablePerformanceInsightsBadExamples,
+			Links:               terraformEnablePerformanceInsightsLinks,
+			RemediationMarkdown: terraformEnablePerformanceInsightsRemediationMarkdown,
+		},
+		CloudFormation: &rules.EngineMetadata{
+			GoodExamples:        cloudFormationEnablePerformanceInsightsGoodExamples,
+			BadExamples:         cloudFormationEnablePerformanceInsightsBadExamples,
+			Links:               cloudFormationEnablePerformanceInsightsLinks,
+			RemediationMarkdown: cloudFormationEnablePerformanceInsightsRemediationMarkdown,
+		},
+		Severity: severity.High,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, cluster := range s.AWS.RDS.Clusters {
 			if !cluster.IsManaged() {
 				continue
 			}
-			if cluster.PerformanceInsights.Enabled.IsFalse() {
-				results.Add(
-					"Cluster does not have performance insights enabled.",
-					&cluster,
-					cluster.PerformanceInsights.Enabled,
-				)
-			} else if cluster.PerformanceInsights.KMSKeyID.IsEmpty() {
-				results.Add(
-					"Cluster has performance insights enabled without encryption.",
-					&cluster,
-					cluster.PerformanceInsights.KMSKeyID,
-				)
-			} else {
-				results.AddPassed(&cluster)
+			for _, instance := range cluster.Instances {
+				if !instance.IsManaged() {
+					continue
+				}
+				if instance.PerformanceInsights.Enabled.IsFalse() {
+					results.Add(
+						"Instance does not have performance insights enabled.",
+						&instance,
+						instance.PerformanceInsights.Enabled,
+					)
+				} else if instance.PerformanceInsights.KMSKeyID.IsEmpty() {
+					results.Add(
+						"Instance has performance insights enabled without encryption.",
+						&instance,
+						instance.PerformanceInsights.KMSKeyID,
+					)
+				} else {
+					results.AddPassed(&instance)
+				}
 			}
 		}
 		for _, instance := range s.AWS.RDS.Instances {
diff --git a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go
index 410080257..4f4546030 100644
--- a/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go
+++ b/vendor/github.com/aquasecurity/defsec/rules/aws/rds/specify_backup_retention.go
@@ -20,19 +20,19 @@ var CheckBackupRetentionSpecified = rules.Register(
 		Links: []string{
 			"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupRetention",
 		},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformSpecifyBackupRetentionGoodExamples,
-            BadExamples:         terraformSpecifyBackupRetentionBadExamples,
-            Links:               terraformSpecifyBackupRetentionLinks,
-            RemediationMarkdown: terraformSpecifyBackupRetentionRemediationMarkdown,
-        },
-        CloudFormation:   &rules.EngineMetadata{
-            GoodExamples:        cloudFormationSpecifyBackupRetentionGoodExamples,
-            BadExamples:         cloudFormationSpecifyBackupRetentionBadExamples,
-            Links:               cloudFormationSpecifyBackupRetentionLinks,
-            RemediationMarkdown: cloudFormationSpecifyBackupRetentionRemediationMarkdown,
-        },
-        Severity: severity.Medium,
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformSpecifyBackupRetentionGoodExamples,
+			BadExamples:         terraformSpecifyBackupRetentionBadExamples,
+			Links:               terraformSpecifyBackupRetentionLinks,
+			RemediationMarkdown: terraformSpecifyBackupRetentionRemediationMarkdown,
+		},
+		CloudFormation: &rules.EngineMetadata{
+			GoodExamples:        cloudFormationSpecifyBackupRetentionGoodExamples,
+			BadExamples:         cloudFormationSpecifyBackupRetentionBadExamples,
+			Links:               cloudFormationSpecifyBackupRetentionLinks,
+			RemediationMarkdown: cloudFormationSpecifyBackupRetentionRemediationMarkdown,
+		},
+		Severity: severity.Medium,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, cluster := range s.AWS.RDS.Clusters {
@@ -53,6 +53,9 @@ var CheckBackupRetentionSpecified = rules.Register(
 			}
 		}
 		for _, instance := range s.AWS.RDS.Instances {
+			if !instance.ReplicationSourceARN.IsEmpty() {
+				continue
+			}
 			if !instance.IsManaged() {
 				continue
 			}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 328a3964a..d0bf874f6 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -28,7 +28,7 @@ github.com/apparentlymart/go-cidr/cidr
 # github.com/apparentlymart/go-textseg/v13 v13.0.0
 ## explicit; go 1.16
 github.com/apparentlymart/go-textseg/v13/textseg
-# github.com/aquasecurity/defsec v0.3.16
+# github.com/aquasecurity/defsec v0.3.18
 ## explicit; go 1.17
 github.com/aquasecurity/defsec/cidr
 github.com/aquasecurity/defsec/formatters


Test patch:
diff --git a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go
index 6f4724bb0..16d0cc6e6 100644
--- a/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go
+++ b/internal/app/tfsec/rules/aws/rds/backup_retention_specified_rule_test.go
@@ -18,136 +18,135 @@ func Test_AWSRDSRetentionPeriod(t *testing.T) {
 		{
 			name: "db instance with default retention fails check",
 			source: `
- 			resource "aws_db_instance" "bad_example" {
- 				allocated_storage    = 10
- 				engine               = "mysql"
- 				engine_version       = "5.7"
- 				instance_class       = "db.t3.micro"
- 				name                 = "mydb"
- 				username             = "foo"
- 				password             = "foobarbaz"
- 				parameter_group_name = "default.mysql5.7"
- 				skip_final_snapshot  = true
- 			}
- `,
+		 			resource "aws_db_instance" "bad_example" {
+		 				allocated_storage    = 10
+		 				engine               = "mysql"
+		 				engine_version       = "5.7"
+		 				instance_class       = "db.t3.micro"
+		 				name                 = "mydb"
+		 				username             = "foo"
+		 				password             = "foobarbaz"
+		 				parameter_group_name = "default.mysql5.7"
+		 				skip_final_snapshot  = true
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "rds cluster with default retention fails check",
 			source: `
- 			resource "aws_rds_cluster" "bad_example" {
- 				cluster_identifier      = "aurora-cluster-demo"
- 				engine                  = "aurora-mysql"
- 				engine_version          = "5.7.mysql_aurora.2.03.2"
- 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
- 				database_name           = "mydb"
- 				master_username         = "foo"
- 				master_password         = "bar"
- 				preferred_backup_window = "07:00-09:00"
- 			}
- `,
+		 			resource "aws_rds_cluster" "bad_example" {
+		 				cluster_identifier      = "aurora-cluster-demo"
+		 				engine                  = "aurora-mysql"
+		 				engine_version          = "5.7.mysql_aurora.2.03.2"
+		 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
+		 				database_name           = "mydb"
+		 				master_username         = "foo"
+		 				master_password         = "bar"
+		 				preferred_backup_window = "07:00-09:00"
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "db instance with explicit retention of 1 fails check",
 			source: `
- 			resource "aws_db_instance" "bad_example" {
- 				allocated_storage    = 10
- 				engine               = "mysql"
- 				engine_version       = "5.7"
- 				instance_class       = "db.t3.micro"
- 				name                 = "mydb"
- 				username             = "foo"
- 				password             = "foobarbaz"
- 				parameter_group_name = "default.mysql5.7"
- 				backup_retention_period = 1
- 				skip_final_snapshot  = true
- 			}
- `,
+		 			resource "aws_db_instance" "bad_example" {
+		 				allocated_storage    = 10
+		 				engine               = "mysql"
+		 				engine_version       = "5.7"
+		 				instance_class       = "db.t3.micro"
+		 				name                 = "mydb"
+		 				username             = "foo"
+		 				password             = "foobarbaz"
+		 				parameter_group_name = "default.mysql5.7"
+		 				backup_retention_period = 1
+		 				skip_final_snapshot  = true
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "rds cluster with explicit retention of 1 fails check",
 			source: `
- 			resource "aws_rds_cluster" "bad_example" {
- 				cluster_identifier      = "aurora-cluster-demo"
- 				engine                  = "aurora-mysql"
- 				engine_version          = "5.7.mysql_aurora.2.03.2"
- 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
- 				database_name           = "mydb"
- 				master_username         = "foo"
- 				master_password         = "bar"
- 				backup_retention_period = 1
- 				preferred_backup_window = "07:00-09:00"
- 			}
- `,
+		 			resource "aws_rds_cluster" "bad_example" {
+		 				cluster_identifier      = "aurora-cluster-demo"
+		 				engine                  = "aurora-mysql"
+		 				engine_version          = "5.7.mysql_aurora.2.03.2"
+		 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
+		 				database_name           = "mydb"
+		 				master_username         = "foo"
+		 				master_password         = "bar"
+		 				backup_retention_period = 1
+		 				preferred_backup_window = "07:00-09:00"
+		 			}
+		 `,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "rds cluster with retention greater than default passes check",
 			source: `
- 			resource "aws_rds_cluster" "good_example" {
- 				cluster_identifier      = "aurora-cluster-demo"
- 				engine                  = "aurora-mysql"
- 				engine_version          = "5.7.mysql_aurora.2.03.2"
- 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
- 				database_name           = "mydb"
- 				master_username         = "foo"
- 				master_password         = "bar"
- 				backup_retention_period = 5
- 				preferred_backup_window = "07:00-09:00"
- 			}
- `,
+		 			resource "aws_rds_cluster" "good_example" {
+		 				cluster_identifier      = "aurora-cluster-demo"
+		 				engine                  = "aurora-mysql"
+		 				engine_version          = "5.7.mysql_aurora.2.03.2"
+		 				availability_zones      = ["us-west-2a", "us-west-2b", "us-west-2c"]
+		 				database_name           = "mydb"
+		 				master_username         = "foo"
+		 				master_password         = "bar"
+		 				backup_retention_period = 5
+		 				preferred_backup_window = "07:00-09:00"
+		 			}
+		 `,
 			mustExcludeResultCode: expectedCode,
 		},
 		{
 			name: "db instance with retention greater than default passes check",
 			source: `
- 	        resource "aws_db_instance" "good_example" {
- 				allocated_storage       = 10
- 				engine                  = "mysql"
- 				engine_version          = "5.7"
- 				instance_class          = "db.t3.micro"
- 				name                    = "mydb"
- 				username                = "foo"
- 				password                = "foobarbaz"
- 				parameter_group_name    = "default.mysql5.7"
- 				backup_retention_period = 5
- 				skip_final_snapshot     = true
- 			}
- `,
+		 	        resource "aws_db_instance" "good_example" {
+		 				allocated_storage       = 10
+		 				engine                  = "mysql"
+		 				engine_version          = "5.7"
+		 				instance_class          = "db.t3.micro"
+		 				name                    = "mydb"
+		 				username                = "foo"
+		 				password                = "foobarbaz"
+		 				parameter_group_name    = "default.mysql5.7"
+		 				backup_retention_period = 5
+		 				skip_final_snapshot     = true
+		 			}
+		 `,
 			mustExcludeResultCode: expectedCode,
 		},
 		{
-			name: "db instance with which is a replica with no retention period set  passes check",
+			name: "db instance with which is a replica with no retention period set passes check",
 			source: `
- 			resource "aws_db_instance" "good_example" {
- 				allocated_storage       = 10
- 				engine                  = "mysql"
- 				engine_version          = "5.7"
- 				instance_class          = "db.t3.micro"
- 				name                    = "mydb"
- 				username                = "foo"
- 				password                = "foobarbaz"
- 				parameter_group_name    = "default.mysql5.7"
- 				backup_retention_period = 5
- 				skip_final_snapshot     = true
- 			}
- 
- 
- 	        resource "aws_db_instance" "good_example_replica" {
- 				allocated_storage       = 10
- 				engine                  = "mysql"
- 				engine_version          = "5.7"
- 				instance_class          = "db.t3.micro"
- 				name                    = "mydb"
- 				username                = "foo"
- 				password                = "foobarbaz"
- 				parameter_group_name    = "default.mysql5.7"
- 				replicate_source_db     = aws_db_instance.good_example_replica.id
- 				skip_final_snapshot     = true
- 			}
- `,
+		 			resource "aws_db_instance" "good_example" {
+		 				allocated_storage       = 10
+		 				engine                  = "mysql"
+		 				engine_version          = "5.7"
+		 				instance_class          = "db.t3.micro"
+		 				name                    = "mydb"
+		 				username                = "foo"
+		 				password                = "foobarbaz"
+		 				parameter_group_name    = "default.mysql5.7"
+		 				backup_retention_period = 5
+		 				skip_final_snapshot     = true
+		 			}
+
+		 	        resource "aws_db_instance" "good_example_replica" {
+		 				allocated_storage       = 10
+		 				engine                  = "mysql"
+		 				engine_version          = "5.7"
+		 				instance_class          = "db.t3.micro"
+		 				name                    = "mydb"
+		 				username                = "foo"
+		 				password                = "foobarbaz"
+		 				parameter_group_name    = "default.mysql5.7"
+		 				replicate_source_db     = aws_db_instance.good_example_replica.arn
+		 				skip_final_snapshot     = true
+		 			}
+		 `,
 			mustExcludeResultCode: expectedCode,
 		},
 	}
diff --git a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go
index a767f2666..dc40f48fc 100644
--- a/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go
+++ b/internal/app/tfsec/rules/aws/rds/enable_performance_insights_rule_test.go
@@ -18,10 +18,15 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
 		{
 			name: "Performance insights enabled but no kms key provided",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
-   name                 = "bar"
-   performance_insights_enabled = true
+   name                            = "bar"
+   performance_insights_enabled    = true
    performance_insights_kms_key_id = ""
+   cluster_identifier              = aws_rds_cluster.cluster1.id
  }
  `,
 			mustIncludeResultCode: expectedCode,
@@ -29,27 +34,43 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
 		{
 			name: "Performance insights disable",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
-   name                 = "bar"
+   name                         = "bar"
    performance_insights_enabled = false
+   cluster_identifier           = aws_rds_cluster.cluster1.id
  
  }
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights not mentioned",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
+	cluster_identifier   = aws_rds_cluster.cluster1.id
    
- }
+   
+}
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights enabled and kms key provided",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "foo" {
+   cluster_identifier   = aws_rds_cluster.cluster1.id
    name                 = "bar"
    performance_insights_enabled = true
    performance_insights_kms_key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
@@ -77,7 +98,7 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
  
  }
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights on aws_db_instance not mentioned",
@@ -86,7 +107,7 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
    
  }
  `,
-			mustExcludeResultCode: expectedCode,
+			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "Performance insights enabled on aws_db_instance and kms key provided",
@@ -102,11 +123,15 @@ func Test_AWSRDSPerformanceInsughtsEncryptionNotEnabled(t *testing.T) {
 		{
 			name: "Testing issue 506: error when performance insights enabled and kms included",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
  resource "aws_rds_cluster_instance" "covidshield_server_instances" {
    count                        = 3
  
    identifier           = "${var.rds_server_db_name}-instance-${count.index}"
-   cluster_identifier   = aws_rds_cluster.covidshield_server.id
+   cluster_identifier   = aws_rds_cluster.cluster1.id
    instance_class       = var.rds_server_instance_class
    db_subnet_group_name = aws_db_subnet_group.covidshield.name
  
diff --git a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go
index d878ed594..797235700 100644
--- a/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go
+++ b/internal/app/tfsec/rules/aws/rds/no_public_db_access_rule_test.go
@@ -20,41 +20,23 @@ func Test_AWSPublic(t *testing.T) {
 			source: `
  resource "aws_db_instance" "my-resource" {
  	publicly_accessible = true
- }`,
-			mustIncludeResultCode: expectedCode,
-		},
-		{
-			name: "check aws_dms_replication_instance when publicly exposed",
-			source: `
- resource "aws_dms_replication_instance" "my-resource" {
- 	publicly_accessible = true
  }`,
 			mustIncludeResultCode: expectedCode,
 		},
 		{
 			name: "check aws_rds_cluster_instance when publicly exposed",
 			source: `
+resource "aws_rds_cluster" "cluster1" {
+
+}
+
+
  resource "aws_rds_cluster_instance" "my-resource" {
+	cluster_identifier = aws_rds_cluster.cluster1.id
  	publicly_accessible = true
  }`,
 			mustIncludeResultCode: expectedCode,
 		},
-		{
-			name: "check aws_redshift_cluster when publicly exposed",
-			source: `
- resource "aws_redshift_cluster" "my-resource" {
- 	publicly_accessible = true
- }`,
-			mustIncludeResultCode: expectedCode,
-		},
-		{
-			name: "check aws_redshift_cluster when not publicly exposed",
-			source: `
- resource "aws_redshift_cluster" "my-resource" {
- 	publicly_accessible = false
- }`,
-			mustExcludeResultCode: expectedCode,
-		},
 	}
 
 	for _, test := range tests {