def ec2_security_groups_with_in_use_flag(): """Returns security groups with an additional "InUse" key, which is True if it is associated with at least one resource. Possible resources: - EC2 - ELBs (v1 and v2) - RDS - Redshift - ElasticCache - ElasticSearchService - AutoScaling """ sec_groups = ec2_security_groups() in_use_sec_group_ids = defaultdict(int) # These resources have their security groups under 'SecurityGroups'. # Most of these are a list of dictionaries which include either SecurityGroupId # or GroupId, but some have just a list of group ids. resources = sum([ ec2_instances(), elbs(), elbs_v2(), elasticache_clusters(), autoscaling_launch_configurations() ], []) for resource in resources: for attached_sec_group in resource.get('SecurityGroups', []): if isinstance(attached_sec_group, dict): for key in ['SecurityGroupId', 'GroupId']: if key in attached_sec_group: in_use_sec_group_ids[attached_sec_group[key]] += 1 elif isinstance(attached_sec_group, str): in_use_sec_group_ids[attached_sec_group] += 1 else: raise Exception("Got security group value with a type of %s" % type(attached_sec_group)) # These resources have two types of security groups, therefore # the Vpc ones are namespaced under "VpcSecurityGroups" vpc_namespaced_resources = sum( [rds_db_instances(), redshift_clusters()], []) for resource in vpc_namespaced_resources: for attached_sec_group in resource.get('VpcSecurityGroups', []): in_use_sec_group_ids[attached_sec_group['VpcSecurityGroupId']] += 1 # ElasticSearchService does it a little differently for domain in elasticsearch_domains(): if 'VPCOptions' in domain: for attached_sec_group in domain['VPCOptions']['SecurityGroupIds']: in_use_sec_group_ids[attached_sec_group] += 1 for sec_group in sec_groups: if sec_group["GroupId"] in in_use_sec_group_ids.keys(): sec_group["InUse"] = True else: sec_group["InUse"] = False return sec_groups
import pytest from aws.elasticsearch.resources import elasticsearch_domains @pytest.mark.elasticsearch @pytest.mark.parametrize("es_domain", elasticsearch_domains(), ids=lambda es_domain: es_domain["ARN"]) def test_elasticsearch_domains_have_logging_enabled(es_domain): """ Tests whether an elasticsearch domain has logging enabled. """ assert (es_domain.get("LogPublishingOption") is not None), "Logging is disabled for {}".format( es_domain["DomainName"]) assert es_domain["LogPublishingOptions"]["INDEX_SLOW_LOGS"][ "Enabled"], "Index Slow Logs are disabled for {}".format( es_domain["DomainName"]) assert es_domain["LogPublishingOptions"]["SEARCH_SLOW_LOGS"][ "Enabled"], "Search Slow Logs are disabled for {}".format( es_domain["DomainName"])