⭐️ improve rds resource

[chris-rock]

after #4526

The AWS RDS aws.rds.instances resource is handy to quickly see the RDS instances, their engines and engine version:

aws.rds.instances: [
  0: aws.rds.dbinstance id="database-1" region="us-east-1" engine="postgres" engineVersion="16.4"
  1: aws.rds.dbinstance id="database-2" region="us-east-1" engine="sqlserver-ex" engineVersion="15.00.4382.1.v1"
  2: aws.rds.dbinstance id="database-2-instance-1" region="us-east-1" engine="aurora-postgresql" engineVersion="15.4"
  3: aws.rds.dbinstance id="database-3" region="us-east-1" engine="postgres" engineVersion="11.22-rds.20240418"
  4: aws.rds.dbinstance id="docdb-2024-08-11-08-16-54" region="us-east-1" engine="docdb" engineVersion="5.0.0"
]

With this PR we extend the existing resource to become even more useful to verify that your RDS databases are configured correctly.

Certificate configuration

To ensure you have enabled certificate authentication you can check now if a certificateAuthority was attached

aws.rds.instances.all(certificateAuthority != empty)

Check if RDS databases is using IAM authentication

MQL now exposes a new field iamDatabaseAuthentication. This is handy when you want to verify that all database instances need to use IAM authentication:

aws.rds.instances.all(iamDatabaseAuthentication)

Expose activity stream mode

The new exposed activityStreamStatus field allows us to quickly verify that all aurora instances have an active activity stream:

aws.rds.instances.all(activityStreamStatus == "started")

expose status for cluster and instance

The new status field allows you to quickly verify if all instances are available:

cnspec> aws.rds.instances { id status }
aws.rds.instances: [
  0: {
    status: "available"
    id: "database-1"
  }
  1: {
    status: "available"
    id: "database-2"
  }
  2: {
    status: "available"
    id: "database-2-instance-1"
  }
  3: {
    status: "available"
    id: "database-3"
  }
  4: {
    status: "available"
    id: "docdb-2024-08-11-08-16-54"
  }
]

To check that all are available, just use:

cnspec> aws.rds.instances.all(status == "available")
[ok] value: true

Pending maintenance actions

It is often important to know that all databases are properly maintained. While AWS abstracts a lot of maintaince into RDS service, the engine may need an upgrade that leads to a downtime of the database. You can easily verify that no maintenance actions are open:

// global for all rds instances
aws.rds.allPendingMaintenanceActions == empty

You can also see individual maintenance actions for individual instances:

cnspec> aws.rds.instances { id pendingMaintenanceActions}
aws.rds.instances: [
  0: {
    pendingMaintenanceActions: []
    id: "database-1"
  }
  1: {
    pendingMaintenanceActions: []
    id: "database-2"
  }
  2: {
    pendingMaintenanceActions: []
    id: "database-2-instance-1"
  }
  3: {
    pendingMaintenanceActions: []
    id: "database-3"
  }
  4: {
    pendingMaintenanceActions: []
    id: "docdb-2024-08-11-08-16-54"
  }
]

expose AWS RDS instance monitoring interval

With the enhancedMonitoringResourceArn field and monitoringInterval you verify that all databases have enhanced monitoring enabled and a monitoring interval is set

cnspec> aws.rds.instances.all(enhancedMonitoringResourceArn != empty && monitoringInterval > 0)
[failed] [].all()
  actual:   [
    0: aws.rds.dbinstance engineVersion="15.00.4382.1.v1" region="us-east-1" engine="sqlserver-ex" id="database-2" {
      monitoringInterval: 0
      enhancedMonitoringResourceArn: null
    }
    1: aws.rds.dbinstance engineVersion="11.22-rds.20240418" region="us-east-1" engine="postgres" id="database-3" {
      monitoringInterval: 0
      enhancedMonitoringResourceArn: null
    }
    2: aws.rds.dbinstance engineVersion="5.0.0" region="us-east-1" engine="docdb" id="docdb-2024-08-11-08-16-54" {
      monitoringInterval: 0
      enhancedMonitoringResourceArn: null
    }
  ]

expose AWS RDS network type

To see which network types the databases use, we added a new networkType field to the instances and clusters:

cnspec> aws.rds.instances { id engine networkType }
aws.rds.instances: [
  0: {
    networkType: "IPV4"
    engine: "postgres"
    id: "database-1"
  }
  1: {
    networkType: "IPV4"
    engine: "sqlserver-ex"
    id: "database-2"
  }
  2: {
    networkType: "IPV4"
    engine: "aurora-postgresql"
    id: "database-2-instance-1"
  }
  3: {
    networkType: "IPV4"
    engine: "postgres"
    id: "database-3"
  }
  4: {
    networkType: "IPV4"
    engine: "docdb"
    id: "docdb-2024-08-11-08-16-54"
  }
]

[github-actions]

Test Results

3 097 tests  ±0   3 096 ✅ ±0   1m 22s ⏱️ -6s
  370 suites ±0       1 💤 ±0 
   28 files   ±0       0 ❌ ±0 

Results for commit 4145873. ± Comparison against base commit 0b3b6c9.

♻️ This comment has been updated with latest results.

[preslavgerchev]

some small renaming suggestions