Skip to content
This repository has been archived by the owner on Sep 17, 2021. It is now read-only.

Commit

Permalink
Merge pull request #419 from Netflix/rds_sg_index
Browse files Browse the repository at this point in the history 
Auditor will now fix any issues that are not attached to an AuditorSetting
  • Loading branch information
Patrick Kelley authored Sep 23, 2016
2 parents cf8324b + ed2872d commit 0c82202
Show file tree
Hide file tree
Showing 3 changed files with 19 additions and 2 deletions.
4 changes: 4 additions & 0 deletions security_monkey/auditor.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,10 @@ def save_issues(self):
existing_issues = list(item.db_item.issues)
new_issues = item.audit_issues

for issue in item.db_item.issues:
if not issue.auditor_setting:
self._set_auditor_setting_for_issue(issue)

# Add new issues
old_scored = ["{} -- {} -- {} -- {}".format(
old_issue.auditor_setting.auditor_class,
Expand Down
16 changes: 15 additions & 1 deletion security_monkey/datastore.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,18 @@ def store(self, ctype, region, account, name, active_flag, config, arn=None, new
"""
item = self._get_item(ctype, region, account, name)

if arn:
duplicate_arns = Item.query.filter(Item.arn == arn).all()
for duplicate_item in duplicate_arns:
if duplicate_item.id != item.id:
duplicate_item.arn = None
app.logger.info("Moving ARN {arn} from {duplicate} to {item}".format(
arn=arn,
duplicate=duplicate_item.name,
item=item.name
))
db.session.add(duplicate_item)

if arn:
item.arn = arn

Expand Down Expand Up @@ -517,10 +529,12 @@ def _get_item(self, technology, region, account, name):
technology_result = Technology(name=technology)
db.session.add(technology_result)
db.session.commit()
#db.session.close()
app.logger.info("Creating a new Technology: {} - ID: {}"
.format(technology, technology_result.id))
item = Item(tech_id=technology_result.id, region=region, account_id=account_result.id, name=name)
db.session.add(item)
db.session.commit()
db.session.refresh(item)
return item


Expand Down
1 change: 0 additions & 1 deletion security_monkey/reporter.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,6 @@ def run(self, account, interval=None):
time1 = time.time()
for monitor in self.get_watchauditors(account, interval):
app.logger.info("Running {} for {} ({} minutes interval)".format(monitor.watcher.i_am_singular, account, interval))
value = monitor.watcher.slurp()
(items, exception_map) = monitor.watcher.slurp()
monitor.watcher.find_changes(current=items, exception_map=exception_map)
items_to_audit = [item for item in monitor.watcher.created_items + monitor.watcher.changed_items]
Expand Down

2 comments on commit 0c82202

@sho3hit
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please explain , what's going on above .....

@scriptsrc
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gitshbhts - Hopefully this answers the question:

  1. If the auditor finds an issue that does not have an auditor_setting attached, it will fix it:
       for issue in item.db_item.issues:
            if not issue.auditor_setting:
                self._set_auditor_setting_for_issue(issue)
  1. If we determine we need to create an item, create it immediately and we'll add ARN and other fields later.
          item = Item(tech_id=technology_result.id, region=region, account_id=account_result.id, name=name)
          db.session.add(item)
          db.session.commit()
          db.session.refresh(item)
  1. If the watcher is saving an item, and determines another item has been assigned the same ARN, it will move the ARN to the new item:
   if arn:
        duplicate_arns = Item.query.filter(Item.arn == arn).all()
        for duplicate_item in duplicate_arns:
            if duplicate_item.id != item.id:
                duplicate_item.arn = None
                app.logger.info("Moving ARN {arn} from {duplicate} to {item}".format(
                    arn=arn,
                    duplicate=duplicate_item.name,
                    item=item.name
                ))
                db.session.add(duplicate_item)

This is possible in situations where someone renames a subnet. The ARN is the same, and the database enforces that ARNs are unique. To fix the conflict, we just move the ARN over to the new item.

  1. slurp() was being called twice. I removed the extra call.
         value = monitor.watcher.slurp()        
          (items, exception_map) = monitor.watcher.slurp()

Please sign in to comment.