@infrascan/aws-rds-scanner

A scanner module for AWS RDS, designed to be used with the @infrascan/sdk.

This module pulls information about the RDS resources in an AWS account by calling: DescribeDBInstances, DescribeDBClusters, DescribeDBSubnetGroups, DescribeDBProxies, DescribeDBProxyTargets (per proxy), and DescribeGlobalClusters.

The scanning role needs the matching IAM permissions: rds:DescribeDBInstances, rds:DescribeDBClusters, rds:DescribeDBSubnetGroups, rds:DescribeDBProxies, rds:DescribeDBProxyTargets and rds:DescribeGlobalClusters.

It produces the following nodes:

| Node type | ID | Parent | | -------------------- | ---------------------- | ---------------------------------------------------------- | | rds-instance | DBInstanceIdentifier | Its DB cluster when it belongs to one, otherwise the region | | rds-cluster | DBClusterArn | Region | | rds-proxy | DBProxyArn | Region | | rds-global-cluster | GlobalClusterArn | Account |

Clusters cover Aurora (provisioned, Serverless v1 and v2) and non-Aurora Multi-AZ DB clusters. VPC, subnet and security group placement is recorded in each node's network component (cluster subnets are resolved through DescribeDBSubnetGroups). Secrets Manager secrets (cluster MasterUserSecret, proxy auth) and KMS keys are recorded on the node's state, but no edges are drawn to them.

And the following edges:

• DB cluster → member instance (labelled writer/reader)
• RDS Proxy → target DB cluster, or → target DB instance for proxies in front of a standalone instance
• Global cluster → regional member clusters (labelled primary/secondary)

Quickstart

import RDSScanner from "@infrascan/aws-rds-scanner";
import Infrascan from "@infrascan/sdk";

const infrascanClient = new Infrascan();
infrascanClient.registerScanner(RDSScanner);

If you plan on scanning all of an AWS account, you should use the @infrascan/aws package.

Contributing

The majority of the scanner modules are autogenerated from their config.ts file.

Changes such as adding a new function/endpoint in the service to scan can be done within the config file. Entities live in src/graph, and edges are hand-written in src/edges.ts.

More significant changes will likely need to take place in the aws-codegen package.