Update RDS Policies (tenable#1424)

* fix cloudwatch log export policy

* add backup retention policy

pkg/policies/opa/rego/aws/aws_db_instance/AC_AWS_0052.json

@@ -0,0 +1,17 @@
+{
+    "name": "rdsBackupDisabled",
+    "file": "rdsBackupDisabled.rego",
+    "policy_type": "aws",
+    "resource_type": "aws_db_instance",
+    "template_args": {
+        "prefix": "",
+        "name": "rdsBackupDisabled",
+        "suffix": ""
+    },
+    "severity": "HIGH",
+    "description": "Ensure automated backups are enabled for AWS RDS instances",
+    "reference_id": "AC_AWS_0052",
+    "category": "Data Protection",
+    "id": "AC_AWS_0052",
+    "version": 2
+}

pkg/policies/opa/rego/aws/aws_db_instance/AWS.ADI.LM.MEDIUM.0076.json

@@ -1,13 +1,15 @@
 {
-    "name": "dbInstanceLoggingDisabled",
-    "file": "dbInstanceLoggingDisabled.rego",
+    "name": "rdsLogExportDisabled",
+    "file": "rdsLogExportDisabled.rego",
     "policy_type": "aws",
     "resource_type": "aws_db_instance",
     "template_args": {
-        "prefix": ""
+        "prefix": "",
+        "name": "rdsLogExportDisabled",
+        "suffix": ""
     },
     "severity": "MEDIUM",
-    "description": "Ensure AWS RDS instances have logging enabled.",
+    "description": "Ensure CloudWatch logging is enabled for AWS DB instances",
     "reference_id": "AWS.ADI.LM.MEDIUM.0076",
     "category": "Logging and Monitoring",
     "id": "AC_AWS_0454",

pkg/policies/opa/rego/aws/aws_db_instance/rdsBackupDisabled.rego

@@ -0,0 +1,9 @@
+package accurics
+
+{{.prefix}}{{.name}}{{.suffix}}[retVal] {
+    backup := input.aws_db_instance[_]
+    object.get(backup.config, "backup_retention_period", "undefined") == ["undefined", null, 0, []][_]
+
+    traverse = "backup_retention_period"
+    retVal := { "Id": backup.id, "ReplaceType": "add", "CodeType": "attribute", "Traverse": traverse, "Attribute": "backup_retention_period", "AttributeDataType": "int", "Expected": 30, "Actual": null }
+}

pkg/policies/opa/rego/aws/aws_db_instance/rdsLogExportDisabled.rego

@@ -0,0 +1,6 @@
+package accurics
+
+{{.prefix}}{{.name}}{{.suffix}}[db_instance.id] {
+    db_instance := input.aws_db_instance[_]
+    object.get(db_instance.config, "enabled_cloudwatch_logs_exports", "undefined") == ["undefined", [], null][_]
+}