#!/bin/sh

# shellcheck disable=SC1090
# shellcheck disable=SC2034
# shellcheck disable=SC2154

# audit_aws_ec
#
# Check AWS ElastiCache
#
# Refer to https://www.cloudconformity.com/conformity-rules/ElastiCache/elasticache-multi-az.html
#.

audit_aws_ec () {
  print_function  "audit_aws_ec"
  check_message   "ElastiCache"
  command="aws elasticache describe-replication-groups --region \"${aws_region}\" --query 'ReplicationGroups[].ReplicationGroupId' --output text"
  command_message "${command}"
  caches=$( eval  "${command}" )
  for cache in ${caches}; do 
    command="aws elasticache describe-replication-groups --region \"${aws_region}\" --replication-group-id \"${cache}\" --query 'ReplicationGroups[].AutomaticFailover' | grep enabled"
    command_message "${command}"
    check=$( eval   "${command}" )
    if [ -n "${check}" ]; then
      inc_secure   "ElastiCache \"${cache}\" is Multi-AZ enabled"
    else
      inc_insecure "ElastiCache \"${cache}\" is not Multi-AZ enabled"
      lock_command="aws elasticache modify-replication-group --region ${aws_region} --replication-group-id ${cache} --automatic-failover-enabled --apply-immediately"
      lock_message="ElastiCache \"${cache}\" Multi-AZ to enabled"
      run_lockdown "${lock_command}" "${lock_message}" "sudo"
    fi
  done
}

