ensure cis

Overview

defined type pg_secured::ensure_cis

Apply all Postgres database CIS control to the specified database

Here is an example showing how to enable the CIS bencgmark for your database.:

pg_secured::ensure_cis { 'DBNAME':
  product_version => 'pg14',
  doc_version     => 'V1.0.0',
}

When you don’t specify the doc_version, puppet automatically uses the latest version for your current product_version. If you also don’t specify a product_version, Puppet will detect the version of Postgres running and use this to determine the product_version. There is, however, one issue with the detection. On an initial run Puppet canot determine what the Postgres version is. In that case, the pg_secured defined type will skip applying the CIS benchmark and wait until (hopefully) the next run the version of Postgres for specified database is available.

When you want to skip certain controls, you can use the skip_list.

pg_secured::ensure_cis { 'DBNAME':
  product_version => 'pg14',
  doc_version     => 'V1.0.0',
  skip_list       => [
    'log_disconnections_is_enabled',
    'log_destinations_are_set_correctly',
  ]
}

When you have multiple database on your system and want to use the same database version and CIS document version, you can do this:

pg_secured::Ensure_cis {
  product_version => 'pg14',
  doc_version     => 'V1.0.0',
  skip_list       => [
    'log_disconnections_is_enabled',
    'log_destinations_are_set_correctly',
  ]
}

pg_secured::ensure_cis {'DB1':}
pg_secured::ensure_cis {'DB2':}

Attributes

title

The database to apply the control to.

The CIS benchmark need an database to apply the controls to. Here is a simple example:

pg_secured { 'DB':}

In this example, the string DB is the database to apply the controls to.

Back to overview of ensure_cis

product_version

The database version of the CIS benchmark you want to apply. Although not very logical, you can apply an older (or newer) database version to your database.

If you also don’t specify a product_version, Puppet will detect the version of Postgres running and use this to determine the product_version. There is, however, one issue with the detection. On an initial run Puppet canot determine what the Postgres version is. In that case, the pg_secured defined type will skip applying the CIS benchmark and wait until (hopefully) the next run the version of Postgres for specified database is available.

Type: Optional[String[1]]

Default:pg_secured::default_product_version($title)

Back to overview of ensure_cis

doc_version

The version of the CIS benchmark you want to apply to your database. When you don’t specify the doc_version, puppet automatically uses the latest version for your current product_version. Type: Optional[String[1]]

Default:pg_secured::default_doc_version($product_version, 'pg14')

Back to overview of ensure_cis

all_controls

This is an internal parameter. This is the Hash containing all paragraphs from the selected CIS benchmark.

Back to overview of ensure_cis

skip_list

This is the list of controls that you want to skip. By default this vale is empty, meaning pg_secured will apply ALL controls. You must specifiy the name of the control. Here is an example on how to do this:

pg_secured { 'MYDB':
  product_version => 'pg14',
  doc_version     => 'V1.0.0',
  skip_list       => [
    'log_file_destination_directory_is_set_correctly',
    'filename_pattern_for_log_files_is_set_correctly',
  ]
}

Type: Array

Default:pg_secured::lookup_setting('skip_list', [])

Back to overview of ensure_cis