let dbClusters = Resources.*[
	Type == "AWS::DocDB::DBCluster"
]

rule docdb_encryption_at_rest when %dbClusters !empty {
	%dbClusters {
		Properties {
			StorageEncrypted exists <<StorageEncrypted is not configured (i.e. disabled).>>
			when StorageEncrypted exists {
				StorageEncrypted == true <<Storage Encryption is disabled.>>
			}
		}
	}
}

rule docdb_backup_retention_period when %dbClusters !empty {
	%dbClusters {
		Properties {
			BackupRetentionPeriod exists <<BackupRetentionPeriod is not configured (Default set to 1).>>
			when BackupRetentionPeriod exists {
				BackupRetentionPeriod >= 7 <<Backup Retention Period is less than 7.>>
			}
		}
	}
}

rule docdb_deletion_protection when %dbClusters !empty {
	%dbClusters {
		Properties {
			DeletionProtection exists <<DeletionProtection is not configured (i.e. disabled).>>
			when DeletionProtection exists {
				DeletionProtection == true <<Deletion Protection is disabled.>>
			}
		}
	}
}