let neptune_dbclusters = Resources.*[
	Type == "AWS::Neptune::DBCluster"
]

rule neptune_encryption_at_rest when %neptune_dbclusters !empty {
	%neptune_dbclusters {
		Properties {
			StorageEncrypted exists <<StorageEncrypted is not configured. (i.e. disabled)>>
			when StorageEncrypted exists {
				StorageEncrypted == true <<StorageEncrypted is disabled.>>
			}
		}
	}
}

rule neptune_audit_logs_enabled when %neptune_dbclusters !empty {
	%neptune_dbclusters {
		Properties {
			EnableCloudwatchLogsExports exists <<EnableCloudwatchLogsExports is not configured. (i.e. disabled)>>
			when EnableCloudwatchLogsExports exists {
				some EnableCloudwatchLogsExports[*] == "audit" <<Audit logs is disabled.>>
			}
		}
	}
}

rule neptune_backup_retention_period when %neptune_dbclusters !empty {
	%neptune_dbclusters {
		Properties {
			BackupRetentionPeriod exists <<BackupRetentionPeriod is not configured. (i.e. default is 1)>>
			when BackupRetentionPeriod exists {
				BackupRetentionPeriod >= 7 <<BackupRetentionPeriod is set to less than 7 days.>>
			}
		}
	}
}

rule neptune_deletion_protection when %neptune_dbclusters !empty {
	%neptune_dbclusters {
		Properties {
			DeletionProtection exists <<DeletionProtection is not configured. (i.e. disabled)>>
			when DeletionProtection exists {
				DeletionProtection == true <<DeletionProtection is disabled.>>
			}
		}
	}
}