Not a requirement but to provide more meaningful output in the cli, maybe these controls can have a statement after skip:

• SV-235095
• SV-235098
• SV-235102
• SV-235105
• SV-235106
• SV-235107
• SV-235108
• SV-235109
• SV-235110
• SV-235111
• SV-235112
• SV-235113
• SV-235114
• SV-235115
• SV-235116
• SV-235117
• SV-235118
• SV-235119
• SV-235120
• SV-235121
• SV-235122
• SV-235123
• SV-235124
• SV-235125
• SV-235126
• SV-235127
• SV-235128
• SV-235129
• SV-235130
• SV-235131
• SV-235132
• SV-235133
• SV-235140
• SV-235141
• SV-235142
• SV-235147
• SV-235149
• SV-235151
• SV-235152
• SV-235153
• SV-235156
• SV-235157
• SV-235163
• SV-235164
• SV-235165
• SV-235166
• SV-235170
• SV-235171
• SV-235172
• SV-235173
• SV-235174
• SV-235175
• SV-235176
• SV-235177
• SV-235178
• SV-235182
• SV-235183
• SV-235184
• SV-235185
• SV-235195

Current code:

  describe 'List of users who have been delegated the right to grant permissions to other users' do
    subject { sql_session.query(query_admin_grantees).results.column('grantee') }
    it { should be_in mysql_administrative_grantees }
  end

Current output:

Proposed code:

  all_grantees = sql_session.query(query_admin_grantees).results.rows
  unathorized_grantees = (sql_session.query(query_admin_grantees).results.column('grantee')).uniq

  describe 'Users who have been delegated the right to grant permissions to other users' do
    it "should be in the list of authorized users" do
      unathorized_grantees.each do |current_grantee|
        privileges = []
        all_grantees.each { |priv| priv.grantee == current_grantee ? privileges << priv.privilege_type : next }
        failure_message = "Unauthorized user: #{current_grantee} with privileges: #{privileges}"
        expect(current_grantee).to be_in mysql_administrative_grantees, failure_message
      end
    end
  end

Output:

Note: Find a way to output the privileges assigned to the unauthorized users - the failure_message above isn't being displayed in the output. (Cause?)

Using a describe block like this:

describe <resource> do
  it { should match /1|ON/ }
end

Returns a result that might be hard to read to some users:

Using describe.one and splitting the tests in two would provide a cleaner result. Here are the controls currently using the match <regex> approach.

• SV-235134
• SV-235135
• SV-235139
• SV-235148
• SV-235154
• SV-235158
• SV-235186
• SV-235187
• SV-235188
• SV-235189
• SV-235190

It looks like the check text is looking for the keyword menagerie but the test is looking for keyword menager

Based on the check text for default_password_lifetime, it seems like the following values are required:

• Max password lifetime for interactive accounts = 60 days
• Max password lifetime for non-interactive accounts = 365 days

There are 2 examples (in the check and the fix text) that are different than the requirements listed above.

I believe the value on this line should be changed from 180 to 60

This section in the control seems to require a minimum password lifetime of 24 hours (bullets a and b). I'm currently unable to find the parameter to set this value in the MySQL docs - is that why the test is missing for this requirement?

From the two describe blocks, the first block leads to the following output:

To address it, I think the describe block can either access the value within the array before comparing it
OR change the matcher to include?

The base resource, mysql, can be enhanced to identify if the target is an AWS RDS instance. This will allow us to set AWS RDS defaults right in the resource.

Also, consider moving the logic from the local library mysql_session into the InSpec resource pack.

Not sure but the check and fix text seem to require more stringent permissions for mysqld-auto.cnf. Should the value in this describe block be changed from 0644 to 0640?

Find out if the ALTER statements can be implemented to remediate a finding from these controls. Check on both locally hosted and an AWS RDS instance. Provide exceptions accordingly.

During https://github.com/mitre/oracle-mysql-8-stig-baseline/pull/20/files#diff-1eaf735846ca498a34dd69d5819a48481b2b263566d57c780ca9db631552db09, I inadvertently muted the 4 later tests out of the total 5 in SV-235134 when in hosted mode. Need to allow them to run during !aws_rds mode.