@Test public void executeFixTest()throws Exception{ ElasticsearchDomainStatus emptyDomainStatus = new ElasticsearchDomainStatus(); emptyDomainStatus.setDomainId("123"); emptyDomainStatus.setAccessPolicies("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"es:*\",\"Resource\":\"123\"}]}"); DescribeElasticsearchDomainResult domainResult = new DescribeElasticsearchDomainResult(); domainResult.setDomainStatus(CommonTestUtils.getElasticsearchDomainStatus()); DescribeElasticsearchDomainResult emptyDdomainResult = new DescribeElasticsearchDomainResult(); emptyDdomainResult.setDomainStatus(CommonTestUtils.getElasticsearchDomainStatus()); mockStatic(PublicAccessAutoFix.class); Map<String,Object> ec2Map=new HashMap<String, Object>(); ec2Map.put("client", amazonEC2); when(PublicAccessAutoFix.getAWSClient(anyString(),anyObject(),anyString())).thenReturn(ec2Map); Map<String,Object> elasticSearch=new HashMap<String, Object>(); elasticSearch.put("client", elasticsearch); ElasticSearchPublicAccessAutoFix spy = Mockito.spy(new ElasticSearchPublicAccessAutoFix()); Mockito.doReturn(elasticSearch).when((BaseFix)spy).getClientFor(anyObject(), anyString(), anyObject()); when(PublicAccessAutoFix.getDomainStatusForEsResource(anyObject(),anyObject())).thenReturn(CommonTestUtils.getElasticsearchDomainStatus()); when(elasticsearch.describeElasticsearchDomain(anyObject())).thenReturn(domainResult); when(PublicAccessAutoFix.isEsHavingPublicAccess(anyObject(),anyString())).thenReturn(true); spy.executeFix(CommonTestUtils.getMapString("r_123 "), elasticSearch, CommonTestUtils.getMapString("r_123 ")); VPCDerivedInfo vPCOptions = new VPCDerivedInfo(); vPCOptions.setSecurityGroupIds(Arrays.asList("123")); ElasticsearchDomainStatus domainStatusEmpty = new ElasticsearchDomainStatus(); domainStatusEmpty.setDomainId("123"); domainStatusEmpty.setVPCOptions(vPCOptions); domainStatusEmpty.setAccessPolicies("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"es:*\",\"Resource\":\"123\"}]}"); DescribeElasticsearchDomainResult domainEmptyResult = new DescribeElasticsearchDomainResult(); domainEmptyResult.setDomainStatus(domainStatusEmpty); when(PublicAccessAutoFix.getDomainStatusForEsResource(anyObject(),anyObject())).thenReturn(CommonTestUtils.getWithoutEndPOintElasticsearchDomainStatus()); when(PublicAccessAutoFix.getExistingSecurityGroupDetails(anyObject(),anyObject())).thenReturn(CommonTestUtils.getSecurityGroupIdList()); when(PublicAccessAutoFix.nestedSecurityGroupDetails(anyString(),anyObject(),anyObject(),anyObject(),anyObject(),anyInt())).thenReturn(CommonTestUtils.getSetString("123")); when(PublicAccessAutoFix.createSecurityGroup(anyString(),anyString(),anyObject(),anyObject(),anyString(),anyString(),anyObject())).thenReturn("123"); when(PublicAccessAutoFix.applySecurityGroupsToAppELB(anyObject(),anyObject(),anyString())).thenReturn(true); spy.executeFix(CommonTestUtils.getMapString("r_123 "), elasticSearch, CommonTestUtils.getMapString("r_123 ")); when(PublicAccessAutoFix.getAWSClient(anyString(),anyObject(),anyString())).thenThrow(new Exception()); }
@Override public FixResult executeFix(Map<String, String> issue, Map<String, Object> clientMap, Map<String, String> ruleParams) { afterAutoFixSg = null; String resourceId = issue.get("resourceDisplayId"); String defaultCidrIp = ruleParams.get("defaultCidrIp"); String cidrIp = ruleParams.get("cidrIp"); String accessPolicies = null; String denyAccessPolicy = null; JsonArray statments = new JsonArray(); Map<String, Object> ec2ClinetMap = null; List<SecurityGroup> securityGroupsDetails = null; AmazonEC2 ec2Client = null; String securityGroupId = null; Collection<IpPermission> ipPermissionsToBeAdded = null; Gson serializer = new GsonBuilder().create(); try { UpdateElasticsearchDomainConfigRequest domainConfigRequest = new UpdateElasticsearchDomainConfigRequest(); AWSElasticsearch awsElasticsearch = (AWSElasticsearch) clientMap.get("client"); ElasticsearchDomainStatus domainStatus = PublicAccessAutoFix.getDomainStatusForEsResource(clientMap, resourceId); String endPoint = domainStatus.getEndpoint(); if (!StringUtils.isEmpty(endPoint)) { accessPolicies = domainStatus.getAccessPolicies(); JsonObject accessPoliciesJson = serializer.fromJson(accessPolicies, JsonObject.class); if (accessPoliciesJson.has("Statement")) { statments = accessPoliciesJson.get("Statement").getAsJsonArray(); if (PublicAccessAutoFix.isEsHavingPublicAccess(statments,cidrIp)) { denyAccessPolicy = accessPolicies.replace("Allow", "Deny"); domainConfigRequest.setAccessPolicies(denyAccessPolicy); domainConfigRequest.setDomainName(resourceId); awsElasticsearch.updateElasticsearchDomainConfig(domainConfigRequest); afterPolicyAutoFix = denyAccessPolicy; } } }else{ ec2ClinetMap = PublicAccessAutoFix.getAWSClient("ec2", issue, CommonUtils.getPropValue(PacmanSdkConstants.AUTO_FIX_ROLE_NAME)); List<String> securityGroupsTobeApplied = new ArrayList<>(); VPCDerivedInfo vpcDerivedInfo = domainStatus.getVPCOptions(); List<String> securityGroupNames = vpcDerivedInfo.getSecurityGroupIds(); Set<String> securityGroupsSet = new HashSet<>(securityGroupNames); Set<String> alreadyCheckedSgSet = new HashSet<>(); if (ec2ClinetMap != null) { ec2Client = (AmazonEC2) ec2ClinetMap.get("client"); securityGroupsDetails = PublicAccessAutoFix.getExistingSecurityGroupDetails(securityGroupsSet, ec2Client); } String vpcid; Set<String> publiclyAccessible = new HashSet<>(); boolean isSgApplied = false; for (SecurityGroup securityGroup : securityGroupsDetails) { ipPermissionsToBeAdded = new ArrayList<>(); publiclyAccessible = new HashSet<>(); vpcid = securityGroup.getVpcId(); securityGroupId = securityGroup.getGroupId(); PublicAccessAutoFix.nestedSecurityGroupDetails(securityGroupId, ipPermissionsToBeAdded, ec2Client, publiclyAccessible,alreadyCheckedSgSet,0); if (!publiclyAccessible.isEmpty()) { String createdSgId = PublicAccessAutoFix.createSecurityGroup(securityGroupId, vpcid,ec2Client, ipPermissionsToBeAdded,resourceId,defaultCidrIp,securityGroup.getIpPermissions()); if(!StringUtils.isEmpty(createdSgId)){ securityGroupsTobeApplied.add(createdSgId); } } else { securityGroupsTobeApplied.add(securityGroupId); } } if (!securityGroupsTobeApplied.isEmpty()) { isSgApplied = PublicAccessAutoFix.applySecurityGroupsToElacticSearch(awsElasticsearch, securityGroupsTobeApplied, resourceId, domainConfigRequest); afterAutoFixSg = securityGroupsTobeApplied.toString(); } if (isSgApplied) { LOGGER.info("{} sg's successfully applied for the resource {}",securityGroupsTobeApplied, resourceId); } } } catch (Exception e) { LOGGER.error("Error in elastic public access autofix",e); throw new RuntimeException(e.getMessage()); } return new FixResult(PacmanSdkConstants.STATUS_SUCCESS_CODE,"the elasticsearch "+resourceId+" is now fixed"); }
ElasticSearchPublicAccessAutoFix extends BaseFix { @Override public FixResult executeFix(Map<String, String> issue, Map<String, Object> clientMap, Map<String, String> ruleParams) { afterAutoFixSg = null; String resourceId = issue.get("resourceDisplayId"); String defaultCidrIp = ruleParams.get("defaultCidrIp"); String cidrIp = ruleParams.get("cidrIp"); String accessPolicies = null; String denyAccessPolicy = null; JsonArray statments = new JsonArray(); Map<String, Object> ec2ClinetMap = null; List<SecurityGroup> securityGroupsDetails = null; AmazonEC2 ec2Client = null; String securityGroupId = null; Collection<IpPermission> ipPermissionsToBeAdded = null; Gson serializer = new GsonBuilder().create(); try { UpdateElasticsearchDomainConfigRequest domainConfigRequest = new UpdateElasticsearchDomainConfigRequest(); AWSElasticsearch awsElasticsearch = (AWSElasticsearch) clientMap.get("client"); ElasticsearchDomainStatus domainStatus = PublicAccessAutoFix.getDomainStatusForEsResource(clientMap, resourceId); String endPoint = domainStatus.getEndpoint(); if (!StringUtils.isEmpty(endPoint)) { accessPolicies = domainStatus.getAccessPolicies(); JsonObject accessPoliciesJson = serializer.fromJson(accessPolicies, JsonObject.class); if (accessPoliciesJson.has("Statement")) { statments = accessPoliciesJson.get("Statement").getAsJsonArray(); if (PublicAccessAutoFix.isEsHavingPublicAccess(statments,cidrIp)) { denyAccessPolicy = accessPolicies.replace("Allow", "Deny"); domainConfigRequest.setAccessPolicies(denyAccessPolicy); domainConfigRequest.setDomainName(resourceId); awsElasticsearch.updateElasticsearchDomainConfig(domainConfigRequest); afterPolicyAutoFix = denyAccessPolicy; } } }else{ ec2ClinetMap = PublicAccessAutoFix.getAWSClient("ec2", issue, CommonUtils.getPropValue(PacmanSdkConstants.AUTO_FIX_ROLE_NAME)); List<String> securityGroupsTobeApplied = new ArrayList<>(); VPCDerivedInfo vpcDerivedInfo = domainStatus.getVPCOptions(); List<String> securityGroupNames = vpcDerivedInfo.getSecurityGroupIds(); Set<String> securityGroupsSet = new HashSet<>(securityGroupNames); Set<String> alreadyCheckedSgSet = new HashSet<>(); if (ec2ClinetMap != null) { ec2Client = (AmazonEC2) ec2ClinetMap.get("client"); securityGroupsDetails = PublicAccessAutoFix.getExistingSecurityGroupDetails(securityGroupsSet, ec2Client); } String vpcid; Set<String> publiclyAccessible = new HashSet<>(); boolean isSgApplied = false; for (SecurityGroup securityGroup : securityGroupsDetails) { ipPermissionsToBeAdded = new ArrayList<>(); publiclyAccessible = new HashSet<>(); vpcid = securityGroup.getVpcId(); securityGroupId = securityGroup.getGroupId(); PublicAccessAutoFix.nestedSecurityGroupDetails(securityGroupId, ipPermissionsToBeAdded, ec2Client, publiclyAccessible,alreadyCheckedSgSet,0); if (!publiclyAccessible.isEmpty()) { String createdSgId = PublicAccessAutoFix.createSecurityGroup(securityGroupId, vpcid,ec2Client, ipPermissionsToBeAdded,resourceId,defaultCidrIp,securityGroup.getIpPermissions()); if(!StringUtils.isEmpty(createdSgId)){ securityGroupsTobeApplied.add(createdSgId); } } else { securityGroupsTobeApplied.add(securityGroupId); } } if (!securityGroupsTobeApplied.isEmpty()) { isSgApplied = PublicAccessAutoFix.applySecurityGroupsToElacticSearch(awsElasticsearch, securityGroupsTobeApplied, resourceId, domainConfigRequest); afterAutoFixSg = securityGroupsTobeApplied.toString(); } if (isSgApplied) { LOGGER.info("{} sg's successfully applied for the resource {}",securityGroupsTobeApplied, resourceId); } } } catch (Exception e) { LOGGER.error("Error in elastic public access autofix",e); throw new RuntimeException(e.getMessage()); } return new FixResult(PacmanSdkConstants.STATUS_SUCCESS_CODE,"the elasticsearch "+resourceId+" is now fixed"); } }
ElasticSearchPublicAccessAutoFix extends BaseFix { @Override public FixResult executeFix(Map<String, String> issue, Map<String, Object> clientMap, Map<String, String> ruleParams) { afterAutoFixSg = null; String resourceId = issue.get("resourceDisplayId"); String defaultCidrIp = ruleParams.get("defaultCidrIp"); String cidrIp = ruleParams.get("cidrIp"); String accessPolicies = null; String denyAccessPolicy = null; JsonArray statments = new JsonArray(); Map<String, Object> ec2ClinetMap = null; List<SecurityGroup> securityGroupsDetails = null; AmazonEC2 ec2Client = null; String securityGroupId = null; Collection<IpPermission> ipPermissionsToBeAdded = null; Gson serializer = new GsonBuilder().create(); try { UpdateElasticsearchDomainConfigRequest domainConfigRequest = new UpdateElasticsearchDomainConfigRequest(); AWSElasticsearch awsElasticsearch = (AWSElasticsearch) clientMap.get("client"); ElasticsearchDomainStatus domainStatus = PublicAccessAutoFix.getDomainStatusForEsResource(clientMap, resourceId); String endPoint = domainStatus.getEndpoint(); if (!StringUtils.isEmpty(endPoint)) { accessPolicies = domainStatus.getAccessPolicies(); JsonObject accessPoliciesJson = serializer.fromJson(accessPolicies, JsonObject.class); if (accessPoliciesJson.has("Statement")) { statments = accessPoliciesJson.get("Statement").getAsJsonArray(); if (PublicAccessAutoFix.isEsHavingPublicAccess(statments,cidrIp)) { denyAccessPolicy = accessPolicies.replace("Allow", "Deny"); domainConfigRequest.setAccessPolicies(denyAccessPolicy); domainConfigRequest.setDomainName(resourceId); awsElasticsearch.updateElasticsearchDomainConfig(domainConfigRequest); afterPolicyAutoFix = denyAccessPolicy; } } }else{ ec2ClinetMap = PublicAccessAutoFix.getAWSClient("ec2", issue, CommonUtils.getPropValue(PacmanSdkConstants.AUTO_FIX_ROLE_NAME)); List<String> securityGroupsTobeApplied = new ArrayList<>(); VPCDerivedInfo vpcDerivedInfo = domainStatus.getVPCOptions(); List<String> securityGroupNames = vpcDerivedInfo.getSecurityGroupIds(); Set<String> securityGroupsSet = new HashSet<>(securityGroupNames); Set<String> alreadyCheckedSgSet = new HashSet<>(); if (ec2ClinetMap != null) { ec2Client = (AmazonEC2) ec2ClinetMap.get("client"); securityGroupsDetails = PublicAccessAutoFix.getExistingSecurityGroupDetails(securityGroupsSet, ec2Client); } String vpcid; Set<String> publiclyAccessible = new HashSet<>(); boolean isSgApplied = false; for (SecurityGroup securityGroup : securityGroupsDetails) { ipPermissionsToBeAdded = new ArrayList<>(); publiclyAccessible = new HashSet<>(); vpcid = securityGroup.getVpcId(); securityGroupId = securityGroup.getGroupId(); PublicAccessAutoFix.nestedSecurityGroupDetails(securityGroupId, ipPermissionsToBeAdded, ec2Client, publiclyAccessible,alreadyCheckedSgSet,0); if (!publiclyAccessible.isEmpty()) { String createdSgId = PublicAccessAutoFix.createSecurityGroup(securityGroupId, vpcid,ec2Client, ipPermissionsToBeAdded,resourceId,defaultCidrIp,securityGroup.getIpPermissions()); if(!StringUtils.isEmpty(createdSgId)){ securityGroupsTobeApplied.add(createdSgId); } } else { securityGroupsTobeApplied.add(securityGroupId); } } if (!securityGroupsTobeApplied.isEmpty()) { isSgApplied = PublicAccessAutoFix.applySecurityGroupsToElacticSearch(awsElasticsearch, securityGroupsTobeApplied, resourceId, domainConfigRequest); afterAutoFixSg = securityGroupsTobeApplied.toString(); } if (isSgApplied) { LOGGER.info("{} sg's successfully applied for the resource {}",securityGroupsTobeApplied, resourceId); } } } catch (Exception e) { LOGGER.error("Error in elastic public access autofix",e); throw new RuntimeException(e.getMessage()); } return new FixResult(PacmanSdkConstants.STATUS_SUCCESS_CODE,"the elasticsearch "+resourceId+" is now fixed"); }  }
ElasticSearchPublicAccessAutoFix extends BaseFix { @Override public FixResult executeFix(Map<String, String> issue, Map<String, Object> clientMap, Map<String, String> ruleParams) { afterAutoFixSg = null; String resourceId = issue.get("resourceDisplayId"); String defaultCidrIp = ruleParams.get("defaultCidrIp"); String cidrIp = ruleParams.get("cidrIp"); String accessPolicies = null; String denyAccessPolicy = null; JsonArray statments = new JsonArray(); Map<String, Object> ec2ClinetMap = null; List<SecurityGroup> securityGroupsDetails = null; AmazonEC2 ec2Client = null; String securityGroupId = null; Collection<IpPermission> ipPermissionsToBeAdded = null; Gson serializer = new GsonBuilder().create(); try { UpdateElasticsearchDomainConfigRequest domainConfigRequest = new UpdateElasticsearchDomainConfigRequest(); AWSElasticsearch awsElasticsearch = (AWSElasticsearch) clientMap.get("client"); ElasticsearchDomainStatus domainStatus = PublicAccessAutoFix.getDomainStatusForEsResource(clientMap, resourceId); String endPoint = domainStatus.getEndpoint(); if (!StringUtils.isEmpty(endPoint)) { accessPolicies = domainStatus.getAccessPolicies(); JsonObject accessPoliciesJson = serializer.fromJson(accessPolicies, JsonObject.class); if (accessPoliciesJson.has("Statement")) { statments = accessPoliciesJson.get("Statement").getAsJsonArray(); if (PublicAccessAutoFix.isEsHavingPublicAccess(statments,cidrIp)) { denyAccessPolicy = accessPolicies.replace("Allow", "Deny"); domainConfigRequest.setAccessPolicies(denyAccessPolicy); domainConfigRequest.setDomainName(resourceId); awsElasticsearch.updateElasticsearchDomainConfig(domainConfigRequest); afterPolicyAutoFix = denyAccessPolicy; } } }else{ ec2ClinetMap = PublicAccessAutoFix.getAWSClient("ec2", issue, CommonUtils.getPropValue(PacmanSdkConstants.AUTO_FIX_ROLE_NAME)); List<String> securityGroupsTobeApplied = new ArrayList<>(); VPCDerivedInfo vpcDerivedInfo = domainStatus.getVPCOptions(); List<String> securityGroupNames = vpcDerivedInfo.getSecurityGroupIds(); Set<String> securityGroupsSet = new HashSet<>(securityGroupNames); Set<String> alreadyCheckedSgSet = new HashSet<>(); if (ec2ClinetMap != null) { ec2Client = (AmazonEC2) ec2ClinetMap.get("client"); securityGroupsDetails = PublicAccessAutoFix.getExistingSecurityGroupDetails(securityGroupsSet, ec2Client); } String vpcid; Set<String> publiclyAccessible = new HashSet<>(); boolean isSgApplied = false; for (SecurityGroup securityGroup : securityGroupsDetails) { ipPermissionsToBeAdded = new ArrayList<>(); publiclyAccessible = new HashSet<>(); vpcid = securityGroup.getVpcId(); securityGroupId = securityGroup.getGroupId(); PublicAccessAutoFix.nestedSecurityGroupDetails(securityGroupId, ipPermissionsToBeAdded, ec2Client, publiclyAccessible,alreadyCheckedSgSet,0); if (!publiclyAccessible.isEmpty()) { String createdSgId = PublicAccessAutoFix.createSecurityGroup(securityGroupId, vpcid,ec2Client, ipPermissionsToBeAdded,resourceId,defaultCidrIp,securityGroup.getIpPermissions()); if(!StringUtils.isEmpty(createdSgId)){ securityGroupsTobeApplied.add(createdSgId); } } else { securityGroupsTobeApplied.add(securityGroupId); } } if (!securityGroupsTobeApplied.isEmpty()) { isSgApplied = PublicAccessAutoFix.applySecurityGroupsToElacticSearch(awsElasticsearch, securityGroupsTobeApplied, resourceId, domainConfigRequest); afterAutoFixSg = securityGroupsTobeApplied.toString(); } if (isSgApplied) { LOGGER.info("{} sg's successfully applied for the resource {}",securityGroupsTobeApplied, resourceId); } } } catch (Exception e) { LOGGER.error("Error in elastic public access autofix",e); throw new RuntimeException(e.getMessage()); } return new FixResult(PacmanSdkConstants.STATUS_SUCCESS_CODE,"the elasticsearch "+resourceId+" is now fixed"); }  @Override FixResult executeFix(Map<String, String> issue, Map<String, Object> clientMap, Map<String, String> ruleParams); @Override boolean backupExistingConfigForResource(final String resourceId, final String resourceType, Map<String, Object> clientMap, Map<String, String> ruleParams, Map<String, String> issue); @Override boolean isFixCandidate(String resourceId, String resourceType, Map<String, Object> clientMap, Map<String, String> ruleParams, Map<String, String> issue); @Override AutoFixTransaction addDetailsToTransactionLog(Map<String, String> annotation); }
ElasticSearchPublicAccessAutoFix extends BaseFix { @Override public FixResult executeFix(Map<String, String> issue, Map<String, Object> clientMap, Map<String, String> ruleParams) { afterAutoFixSg = null; String resourceId = issue.get("resourceDisplayId"); String defaultCidrIp = ruleParams.get("defaultCidrIp"); String cidrIp = ruleParams.get("cidrIp"); String accessPolicies = null; String denyAccessPolicy = null; JsonArray statments = new JsonArray(); Map<String, Object> ec2ClinetMap = null; List<SecurityGroup> securityGroupsDetails = null; AmazonEC2 ec2Client = null; String securityGroupId = null; Collection<IpPermission> ipPermissionsToBeAdded = null; Gson serializer = new GsonBuilder().create(); try { UpdateElasticsearchDomainConfigRequest domainConfigRequest = new UpdateElasticsearchDomainConfigRequest(); AWSElasticsearch awsElasticsearch = (AWSElasticsearch) clientMap.get("client"); ElasticsearchDomainStatus domainStatus = PublicAccessAutoFix.getDomainStatusForEsResource(clientMap, resourceId); String endPoint = domainStatus.getEndpoint(); if (!StringUtils.isEmpty(endPoint)) { accessPolicies = domainStatus.getAccessPolicies(); JsonObject accessPoliciesJson = serializer.fromJson(accessPolicies, JsonObject.class); if (accessPoliciesJson.has("Statement")) { statments = accessPoliciesJson.get("Statement").getAsJsonArray(); if (PublicAccessAutoFix.isEsHavingPublicAccess(statments,cidrIp)) { denyAccessPolicy = accessPolicies.replace("Allow", "Deny"); domainConfigRequest.setAccessPolicies(denyAccessPolicy); domainConfigRequest.setDomainName(resourceId); awsElasticsearch.updateElasticsearchDomainConfig(domainConfigRequest); afterPolicyAutoFix = denyAccessPolicy; } } }else{ ec2ClinetMap = PublicAccessAutoFix.getAWSClient("ec2", issue, CommonUtils.getPropValue(PacmanSdkConstants.AUTO_FIX_ROLE_NAME)); List<String> securityGroupsTobeApplied = new ArrayList<>(); VPCDerivedInfo vpcDerivedInfo = domainStatus.getVPCOptions(); List<String> securityGroupNames = vpcDerivedInfo.getSecurityGroupIds(); Set<String> securityGroupsSet = new HashSet<>(securityGroupNames); Set<String> alreadyCheckedSgSet = new HashSet<>(); if (ec2ClinetMap != null) { ec2Client = (AmazonEC2) ec2ClinetMap.get("client"); securityGroupsDetails = PublicAccessAutoFix.getExistingSecurityGroupDetails(securityGroupsSet, ec2Client); } String vpcid; Set<String> publiclyAccessible = new HashSet<>(); boolean isSgApplied = false; for (SecurityGroup securityGroup : securityGroupsDetails) { ipPermissionsToBeAdded = new ArrayList<>(); publiclyAccessible = new HashSet<>(); vpcid = securityGroup.getVpcId(); securityGroupId = securityGroup.getGroupId(); PublicAccessAutoFix.nestedSecurityGroupDetails(securityGroupId, ipPermissionsToBeAdded, ec2Client, publiclyAccessible,alreadyCheckedSgSet,0); if (!publiclyAccessible.isEmpty()) { String createdSgId = PublicAccessAutoFix.createSecurityGroup(securityGroupId, vpcid,ec2Client, ipPermissionsToBeAdded,resourceId,defaultCidrIp,securityGroup.getIpPermissions()); if(!StringUtils.isEmpty(createdSgId)){ securityGroupsTobeApplied.add(createdSgId); } } else { securityGroupsTobeApplied.add(securityGroupId); } } if (!securityGroupsTobeApplied.isEmpty()) { isSgApplied = PublicAccessAutoFix.applySecurityGroupsToElacticSearch(awsElasticsearch, securityGroupsTobeApplied, resourceId, domainConfigRequest); afterAutoFixSg = securityGroupsTobeApplied.toString(); } if (isSgApplied) { LOGGER.info("{} sg's successfully applied for the resource {}",securityGroupsTobeApplied, resourceId); } } } catch (Exception e) { LOGGER.error("Error in elastic public access autofix",e); throw new RuntimeException(e.getMessage()); } return new FixResult(PacmanSdkConstants.STATUS_SUCCESS_CODE,"the elasticsearch "+resourceId+" is now fixed"); }  @Override FixResult executeFix(Map<String, String> issue, Map<String, Object> clientMap, Map<String, String> ruleParams); @Override boolean backupExistingConfigForResource(final String resourceId, final String resourceType, Map<String, Object> clientMap, Map<String, String> ruleParams, Map<String, String> issue); @Override boolean isFixCandidate(String resourceId, String resourceType, Map<String, Object> clientMap, Map<String, String> ruleParams, Map<String, String> issue); @Override AutoFixTransaction addDetailsToTransactionLog(Map<String, String> annotation); static String afterAutoFixSg; static String beforeAutoFixSg; static String afterPolicyAutoFix; }