elastic / cloudbeat / 28875485871

76%

Build Type

push

github

Committed by web-flow

Commit Message

fix: prevent panic when RDS DB instance has a nil DBSubnetGroup (#7188)

## Summary
- AWS can return `DescribeDBInstances` results with a nil
`DBSubnetGroup` (e.g. for EC2-Classic instances or instances in certain
transitional states). `getDBInstanceSubnets` unconditionally
dereferenced `dbInstance.DBSubnetGroup.Subnets`, causing a nil pointer
dereference panic that crashed cloudbeat's CSPM/asset-inventory AWS
agent (observed as `likely-elastic-agent-integration-oom` alerts).
- Added a nil guard that returns an empty subnet list for instances
without a `DBSubnetGroup`, matching existing behavior for instances with
an empty subnet list.

Fixes elastic/seceng#14066

## Test plan
- [x] Added a regression test (`Should not panic when a DB instance has
no DBSubnetGroup`) in `provider_test.go` covering a `DBInstance` with
`DBSubnetGroup: nil`.
- [x] Verified the regression test reproduces the original panic when
the fix is reverted (identical stack trace shape to the one in the
issue).
- [x] `go test ./internal/resources/providers/awslib/...` passes.
- [x] `go build`, `go vet`, and `gofmt -l` clean on changed files.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

10208 of 13409 relevant lines covered (76.13%)

15.91 hits per line