aws_security_viz 0.2.5.pre.alpha.pre.35 → 1.0.0

data/spec/integration/dummy.dot

@@ -1,50 +0,0 @@
-digraph G {
-	graph [bb="0,0,388.31,144",
-		concentrate=true,
-		overlap=false,
-		rankdir=LR,
-		sep=1,
-		splines=true
-	];
-	node [label="\N"];
-	app	 [height=0.5,
-		label=app,
-		pos="222.32,72",
-		width=0.75];
-	db	 [height=0.5,
-		label=db,
-		pos="361.31,72",
-		width=0.75];
-	app -> db	 [color=blue,
-		label="5984/tcp",
-		lp="291.81,79",
-		pos="e,334.25,72 249.45,72 270.68,72 300.46,72 323.95,72",
-		style=bold];
-	"8.8.8.8/32"	 [height=0.5,
-		label="8.8.8.8/32",
-		pos="62.161,126",
-		width=1.2702];
-	"8.8.8.8/32" -> app	 [color=blue,
-		label="80/tcp",
-		lp="159.82,108",
-		pos="e,199.09,81.689 98.964,115.29 121.69,108.48 151.36,99.231 177.32,90 181.33,88.572 185.52,87.006 189.65,85.41",
-		style=bold];
-	"amazon-elb-sg"	 [height=0.5,
-		label="amazon-elb-sg",
-		pos="62.161,72",
-		width=1.7267];
-	"amazon-elb-sg" -> app	 [color=blue,
-		label="80/tcp",
-		lp="159.82,79",
-		pos="e,195.01,72 124.54,72 144.95,72 166.98,72 184.95,72",
-		style=bold];
-	"*"	 [height=0.5,
-		label="*",
-		pos="62.161,18",
-		width=0.75];
-	"*" -> app	 [color=blue,
-		label="22/tcp",
-		lp="159.82,61",
-		pos="e,199.09,62.311 87.055,25.175 110.5,32.076 146.53,43.049 177.32,54 181.33,55.428 185.52,56.994 189.65,58.59",
-		style=bold];
-}

data/spec/integration/dummy.json

@@ -1,64 +0,0 @@
-{
-  "SecurityGroups": [
-    {
-      "IpPermissionsEgress": [],
-      "Description": "app",
-      "IpPermissions": [
-        {
-          "ToPort": 80,
-          "IpProtocol": "tcp",
-          "IpRanges": [
-            {
-              "CidrIp": "8.8.8.8/32"
-            }
-          ],
-          "UserIdGroupPairs": [
-            {
-              "GroupName": "amazon-elb-sg",
-              "UserId": "amazon-elb",
-              "GroupId": "sg-amzelb"
-            }
-          ],
-          "FromPort": 80
-        },
-        {
-          "ToPort": 22,
-          "IpProtocol": "tcp",
-          "IpRanges": [
-            {
-              "CidrIp": "0.0.0.0/0"
-            }
-          ],
-          "UserIdGroupPairs": [],
-          "FromPort": 22
-        }
-      ],
-      "GroupName": "app",
-      "OwnerId": "owner1",
-      "GroupId": "sg-appgrp"
-    },
-    {
-      "IpPermissionsEgress": [],
-      "Description": "db",
-      "IpPermissions": [
-        {
-          "ToPort": 5984,
-          "IpProtocol": "tcp",
-          "IpRanges": [],
-          "UserIdGroupPairs": [
-            {
-              "GroupName": "app",
-              "UserId": "owner1",
-              "GroupId": "sg-appgrp"
-            }
-          ],
-          "FromPort": 5984
-        }
-      ],
-      "GroupName": "db",
-      "OwnerId": "owner1",
-      "GroupId": "sg-dbgrp"
-    }
-  ]
-}
-

data/spec/integration/expected.json

@@ -1 +0,0 @@
-{"nodes":[{"id":"app","label":"app"},{"id":"8.8.8.8/32","label":"8.8.8.8/32"},{"id":"amazon-elb-sg","label":"amazon-elb-sg"},{"id":"*","label":"*"},{"id":"db","label":"db"}],"edges":[{"id":"app-db","source":"app","target":"db","label":"5984/tcp"},{"id":"8.8.8.8/32-app","source":"8.8.8.8/32","target":"app","label":"80/tcp"},{"id":"amazon-elb-sg-app","source":"amazon-elb-sg","target":"app","label":"80/tcp"},{"id":"*-app","source":"*","target":"app","label":"22/tcp"}]}

data/spec/integration/navigator.json

@@ -1 +0,0 @@
-{"data":{"nodes":[{"id":"app","label":"app","categories":["default"],"info":"<b>Security group</b>: app, <br/><b>VPC:</b> default"},{"id":"8.8.8.8/32","label":"8.8.8.8/32","categories":["default"],"info":"<b>Security group</b>: 8.8.8.8/32, <br/><b>VPC:</b> default"},{"id":"amazon-elb-sg","label":"amazon-elb-sg","categories":["default"],"info":"<b>Security group</b>: amazon-elb-sg, <br/><b>VPC:</b> default"},{"id":"*","label":"*","categories":["default"],"info":"<b>Security group</b>: *, <br/><b>VPC:</b> default"},{"id":"db","label":"db","categories":["default"],"info":"<b>Security group</b>: db, <br/><b>VPC:</b> default"}],"edges":[{"id":"app-db","from":"app","to":"db","label":"5984/tcp"},{"id":"8.8.8.8/32-app","from":"8.8.8.8/32","to":"app","label":"80/tcp"},{"id":"amazon-elb-sg-app","from":"amazon-elb-sg","to":"app","label":"80/tcp"},{"id":"*-app","from":"*","to":"app","label":"22/tcp"}]},"categories":{"default":"default"}}

data/spec/integration/visualize_aws_spec.rb

@@ -1,96 +0,0 @@
-require 'spec_helper'
-require 'tempfile'
-
-RSpec::Matchers.define :be_graph_with do |nodes|
-  match do |graphv|
-    graphv.nodes.keys == nodes
-  end
-end
-
-describe VisualizeAws do
-  let(:opts) {
-    {
-        :source_file => source_file,
-        :filename => temp_file
-    }
-  }
-  let(:source_file) { File.join(File.dirname(__FILE__), 'dummy.json') }
-  let(:config) { AwsConfig.new({groups: {'0.0.0.0/0' => '*'}}) }
-  let(:expected_content) { File.read(expected_file) }
-  let(:actual_content) { temp_file.read }
-
-  context 'json to dot file' do
-    let(:expected_file) { File.join(File.dirname(__FILE__), 'dummy.dot') }
-    let(:temp_file) { Tempfile.new(%w(aws .dot)) }
-
-    def without_pos(data)
-      return data
-        .gsub(/pos=\"[a-z,0-9\.\s]*\"/, '')
-        .gsub(/\s{2,}/, ' ') # trim spaces
-        .gsub(/\t/, ' ') # remove tabs
-    end
-
-    it 'should parse json input', :integration => true do
-      VisualizeAws.new(config, opts).unleash(temp_file.path)
-      expect(without_pos(expected_content)).to eq(without_pos(actual_content))
-    end
-    
-    it 'should parse json input with stubbed out graphviz' do
-      nodes = ["app", "8.8.8.8/32", "amazon-elb-sg", "*", "db"]
-      allow(Graphviz).to receive(:output).with(be_graph_with(nodes), path: temp_file.path, format: nil)
-      VisualizeAws.new(config, opts).unleash(temp_file.path)
-    end
-  end
-
-  context 'json to json file' do
-    let(:expected_file) { File.join(File.dirname(__FILE__), 'expected.json') }
-    let(:temp_file) { Tempfile.new(%w(aws .json)) }
-
-    it 'should parse json input' do
-      expect(FileUtils).to receive(:copy)
-      VisualizeAws.new(config, opts.merge(:renderer => 'json')).unleash(temp_file.path)
-      expect(JSON.parse(expected_content)).to eq(JSON.parse(actual_content))
-    end
-
-    it 'should parse json input with obfuscation' do
-      config = AwsConfig.new({groups: {'0.0.0.0/0' => '*'}, obfuscate: true})
-      expect(FileUtils).to receive(:copy)
-      VisualizeAws.new(config, opts.merge(:renderer => 'json')).unleash(temp_file.path)
-      expect(actual_content).not_to include('"amazon-elb-sg"', '"app"', '"db"')
-    end
-
-  end
-
-  context 'json to navigator file' do
-    let(:expected_file) { File.join(File.dirname(__FILE__), 'navigator.json') }
-    let(:temp_file) { Tempfile.new(%w(aws .json)) }
-
-    it 'should parse json input' do
-      expect(FileUtils).to receive(:copy)
-      VisualizeAws.new(config, opts.merge(:renderer => 'navigator')).unleash(temp_file.path)
-      expect(JSON.parse(expected_content)).to eq(JSON.parse(actual_content))
-    end
-  end
-
-  if ENV['TEST_ACCESS_KEY']
-    context 'ec2 to json file' do
-      let(:expected_file) { File.join(File.dirname(__FILE__), 'aws_expected.json') }
-      let(:temp_file) { Tempfile.new(%w(aws .json)) }
-      let(:opts) {
-        {
-            :filename => temp_file,
-            :secret_key => ENV['TEST_SECRET_KEY'],
-            :access_key => ENV['TEST_ACCESS_KEY'],
-            :region => 'us-east-1'
-        }
-      }
-
-      it 'should read from ec2 account', :integration => true do
-        expect(FileUtils).to receive(:copy)
-        VisualizeAws.new(config, opts).unleash(temp_file.path)
-        expect(JSON.parse(expected_content)['edges']).to match_array(JSON.parse(actual_content)['edges'])
-        expect(JSON.parse(expected_content)['nodes']).to match_array(JSON.parse(actual_content)['nodes'])
-      end
-    end
-  end
-end

data/spec/spec_helper.rb

@@ -1,36 +0,0 @@
-if ENV['COVERAGE']
-  require 'simplecov'
-
-  SimpleCov.start do
-    add_filter '/spec/' 
-  end
-end
-
-require 'bundler'
-Bundler.require
-require 'rspec'
-require 'rubygems'
-require File.expand_path(File.dirname(__FILE__) + "/../config/boot")
-Dir[File.dirname(__FILE__) + "/support/**/*.rb"].each {|f| require f}
-
-def group name, *ingress
-  {group_name: name, group_id: 'some group', ip_permissions: ingress, ip_permissions_egress: []}
-end
-
-def group_ingress port, name
-  {user_id_group_pairs:[{user_id: "userId", group_id: "sg-groupId", group_name: name}], ip_ranges:[], ip_protocol: "tcp", from_port: port, to_port: port}
-end
-
-def cidr_ingress port, cidr_ip
-  {ip_ranges:[{cidr_ip: cidr_ip}], ip_protocol: "tcp", from_port: port, to_port: port}
-end
-
-def stub_security_groups groups
-  Aws.config[:ec2] = {
-    stub_responses: {
-        describe_security_groups: {
-          security_groups: groups
-      }
-    }
-  }
-end

data/spec/visualize_aws_spec.rb

@@ -1,194 +0,0 @@
-require 'spec_helper'
-
-class DummyRenderer
-  attr_reader :output
-
-  def initialize
-    @output = []
-  end
-
-  def add_node(name, opts)
-    @output << [:node, name]
-  end
-
-  def add_edge(from, to, opts)
-    @output << [:edge, from, to, opts]
-  end
-end
-
-describe VisualizeAws do
-  let(:visualize_aws) { VisualizeAws.new(AwsConfig.new) }
-  let(:renderer) { DummyRenderer.new }
-
-  it 'should add nodes, edges for each security group' do   
-    stub_security_groups([group('Remote ssh', group_ingress(22, 'My machine')), group('My machine')])
-    graph = visualize_aws.build
-
-    expect(graph.output(renderer)).to contain_exactly(
-                                          [:node, 'Remote ssh'],
-                                          [:node, 'My machine'],
-                                          [:edge, 'My machine', 'Remote ssh', {:color => :blue, :label => '22/tcp'}],
-                                      )
-  end
-
-  context 'groups' do
-    it 'should add nodes for external security groups defined through ingress' do
-      stub_security_groups([group('Web', group_ingress(80, 'ELB'))])
-      graph = visualize_aws.build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'Web'],
-                                            [:node, 'ELB'],
-                                            [:edge, 'ELB', 'Web', {:color => :blue, :label => '80/tcp'}]
-                                        )
-    end
-
-    it 'should add an edge for each security ingress' do
-      stub_security_groups(
-          [
-              group('App', group_ingress(80, 'Web'), group_ingress(8983, 'Internal')),
-              group('Web', group_ingress(80, 'External')),
-              group('Db', group_ingress(7474, 'App'))
-          ])
-      graph = visualize_aws.build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'App'],
-                                            [:node, 'Web'],
-                                            [:edge, 'Web', 'App', {:color => :blue, :label => '80/tcp'}],
-                                            [:node, 'Internal'],
-                                            [:edge, 'Internal', 'App', {:color => :blue, :label => '8983/tcp'}],
-                                            [:node, 'External'],
-                                            [:edge, 'External', 'Web', {:color => :blue, :label => '80/tcp'}],
-                                            [:node, 'Db'],
-                                            [:edge, 'App', 'Db', {:color => :blue, :label => '7474/tcp'}]
-                                        )
-
-    end
-  end
-
-  context 'cidr' do
-
-    it 'should add an edge for each cidr ingress' do
-        stub_security_groups(
-          [
-              group('Web', group_ingress(80, 'External')),
-              group('Db', group_ingress(7474, 'App'), cidr_ingress(22, '127.0.0.1/32'))
-          ])
-      graph = visualize_aws.build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'Web'],
-                                            [:node, 'External'],
-                                            [:edge, 'External', 'Web', {:color => :blue, :label => '80/tcp'}],
-                                            [:node, 'Db'],
-                                            [:node, 'App'],
-                                            [:edge, 'App', 'Db', {:color => :blue, :label => '7474/tcp'}],
-                                            [:node, '127.0.0.1/32'],
-                                            [:edge, '127.0.0.1/32', 'Db', {:color => :blue, :label => '22/tcp'}]
-                                        )
-
-    end
-
-    it 'should add map edges for cidr ingress' do
-        stub_security_groups(
-          [
-              group('Web', group_ingress(80, 'External')),
-              group('Db', group_ingress(7474, 'App'), cidr_ingress(22, '127.0.0.1/32'))
-          ])
-      mapping = {'127.0.0.1/32' => 'Work'}
-      mapping = CidrGroupMapping.new([], mapping)
-      allow(CidrGroupMapping).to receive(:new).and_return(mapping)
-
-      graph = visualize_aws.build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'Web'],
-                                            [:node, 'External'],
-                                            [:edge, 'External', 'Web', {:color => :blue, :label => '80/tcp'}],
-                                            [:node, 'Db'],
-                                            [:node, 'App'],
-                                            [:edge, 'App', 'Db', {:color => :blue, :label => '7474/tcp'}],
-                                            [:node, 'Work'],
-                                            [:edge, 'Work', 'Db', {:color => :blue, :label => '22/tcp'}]
-                                        )
-
-    end
-
-    it 'should group mapped duplicate edges for cidr ingress' do
-    stub_security_groups(
-          [
-              group('ssh', cidr_ingress(22, '192.168.0.1/32'), cidr_ingress(22, '127.0.0.1/32'))
-          ])
-      mapping = {'127.0.0.1/32' => 'Work', '192.168.0.1/32' => 'Work'}
-      mapping = CidrGroupMapping.new([], mapping)
-      allow(CidrGroupMapping).to receive(:new).and_return(mapping)
-
-      graph = visualize_aws.build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'ssh'],
-                                            [:node, 'Work'],
-                                            [:edge, 'Work', 'ssh', {:color => :blue, :label => '22/tcp'}]
-                                        )
-    end
-  end
-
-  context "filter" do
-    it 'include cidr which do not match the pattern' do
-        stub_security_groups(
-          [
-              group('Web', cidr_ingress(22, '127.0.0.1/32')),
-              group('Db', cidr_ingress(22, '192.0.1.1/32'))
-          ])
-
-      opts = {:exclude => ['127.*']}
-      graph = VisualizeAws.new(AwsConfig.new(opts)).build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'Web'],
-                                            [:node, 'Db'],
-                                            [:node, '192.0.1.1/32'],
-                                            [:edge, '192.0.1.1/32', 'Db', {:color => :blue, :label => '22/tcp'}]
-                                        )
-    end
-
-    it 'include groups which do not match the pattern' do
-        stub_security_groups(
-          [
-              group('Web', group_ingress(80, 'External')),
-              group('Db', group_ingress(7474, 'App'), cidr_ingress(22, '127.0.0.1/32'))
-          ])
-
-      opts = {:exclude => ['D.*b', 'App']}
-      graph = VisualizeAws.new(AwsConfig.new(opts)).build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'Web'],
-                                            [:node, 'External'],
-                                            [:edge, 'External', 'Web', {:color => :blue, :label => '80/tcp'}]
-                                        )
-    end
-
-    it 'include derived groups which do not match the pattern' do
-        stub_security_groups(
-          [
-              group('Web', group_ingress(80, 'External')),
-              group('Db', group_ingress(7474, 'App'), cidr_ingress(22, '127.0.0.1/32'))
-          ])
-
-      opts = {:exclude => ['App']}
-      graph = VisualizeAws.new(AwsConfig.new(opts)).build
-
-      expect(graph.output(renderer)).to contain_exactly(
-                                            [:node, 'Web'],
-                                            [:node, 'External'],
-                                            [:edge, 'External', 'Web', {:color => :blue, :label => '80/tcp'}],
-                                            [:node, 'Db'],
-                                            [:node, '127.0.0.1/32'],
-                                            [:edge, '127.0.0.1/32', 'Db', {:color => :blue, :label => '22/tcp'}]
-                                        )
-
-    end
-  end
-end