cfn-guardian 0.1.0 → 0.6.3

data/lib/cfnguardian/models/check.rb

@@ -2,54 +2,91 @@ require 'cfnguardian/string'
 
 module CfnGuardian
   module Models
-    class Check
+    class BaseCheck
       
       attr_reader :type
-      attr_accessor :class,
+      attr_accessor :group,
         :name,
+        :package,
         :handler,
         :version,
         :runtime,
-        :environment
+        :environment,
+        :subnets, 
+        :vpc,
+        :memory,
+        :timeout
         
       def initialize(resource)
         @type = 'Check'
-        @class = nil
+        @group = nil
         @name = nil
         @package = nil
         @handler = nil
         @version = nil
         @runtime = nil
         @environment = ''
-      end
-      
-      def to_h
-        Hash[instance_variables.map { |name| [name[1..-1].to_sym, instance_variable_get(name)] } ]
+        @subnets = nil
+        @vpc = nil
+        @memory = 128
+        @timeout = 120
       end
     end
     
-    class HttpCheck < Check      
+    class HttpCheck < BaseCheck      
       def initialize(resource)
         super(resource)
-        @class = 'Http'
+        @group = 'Http'
         @name = 'HttpCheck'
-        @package = 'aws-lambda-http-check'
-        @handler = 'handler.main'
-        @version = '0.1'
+        @package = 'http-check'
+        @handler = 'handler.http_check'
+        @version = 'f739631de74f1a882163b7e584a8b4710ccbc134'
+        @runtime = 'python3.7'
+      end
+    end
+    
+    class InternalHttpCheck < HttpCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'InternalHttp'
+        @name = 'InternalHttpCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
+    
+    class PortCheck < BaseCheck      
+      def initialize(resource)
+        super(resource)
+        @group = 'Port'
+        @name = 'PortCheck'
+        @package = 'port-check'
+        @handler = 'handler.port_check'
+        @version = '356203b2a720ba0730622f978e677b88f8d0c328'
         @runtime = 'python3.6'
       end
     end
     
-    class NrpeCheck < Check
-      attr_accessor :subnets, :vpc
-      
+    class InternalPortCheck < PortCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'InternalPort'
+        @name = 'InternalPortCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
+    
+    class NrpeCheck < BaseCheck
       def initialize(resource)
         super(resource)
-        @class = 'Nrpe'
+        @group = 'Nrpe'
         @name = 'NrpeCheck'
         @package = 'aws-lambda-nrpe-check'
         @handler = 'main'
-        @version = '0.2'
+        @version = 'aa51a0ad497a6c012a3639da0eb3446e4c0f9540'
         @runtime = 'go1.x'
         @subnets = resource['Subnets']
         @vpc = resource['VpcId']
@@ -57,40 +94,49 @@ module CfnGuardian
       end
     end
     
-    class SslCheck < Check
+    class SslCheck < BaseCheck
       def initialize(resource)
         super(resource)
-        @class = 'Ssl'
+        @group = 'Ssl'
         @name = 'SslCheck'
         @package = 'aws-lambda-ssl-check'
         @handler = 'main'
-        @version = '0.1'
+        @version = 'a25fd4006d1f95c06f3c098188543f5eea1986da'
         @runtime = 'go1.x'
       end
     end
     
-    class DomainExpiryCheck < Check
+    class InternalSslCheck < SslCheck
       def initialize(resource)
         super(resource)
-        @class = 'DomainExpiry'
+        @group = 'InternalSsl'
+        @name = 'InternalSslCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
+    
+    class DomainExpiryCheck < BaseCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'DomainExpiry'
         @name = 'DomainExpiryCheck'
         @package = 'aws-lambda-dns-check'
         @handler = 'main'
-        @version = '0.1'
+        @version = '9db96ca32379faddc47e55849b7e296b7b70a48e'
         @runtime = 'go1.x'
       end
     end
     
-    class SqlCheck < Check
-      attr_accessor :subnets, :vpc
-      
+    class SqlCheck < BaseCheck
       def initialize(resource)
         super(resource)
-        @class = 'Sql'
+        @group = 'Sql'
         @name = 'SqlCheck'
         @package = 'aws-lambda-sql-check'
         @handler = 'main'
-        @version = '0.1'
+        @version = '83bd6399c0376c98df90dd5f29e49d629c556cee'
         @runtime = 'go1.x'
         @subnets = resource['Subnets']
         @vpc = resource['VpcId']
@@ -98,17 +144,66 @@ module CfnGuardian
       end
     end
     
-    class ContainerInstanceCheck < Check
+    class ContainerInstanceCheck < BaseCheck
       def initialize(resource)
         super(resource)
-        @class = 'ContainerInstance'
+        @group = 'ContainerInstance'
         @name = 'ContainerInstanceCheck'
-        @package = 'aws-lambda-ecs-container-instance-check'
+        @package = 'ecs-containder-instance-check'
         @handler = 'handler.run_check'
-        @version = '0.1'
+        @version = '4f650d5846d6e8d19f0139bccdeeb147f03f0dd6'
         @runtime = 'python3.6'
       end
     end
+    
+    class TLSCheck < BaseCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'TLS'
+        @name = 'TLSCheck'
+        @package = 'tls-version-check'
+        @handler = 'handler.run_check'
+        @version = 'de83afdde0d976364af37ad7552a8496c3c94ab5'
+        @runtime = 'python3.7'
+      end
+    end
+    
+    class SFTPCheck < BaseCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'SFTP'
+        @name = 'SFTPCheck'
+        @package = 'sftp-check'
+        @handler = 'handler.sftp_check'
+        @version = '987e71f2607347e13e3f156535059d6d3ce1ceed'
+        @runtime = 'python3.7'
+      end
+    end
+    
+    class InternalSFTPCheck < SFTPCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'InternalSFTP'
+        @name = 'InternalSFTPCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
+
+    class AzureFileCheck < BaseCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'AzureFile'
+        @name = 'AzureFileCheck'
+        @package = 'azure-file-check'
+        @handler = 'handler.file_check'
+        @version = 'cc37aa8fe4855570132431611b507274b390f4c1'
+        @runtime = 'python3.7'
+        @memory = 256
+        @timeout = 600
+      end
+    end
 
   end
 end

data/lib/cfnguardian/models/composite.rb

@@ -0,0 +1,21 @@
+module CfnGuardian
+  module Models
+    class Composite
+      
+      attr_reader :type
+      attr_accessor :name,
+        :description,
+        :rule,
+        :alarm_action
+        
+      def initialize(name,params = {})
+        @type = 'Composite'
+        @name = name
+        @description = params.fetch('Description', '')
+        @rule = params.fetch('Rule', 'FALSE')
+        @alarm_action = params.fetch('Action', nil)
+      end
+              
+    end
+  end
+end

data/lib/cfnguardian/models/event.rb

@@ -2,49 +2,36 @@ require 'cfnguardian/string'
 
 module CfnGuardian
   module Models
-    class Event
+    class BaseEvent
       
       attr_reader :type
-      attr_accessor :class,
+      attr_accessor :group,
         :target,
         :hash,
         :name,
         :cron,
         :enabled,
-        :resource
+        :resource,
+        :environment,
+        :payload,
+        :ssm_parameters
       
       def initialize(resource)
         @type = 'Event'
-        @class = nil
+        @group = nil
         @target = nil
         @hash = Digest::MD5.hexdigest resource['Id']
         @name = @hash
         @cron = "* * * * ? *"
         @enabled = true
         @resource = resource['Id'].to_resource_name
-      end
-      
-      def to_h
-        return {
-          type: @type,
-          class: @class,
-          target: @target,
-          hash: @hash,
-          name: @name,
-          cron: @cron,
-          enabled: @enabled,
-          resource: @resource,
-          payload: event_payload()
-        }
-      end
-      
-      def event_payload
-        {}.to_json
-      end
-      
+        @environment = ""
+        @payload = {}.to_json
+        @ssm_parameters = []
+      end      
     end
     
-    class HttpEvent < Event
+    class HttpEvent < BaseEvent
       
       attr_accessor :endpoint,
         :method,
@@ -56,7 +43,7 @@ module CfnGuardian
       
       def initialize(resource)
         super(resource)
-        @class = 'Http'
+        @group = 'Http'
         @name = 'HttpEvent'
         @target = 'HttpCheckFunction'
         @endpoint = resource['Id']
@@ -66,9 +53,10 @@ module CfnGuardian
         @body_regex = resource.fetch('BodyRegex',nil)
         @headers = resource.fetch('Headers',nil)
         @payload = resource.fetch('Payload',nil)
+        @compressed = resource.fetch('Compressed',false)
       end
       
-      def event_payload
+      def payload
         payload = {
           'ENDPOINT' => @endpoint,
           'METHOD' => @method,
@@ -78,23 +66,66 @@ module CfnGuardian
         payload['BODY_REGEX_MATCH'] = @body_regex unless @body_regex.nil?
         payload['HEADERS'] = @headers unless @headers.nil?
         payload['PAYLOAD'] = @payload unless @payload.nil?
+        payload['COMPRESSED'] = '1' if @compressed
         return payload.to_json
       end
     end
     
-    class NrpeEvent < Event
+    class InternalHttpEvent < HttpEvent      
+      def initialize(resource,environment)
+        super(resource)
+        @group = 'InternalHttp'
+        @name = 'InternalHttpEvent'
+        @target = "InternalHttpCheckFunction#{environment}"
+        @environment = environment
+      end
+    end
+    
+    class PortEvent < BaseEvent      
+      def initialize(resource)
+        super(resource)
+        @group = 'Port'
+        @name = 'PortEvent'
+        @target = 'PortCheckFunction'
+        @hostname = resource['Id']
+        @port = resource['Port']
+        @timeout = resource.fetch('Timeout',120)
+      end
+      
+      def payload
+        return {
+          'HOSTNAME' => @hostname,
+          'PORT' => @port,
+          'TIMEOUT' => @timeout,
+          'STATUS_CODE_MATCH' => @status_code
+        }.to_json
+      end
+    end
+    
+    class InternalPortEvent < PortEvent    
+      def initialize(resource,environment)
+        super(resource)
+        @group = 'InternalPort'
+        @name = 'InternalPortEvent'
+        @target = "InternalPortCheckFunction#{environment}"
+        @environment = environment
+      end
+    end
+    
+    class NrpeEvent < BaseEvent      
       def initialize(resource,environment,command)
         super(resource)
-        @class = 'Nrpe'
+        @group = 'Nrpe'
         @name = 'NrpeEvent'
         @target = "NrpeCheckFunction#{environment}"
         @host = resource['Id']
         @environment = environment
         @region = resource.fetch('Region',"${AWS::Region}")
+        @hash = Digest::MD5.hexdigest "#{resource['Id']}#{command}"
         @command = command
       end
       
-      def event_payload
+      def payload
         return {
           'host' => @host,
           'environment' => @environment,
@@ -104,18 +135,18 @@ module CfnGuardian
       end
     end
     
-    class SslEvent < Event
+    class SslEvent < BaseEvent
       def initialize(resource)
         super(resource)
-        @class = 'Ssl'
+        @group = 'Ssl'
         @name = 'SslEvent'
         @target = 'SslCheckFunction'
-        @cron = "0 12 * * ? *" 
+        @cron = resource.fetch('Schedule', "0 12 * * ? *")
         @url = resource['Id']
         @region = resource.fetch('Region',"${AWS::Region}")
       end
       
-      def event_payload
+      def payload
         return {
           'Url' => @url,
           'Region' => @region
@@ -123,32 +154,42 @@ module CfnGuardian
       end
     end
     
-    class DomainExpiryEvent < Event
+    class InternalSslEvent < SslEvent    
+      def initialize(resource,environment)
+        super(resource)
+        @group = 'InternalSsl'
+        @name = 'InternalSslEvent'
+        @target = "InternalSslCheckFunction#{environment}"
+        @environment = environment
+      end
+    end
+    
+    class DomainExpiryEvent < BaseEvent
       
       attr_accessor :domain,
         :region
       
       def initialize(resource)
         super(resource)
-        @class = 'DomainExpiry'
+        @group = 'DomainExpiry'
         @name = 'DomainExpiryEvent'
         @target = 'DomainExpiryCheckFunction'
-        @cron = "0 12 * * ? *" 
+        @cron = resource.fetch('Schedule', "0 12 * * ? *")
         @domain = resource['Id']
         @region = resource.fetch('Region',"${AWS::Region}")
       end
       
-      def event_payload
-        {'Domain' => @domain}.to_json
+      def payload
+        return {'Domain' => @domain}.to_json
       end
     end
     
-    class SqlEvent < Event
-      def initialize(resource,query)
+    class SqlEvent < BaseEvent
+      def initialize(resource,query,environment)
         super(resource)
-        @class = 'Sql'
+        @group = 'Sql'
         @name = 'SqlEvent'
-        @target = 'SqlCheckFunction'
+        @target = "SqlCheckFunction#{environment}"
         @host = resource['Id']
         @engine = resource['Engine']
         @port = resource['Port']
@@ -157,9 +198,10 @@ module CfnGuardian
         @query = query
         @region = resource.fetch('Region',"${AWS::Region}")
         @test_type = '1-row-1-value-zero-is-good'
+        @environment = environment
       end
       
-      def event_payload
+      def payload
         return {
           'Host' => @host,
           'Engine' => @engine,
@@ -171,20 +213,130 @@ module CfnGuardian
           'TestType' => @test_type
         }.to_json
       end
+      
+      def ssm_parameters
+        params = []
+        params << @ssm_username
+        params << @ssm_password
+        return params
+      end
     end
     
-    class ContainerInstanceEvent < Event
+    class ContainerInstanceEvent < BaseEvent
       def initialize(resource)
         super(resource)
-        @class = 'ContainerInstance'
+        @group = 'ContainerInstance'
         @name = 'ContainerInstanceEvent'
         @target = 'ContainerInstanceCheckFunction'
-        @cron = "0/5 * * * ? *"
+        @cron = resource.fetch('Schedule', "0/5 * * * ? *")
         @cluster = resource['Id']
       end
       
-      def event_payload
-        {'CLUSTER' => @cluster}.to_json
+      def payload
+        return {'CLUSTER' => @cluster}.to_json
+      end
+    end
+    
+    class SFTPEvent < BaseEvent
+      def initialize(resource)
+        super(resource)
+        @group = 'SFTP'
+        @name = 'SFTPEvent'
+        @target = 'SFTPCheckFunction'
+        @cron = resource.fetch('Schedule', "0/5 * * * ? *")
+        @host = resource['Id']
+        @user = resource['User']
+        @port = resource.fetch('Port', nil)
+        @server_key = resource.fetch('ServerKey', nil)
+        @password = resource.fetch('Password', nil)
+        @private_key = resource.fetch('PrivateKey', nil)
+        @private_key_pass = resource.fetch('PrivateKeyPass', nil)
+        @file = resource.fetch('File', nil)
+        @file_regex_match = resource.fetch('FileRegexMatch', nil)
+      end
+      
+      def payload
+        payload = {
+          'HOSTNAME' => @host,
+          'USERNAME' => @user
+        }
+        payload['PORT'] = @port unless @port.nil?
+        payload['SERVER_KEY'] = @server_key unless @server_key.nil?
+        payload['PASSWORD'] = @password unless @password.nil?
+        payload['PRIVATEKEY'] = @private_key unless @private_key.nil?
+        payload['PRIVATEKEY_PASSWORD'] = @private_key_pass unless @private_key_pass.nil?
+        payload['FILE'] = @file unless @file.nil?
+        payload['FILE_REGEX_MATCH'] = @file_regex_match unless @file_regex_match.nil?
+        return payload.to_json
+      end
+      
+      def ssm_parameters
+        params = []
+        params << @password unless @password.nil?
+        params << @private_key unless @private_key.nil?
+        params << @private_key_pass unless @private_key_pass.nil?
+        return params
+      end
+    end
+    
+    class InternalSFTPEvent < SFTPEvent    
+      def initialize(resource,environment)
+        super(resource)
+        @group = 'InternalSFTP'
+        @name = 'InternalSFTPEvent'
+        @target = "InternalSFTPCheckFunction#{environment}"
+        @environment = environment
+      end
+    end
+    
+    class TLSEvent < BaseEvent
+      def initialize(resource)
+        super(resource)
+        @group = 'TLS'
+        @name = 'TLSEvent'
+        @target = 'TLSCheckFunction'
+        @cron = resource.fetch('Schedule', "0/5 * * * ? *")
+        @host = resource['Id']
+        @port = resource.fetch('Port', 443)
+        @check_max = resource.fetch('MaxSupported', nil)
+        @versions =  resource.fetch('Versions', ['SSLv2','SSLv3','TLSv1','TLSv1.1','TLSv1.2'])
+      end
+      
+      def payload
+        payload = {
+          'HOSTNAME' => @host,
+          'PORT' => @port
+        }
+        payload['CHECK_MAX_SUPPORTED'] = @check_max.nil?
+        payload['PROTOCOLS'] = @versions unless @versions.nil?
+        return payload.to_json
+      end
+    end
+
+    class AzureFileEvent < BaseEvent
+      def initialize(resource)
+        super(resource)
+        @group = 'AzureFile'
+        @name = 'AzureFileEvent'
+        @target = 'AzureFileCheckFunction'
+        @cron = resource.fetch('Schedule', "0/5 * * * ? *")
+        @storage_account = resource['Id']
+        @container = resource['Container']
+        @connection_string = resource['ConnectionString']
+        @search = resource['Search']
+      end
+
+      def payload
+        return {
+          'STORAGE_ACCOUNT' => @storage_account,
+          'CONTAINER' => @container,
+          'CONNECTION_STRING' => @connection_string,
+          'SEARCH' => @search
+        }.to_json
+      end
+
+      def ssm_parameters
+        return [@connection_string]
       end
     end