cfn-guardian 0.11.0 → 0.11.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 597eff7904e03dd773f5d3b2c5e9928b03ce3081f76c7dd0cf33d95e0020af3e
-  data.tar.gz: 97ad25a41db6e7c6b88d4afd5c02560a2a114e6343ad27a001ca4dde87eeef97
+  metadata.gz: df845cc5dda684abf92cc6b71c4f285f370026389fe494510ecf5b6bca5062a8
+  data.tar.gz: 5549dd5b6070d88c8fe153aab86b15890d61cea88bfe650fd41cd9e2497b0dfb
 SHA512:
-  metadata.gz: e8f6556b639e720418edf32faf4e19e1421636ef9835e85b2f6a61de40a26712affd4d4d9f63f4d1e83f6fad6da1461c7ffcd7fb845a16f4dfffda8c285b7853
-  data.tar.gz: '068ddd35b4996594a05189ca9d6c3c232e362c951b37405e2ed9dbb0f747b77967637595a4f584177404814a77fe48268a71ce484621c42903723326bb6a0e1f'
+  metadata.gz: 1dee7c9fff0a49ffcfaf4455912ce6b324f34b79323a816660e0573840a9c35b1b2229b1e8fbed5460b2dd496802eb1b45ddecd1dbf604928b3c080c54de82b0
+  data.tar.gz: 82d325e4b19e862eee2b28c11acdfbedc0d96d7fbcaf392cb87642c42d2f31fd0a589b19abfe08de85e117e510ad02543bc169986e2121cb182c1b198eb7b7c1

data/docs/custom_checks/sftp.md

@@ -39,6 +39,8 @@ Resources:
     File: file.txt
     # optionally check for a regex match pattern in the body of the file
     FileBodyMatch: ok
+    # optionally override the default connection timeout of 10 seconds
+    Timeout: 10
 ```
 
 ## Private SFTP Check
@@ -70,4 +72,5 @@ Resources:
       PrivateKeyPass: /ssm/path/privatekey/password
       File: file.txt
       FileBodyMatch: ok
+      Timeout: 10
 ```

data/lib/cfnguardian/models/check.rb

@@ -189,7 +189,7 @@ module CfnGuardian
         @name = 'SFTPCheck'
         @package = 'sftp-check'
         @handler = 'handler.sftp_check'
-        @version = '987e71f2607347e13e3f156535059d6d3ce1ceed'
+        @version = '901a63a0b9bbb4f09d1efae7049b20de4a1a22e2'
         @runtime = 'python3.7'
       end
     end

data/lib/cfnguardian/models/event.rb

@@ -287,6 +287,7 @@ module CfnGuardian
         @private_key_pass = resource.fetch('PrivateKeyPass', nil)
         @file = resource.fetch('File', nil)
         @file_regex_match = resource.fetch('FileRegexMatch', nil)
+        @timeout = resource.fetch('Timeout', nil)
       end
       
       def payload
@@ -301,6 +302,7 @@ module CfnGuardian
         payload['PRIVATEKEY_PASSWORD'] = @private_key_pass unless @private_key_pass.nil?
         payload['FILE'] = @file unless @file.nil?
         payload['FILE_REGEX_MATCH'] = @file_regex_match unless @file_regex_match.nil?
+        payload['TIMEOUT'] = @timeout unless @timeout.nil?
         return payload.to_json
       end
       

data/lib/cfnguardian/models/event_subscription.rb

@@ -35,39 +35,42 @@ module CfnGuardian
     end
 
     class RDSEventSubscription < BaseEventSubscription
-      attr_accessor :source_id, :rds_event_category, :message
+      attr_accessor :event_id
 
       def initialize(resource)
         super(resource)
         @source = 'aws.rds'
-        @detail_type = 'RDS DB Instance Event'
-        @source_id = ''
-        @rds_event_category = ''
-        @message = ''
+        @event_id = nil
       end
 
       def detail
-        return {
-          EventCategories: [@rds_event_category],
-          SourceType: [@source_type],
-          SourceIdentifier: ["rds:#{@resource_id}"],
-          Message: [@message]
-        }
+        if @event_id.nil?
+          raise "#{self.class} missing `EventID` property"
+        end
+
+        return { EventID: [@event_id] }
       end
     end
 
     class RDSInstanceEventSubscription < RDSEventSubscription
       def initialize(resource)
         super(resource)
-        @source_type = 'DB_INSTANCE'
+        @resource_arn = "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:#{@resource_id}"
       end
     end
 
     class RDSClusterEventSubscription < RDSEventSubscription
       def initialize(resource)
         super(resource)
-        @detail_type = 'RDS DB Cluster Event'
-        @source_type = 'DB_CLUSTER'
+        @resource_arn = "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:cluster:#{@resource_id}"
+      end
+    end
+
+
+    class RDSClusterInstanceEventSubscription < RDSEventSubscription
+      def initialize(resource)
+        super(resource)
+        @resource_arn = "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:#{@resource_id}"
       end
     end
 

data/lib/cfnguardian/resources/cloudfront_distribution.rb

@@ -5,20 +5,15 @@ module CfnGuardian::Resource
       alarm = CfnGuardian::Models::CloudFrontDistributionAlarm.new(@resource)
       alarm.name = '4xxErrorRate'
       alarm.metric_name = '4xxErrorRate'
-      alarm.threshold = 2
-      alarm.statistic = 'Sum'
+      alarm.threshold = 10
+      alarm.statistic = 'Average'
       @alarms.push(alarm)
       
       alarm = CfnGuardian::Models::CloudFrontDistributionAlarm.new(@resource)
       alarm.name = '5xxErrorRate'
       alarm.metric_name = '5xxErrorRate'
-      alarm.threshold = 5
-      @alarms.push(alarm)
-      
-      alarm = CfnGuardian::Models::CloudFrontDistributionAlarm.new(@resource)
-      alarm.name = 'TotalErrorRate'
-      alarm.metric_name = 'TotalErrorRate'
-      alarm.threshold = 5
+      alarm.statistic = 'Average'
+      alarm.threshold = 10
       @alarms.push(alarm)
     end
     

data/lib/cfnguardian/resources/rds_cluster.rb

@@ -4,15 +4,22 @@ module CfnGuardian::Resource
       def default_event_subscriptions()
         event_subscription = CfnGuardian::Models::RDSClusterEventSubscription.new(@resource)
         event_subscription.name = 'FailoverFailed'
-        event_subscription.rds_event_category = 'failover'
-        event_subscription.message = 'A failover for the DB cluster has failed.'
+        event_subscription.event_id = 'RDS-EVENT-0069'
         @event_subscriptions.push(event_subscription)
 
         event_subscription = CfnGuardian::Models::RDSClusterEventSubscription.new(@resource)
         event_subscription.name = 'FailoverFinished'
-        event_subscription.rds_event_category = 'failover'
-        event_subscription.message = 'A failover for the DB cluster has finished.'
-        event_subscription.enabled = false
+        event_subscription.event_id = 'RDS-EVENT-0071'
+        @event_subscriptions.push(event_subscription)
+
+        event_subscription = CfnGuardian::Models::RDSClusterEventSubscription.new(@resource)
+        event_subscription.name = 'FailoverStartedSameAZ'
+        event_subscription.event_id = 'RDS-EVENT-0072'
+        @event_subscriptions.push(event_subscription)
+
+        event_subscription = CfnGuardian::Models::RDSClusterEventSubscription.new(@resource)
+        event_subscription.name = 'FailoverStartedDifferentAZ'
+        event_subscription.event_id = 'RDS-EVENT-0073'
         @event_subscriptions.push(event_subscription)
       end
   

data/lib/cfnguardian/resources/rds_cluster_instance.rb

@@ -25,6 +25,23 @@ module CfnGuardian::Resource
       alarm.evaluation_periods = 10
       @alarms.push(alarm)
     end
+
+    def default_event_subscriptions()
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'MasterPasswordReset'
+      event_subscription.event_id = 'RDS-EVENT-0016'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'MasterPasswordResetFailure'
+      event_subscription.event_id = 'RDS-EVENT-0067'
+      @event_subscriptions.push(event_subscription)
+      
+      event_subscription = CfnGuardian::Models::RDSClusterInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'AuroraStorageLow'
+      event_subscription.event_id = 'RDS-EVENT-0227'
+      @event_subscriptions.push(event_subscription)
+    end
     
   end
 end

data/lib/cfnguardian/resources/rds_instance.rb

@@ -57,71 +57,100 @@ module CfnGuardian::Resource
     def default_event_subscriptions()
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'MasterPasswordReset'
-      event_subscription.rds_event_category = 'configuration change'
-      event_subscription.message = 'The master password for the DB instance has been reset.'
+      event_subscription.event_id = 'RDS-EVENT-0016'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'MasterPasswordResetFailure'
-      event_subscription.rds_event_category = 'configuration change'
-      event_subscription.message = 'An attempt to reset the master password for the DB instance has failed.'
+      event_subscription.event_id = 'RDS-EVENT-0067'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'Deletion'
-      event_subscription.rds_event_category = 'deletion'
-      event_subscription.message = 'The DB instance has been deleted.'
+      event_subscription.event_id = 'RDS-EVENT-0003'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'StorageFullShutDown'
+      event_subscription.event_id = 'RDS-EVENT-0221'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'StorageCapacityLow'
+      event_subscription.event_id = 'RDS-EVENT-0222'
+      @event_subscriptions.push(event_subscription)
+      
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'InvalidState'
+      event_subscription.event_id = 'RDS-EVENT-0219'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'StorageScalingReachedThreshold'
+      event_subscription.event_id = 'RDS-EVENT-0224'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'StorageScalingFailed'
+      event_subscription.event_id = 'RDS-EVENT-0223'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'MultiAZStandByFailoverStarted'
+      event_subscription.event_id = 'RDS-EVENT-0013'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'MultiAZStandByFailoverCompleted'
+      event_subscription.event_id = 'RDS-EVENT-0015'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'MultiAZFailoverStarted'
-      event_subscription.rds_event_category = 'failover'
-      event_subscription.message = 'A Multi-AZ failover that resulted in the promotion of a standby instance has started.'
+      event_subscription.event_id = 'RDS-EVENT-0050'
+      @event_subscriptions.push(event_subscription)
+
+      event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
+      event_subscription.name = 'MultiAZFailoverCompleted'
+      event_subscription.event_id = 'RDS-EVENT-0049'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
-      event_subscription.name = 'MultiAZFailoverComplete'
-      event_subscription.rds_event_category = 'failover'
-      event_subscription.message = 'A Multi-AZ failover has completed.'
+      event_subscription.name = 'NotAttemptingFailover'
+      event_subscription.event_id = 'RDS-EVENT-0034'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'DBFailure'
-      event_subscription.rds_event_category = 'failure'
-      event_subscription.message = 'The DB instance has failed due to an incompatible configuration or an underlying storage issue. Begin a point-in-time-restore for the DB instance.'
+      event_subscription.event_id = 'RDS-EVENT-0031'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'TableCountExceedsRecommended'
-      event_subscription.rds_event_category = 'notification'
-      event_subscription.message = 'The number of tables you have for your DB instance exceeds the recommended best practices for Amazon RDS.'
+      event_subscription.event_id = 'RDS-EVENT-0055'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'DatabasesCountExceedsRecommended'
-      event_subscription.rds_event_category = 'notification'
-      event_subscription.message = 'The number of databases you have for your DB instance exceeds the recommended best practices for Amazon RDS.'
+      event_subscription.event_id = 'RDS-EVENT-0056'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'ReplicationFailure'
       event_subscription.enabled = false
-      event_subscription.rds_event_category = 'read replica'
-      event_subscription.message = 'An error has occurred in the read replication process.'
+      event_subscription.event_id = 'RDS-EVENT-0045'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'ReplicationTerminated'
       event_subscription.enabled = false
-      event_subscription.rds_event_category = 'read replica'
-      event_subscription.message = 'Replication on the read replica was terminated.'
+      event_subscription.event_id = 'RDS-EVENT-0057'
       @event_subscriptions.push(event_subscription)
 
       event_subscription = CfnGuardian::Models::RDSInstanceEventSubscription.new(@resource)
       event_subscription.name = 'ReplicationStopped'
       event_subscription.enabled = false
-      event_subscription.rds_event_category = 'read replica'
-      event_subscription.message = 'Replication on the read replica was manually stopped.'
+      event_subscription.event_id = 'RDS-EVENT-0062'
       @event_subscriptions.push(event_subscription)
     end
 

data/lib/cfnguardian/stacks/resources.rb

@@ -112,7 +112,7 @@ module CfnGuardian
 
       def add_event_subscription(subscription)
         event_pattern = {}
-        event_pattern['detail-type'] = [subscription.detail_type]
+        event_pattern['detail-type'] = [subscription.detail_type] unless subscription.detail_type.empty?
         event_pattern['source'] = [subscription.source]
         event_pattern['resources'] = [subscription.resource_arn] unless subscription.resource_arn.empty?
         event_pattern['detail'] = subscription.detail unless subscription.detail.empty?

data/lib/cfnguardian/version.rb

@@ -1,4 +1,4 @@
 module CfnGuardian
-  VERSION = "0.11.0"
+  VERSION = "0.11.2"
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

data/lib/cfnguardian.rb

@@ -215,6 +215,7 @@ module CfnGuardian
     method_option :config, aliases: :c, type: :array, desc: "yaml config files", required: true
     method_option :region, aliases: :r, type: :string, desc: "set the AWS region"
     method_option :tags, type: :hash, desc: "additional tags on the cloudformation stack"
+    method_option :check_resources_exist, type: :boolean, default: true, desc: "check each resource exists in the aws account"
 
     def tag_alarms
       set_log_level(options[:debug])
@@ -233,7 +234,7 @@ module CfnGuardian
         tags[:'guardian:config:yaml'] = config
 
         logger.info "tagging alarms from config file #{config}"
-        compiler = CfnGuardian::Compile.new(config)
+        compiler = CfnGuardian::Compile.new(config, options[:check_resources_exist])
         compiler.get_resources
         alarms = compiler.alarms
         global_tags = compiler.global_tags.merge(tags)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-guardian
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.2
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-03-30 00:00:00.000000000 Z
+date: 2023-04-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor