cfn-guardian 0.13.2 → 0.13.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0cc2724cc132d8d63320389df91b3c10a5f03c20ee7268196c97849e5be65c1
-  data.tar.gz: 75a0a157d81de0b56cf70736c899d902a08836bb5d8a8375854dbaca28fa531a
+  metadata.gz: 6499c49242499318fb5e91766a52219a941f2993bc6d8236734a95c47c67f392
+  data.tar.gz: 6caf244eeb6ffbf88fa299fd9c908f84f4c4866fac81a470141aa971f5a6d461
 SHA512:
-  metadata.gz: 0f512b00589c8448d1ec5cdb1f4fe9946637a13392808e22897fa4e814dc54d5b0fa6ff907283e99666115dbe4ff57d3fd3e8a18574f41cd08131e26b00d50f0
-  data.tar.gz: 32677e892cb44a0e2fab340fb2e69bae3695bb801b1d2e990d2ed4fc3f8bec46e0802f3bf844eb5a36fa7d04dd8cb8a91ff66f88d8bd0249c3c4404b2347add0
+  metadata.gz: ffbcd0281d97cc3b4ff01e4dd4de1f5cd5f3db76759a9e2b93a831d346acbd3849702d450039bd54e1031bb9782d7a3ff9109ebda738a4c18a39a425ab728fe5
+  data.tar.gz: 679154efbf9054ffabde0511df35e7b618cd602e170b687f496f6e8ec0710219badcc050a2ea5562914f5ce11e8e09eca74522ac048c200dd0b1feb2e081b670

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    cfn-guardian (0.13.2)
+    cfn-guardian (0.13.3)
       aws-sdk-cloudformation (~> 1.76, < 2)
       aws-sdk-cloudwatch (~> 1.72, < 2)
       aws-sdk-codecommit (~> 1.53, < 2)

data/docs/custom_checks/http.md

@@ -58,6 +58,7 @@ When enabled, the HTTP check Lambda (see [aws-lambda-http-check](https://github.
 | `HmacSecretSsm` | Yes | SSM Parameter Store path to the HMAC secret (SecureString). The Guardian-generated IAM role grants the Lambda `ssm:GetParameter` for this path. |
 | `HmacKeyId` | No | Key id sent in the `Key-Id` header. Default: `default`. |
 | `HmacHeaderPrefix` | No | Prefix for all HMAC header names. Default: `X-Health` (yields `X-Health-Signature`, `X-Health-Key-Id`, etc.). |
+| `HealthConfigOverrides` | No | Request-scoped health check overrides sent as the `X-Health-Config-Overrides` header. Accepts a YAML object (serialized to JSON) or a raw JSON string. Included in the HMAC signature when `HmacSecretSsm` is set. |
 
 **Example:**
 
@@ -69,6 +70,12 @@ Resources:
     HmacSecretSsm: /guardian/myapp/hmac-secret
     HmacKeyId: default
     HmacHeaderPrefix: X-Health
+    HealthConfigOverrides:
+      roles:
+        my_service:
+          probes:
+          - id: my-probe
+            enabled: false
 ```
 
 Internal HTTP checks support the same keys under each host:
@@ -118,7 +125,7 @@ If you want Guardian to call a health endpoint that only accepts HMAC-authentica
 The Lambda signs this string (newline-separated, no trailing newline):
 
 ```
-METHOD\nPATH\nTIMESTAMP\nNONCE\nQUERY\nBODY_HASH
+METHOD\nPATH\nTIMESTAMP\nNONCE\nQUERY\nBODY_HASH\nOVERRIDE_HEADER_HASH
 ```
 
 - `METHOD` – HTTP method (e.g. `GET`).
@@ -127,6 +134,7 @@ METHOD\nPATH\nTIMESTAMP\nNONCE\nQUERY\nBODY_HASH
 - `NONCE` – Same value as the `{prefix}-Nonce` header.
 - `QUERY` – Raw query string (e.g. `foo=bar` or empty).
 - `BODY_HASH` – SHA-256 hex digest of the raw request body (empty string for GET; for POST/PUT, hash the body as sent).
+- `OVERRIDE_HEADER_HASH` – SHA-256 hex digest of the raw `X-Health-Config-Overrides` header value when sent, otherwise the SHA-256 digest of an empty string (`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`).
 
 **Verification steps (pseudo code):**
 
@@ -175,6 +183,8 @@ def verify_health_request(request, secret_by_key_id, header_prefix="X-Health", m
         return False
 
     body_hash = hashlib.sha256(request.body or b"").hexdigest()
+    override_raw = request.headers.get("X-Health-Config-Overrides", "")
+    override_hash = hashlib.sha256(override_raw.encode()).hexdigest()
     canonical = "\n".join([
         request.method,
         request.path,
@@ -182,6 +192,7 @@ def verify_health_request(request, secret_by_key_id, header_prefix="X-Health", m
         nonce,
         request.query_string or "",
         body_hash,
+        override_hash,
     ])
     expected = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
     return hmac.compare_digest(expected, signature)

data/lib/cfnguardian/models/check.rb

@@ -42,7 +42,7 @@ module CfnGuardian
         @name = 'HttpCheck'
         @package = 'http-check'
         @handler = 'handler.http_check'
-        @version = '685c17ced2429954fccbf8b8b8f2132b37b3f4ff'
+        @version = '3bd07fce99eaa560f2499673d4adc24cb4d72d2c'
         @runtime = 'python3.11'
       end
     end

data/lib/cfnguardian/models/event.rb

@@ -1,3 +1,4 @@
+require 'json'
 require 'cfnguardian/string'
 
 module CfnGuardian
@@ -58,8 +59,21 @@ module CfnGuardian
         @hmac_secret_ssm = resource.fetch('HmacSecretSsm',nil)
         @hmac_key_id = resource.fetch('HmacKeyId','default')
         @hmac_header_prefix = resource.fetch('HmacHeaderPrefix','X-Health')
+        @health_config_overrides = resource.fetch('HealthConfigOverrides',nil)
         @report_response_body = resource.fetch('ReportResponseBody',false)
       end
+
+      def http_headers
+        parts = []
+        parts << @headers unless @headers.nil? || @headers.empty?
+        unless @health_config_overrides.nil?
+          override_value = @health_config_overrides.is_a?(String) ?
+            @health_config_overrides :
+            JSON.generate(@health_config_overrides)
+          parts << "X-Health-Config-Overrides=#{override_value.gsub(' ', '%20')}"
+        end
+        parts.empty? ? nil : parts.join(' ')
+      end
       
       def payload
         payload = {
@@ -69,7 +83,8 @@ module CfnGuardian
           'STATUS_CODE_MATCH' => @status_code
         }
         payload['BODY_REGEX_MATCH'] = @body_regex unless @body_regex.nil?
-        payload['HEADERS'] = @headers unless @headers.nil?
+        headers = http_headers
+        payload['HEADERS'] = headers unless headers.nil?
         payload['USER_AGENT'] = @user_agent unless @user_agent.nil?
         payload['PAYLOAD'] = @payload unless @payload.nil?
         payload['COMPRESSED'] = '1' if @compressed

data/lib/cfnguardian/version.rb

@@ -1,4 +1,4 @@
 module CfnGuardian
-  VERSION = "0.13.2"
+  VERSION = "0.13.3"
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-guardian
 version: !ruby/object:Gem::Version
-  version: 0.13.2
+  version: 0.13.3
 platform: ruby
 authors:
 - Guslington