cfn-guardian 0.10.4 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 19ef61efb4a240960a8ad0818184f1cdea82dc186ab48a7ed7c645b7b2f57a69
-  data.tar.gz: d2d6c30ea763f40b3ee726738a9c8b63a96b7844a01b0ec68aacd684f4f9f906
+  metadata.gz: 597eff7904e03dd773f5d3b2c5e9928b03ce3081f76c7dd0cf33d95e0020af3e
+  data.tar.gz: 97ad25a41db6e7c6b88d4afd5c02560a2a114e6343ad27a001ca4dde87eeef97
 SHA512:
-  metadata.gz: aba8ad3df1ba1491b4fb66532775c3383e094c6eddb957eb5fbaeab891f7624bd48547c88f247c2e089cadb91dd4ea441941bb96609d4e8879a67f1e76e0e8c5
-  data.tar.gz: 4a5bf9ea7c2649b143c881499ab5af42781703f7855d118433dc11aabef5ac6ed2905e61466b78373194a3d3282307f7d2578ae587cee5a430f560215caaa4d4
+  metadata.gz: e8f6556b639e720418edf32faf4e19e1421636ef9835e85b2f6a61de40a26712affd4d4d9f63f4d1e83f6fad6da1461c7ffcd7fb845a16f4dfffda8c285b7853
+  data.tar.gz: '068ddd35b4996594a05189ca9d6c3c232e362c951b37405e2ed9dbb0f747b77967637595a4f584177404814a77fe48268a71ce484621c42903723326bb6a0e1f'

data/Gemfile.lock

@@ -1,13 +1,16 @@
 PATH
   remote: .
   specs:
-    cfn-guardian (0.6.0)
-      aws-sdk-cloudformation (~> 1.31, < 2)
-      aws-sdk-cloudwatch (~> 1.28, < 2)
-      aws-sdk-codecommit (~> 1.28, < 2)
-      aws-sdk-codepipeline (~> 1.28, < 2)
-      aws-sdk-s3 (~> 1.60, < 2)
+    cfn-guardian (0.10.4)
+      aws-sdk-cloudformation (~> 1.76, < 2)
+      aws-sdk-cloudwatch (~> 1.72, < 2)
+      aws-sdk-codecommit (~> 1.53, < 2)
+      aws-sdk-codepipeline (~> 1.55, < 2)
+      aws-sdk-ec2 (~> 1.371, < 2)
+      aws-sdk-rds (~> 1.174, < 2)
+      aws-sdk-s3 (~> 1.119, < 2)
       cfndsl (~> 1.0, < 2)
+      rexml
       term-ansicolor (~> 1, < 2)
       terminal-table (~> 1, < 2)
       thor (~> 0.20)
@@ -15,51 +18,58 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    aws-eventstream (1.1.0)
-    aws-partitions (1.390.0)
-    aws-sdk-cloudformation (1.44.0)
-      aws-sdk-core (~> 3, >= 3.109.0)
+    aws-eventstream (1.2.0)
+    aws-partitions (1.737.0)
+    aws-sdk-cloudformation (1.76.0)
+      aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-cloudwatch (1.40.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
+    aws-sdk-cloudwatch (1.72.0)
+      aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-codecommit (1.36.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
+    aws-sdk-codecommit (1.53.0)
+      aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-codepipeline (1.33.0)
-      aws-sdk-core (~> 3, >= 3.99.0)
+    aws-sdk-codepipeline (1.55.0)
+      aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.109.2)
+    aws-sdk-core (3.171.0)
       aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.239.0)
+      aws-partitions (~> 1, >= 1.651.0)
+      aws-sigv4 (~> 1.5)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-ec2 (1.371.0)
+      aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-      jmespath (~> 1.0)
-    aws-sdk-kms (1.39.0)
-      aws-sdk-core (~> 3, >= 3.109.0)
+    aws-sdk-kms (1.63.0)
+      aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.84.0)
-      aws-sdk-core (~> 3, >= 3.109.0)
-      aws-sdk-kms (~> 1)
+    aws-sdk-rds (1.174.0)
+      aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.2.2)
+    aws-sdk-s3 (1.119.2)
+      aws-sdk-core (~> 3, >= 3.165.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.4)
+    aws-sigv4 (1.5.2)
       aws-eventstream (~> 1, >= 1.0.2)
-    cfndsl (1.2.0)
+    cfndsl (1.6.0)
       hana (~> 1.3)
-    hana (1.3.6)
-    jmespath (1.6.1)
-    rake (13.0.1)
+    hana (1.3.7)
+    jmespath (1.6.2)
+    rake (13.0.6)
+    rexml (3.2.5)
     sync (0.5.0)
     term-ansicolor (1.7.1)
       tins (~> 1.0)
     terminal-table (1.8.0)
       unicode-display_width (~> 1.1, >= 1.1.1)
     thor (0.20.3)
-    tins (1.25.0)
+    tins (1.32.1)
       sync
-    unicode-display_width (1.7.0)
+    unicode-display_width (1.8.0)
 
 PLATFORMS
-  ruby
+  x86_64-darwin-21
 
 DEPENDENCIES
   bundler (~> 2.0)
@@ -67,4 +77,4 @@ DEPENDENCIES
   rake (~> 13.0)
 
 BUNDLED WITH
-   2.0.2
+   2.3.19

data/cfn-guardian.gemspec

@@ -30,11 +30,13 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'cfndsl', '~> 1.0', '<2'
   spec.add_dependency "terminal-table", '~> 1', '<2'
   spec.add_dependency 'term-ansicolor', '~> 1', '<2'
-  spec.add_dependency 'aws-sdk-s3', '~> 1.60', '<2'
-  spec.add_dependency 'aws-sdk-cloudformation', '~> 1.31', '<2'
-  spec.add_dependency 'aws-sdk-cloudwatch', '~> 1.28', '<2'
-  spec.add_dependency 'aws-sdk-codecommit', '~> 1.28', '<2'
-  spec.add_dependency 'aws-sdk-codepipeline', '~> 1.28', '<2'
+  spec.add_dependency 'aws-sdk-s3', '~> 1.119', '<2'
+  spec.add_dependency 'aws-sdk-ec2', '~> 1.371', '<2'
+  spec.add_dependency 'aws-sdk-rds', '~> 1.174', '<2'
+  spec.add_dependency 'aws-sdk-cloudformation', '~> 1.76', '<2'
+  spec.add_dependency 'aws-sdk-cloudwatch', '~> 1.72', '<2'
+  spec.add_dependency 'aws-sdk-codecommit', '~> 1.53', '<2'
+  spec.add_dependency 'aws-sdk-codepipeline', '~> 1.55', '<2'
   
   spec.add_runtime_dependency('rexml', '>= 0')
   

data/lib/cfnguardian/cloudwatch.rb

@@ -121,7 +121,7 @@ module CfnGuardian
         client.set_alarm_state({
           alarm_name: alarm,
           state_value: "OK",
-          state_reason: "End of guardian maintenance peroid"
+          state_reason: "End of guardian maintenance period"
         })
       end
     end

data/lib/cfnguardian/compile.rb

@@ -60,7 +60,7 @@ module CfnGuardian
     
     attr_reader :cost, :resources, :topics, :global_tags
     
-    def initialize(config_file)
+    def initialize(config_file, check_resources_exist)
       config = YAML.load_file(config_file)
             
       @resource_groups = config.fetch('Resources',{})
@@ -70,6 +70,8 @@ module CfnGuardian
       @maintenance_groups = config.fetch('MaintenanceGroups', {})
       @event_subscriptions = config.fetch('EventSubscriptions', {})
       @global_tags = config.fetch('GlobalTags', {})
+      @check_resources_exist = check_resources_exist
+      @errors = []
       
       # Make sure the default topics exist if they aren't supplied in the alarms.yaml
       %w(Critical Warning Task Informational Events).each do |topic|
@@ -87,6 +89,10 @@ module CfnGuardian
     def get_resources
       @resource_groups.each do |group,resources|
         resources.each do |resource|
+          if !resource.has_key?('Id')
+            @errors << "CfnGuardian::NoIdKeyForResourceError - resource: #{resource} in resource group: #{group} doesn't have the `Id:` key"
+            next
+          end
           
           begin
             resource_class = Kernel.const_get("CfnGuardian::Resource::#{group}").new(resource)
@@ -104,6 +110,10 @@ module CfnGuardian
               next
             end
           end
+
+          if @check_resources_exist && !resource_class.resource_exists?
+            @errors << "CfnGuardian::ResourceNotExistsError - #{group} #{resource['Id']} doesn't exist"
+          end
           
           template_overides = @templates.has_key?(group) ? @templates[group] : {}
           @resources.concat resource_class.get_alarms(group,template_overides)
@@ -131,7 +141,7 @@ module CfnGuardian
               res = @resources.find {|r| 
                 (r.type == 'Alarm') && 
                 (r.group == group && r.name == alarm) &&
-                (r.resource_id == resource['Id'] || r.resource_name == resource['Name'])}
+                (r.resource_id == resource['Id'] || (!resource['Name'].nil? && r.resource_name == resource['Name']))}
 
               unless res.nil?
                 res.maintenance_groups.append("#{maintenance_group}MaintenanceGroup")
@@ -150,6 +160,10 @@ module CfnGuardian
       @ssm_parameters = @resources.select {|resource| resource.type == 'Event'}.map {|event| event.ssm_parameters}.flatten.uniq
 
       validate_resources()
+
+      if @errors.any?
+        raise CfnGuardian::ValidationError, "#{@errors.size} errors found\n[*] #{@errors.join("\n[*] ")}"
+      end
     end
     
     def alarms
@@ -157,13 +171,12 @@ module CfnGuardian
     end
 
     def validate_resources()
-      errors = []
       @resources.each do |resource|
         case resource.type
         when 'Alarm'
           %w(metric_name namespace).each do |property|
             if resource.send(property).nil?
-              errors << "Alarm #{resource.name} for resource #{resource.resource_id} has nil value for property #{property.to_camelcase}. This could be due to incorrect spelling of a default alarm name or missing property #{property.to_camelcase} on a new alarm."
+              @errors << "CfnGuardian::AlarmPropertyError - alarm #{resource.name} for resource #{resource.resource_id} has nil value for property #{property.to_camelcase}. This could be due to incorrect spelling of a default alarm name or missing property #{property.to_camelcase} on a new alarm."
             end
           end
         when 'Check'
@@ -178,8 +191,6 @@ module CfnGuardian
           # no validation check yet
         end
       end
-
-      raise CfnGuardian::ValidationError, "#{errors.size} errors found\n[*] #{errors.join("\n[*] ")}" if errors.any?
     end
     
     def compile_templates(template_file)      

data/lib/cfnguardian/resources/base.rb

@@ -84,8 +84,11 @@ module CfnGuardian::Resource
         
         alarms = find_alarms(name)
 
-        if alarms.empty?
+        if alarms.empty? && !['LogGroup'].any?(group)
           # if the alarm doesn't exist and it's not being inherited from another alarm create a new alarm
+          # and is a supported a resource group.
+          # unsupported resource groups
+          # - LogGroup: this is not required as alarms are defined in the Metric Filters object in the resource group
           resources = @resource.has_key?('Hosts') ? @resource['Hosts'] : [@resource]
           resources.each do |res|
             alarm = Kernel.const_get("CfnGuardian::Models::#{self.class.to_s.split('::').last}Alarm").new(res)
@@ -211,6 +214,10 @@ module CfnGuardian::Resource
     def get_cost()
       return @alarms.length * 0.10
     end
+
+    def resource_exists?
+      return true
+    end
     
     private
     

data/lib/cfnguardian/resources/ec2_instance.rb

@@ -1,3 +1,5 @@
+require 'aws-sdk-ec2'
+
 module CfnGuardian
   module Resource
     class Ec2Instance < Base
@@ -42,6 +44,13 @@ module CfnGuardian
         @event_subscriptions.push(event_subscription)
       end
 
+      def resource_exists?
+        client = Aws::EC2::Client.new
+        resource = Aws::EC2::Resource.new(client: client)
+        instance = resource.instance(@resource['Id'])
+        return instance.exists?
+      end
+
     end
   end
 end

data/lib/cfnguardian/resources/network_targetgroup.rb

@@ -25,6 +25,7 @@ module CfnGuardian::Resource
       alarm.threshold = 5
       alarm.evaluation_periods = 5
       alarm.treat_missing_data = 'notBreaching'
+      alarm.enabled = false
       @alarms.push(alarm)
     end
     

data/lib/cfnguardian/resources/rds_cluster.rb

@@ -16,6 +16,20 @@ module CfnGuardian::Resource
         @event_subscriptions.push(event_subscription)
       end
   
+      def resource_exists?
+        client = Aws::RDS::Client.new
+        resource = Aws::RDS::Resource.new(client: client)
+        instance = resource.db_cluster(@resource['Id'])
+  
+        begin
+          instance.load
+        rescue Aws::RDS::Errors::DBClusterNotFoundFault
+          return false
+        end
+        
+        return true
+      end
+
     end
   end
   

data/lib/cfnguardian/resources/rds_instance.rb

@@ -1,3 +1,5 @@
+require 'aws-sdk-rds'
+
 module CfnGuardian::Resource
   class RDSInstance < Base
     
@@ -123,5 +125,19 @@ module CfnGuardian::Resource
       @event_subscriptions.push(event_subscription)
     end
 
+    def resource_exists?
+      client = Aws::RDS::Client.new
+      resource = Aws::RDS::Resource.new(client: client)
+      instance = resource.db_instance(@resource['Id'])
+
+      begin
+        instance.load
+      rescue Aws::RDS::Errors::DBInstanceNotFound
+        return false
+      end
+      
+      return true
+    end
+
   end
 end

data/lib/cfnguardian/stacks/main.rb

@@ -87,7 +87,7 @@ module CfnGuardian
             Version: '2012-10-17',
             Statement: [{
               Effect: 'Allow',
-              Action: [ 'ecs:ListContainerInstances' ],
+              Action: [ 'ecs:ListContainerInstances','ecs:DescribeContainerInstances' ],
               Resource: '*'
             }]
           }

data/lib/cfnguardian/tagger.rb

@@ -27,10 +27,15 @@ module CfnGuardian
 
       if tags_changed?(current_tags, new_tags)
         logger.debug "Updating tags on alarm #{alarm_arn}"
-        @client.tag_resource({
-          resource_arn: alarm_arn,
-          tags: new_tags.map {|key,value| {key: key, value: value}}
-        })
+        new_tags.delete_if {|key, value| value.include?('?')}
+        begin
+          @client.tag_resource({
+            resource_arn: alarm_arn,
+            tags: new_tags.map {|key,value| {key: key, value: value}}
+          })
+        rescue Aws::CloudWatch::Errors::InvalidParameterValue => e
+          logger.debug "Failed due to invalid character in tags for: #{alarm_arn}"
+        end
       end
     end
 

data/lib/cfnguardian/version.rb

@@ -1,4 +1,4 @@
 module CfnGuardian
-  VERSION = "0.10.4"
+  VERSION = "0.11.0"
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

data/lib/cfnguardian.rb

@@ -45,6 +45,7 @@ module CfnGuardian
     method_option :sns_informational, type: :string, desc: "sns topic arn for the informational alarms"
     method_option :sns_events, type: :string, desc: "sns topic arn for the informational alarms"
     method_option :template_file, type: :string, default: 'guardian.compiled.yaml', desc: "name of the compiled cloudformation template file"
+    method_option :check_resources_exist, type: :boolean, default: true, desc: "check each resource exists in the aws account"
 
     def compile
       set_log_level(options[:debug])
@@ -54,7 +55,7 @@ module CfnGuardian
 
       clean_out_directory()
 
-      compiler = CfnGuardian::Compile.new(options[:config])
+      compiler = CfnGuardian::Compile.new(options[:config], options[:check_resources_exist])
       compiler.get_resources
       compiler.compile_templates(options[:template_file])
       logger.info "Cloudformation templates compiled successfully in out/ directory"
@@ -92,6 +93,7 @@ module CfnGuardian
     method_option :role_arn, type: :string, desc: "IAM role arn that CloudFormation assumes when executing the change set"
     method_option :template_file, type: :string, default: 'guardian.compiled.yaml', desc: "name of the compiled cloudformation template file"
     method_option :fail_empty_change_set, type: :boolean, default: true, desc: "fail a cloudformation changeset if it contains no changes"
+    method_option :check_resources_exist, type: :boolean, default: true, desc: "check each resource exists in the aws account"
 
     def deploy
       set_log_level(options[:debug])
@@ -101,7 +103,7 @@ module CfnGuardian
       
       clean_out_directory()
 
-      compiler = CfnGuardian::Compile.new(options[:config])
+      compiler = CfnGuardian::Compile.new(options[:config], options[:check_resources_exist])
       compiler.get_resources
       compiler.compile_templates(options[:template_file])
       parameters = compiler.load_parameters(options)
@@ -137,6 +139,7 @@ module CfnGuardian
     method_option :tags, type: :hash, desc: "additional tags on the cloudformation stack"
     method_option :role_arn, type: :string, desc: "IAM role arn that CloudFormation assumes when executing the change set"
     method_option :fail_empty_change_set, type: :boolean, default: true, desc: "fail a cloudformation changeset if it contains no changes"
+    method_option :check_resources_exist, type: :boolean, default: true, desc: "check each resource exists in the aws account"
 
     def bulk_deploy
       set_log_level(options[:debug])
@@ -156,7 +159,7 @@ module CfnGuardian
         guardian_name = config_basename == "alarms.yaml" ? "" : "-#{config_basename}"
         template_file = "guardian#{guardian_name}.#{template_file_suffix}"
 
-        compiler = CfnGuardian::Compile.new(config)
+        compiler = CfnGuardian::Compile.new(config, options[:check_resources_exist])
         compiler.get_resources
         compiler.compile_templates(template_file)
         logger.info "compiled template to out/#{template_file} from yaml config #{config}"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-guardian
 version: !ruby/object:Gem::Version
-  version: 0.10.4
+  version: 0.11.0
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-01-23 00:00:00.000000000 Z
+date: 2023-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -90,7 +90,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.60'
+        version: '1.119'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -100,7 +100,47 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.60'
+        version: '1.119'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-ec2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.371'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.371'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-rds
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.174'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.174'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -110,7 +150,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.31'
+        version: '1.76'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -120,7 +160,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.31'
+        version: '1.76'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -130,7 +170,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.28'
+        version: '1.72'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -140,7 +180,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.28'
+        version: '1.72'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -150,7 +190,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.28'
+        version: '1.53'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -160,7 +200,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.28'
+        version: '1.53'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -170,7 +210,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.28'
+        version: '1.55'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
@@ -180,7 +220,7 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.28'
+        version: '1.55'
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'