cfn-nag 0.0.44 → 0.1.0

data/lib/cfn-nag/custom_rules/IamManagedPolicyNotResourceRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamManagedPolicyNotResourceRule < BaseRule
+
+  def rule_text
+    'IAM managed policy should not allow Allow+NotResource'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W23'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
+      !policy.policyDocument.allows_not_resource.empty?
+    end
+
+    violating_policies.map { |policy| policy.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardActionRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamManagedPolicyWildcardActionRule < BaseRule
+
+  def rule_text
+    'IAM managed policy should not allow * action'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F5'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
+      !policy.policyDocument.wildcard_allowed_actions.empty?
+    end
+
+    violating_policies.map { |policy| policy.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardResourceRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamManagedPolicyWildcardResourceRule < BaseRule
+
+  def rule_text
+    'IAM managed policy should not allow * resource'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W13'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
+      !policy.policyDocument.wildcard_allowed_resources.empty?
+    end
+
+    violating_policies.map { |policy| policy.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamPolicyNotActionRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamPolicyNotActionRule < BaseRule
+
+  def rule_text
+    'IAM policy should not allow Allow+NotAction'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W16'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
+      !policy.policyDocument.allows_not_action.empty?
+    end
+
+    violating_policies.map { |policy| policy.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamPolicyNotResourceRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamPolicyNotResourceRule < BaseRule
+
+  def rule_text
+    'IAM policy should not allow Allow+NotResource'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W22'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
+      !policy.policyDocument.allows_not_resource.empty?
+    end
+
+    violating_policies.map { |policy| policy.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamPolicyWildcardActionRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamPolicyWildcardActionRule < BaseRule
+
+  def rule_text
+    'IAM policy should not allow * action'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F4'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
+      !policy.policyDocument.wildcard_allowed_actions.empty?
+    end
+
+    violating_policies.map { |policy| policy.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamPolicyWildcardResourceRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamPolicyWildcardResourceRule < BaseRule
+
+  def rule_text
+    'IAM policy should not allow * resource'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W12'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
+      !policy.policyDocument.wildcard_allowed_resources.empty?
+    end
+
+    violating_policies.map { |policy| policy.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamRoleNotActionOnPermissionsPolicyRule.rb

@@ -0,0 +1,28 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamRoleNotActionOnPermissionsPolicyRule < BaseRule
+
+  def rule_text
+    'IAM role should not allow Allow+NotAction'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W15'
+  end
+
+  def audit_impl(cfn_model)
+    violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
+      violating_policies = role.policies.select do |policy|
+        !policy.policyDocument.allows_not_action.empty?
+      end
+      !violating_policies.empty?
+    end
+
+    violating_roles.map { |role| role.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamRoleNotActionOnTrustPolicyRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamRoleNotActionOnTrustPolicyRule < BaseRule
+
+  def rule_text
+    'IAM role should not allow Allow+NotAction on trust permissions'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W14'
+  end
+
+  def audit_impl(cfn_model)
+    violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
+      !role.assumeRolePolicyDocument.allows_not_action.empty?
+    end
+
+    violating_roles.map { |role| role.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamRoleNotPrincipalOnTrustPolicyRule.rb

@@ -0,0 +1,25 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamRoleNotPrincipalOnTrustPolicyRule < BaseRule
+
+  def rule_text
+    'IAM role should not allow Allow+NotPrincipal in its trust policy'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F6'
+  end
+
+  def audit_impl(cfn_model)
+    violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
+      !role.assumeRolePolicyDocument.allows_not_principal.empty?
+    end
+
+    violating_roles.map { |role| role.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamRoleNotResourceOnPermissionsPolicyRule.rb

@@ -0,0 +1,28 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamRoleNotResourceOnPermissionsPolicyRule < BaseRule
+
+  def rule_text
+    'IAM role should not allow Allow+NotResource'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W21'
+  end
+
+  def audit_impl(cfn_model)
+    violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
+      violating_policies = role.policies.select do |policy|
+        !policy.policyDocument.allows_not_resource.empty?
+      end
+      !violating_policies.empty?
+    end
+
+    violating_roles.map { |role| role.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnPermissionsPolicyRule.rb

@@ -0,0 +1,28 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamRoleWildcardActionOnPermissionsPolicyRule < BaseRule
+
+  def rule_text
+    'IAM role should not allow * action on its permissions policy'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F3'
+  end
+
+  def audit_impl(cfn_model)
+    violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
+      violating_policies = role.policies.select do |policy|
+        !policy.policyDocument.wildcard_allowed_actions.empty?
+      end
+      !violating_policies.empty?
+    end
+
+    violating_roles.map { |role| role.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnTrustPolicyRule.rb

@@ -0,0 +1,27 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamRoleWildcardActionOnTrustPolicyRule < BaseRule
+
+  def rule_text
+    'IAM role should not allow * action on its trust policy'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F2'
+  end
+
+  def audit_impl(cfn_model)
+    violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
+      !role.assumeRolePolicyDocument.wildcard_allowed_actions.empty?
+    end
+
+    violating_roles.map { |role| role.logical_resource_id}
+  end
+end
+
+

data/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb

@@ -0,0 +1,28 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class IamRoleWildcardResourceOnPermissionsPolicyRule < BaseRule
+
+  def rule_text
+    'IAM role should not allow * resource on its permissions policy'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W11'
+  end
+
+  def audit_impl(cfn_model)
+    violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
+      violating_policies = role.policies.select do |policy|
+        !policy.policyDocument.wildcard_allowed_resources.empty?
+      end
+      !violating_policies.empty?
+    end
+
+    violating_roles.map { |role| role.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb

@@ -0,0 +1,24 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class LambdaPermissionInvokeFunctionActionRule < BaseRule
+  def rule_text
+    'Lambda permission beside InvokeFunction might not be what you want?  Not sure!?'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W24'
+  end
+
+  def audit_impl(cfn_model)
+    violating_lambdas = cfn_model.resources_by_type('AWS::Lambda::Permission').select do |lambda_permission|
+      lambda_permission.action != 'lambda:InvokeFunction'
+    end
+
+    violating_lambdas.map { |violating_lambda| violating_lambda.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb

@@ -0,0 +1,24 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class LambdaPermissionWildcardPrincipalRule < BaseRule
+  def rule_text
+    'Lambda permission principal should not be wildcard'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F13'
+  end
+
+  def audit_impl(cfn_model)
+    violating_lambdas = cfn_model.resources_by_type('AWS::Lambda::Permission').select do |lambda_permission|
+      Principal.wildcard? lambda_permission.principal
+    end
+
+    violating_lambdas.map { |violating_lambda| violating_lambda.logical_resource_id }
+  end
+end

data/lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb

@@ -0,0 +1,24 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ManagedPolicyOnUserRule < BaseRule
+  def rule_text
+    'IAM managed policy should not apply directly to users.  Should be on group'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F12'
+  end
+
+  def audit_impl(cfn_model)
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
+      policy.users.size > 0
+    end
+
+    violating_policies.map { |violating_user| violating_user.logical_resource_id }
+  end
+end