cfn-nag 0.3.26 → 0.3.29

data/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class IamRoleWildcardResourceOnPermissionsPolicyRule < BaseRule
-
   def rule_text
     'IAM role should not allow * resource on its permissions policy'
   end
@@ -23,6 +22,6 @@ class IamRoleWildcardResourceOnPermissionsPolicyRule < BaseRule
       !violating_policies.empty?
     end
 
-    violating_roles.map { |role| role.logical_resource_id }
+    violating_roles.map(&:logical_resource_id)
   end
-end
+end

data/lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb

@@ -19,6 +19,6 @@ class LambdaPermissionInvokeFunctionActionRule < BaseRule
       lambda_permission.action != 'lambda:InvokeFunction'
     end
 
-    violating_lambdas.map { |violating_lambda| violating_lambda.logical_resource_id }
+    violating_lambdas.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb

@@ -20,6 +20,6 @@ class LambdaPermissionWildcardPrincipalRule < BaseRule
       LambdaPrincipal.wildcard? lambda_permission.principal
     end
 
-    violating_lambdas.map { |violating_lambda| violating_lambda.logical_resource_id }
+    violating_lambdas.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb

@@ -19,6 +19,6 @@ class ManagedPolicyOnUserRule < BaseRule
       policy.users.size > 0
     end
 
-    violating_policies.map { |violating_user| violating_user.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/PolicyOnUserRule.rb

@@ -19,6 +19,6 @@ class PolicyOnUserRule < BaseRule
       policy.users.size > 0
     end
 
-    violating_policies.map { |violating_user| violating_user.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/RDSInstanceMasterUserPasswordRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class RDSInstanceMasterUserPasswordRule < BaseRule
-
   def rule_text
     'RDS instance master user password must be Ref to NoEcho Parameter'
   end
@@ -27,7 +26,7 @@ class RDSInstanceMasterUserPasswordRule < BaseRule
       end
     end
 
-     violating_rdsinstances.map { |instance| instance.logical_resource_id }
+    violating_rdsinstances.map(&:logical_resource_id)
   end
 
   private
@@ -43,8 +42,8 @@ class RDSInstanceMasterUserPasswordRule < BaseRule
   def references_no_echo_parameter_without_default?(cfn_model, master_user_password)
     # i feel like i've written this mess somewhere before
     if master_user_password.is_a? Hash
-      if master_user_password.has_key? 'Ref'
-        if cfn_model.parameters.has_key? master_user_password['Ref']
+      if master_user_password.key? 'Ref'
+        if cfn_model.parameters.key? master_user_password['Ref']
           parameter = cfn_model.parameters[master_user_password['Ref']]
 
           return to_boolean(parameter.noEcho) && parameter.default.nil?

data/lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class RDSInstancePubliclyAccessibleRule < BaseRule
-
   def rule_text
     'RDS instance should not be publicly accessible'
   end
@@ -20,6 +19,6 @@ class RDSInstancePubliclyAccessibleRule < BaseRule
       instance.publiclyAccessible.nil? || instance.publiclyAccessible.to_s.downcase == 'true'
     end
 
-    violating_rdsinstances.map { |instance| instance.logical_resource_id }
+    violating_rdsinstances.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/S3BucketPolicyNotActionRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class S3BucketPolicyNotActionRule < BaseRule
-
   def rule_text
     'S3 Bucket policy should not allow Allow+NotAction'
   end
@@ -20,6 +19,6 @@ class S3BucketPolicyNotActionRule < BaseRule
       !policy.policy_document.allows_not_action.empty?
     end
 
-    violating_policies.map { |policy| policy.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/S3BucketPolicyNotPrincipalRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class S3BucketPolicyNotPrincipalRule < BaseRule
-
   def rule_text
     'S3 Bucket policy should not allow Allow+NotPrincipal'
   end
@@ -20,6 +19,6 @@ class S3BucketPolicyNotPrincipalRule < BaseRule
       !policy.policy_document.allows_not_principal.empty?
     end
 
-    violating_policies.map { |policy| policy.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardActionRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class S3BucketPolicyWildcardActionRule < BaseRule
-
   def rule_text
     'S3 Bucket policy should not allow * action'
   end

data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardPrincipalRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class S3BucketPolicyWildcardPrincipalRule < BaseRule
-
   def rule_text
     'S3 Bucket policy should not allow * principal'
   end

data/lib/cfn-nag/custom_rules/S3BucketPublicReadAclRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class S3BucketPublicReadAclRule < BaseRule
-
   def rule_text
     'S3 Bucket likely should not have a public read acl'
   end

data/lib/cfn-nag/custom_rules/S3BucketPublicReadWriteAclRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class S3BucketPublicReadWriteAclRule < BaseRule
-
   def rule_text
     'S3 Bucket should not have a public read-write acl'
   end

data/lib/cfn-nag/custom_rules/SecurityGroupEgressOpenToWorldRule.rb

@@ -35,6 +35,6 @@ class SecurityGroupEgressOpenToWorldRule < BaseRule
       ip4_open?(standalone_egress) || ip6_open?(standalone_egress)
     end
 
-    logical_resource_ids + violating_egresses.map { |egress| egress.logical_resource_id}
+    logical_resource_ids + violating_egresses.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/SecurityGroupEgressPortRangeRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SecurityGroupEgressPortRangeRule < BaseRule
-
   def rule_text
     'Security Groups found egress with port range instead of just a single port'
   end
@@ -33,6 +32,6 @@ class SecurityGroupEgressPortRangeRule < BaseRule
       standalone_egress.fromPort != standalone_egress.toPort
     end
 
-    logical_resource_ids + violating_egresses.map { |egress| egress.logical_resource_id}
+    logical_resource_ids + violating_egresses.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/SecurityGroupIngressCidrNon32Rule.rb

@@ -35,7 +35,6 @@ class SecurityGroupIngressCidrNon32Rule < BaseRule
       ip4_cidr_range?(standalone_ingress) || ip6_cidr_range?(standalone_ingress)
     end
 
-    logical_resource_ids + violating_ingresses.map { |ingress| ingress.logical_resource_id}
+    logical_resource_ids + violating_ingresses.map(&:logical_resource_id)
   end
 end
-

data/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb

@@ -4,7 +4,7 @@ require 'cfn-nag/ip_addr'
 
 class SecurityGroupIngressOpenToWorldRule < BaseRule
   include IpAddr
-  
+
   def rule_text
     'Security Groups found with cidr open to world on ingress.  This should never be true on instance.  Permissible on ELB'
   end
@@ -35,6 +35,6 @@ class SecurityGroupIngressOpenToWorldRule < BaseRule
       ip4_open?(standalone_ingress) || ip6_open?(standalone_ingress)
     end
 
-    logical_resource_ids + violating_ingresses.map { |ingress| ingress.logical_resource_id}
+    logical_resource_ids + violating_ingresses.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/SecurityGroupIngressPortRangeRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SecurityGroupIngressPortRangeRule < BaseRule
-
   def rule_text
     'Security Groups found ingress with port range instead of just a single port'
   end
@@ -33,6 +32,6 @@ class SecurityGroupIngressPortRangeRule < BaseRule
       standalone_ingress.fromPort != standalone_ingress.toPort
     end
 
-    logical_resource_ids + violating_ingresses.map { |ingress| ingress.logical_resource_id}
+    logical_resource_ids + violating_ingresses.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/SecurityGroupMissingEgressRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SecurityGroupMissingEgressRule < BaseRule
-
   def rule_text
     'Missing egress rule means all traffic is allowed outbound.  Make this explicit if it is desired configuration'
   end
@@ -25,4 +24,4 @@ class SecurityGroupMissingEgressRule < BaseRule
 
     logical_resource_ids
   end
-end
+end

data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotActionRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SnsTopicPolicyNotActionRule < BaseRule
-
   def rule_text
     'SNS Topic policy should not allow Allow+NotAction'
   end
@@ -20,6 +19,6 @@ class SnsTopicPolicyNotActionRule < BaseRule
       !policy.policy_document.allows_not_action.empty?
     end
 
-    violating_policies.map { |policy| policy.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
-end
+end

data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotPrincipalRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SnsTopicPolicyNotPrincipalRule < BaseRule
-
   def rule_text
     'SNS Topic policy should not allow Allow+NotPrincipal'
   end
@@ -20,7 +19,6 @@ class SnsTopicPolicyNotPrincipalRule < BaseRule
       !policy.policy_document.allows_not_principal.empty?
     end
 
-    violating_policies.map { |policy| policy.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
 end
-

data/lib/cfn-nag/custom_rules/SnsTopicPolicyWildcardPrincipalRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SnsTopicPolicyWildcardPrincipalRule < BaseRule
-
   def rule_text
     'SNS topic policy should not allow * principal'
   end

data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotActionRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SqsQueuePolicyNotActionRule < BaseRule
-
   def rule_text
     'SQS Queue policy should not allow Allow+NotAction'
   end
@@ -20,6 +19,6 @@ class SqsQueuePolicyNotActionRule < BaseRule
       !policy.policy_document.allows_not_action.empty?
     end
 
-    violating_policies.map { |policy| policy.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotPrincipalRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SqsQueuePolicyNotPrincipalRule < BaseRule
-
   def rule_text
     'SQS Queue policy should not allow Allow+NotPrincipal'
   end
@@ -20,6 +19,6 @@ class SqsQueuePolicyNotPrincipalRule < BaseRule
       !policy.policy_document.allows_not_principal.empty?
     end
 
-    violating_policies.map { |policy| policy.logical_resource_id }
+    violating_policies.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardActionRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SqsQueuePolicyWildcardActionRule < BaseRule
-
   def rule_text
     'SQS Queue policy should not allow * action'
   end

data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardPrincipalRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class SqsQueuePolicyWildcardPrincipalRule < BaseRule
-
   def rule_text
     'SQS Queue policy should not allow * principal'
   end

data/lib/cfn-nag/custom_rules/UserHasInlinePolicyRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class UserHasInlinePolicyRule < BaseRule
-
   def rule_text
     'IAM user should not have any inline policies.  Should be centralized Policy object on group'
   end
@@ -20,6 +19,6 @@ class UserHasInlinePolicyRule < BaseRule
       iam_user.policy_objects.size > 0
     end
 
-    violating_users.map { |violating_user| violating_user.logical_resource_id }
+    violating_users.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/UserMissingGroupRule.rb

@@ -2,7 +2,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class UserMissingGroupRule < BaseRule
-
   def rule_text
     'User is not assigned to a group'
   end
@@ -25,4 +24,4 @@ class UserMissingGroupRule < BaseRule
 
     logical_resource_ids
   end
-end
+end

data/lib/cfn-nag/custom_rules/WafWebAclDefaultActionRule.rb

@@ -11,7 +11,6 @@ require 'cfn-nag/violation'
 require_relative 'base'
 
 class WafWebAclDefaultActionRule < BaseRule
-
   def rule_text
     'WebAcl DefaultAction should not be ALLOW'
   end
@@ -29,6 +28,6 @@ class WafWebAclDefaultActionRule < BaseRule
       web_acl.defaultAction['Type'] == 'ALLOW'
     end
 
-    violating_web_acls.map { |web_acl| web_acl.logical_resource_id }
+    violating_web_acls.map(&:logical_resource_id)
   end
 end

data/lib/cfn-nag/custom_rules/base.rb

@@ -1,11 +1,10 @@
 require 'cfn-nag/violation'
 
 class BaseRule
-
   ##
   # Returns a collection of logical resource ids
   #
-  def audit_impl(cfn_model)
+  def audit_impl(_cfn_model)
     raise 'must implement in subclass'
   end
 
@@ -25,4 +24,4 @@ class BaseRule
       nil
     end
   end
-end
+end

data/lib/cfn-nag/custom_rules/unencrypted_s3_put_allowed.rb

@@ -55,4 +55,4 @@
 #         S3BucketPolicy::condition_includes?(statement, encryption_condition) and
 #         statement['Principal'] == '*'
 #   end
-# end
+# end

data/lib/cfn-nag/ip_addr.rb

@@ -6,7 +6,6 @@ module IpAddr
     ingress.cidrIp.is_a?(String) && ingress.cidrIp == '0.0.0.0/0'
   end
 
-
   def ip6_open?(ingress)
     normalized_cidr_ip6 = normalize_cidr_ip6(ingress)
     return false if normalized_cidr_ip6.nil?
@@ -41,4 +40,4 @@ module IpAddr
       nil
     end
   end
-end
+end

data/lib/cfn-nag/jmes_path_discovery.rb

@@ -14,4 +14,4 @@ class JmesPathDiscovery
                               type: Violation::FAILING_VIOLATION,
                               message: message)
   end
-end
+end