cfn-nag 0.3.26 → 0.3.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/bin/cfn_nag_rules +7 -3
- data/bin/cfn_nag_scan +34 -17
- data/lib/cfn-nag.rb +3 -1
- data/lib/cfn-nag/cfn_nag.rb +6 -7
- data/lib/cfn-nag/custom_rule_loader.rb +3 -4
- data/lib/cfn-nag/custom_rules/CloudFormationAuthenticationRule.rb +2 -3
- data/lib/cfn-nag/custom_rules/CloudFrontDistributionAccessLoggingRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/ElasticLoadBalancerAccessLoggingRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/IamManagedPolicyNotActionRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamManagedPolicyNotResourceRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardActionRule.rb +2 -3
- data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardResourceRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamPolicyNotActionRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamPolicyNotResourceRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamPolicyWildcardActionRule.rb +2 -3
- data/lib/cfn-nag/custom_rules/IamPolicyWildcardResourceRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamRoleNotActionOnPermissionsPolicyRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamRoleNotActionOnTrustPolicyRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamRoleNotPrincipalOnTrustPolicyRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamRoleNotResourceOnPermissionsPolicyRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnPermissionsPolicyRule.rb +2 -3
- data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnTrustPolicyRule.rb +1 -4
- data/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb +2 -3
- data/lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/PolicyOnUserRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/RDSInstanceMasterUserPasswordRule.rb +3 -4
- data/lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/S3BucketPolicyNotActionRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/S3BucketPolicyNotPrincipalRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardActionRule.rb +0 -1
- data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardPrincipalRule.rb +0 -1
- data/lib/cfn-nag/custom_rules/S3BucketPublicReadAclRule.rb +0 -1
- data/lib/cfn-nag/custom_rules/S3BucketPublicReadWriteAclRule.rb +0 -1
- data/lib/cfn-nag/custom_rules/SecurityGroupEgressOpenToWorldRule.rb +1 -1
- data/lib/cfn-nag/custom_rules/SecurityGroupEgressPortRangeRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/SecurityGroupIngressCidrNon32Rule.rb +1 -2
- data/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb +2 -2
- data/lib/cfn-nag/custom_rules/SecurityGroupIngressPortRangeRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/SecurityGroupMissingEgressRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotActionRule.rb +2 -3
- data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotPrincipalRule.rb +1 -3
- data/lib/cfn-nag/custom_rules/SnsTopicPolicyWildcardPrincipalRule.rb +0 -1
- data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotActionRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotPrincipalRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardActionRule.rb +0 -1
- data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardPrincipalRule.rb +0 -1
- data/lib/cfn-nag/custom_rules/UserHasInlinePolicyRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/UserMissingGroupRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/WafWebAclDefaultActionRule.rb +1 -2
- data/lib/cfn-nag/custom_rules/base.rb +2 -3
- data/lib/cfn-nag/custom_rules/unencrypted_s3_put_allowed.rb +1 -1
- data/lib/cfn-nag/ip_addr.rb +1 -2
- data/lib/cfn-nag/jmes_path_discovery.rb +1 -1
- data/lib/cfn-nag/jmes_path_evaluator.rb +1 -1
- data/lib/cfn-nag/profile.rb +1 -1
- data/lib/cfn-nag/profile_loader.rb +1 -3
- data/lib/cfn-nag/result_view/json_results.rb +2 -3
- data/lib/cfn-nag/result_view/rules_view.rb +4 -6
- data/lib/cfn-nag/result_view/simple_stdout_results.rb +5 -8
- data/lib/cfn-nag/rule_definition.rb +4 -6
- data/lib/cfn-nag/rule_dumper.rb +1 -1
- data/lib/cfn-nag/rule_registry.rb +1 -1
- data/lib/cfn-nag/template_discovery.rb +8 -8
- data/lib/cfn-nag/violation.rb +14 -14
- metadata +16 -16
data/lib/cfn-nag/profile.rb
CHANGED
@@ -1,14 +1,12 @@
|
|
1
1
|
require_relative 'profile'
|
2
2
|
|
3
3
|
class ProfileLoader
|
4
|
-
|
5
4
|
def initialize(rules_registry)
|
6
5
|
@rules_registry = rules_registry
|
7
6
|
end
|
8
7
|
|
9
8
|
def load(profile_definition:)
|
10
|
-
|
11
|
-
if profile_definition.nil? or profile_definition.strip == ''
|
9
|
+
if profile_definition.nil? || (profile_definition.strip == '')
|
12
10
|
raise 'Empty profile'
|
13
11
|
end
|
14
12
|
|
@@ -2,11 +2,10 @@ require 'json'
|
|
2
2
|
|
3
3
|
class JsonResults
|
4
4
|
def render(results)
|
5
|
-
|
6
5
|
hashified_results = results.each do |result|
|
7
|
-
result[:file_results][:violations] = result[:file_results][:violations].map
|
6
|
+
result[:file_results][:violations] = result[:file_results][:violations].map(&:to_h)
|
8
7
|
end
|
9
8
|
|
10
9
|
puts JSON.pretty_generate(hashified_results)
|
11
10
|
end
|
12
|
-
end
|
11
|
+
end
|
@@ -1,9 +1,7 @@
|
|
1
1
|
class RulesView
|
2
|
-
|
3
2
|
def emit(rule_registry, profile)
|
4
|
-
|
5
3
|
puts 'WARNING VIOLATIONS:'
|
6
|
-
rule_registry.warnings.sort {|left, right| sort_id(left, right) }.each do |warning|
|
4
|
+
rule_registry.warnings.sort { |left, right| sort_id(left, right) }.each do |warning|
|
7
5
|
if profile.nil?
|
8
6
|
puts "#{warning.id} #{warning.message}"
|
9
7
|
else
|
@@ -12,7 +10,7 @@ class RulesView
|
|
12
10
|
end
|
13
11
|
puts
|
14
12
|
puts 'FAILING VIOLATIONS:'
|
15
|
-
rule_registry.failings.sort {|left, right| sort_id(left, right) }.each do |failing|
|
13
|
+
rule_registry.failings.sort { |left, right| sort_id(left, right) }.each do |failing|
|
16
14
|
if profile.nil?
|
17
15
|
puts "#{failing.id} #{failing.message}"
|
18
16
|
else
|
@@ -24,10 +22,10 @@ class RulesView
|
|
24
22
|
private
|
25
23
|
|
26
24
|
def sort_id(left, right)
|
27
|
-
if left.id.match
|
25
|
+
if left.id.match(/[FW][0-9]+/) && right.id.match(/[FW][0-9]+/)
|
28
26
|
left.id[1..-1].to_i <=> right.id[1..-1].to_i
|
29
27
|
else
|
30
28
|
left.id <=> right.id
|
31
29
|
end
|
32
30
|
end
|
33
|
-
end
|
31
|
+
end
|
@@ -1,12 +1,11 @@
|
|
1
1
|
require 'cfn-nag/violation'
|
2
2
|
|
3
3
|
class SimpleStdoutResults
|
4
|
-
|
5
4
|
def render(results)
|
6
5
|
results.each do |result|
|
7
|
-
|
6
|
+
60.times { print '-' }
|
8
7
|
puts "\n" + result[:filename]
|
9
|
-
|
8
|
+
60.times { print '-' }
|
10
9
|
|
11
10
|
result[:file_results][:violations].each do |violation|
|
12
11
|
message message_type: "#{violation.type} #{violation.id}",
|
@@ -24,11 +23,9 @@ class SimpleStdoutResults
|
|
24
23
|
message:,
|
25
24
|
logical_resource_ids: nil)
|
26
25
|
|
27
|
-
if logical_resource_ids == []
|
28
|
-
logical_resource_ids = nil
|
29
|
-
end
|
26
|
+
logical_resource_ids = nil if logical_resource_ids == []
|
30
27
|
|
31
|
-
|
28
|
+
60.times { print '-' }
|
32
29
|
puts
|
33
30
|
puts "| #{message_type.upcase}"
|
34
31
|
puts '|'
|
@@ -40,4 +37,4 @@ class SimpleStdoutResults
|
|
40
37
|
def indent_multiline_string_with_prefix(prefix, multiline_string)
|
41
38
|
prefix + ' ' + multiline_string.gsub(/\n/, "\n#{prefix} ")
|
42
39
|
end
|
43
|
-
end
|
40
|
+
end
|
@@ -1,6 +1,6 @@
|
|
1
1
|
class RuleDefinition
|
2
|
-
WARNING = 'WARN'
|
3
|
-
FAILING_VIOLATION = 'FAIL'
|
2
|
+
WARNING = 'WARN'.freeze
|
3
|
+
FAILING_VIOLATION = 'FAIL'.freeze
|
4
4
|
|
5
5
|
attr_reader :id, :type, :message
|
6
6
|
|
@@ -12,9 +12,7 @@ class RuleDefinition
|
|
12
12
|
@message = message
|
13
13
|
|
14
14
|
[@id, @type, @message].each do |required|
|
15
|
-
if required.nil?
|
16
|
-
raise 'No parameters to Violation constructor can be nil'
|
17
|
-
end
|
15
|
+
raise 'No parameters to Violation constructor can be nil' if required.nil?
|
18
16
|
end
|
19
17
|
end
|
20
18
|
|
@@ -33,4 +31,4 @@ class RuleDefinition
|
|
33
31
|
def ==(other_violation)
|
34
32
|
other_violation.class == self.class && other_violation.to_h == to_h
|
35
33
|
end
|
36
|
-
end
|
34
|
+
end
|
data/lib/cfn-nag/rule_dumper.rb
CHANGED
@@ -3,13 +3,13 @@ class TemplateDiscovery
|
|
3
3
|
if ::File.directory? input_json_path
|
4
4
|
templates = find_templates_in_directory(directory: input_json_path)
|
5
5
|
elsif ::File.file? input_json_path
|
6
|
-
if input_json_path.is_a? File
|
7
|
-
|
8
|
-
|
9
|
-
|
10
|
-
|
6
|
+
templates = if input_json_path.is_a? File
|
7
|
+
[input_json_path.path]
|
8
|
+
else
|
9
|
+
[input_json_path]
|
10
|
+
end
|
11
11
|
else
|
12
|
-
|
12
|
+
raise "#{input_json_path} is not a proper path"
|
13
13
|
end
|
14
14
|
templates
|
15
15
|
end
|
@@ -17,7 +17,7 @@ class TemplateDiscovery
|
|
17
17
|
private
|
18
18
|
|
19
19
|
def find_templates_in_directory(directory:,
|
20
|
-
cfn_extensions: %w
|
20
|
+
cfn_extensions: %w[json yaml yml template])
|
21
21
|
|
22
22
|
templates = []
|
23
23
|
cfn_extensions.each do |cfn_extension|
|
@@ -25,4 +25,4 @@ class TemplateDiscovery
|
|
25
25
|
end
|
26
26
|
templates
|
27
27
|
end
|
28
|
-
end
|
28
|
+
end
|
data/lib/cfn-nag/violation.rb
CHANGED
@@ -19,19 +19,19 @@ class Violation < RuleDefinition
|
|
19
19
|
end
|
20
20
|
|
21
21
|
def to_h
|
22
|
-
super.to_h.merge(
|
22
|
+
super.to_h.merge(
|
23
23
|
logical_resource_ids: @logical_resource_ids
|
24
|
-
|
24
|
+
)
|
25
25
|
end
|
26
26
|
|
27
27
|
def self.count_warnings(violations)
|
28
28
|
violations.inject(0) do |count, violation|
|
29
29
|
if violation.type == Violation::WARNING
|
30
|
-
if empty?(violation.logical_resource_ids)
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
30
|
+
count += if empty?(violation.logical_resource_ids)
|
31
|
+
1
|
32
|
+
else
|
33
|
+
violation.logical_resource_ids.size
|
34
|
+
end
|
35
35
|
end
|
36
36
|
count
|
37
37
|
end
|
@@ -40,11 +40,11 @@ class Violation < RuleDefinition
|
|
40
40
|
def self.count_failures(violations)
|
41
41
|
violations.inject(0) do |count, violation|
|
42
42
|
if violation.type == Violation::FAILING_VIOLATION
|
43
|
-
if empty?(violation.logical_resource_ids)
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
43
|
+
count += if empty?(violation.logical_resource_ids)
|
44
|
+
1
|
45
|
+
else
|
46
|
+
violation.logical_resource_ids.size
|
47
|
+
end
|
48
48
|
end
|
49
49
|
count
|
50
50
|
end
|
@@ -53,6 +53,6 @@ class Violation < RuleDefinition
|
|
53
53
|
private
|
54
54
|
|
55
55
|
def self.empty?(array)
|
56
|
-
array.nil? || array.
|
56
|
+
array.nil? || array.empty?
|
57
57
|
end
|
58
|
-
end
|
58
|
+
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: cfn-nag
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.3.
|
4
|
+
version: 0.3.29
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Eric Kascic
|
@@ -11,75 +11,75 @@ cert_chain: []
|
|
11
11
|
date: 2018-03-23 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
-
name:
|
14
|
+
name: cfn-model
|
15
15
|
requirement: !ruby/object:Gem::Requirement
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version:
|
19
|
+
version: 0.1.22
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version:
|
26
|
+
version: 0.1.22
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
|
-
name:
|
28
|
+
name: jmespath
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
30
30
|
requirements:
|
31
31
|
- - '='
|
32
32
|
- !ruby/object:Gem::Version
|
33
|
-
version:
|
33
|
+
version: 1.3.1
|
34
34
|
type: :runtime
|
35
35
|
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
38
|
- - '='
|
39
39
|
- !ruby/object:Gem::Version
|
40
|
-
version:
|
40
|
+
version: 1.3.1
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
|
-
name:
|
42
|
+
name: logging
|
43
43
|
requirement: !ruby/object:Gem::Requirement
|
44
44
|
requirements:
|
45
45
|
- - '='
|
46
46
|
- !ruby/object:Gem::Version
|
47
|
-
version:
|
47
|
+
version: 2.2.2
|
48
48
|
type: :runtime
|
49
49
|
prerelease: false
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
52
|
- - '='
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version:
|
54
|
+
version: 2.2.2
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
|
-
name:
|
56
|
+
name: netaddr
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
58
58
|
requirements:
|
59
59
|
- - '='
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: 1.
|
61
|
+
version: 1.5.1
|
62
62
|
type: :runtime
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
66
|
- - '='
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: 1.
|
68
|
+
version: 1.5.1
|
69
69
|
- !ruby/object:Gem::Dependency
|
70
|
-
name:
|
70
|
+
name: trollop
|
71
71
|
requirement: !ruby/object:Gem::Requirement
|
72
72
|
requirements:
|
73
73
|
- - '='
|
74
74
|
- !ruby/object:Gem::Version
|
75
|
-
version: 1.
|
75
|
+
version: 2.1.2
|
76
76
|
type: :runtime
|
77
77
|
prerelease: false
|
78
78
|
version_requirements: !ruby/object:Gem::Requirement
|
79
79
|
requirements:
|
80
80
|
- - '='
|
81
81
|
- !ruby/object:Gem::Version
|
82
|
-
version: 1.
|
82
|
+
version: 2.1.2
|
83
83
|
description: Auditing tool for CloudFormation templates
|
84
84
|
email:
|
85
85
|
executables:
|