cfn-nag 0.3.26 → 0.3.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/bin/cfn_nag_rules +7 -3
  3. data/bin/cfn_nag_scan +34 -17
  4. data/lib/cfn-nag.rb +3 -1
  5. data/lib/cfn-nag/cfn_nag.rb +6 -7
  6. data/lib/cfn-nag/custom_rule_loader.rb +3 -4
  7. data/lib/cfn-nag/custom_rules/CloudFormationAuthenticationRule.rb +2 -3
  8. data/lib/cfn-nag/custom_rules/CloudFrontDistributionAccessLoggingRule.rb +1 -1
  9. data/lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb +1 -1
  10. data/lib/cfn-nag/custom_rules/ElasticLoadBalancerAccessLoggingRule.rb +1 -1
  11. data/lib/cfn-nag/custom_rules/IamManagedPolicyNotActionRule.rb +1 -2
  12. data/lib/cfn-nag/custom_rules/IamManagedPolicyNotResourceRule.rb +1 -2
  13. data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardActionRule.rb +2 -3
  14. data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardResourceRule.rb +1 -2
  15. data/lib/cfn-nag/custom_rules/IamPolicyNotActionRule.rb +1 -2
  16. data/lib/cfn-nag/custom_rules/IamPolicyNotResourceRule.rb +1 -2
  17. data/lib/cfn-nag/custom_rules/IamPolicyWildcardActionRule.rb +2 -3
  18. data/lib/cfn-nag/custom_rules/IamPolicyWildcardResourceRule.rb +1 -2
  19. data/lib/cfn-nag/custom_rules/IamRoleNotActionOnPermissionsPolicyRule.rb +1 -2
  20. data/lib/cfn-nag/custom_rules/IamRoleNotActionOnTrustPolicyRule.rb +1 -2
  21. data/lib/cfn-nag/custom_rules/IamRoleNotPrincipalOnTrustPolicyRule.rb +1 -2
  22. data/lib/cfn-nag/custom_rules/IamRoleNotResourceOnPermissionsPolicyRule.rb +1 -2
  23. data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnPermissionsPolicyRule.rb +2 -3
  24. data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnTrustPolicyRule.rb +1 -4
  25. data/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb +2 -3
  26. data/lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb +1 -1
  27. data/lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb +1 -1
  28. data/lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb +1 -1
  29. data/lib/cfn-nag/custom_rules/PolicyOnUserRule.rb +1 -1
  30. data/lib/cfn-nag/custom_rules/RDSInstanceMasterUserPasswordRule.rb +3 -4
  31. data/lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb +1 -2
  32. data/lib/cfn-nag/custom_rules/S3BucketPolicyNotActionRule.rb +1 -2
  33. data/lib/cfn-nag/custom_rules/S3BucketPolicyNotPrincipalRule.rb +1 -2
  34. data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardActionRule.rb +0 -1
  35. data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardPrincipalRule.rb +0 -1
  36. data/lib/cfn-nag/custom_rules/S3BucketPublicReadAclRule.rb +0 -1
  37. data/lib/cfn-nag/custom_rules/S3BucketPublicReadWriteAclRule.rb +0 -1
  38. data/lib/cfn-nag/custom_rules/SecurityGroupEgressOpenToWorldRule.rb +1 -1
  39. data/lib/cfn-nag/custom_rules/SecurityGroupEgressPortRangeRule.rb +1 -2
  40. data/lib/cfn-nag/custom_rules/SecurityGroupIngressCidrNon32Rule.rb +1 -2
  41. data/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb +2 -2
  42. data/lib/cfn-nag/custom_rules/SecurityGroupIngressPortRangeRule.rb +1 -2
  43. data/lib/cfn-nag/custom_rules/SecurityGroupMissingEgressRule.rb +1 -2
  44. data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotActionRule.rb +2 -3
  45. data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotPrincipalRule.rb +1 -3
  46. data/lib/cfn-nag/custom_rules/SnsTopicPolicyWildcardPrincipalRule.rb +0 -1
  47. data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotActionRule.rb +1 -2
  48. data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotPrincipalRule.rb +1 -2
  49. data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardActionRule.rb +0 -1
  50. data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardPrincipalRule.rb +0 -1
  51. data/lib/cfn-nag/custom_rules/UserHasInlinePolicyRule.rb +1 -2
  52. data/lib/cfn-nag/custom_rules/UserMissingGroupRule.rb +1 -2
  53. data/lib/cfn-nag/custom_rules/WafWebAclDefaultActionRule.rb +1 -2
  54. data/lib/cfn-nag/custom_rules/base.rb +2 -3
  55. data/lib/cfn-nag/custom_rules/unencrypted_s3_put_allowed.rb +1 -1
  56. data/lib/cfn-nag/ip_addr.rb +1 -2
  57. data/lib/cfn-nag/jmes_path_discovery.rb +1 -1
  58. data/lib/cfn-nag/jmes_path_evaluator.rb +1 -1
  59. data/lib/cfn-nag/profile.rb +1 -1
  60. data/lib/cfn-nag/profile_loader.rb +1 -3
  61. data/lib/cfn-nag/result_view/json_results.rb +2 -3
  62. data/lib/cfn-nag/result_view/rules_view.rb +4 -6
  63. data/lib/cfn-nag/result_view/simple_stdout_results.rb +5 -8
  64. data/lib/cfn-nag/rule_definition.rb +4 -6
  65. data/lib/cfn-nag/rule_dumper.rb +1 -1
  66. data/lib/cfn-nag/rule_registry.rb +1 -1
  67. data/lib/cfn-nag/template_discovery.rb +8 -8
  68. data/lib/cfn-nag/violation.rb +14 -14
  69. metadata +16 -16
@@ -51,4 +51,4 @@ class JmesPathEvaluator
51
51
  end
52
52
  hash
53
53
  end
54
- end
54
+ end
@@ -14,4 +14,4 @@ class Profile
14
14
  def execute_rule?(rule_id)
15
15
  @rule_ids.include? rule_id
16
16
  end
17
- end
17
+ end
@@ -1,14 +1,12 @@
1
1
  require_relative 'profile'
2
2
 
3
3
  class ProfileLoader
4
-
5
4
  def initialize(rules_registry)
6
5
  @rules_registry = rules_registry
7
6
  end
8
7
 
9
8
  def load(profile_definition:)
10
-
11
- if profile_definition.nil? or profile_definition.strip == ''
9
+ if profile_definition.nil? || (profile_definition.strip == '')
12
10
  raise 'Empty profile'
13
11
  end
14
12
 
@@ -2,11 +2,10 @@ require 'json'
2
2
 
3
3
  class JsonResults
4
4
  def render(results)
5
-
6
5
  hashified_results = results.each do |result|
7
- result[:file_results][:violations] = result[:file_results][:violations].map { |violation| violation.to_h }
6
+ result[:file_results][:violations] = result[:file_results][:violations].map(&:to_h)
8
7
  end
9
8
 
10
9
  puts JSON.pretty_generate(hashified_results)
11
10
  end
12
- end
11
+ end
@@ -1,9 +1,7 @@
1
1
  class RulesView
2
-
3
2
  def emit(rule_registry, profile)
4
-
5
3
  puts 'WARNING VIOLATIONS:'
6
- rule_registry.warnings.sort {|left, right| sort_id(left, right) }.each do |warning|
4
+ rule_registry.warnings.sort { |left, right| sort_id(left, right) }.each do |warning|
7
5
  if profile.nil?
8
6
  puts "#{warning.id} #{warning.message}"
9
7
  else
@@ -12,7 +10,7 @@ class RulesView
12
10
  end
13
11
  puts
14
12
  puts 'FAILING VIOLATIONS:'
15
- rule_registry.failings.sort {|left, right| sort_id(left, right) }.each do |failing|
13
+ rule_registry.failings.sort { |left, right| sort_id(left, right) }.each do |failing|
16
14
  if profile.nil?
17
15
  puts "#{failing.id} #{failing.message}"
18
16
  else
@@ -24,10 +22,10 @@ class RulesView
24
22
  private
25
23
 
26
24
  def sort_id(left, right)
27
- if left.id.match /[FW][0-9]+/ and right.id.match /[FW][0-9]+/
25
+ if left.id.match(/[FW][0-9]+/) && right.id.match(/[FW][0-9]+/)
28
26
  left.id[1..-1].to_i <=> right.id[1..-1].to_i
29
27
  else
30
28
  left.id <=> right.id
31
29
  end
32
30
  end
33
- end
31
+ end
@@ -1,12 +1,11 @@
1
1
  require 'cfn-nag/violation'
2
2
 
3
3
  class SimpleStdoutResults
4
-
5
4
  def render(results)
6
5
  results.each do |result|
7
- (1..60).each { print '-' }
6
+ 60.times { print '-' }
8
7
  puts "\n" + result[:filename]
9
- (1..60).each { print '-' }
8
+ 60.times { print '-' }
10
9
 
11
10
  result[:file_results][:violations].each do |violation|
12
11
  message message_type: "#{violation.type} #{violation.id}",
@@ -24,11 +23,9 @@ class SimpleStdoutResults
24
23
  message:,
25
24
  logical_resource_ids: nil)
26
25
 
27
- if logical_resource_ids == []
28
- logical_resource_ids = nil
29
- end
26
+ logical_resource_ids = nil if logical_resource_ids == []
30
27
 
31
- (1..60).each { print '-' }
28
+ 60.times { print '-' }
32
29
  puts
33
30
  puts "| #{message_type.upcase}"
34
31
  puts '|'
@@ -40,4 +37,4 @@ class SimpleStdoutResults
40
37
  def indent_multiline_string_with_prefix(prefix, multiline_string)
41
38
  prefix + ' ' + multiline_string.gsub(/\n/, "\n#{prefix} ")
42
39
  end
43
- end
40
+ end
@@ -1,6 +1,6 @@
1
1
  class RuleDefinition
2
- WARNING = 'WARN'
3
- FAILING_VIOLATION = 'FAIL'
2
+ WARNING = 'WARN'.freeze
3
+ FAILING_VIOLATION = 'FAIL'.freeze
4
4
 
5
5
  attr_reader :id, :type, :message
6
6
 
@@ -12,9 +12,7 @@ class RuleDefinition
12
12
  @message = message
13
13
 
14
14
  [@id, @type, @message].each do |required|
15
- if required.nil?
16
- raise 'No parameters to Violation constructor can be nil'
17
- end
15
+ raise 'No parameters to Violation constructor can be nil' if required.nil?
18
16
  end
19
17
  end
20
18
 
@@ -33,4 +31,4 @@ class RuleDefinition
33
31
  def ==(other_violation)
34
32
  other_violation.class == self.class && other_violation.to_h == to_h
35
33
  end
36
- end
34
+ end
@@ -20,4 +20,4 @@ class CfnNagRuleDumper
20
20
 
21
21
  RulesView.new.emit(rule_registry, profile)
22
22
  end
23
- end
23
+ end
@@ -40,4 +40,4 @@ class RuleRegistry
40
40
  @rules << violation_def
41
41
  violation_def
42
42
  end
43
- end
43
+ end
@@ -3,13 +3,13 @@ class TemplateDiscovery
3
3
  if ::File.directory? input_json_path
4
4
  templates = find_templates_in_directory(directory: input_json_path)
5
5
  elsif ::File.file? input_json_path
6
- if input_json_path.is_a? File
7
- templates = [input_json_path.path]
8
- else
9
- templates = [input_json_path]
10
- end
6
+ templates = if input_json_path.is_a? File
7
+ [input_json_path.path]
8
+ else
9
+ [input_json_path]
10
+ end
11
11
  else
12
- fail "#{input_json_path} is not a proper path"
12
+ raise "#{input_json_path} is not a proper path"
13
13
  end
14
14
  templates
15
15
  end
@@ -17,7 +17,7 @@ class TemplateDiscovery
17
17
  private
18
18
 
19
19
  def find_templates_in_directory(directory:,
20
- cfn_extensions: %w(json yaml yml template))
20
+ cfn_extensions: %w[json yaml yml template])
21
21
 
22
22
  templates = []
23
23
  cfn_extensions.each do |cfn_extension|
@@ -25,4 +25,4 @@ class TemplateDiscovery
25
25
  end
26
26
  templates
27
27
  end
28
- end
28
+ end
@@ -19,19 +19,19 @@ class Violation < RuleDefinition
19
19
  end
20
20
 
21
21
  def to_h
22
- super.to_h.merge({
22
+ super.to_h.merge(
23
23
  logical_resource_ids: @logical_resource_ids
24
- })
24
+ )
25
25
  end
26
26
 
27
27
  def self.count_warnings(violations)
28
28
  violations.inject(0) do |count, violation|
29
29
  if violation.type == Violation::WARNING
30
- if empty?(violation.logical_resource_ids)
31
- count += 1
32
- else
33
- count += violation.logical_resource_ids.size
34
- end
30
+ count += if empty?(violation.logical_resource_ids)
31
+ 1
32
+ else
33
+ violation.logical_resource_ids.size
34
+ end
35
35
  end
36
36
  count
37
37
  end
@@ -40,11 +40,11 @@ class Violation < RuleDefinition
40
40
  def self.count_failures(violations)
41
41
  violations.inject(0) do |count, violation|
42
42
  if violation.type == Violation::FAILING_VIOLATION
43
- if empty?(violation.logical_resource_ids)
44
- count += 1
45
- else
46
- count += violation.logical_resource_ids.size
47
- end
43
+ count += if empty?(violation.logical_resource_ids)
44
+ 1
45
+ else
46
+ violation.logical_resource_ids.size
47
+ end
48
48
  end
49
49
  count
50
50
  end
@@ -53,6 +53,6 @@ class Violation < RuleDefinition
53
53
  private
54
54
 
55
55
  def self.empty?(array)
56
- array.nil? || array.size ==0
56
+ array.nil? || array.empty?
57
57
  end
58
- end
58
+ end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: cfn-nag
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.3.26
4
+ version: 0.3.29
5
5
  platform: ruby
6
6
  authors:
7
7
  - Eric Kascic
@@ -11,75 +11,75 @@ cert_chain: []
11
11
  date: 2018-03-23 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
- name: logging
14
+ name: cfn-model
15
15
  requirement: !ruby/object:Gem::Requirement
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 2.2.2
19
+ version: 0.1.22
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 2.2.2
26
+ version: 0.1.22
27
27
  - !ruby/object:Gem::Dependency
28
- name: trollop
28
+ name: jmespath
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
31
  - - '='
32
32
  - !ruby/object:Gem::Version
33
- version: 2.1.2
33
+ version: 1.3.1
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - '='
39
39
  - !ruby/object:Gem::Version
40
- version: 2.1.2
40
+ version: 1.3.1
41
41
  - !ruby/object:Gem::Dependency
42
- name: cfn-model
42
+ name: logging
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - '='
46
46
  - !ruby/object:Gem::Version
47
- version: 0.1.22
47
+ version: 2.2.2
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - '='
53
53
  - !ruby/object:Gem::Version
54
- version: 0.1.22
54
+ version: 2.2.2
55
55
  - !ruby/object:Gem::Dependency
56
- name: jmespath
56
+ name: netaddr
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
59
  - - '='
60
60
  - !ruby/object:Gem::Version
61
- version: 1.3.1
61
+ version: 1.5.1
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
66
  - - '='
67
67
  - !ruby/object:Gem::Version
68
- version: 1.3.1
68
+ version: 1.5.1
69
69
  - !ruby/object:Gem::Dependency
70
- name: netaddr
70
+ name: trollop
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
73
  - - '='
74
74
  - !ruby/object:Gem::Version
75
- version: 1.5.1
75
+ version: 2.1.2
76
76
  type: :runtime
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
80
  - - '='
81
81
  - !ruby/object:Gem::Version
82
- version: 1.5.1
82
+ version: 2.1.2
83
83
  description: Auditing tool for CloudFormation templates
84
84
  email:
85
85
  executables: