cfn-nag 0.3.50 → 0.3.51

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cc438f47aca265ffa006cf0c5e17f3159ad8e74397e92688e8b562fae9fbd42
-  data.tar.gz: 6d3bd228fb46a2ec3d195aa894649162fd21830e456af318b2930b38f3da5f4d
+  metadata.gz: 9e764bdbe8170764ddbcc2c6ed6030e2626300ef312af2284f6ba52d32158a75
+  data.tar.gz: b90488a204b909cf5decba7db589c0dc570231354a686f3713e33b056484fdb7
 SHA512:
-  metadata.gz: 00d323cfa11018ef0952f949fe94a89e8f1cae8c9173badf6d530dfc24981b473d2ce54d5165e4b1b7b27bd5bb7ffd463efd7a289bd92ebf9b2e12bd8226b40e
-  data.tar.gz: 44537e829f2162cc50159ddcd124503ab0f02d758ecfadd024dda3e8ab71b216b49ac25cb4d20a7a34349a06ed9a0a686ac5974dc71d6d7acbe7fa59b0c0c245
+  metadata.gz: 242bdde3f47c84cb12246b0c54305df8751ad927bd90a75bebf46fdf1e4ec3e6d93405906d234c2ad1f44b137fd7257a7b22969a867078a1120370d03d9818df
+  data.tar.gz: 0f87bcb3a3c6e404b972c2219b4ca93118ce30a9f2e06f792aed6c75d07b36071e3649df5b58968f54f61286606975bfeae89a87d45785abafbb8d934658fdd6

data/bin/cfn_nag

@@ -6,32 +6,44 @@ require 'json'
 require 'rubygems/specification'
 
 opts = Trollop.options do
-  usage '[options] <cloudformation template path ...>|' \
-        '<cloudformation template in STDIN>'
+  usage '[options] <cloudformation template path ...>|<cloudformation template in STDIN>'
   version Gem::Specification.find_by_name('cfn-nag').version
 
-  opt :debug, 'Enable debug output', type: :boolean, required: false,
-                                     default: false
+  opt :debug,
+      'Enable debug output',
+      type: :boolean,
+      required: false,
+      default: false
   opt :allow_suppression,
       'Allow using Metadata to suppress violations',
-      type: :boolean, required: false, default: true
-  opt :print_suppression, 'Emit suppressions to stderr', type: :boolean,
-                                                         required: false,
-                                                         default: false
-  opt :rule_directory, 'Extra rule directory', type: :io,
-                                               required: false,
-                                               default: nil
-  opt :profile_path, 'Path to a profile file', type: :io,
-                                               required: false,
-                                               default: nil
+      type: :boolean,
+      required: false,
+      default: true
+  opt :print_suppression,
+      'Emit suppressions to stderr',
+      type: :boolean,
+      required: false,
+      default: false
+  opt :rule_directory,
+      'Extra rule directory',
+      type: :io,
+      required: false,
+      default: nil
+  opt :profile_path,
+      'Path to a profile file',
+      type: :io,
+      required: false,
+      default: nil
   opt :parameter_values_path,
-      'Path to a JSON file to pull Parameter values from', type: :io,
-                                                           required: false,
-                                                           default: nil
+      'Path to a JSON file to pull Parameter values from',
+      type: :io,
+      required: false,
+      default: nil
   opt :isolate_custom_rule_exceptions,
-      'Isolate custom rule exceptions - just emit the exception ' \
-      'without stack trace and keep chugging',
-      type: :boolean, required: false, default: false
+      'Isolate custom rule exceptions - just emit the exception without stack trace and keep chugging',
+      type: :boolean,
+      required: false,
+      default: false
 end
 
 CfnNag.configure_logging(opts)

data/bin/cfn_nag_scan

@@ -8,28 +8,49 @@ require 'rubygems/specification'
 opts = Trollop.options do
   version Gem::Specification.find_by_name('cfn-nag').version
 
-  opt :input_path, 'CloudFormation template to nag on or directory of ' \
-                   'templates - all *.json, *.yaml, *.yml and *.template ' \
-                   'recursively', type: :io, required: true
-  opt :output_format, 'Format of results: [txt, json]',
-      type: :string, default: 'txt'
-  opt :debug, 'Enable debug output',
-      type: :boolean, required: false, default: false
-  opt :rule_directory, 'Extra rule directory',
-      type: :io, required: false, default: nil
-  opt :profile_path, 'Path to a profile file',
-      type: :io, required: false, default: nil
+  opt :input_path,
+      'CloudFormation template to nag on or directory of templates - all *.json, *.yaml, *.yml and *.template recursively',
+      type: :io,
+      required: true
+  opt :output_format,
+      'Format of results: [txt, json]',
+      type: :string,
+      default: 'txt'
+  opt :debug,
+      'Enable debug output',
+      type: :boolean,
+      required: false,
+      default: false
+  opt :rule_directory,
+      'Extra rule directory',
+      type: :io,
+      required: false,
+      default: nil
+  opt :profile_path,
+      'Path to a profile file',
+      type: :io,
+      required: false,
+      default: nil
   opt :parameter_values_path,
       'Path to a JSON file to pull Parameter values from',
-      type: :io, required: false, default: nil
-  opt :allow_suppression, 'Allow using Metadata to suppress violations',
-      type: :boolean, required: false, default: true
-  opt :print_suppression, 'Emit suppressions to stderr',
-      type: :boolean, required: false, default: false
+      type: :io,
+      required: false,
+      default: nil
+  opt :allow_suppression,
+      'Allow using Metadata to suppress violations',
+      type: :boolean,
+      required: false,
+      default: true
+  opt :print_suppression,
+      'Emit suppressions to stderr',
+      type: :boolean,
+      required: false,
+      default: false
   opt :isolate_custom_rule_exceptions,
-      'Isolate custom rule exceptions - just emit the exception without ' \
-      'stack trace and keep chugging',
-      type: :boolean, required: false, default: false
+      'Isolate custom rule exceptions - just emit the exception without stack trace and keep chugging',
+      type: :boolean,
+      required: false,
+      default: false
 end
 
 unless %w[txt json].include?(opts[:output_format])

data/lib/cfn-nag/cfn_nag.rb

@@ -31,9 +31,8 @@ class CfnNag
   def audit_aggregate_across_files_and_render_results(
     input_path:, output_format: 'txt', parameter_values_path: nil
   )
-    aggregate_results = \
-      audit_aggregate_across_files input_path: input_path,
-                                   parameter_values_path: parameter_values_path
+    aggregate_results = audit_aggregate_across_files input_path: input_path,
+                                                     parameter_values_path: parameter_values_path
 
     render_results(aggregate_results: aggregate_results,
                    output_format: output_format)
@@ -49,8 +48,7 @@ class CfnNag
   # Given a file or directory path, return aggregate results
   #
   def audit_aggregate_across_files(input_path:, parameter_values_path: nil)
-    parameter_values_string = \
-      parameter_values_path.nil? ? nil : IO.read(parameter_values_path)
+    parameter_values_string = parameter_values_path.nil? ? nil : IO.read(parameter_values_path)
     templates = TemplateDiscovery.new.discover_templates(input_path)
     aggregate_results = []
     templates.each do |template|

data/lib/cfn-nag/custom_rule_loader.rb

@@ -74,9 +74,9 @@ class CustomRuleLoader
   def filter_rule_classes(cfn_model, violations)
     discover_rule_classes(@rule_directory).each do |rule_class|
       begin
-        filtered_cfn_model = cfn_model_with_suppressed_resources_removed \
-          cfn_model: cfn_model, rule_id: rule_class.new.rule_id,
-          allow_suppression: @allow_suppression
+        filtered_cfn_model = cfn_model_with_suppressed_resources_removed cfn_model: cfn_model,
+                                                                         rule_id: rule_class.new.rule_id,
+                                                                         allow_suppression: @allow_suppression
         audit_result = rule_class.new.audit(filtered_cfn_model)
         violations << audit_result unless audit_result.nil?
       rescue Exception => exception
@@ -113,8 +113,7 @@ class CustomRuleLoader
       logical_resource_id = mangled_metadata.first
       mangled_rules = mangled_metadata[1]
 
-      STDERR.puts "#{logical_resource_id} has missing cfn_nag " \
-                  "suppression rule id: #{mangled_rules}"
+      STDERR.puts "#{logical_resource_id} has missing cfn_nag suppression rule id: #{mangled_rules}"
     end
   end
 
@@ -124,8 +123,7 @@ class CustomRuleLoader
       rule_to_suppress['id'] == rule_id
     end
     if found_suppression_rule && @print_suppression
-      STDERR.puts "Suppressing #{rule_id} on #{logical_resource_id} " \
-                  "for reason: #{found_suppression_rule['reason']}"
+      STDERR.puts "Suppressing #{rule_id} on #{logical_resource_id} for reason: #{found_suppression_rule['reason']}"
     end
     !found_suppression_rule.nil?
   end

data/lib/cfn-nag/custom_rules/CloudFormationAuthenticationRule.rb

@@ -4,8 +4,7 @@ require_relative 'base'
 # Rule to ensure credentials are not specified in template
 class CloudFormationAuthenticationRule < BaseRule
   def rule_text
-    'Specifying credentials in the template itself ' \
-    'is probably not the safest thing'
+    'Specifying credentials in the template itself is probably not the safest thing'
   end
 
   def rule_type

data/lib/cfn-nag/custom_rules/CloudFrontDistributionAccessLoggingRule.rb

@@ -16,11 +16,10 @@ class CloudFrontDistributionAccessLoggingRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_distributions = \
-      cfn_model.resources_by_type('AWS::CloudFront::Distribution')
-               .select do |distribution|
-        distribution.distributionConfig['Logging'].nil?
-      end
+    violating_distributions = cfn_model.resources_by_type('AWS::CloudFront::Distribution')
+                                       .select do |distribution|
+      distribution.distributionConfig['Logging'].nil?
+    end
 
     violating_distributions.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb

@@ -15,10 +15,10 @@ class EbsVolumeHasSseRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_volumes = \
-      cfn_model.resources_by_type('AWS::EC2::Volume').select do |volume|
-        volume.encrypted.nil? || volume.encrypted.to_s.casecmp('false').zero?
-      end
+    violating_volumes = cfn_model.resources_by_type('AWS::EC2::Volume')
+                                 .select do |volume|
+      volume.encrypted.nil? || volume.encrypted.to_s.casecmp('false').zero?
+    end
 
     violating_volumes.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/ElasticLoadBalancerAccessLoggingRule.rb

@@ -15,12 +15,10 @@ class ElasticLoadBalancerAccessLoggingRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_elbs = \
-      cfn_model.resources_by_type('AWS::ElasticLoadBalancing::LoadBalancer')
-               .select do |elb|
-        elb.accessLoggingPolicy.nil? ||
-          elb.accessLoggingPolicy['Enabled'] != true
-      end
+    violating_elbs = cfn_model.resources_by_type('AWS::ElasticLoadBalancing::LoadBalancer')
+                              .select do |elb|
+      elb.accessLoggingPolicy.nil? || elb.accessLoggingPolicy['Enabled'] != true
+    end
 
     violating_elbs.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/IamManagedPolicyNotActionRule.rb

@@ -15,11 +15,10 @@ class IamManagedPolicyNotActionRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_policies = \
-      cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
-               .select do |policy|
-        !policy.policy_document.allows_not_action.empty?
-      end
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
+                                  .select do |policy|
+      !policy.policy_document.allows_not_action.empty?
+    end
 
     violating_policies.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/IamManagedPolicyNotResourceRule.rb

@@ -15,11 +15,10 @@ class IamManagedPolicyNotResourceRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_policies = \
-      cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
-               .select do |policy|
-        !policy.policy_document.allows_not_resource.empty?
-      end
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
+                                  .select do |policy|
+      !policy.policy_document.allows_not_resource.empty?
+    end
 
     violating_policies.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardActionRule.rb

@@ -15,11 +15,10 @@ class IamManagedPolicyWildcardActionRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_policies = \
-      cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
-               .select do |policy|
-        !policy.policy_document.wildcard_allowed_actions.empty?
-      end
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
+                                  .select do |policy|
+      !policy.policy_document.wildcard_allowed_actions.empty?
+    end
 
     violating_policies.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardResourceRule.rb

@@ -15,11 +15,10 @@ class IamManagedPolicyWildcardResourceRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_policies = \
-      cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
-               .select do |policy|
-        !policy.policy_document.wildcard_allowed_resources.empty?
-      end
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy')
+                                  .select do |policy|
+      !policy.policy_document.wildcard_allowed_resources.empty?
+    end
 
     violating_policies.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/IamPolicyNotActionRule.rb

@@ -15,11 +15,10 @@ class IamPolicyNotActionRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_policies = \
-      cfn_model.resources_by_type('AWS::IAM::Policy')
-               .select do |policy|
-        !policy.policy_document.allows_not_action.empty?
-      end
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy')
+                                  .select do |policy|
+      !policy.policy_document.allows_not_action.empty?
+    end
 
     violating_policies.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/IamPolicyNotResourceRule.rb

@@ -15,11 +15,10 @@ class IamPolicyNotResourceRule < BaseRule
   end
 
   def audit_impl(cfn_model)
-    violating_policies = \
-      cfn_model.resources_by_type('AWS::IAM::Policy')
-               .select do |policy|
-        !policy.policy_document.allows_not_resource.empty?
-      end
+    violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy')
+                                  .select do |policy|
+      !policy.policy_document.allows_not_resource.empty?
+    end
 
     violating_policies.map(&:logical_resource_id)
   end

data/lib/cfn-nag/custom_rules/RDSInstanceMasterUsernameRule.rb

@@ -4,8 +4,7 @@ require_relative 'base'
 # cfn_nag rules related to RDS Instance master username
 class RDSInstanceMasterUsernameRule < BaseRule
   def rule_text
-    'RDS instance master username must be Ref to NoEcho Parameter. ' \
-    'Default credentials are not recommended'
+    'RDS instance master username must be Ref to NoEcho Parameter. Default credentials are not recommended'
   end
 
   def rule_type

data/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb

@@ -6,8 +6,7 @@ class SecurityGroupIngressOpenToWorldRule < BaseRule
   include IpAddr
 
   def rule_text
-    'Security Groups found with cidr open to world on ingress.  ' \
-    'This should never be true on instance.  Permissible on ELB'
+    'Security Groups found with cidr open to world on ingress.  This should never be true on instance.  Permissible on ELB'
   end
 
   def rule_type

data/lib/cfn-nag/result_view/json_results.rb

@@ -3,8 +3,7 @@ require 'json'
 class JsonResults
   def render(results)
     hashified_results = results.each do |result|
-      result[:file_results][:violations] = \
-        result[:file_results][:violations].map(&:to_h)
+      result[:file_results][:violations] = result[:file_results][:violations].map(&:to_h)
     end
 
     puts JSON.pretty_generate(hashified_results)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.3.50
+  version: 0.3.51
 platform: ruby
 authors:
 - Eric Kascic