cfn-nag 0.6.10 → 0.6.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: abfc80557991b6243d7324acf49f7f86d878a9a076e9760bd42eab6af5a02132
-  data.tar.gz: 28516fe4a3ee488d6608f85a4e4d00d30cd09464e5515b6e7da05b0c2ece771d
+  metadata.gz: 16861651aa50f0df55c1f09ab3ee2b6805a5bbe5df2553509f1728922809d878
+  data.tar.gz: ecf3c006adc7f35cd5f01246b2cb9315c029c7b86055d5ee5438fa2eeb44b68c
 SHA512:
-  metadata.gz: c59247c40157d4f5af73a09ed733e72b26e8a9d5e79e61f304bbbf91b8bba3562a2176a5c0d411755a31f98aef012500ca78e29a8546a0c4a2795e12257cae3e
-  data.tar.gz: 8f343d1a16de3fe03385a757c5b30f4944a70b7223ce116950d7fd4d95fa1f8ac55ea9a7b550d8a36c4de1aa05e05c9fae3f0cc88af1e45514185f0e9dba844f
+  metadata.gz: 640dcd9fe284f48ddcc714fc8573115062547e4e81c7b73500f7369e37392b7c4e06666ec1ac0d294d6f737d31f62be0062eaf745a1e5b640401b79ccafbf4cd
+  data.tar.gz: df569ee1ad3089fd480dd9957cc7dbca4a0d4ec469aadc81048d143f9584369987ce3de53798e3ebd2b986a1ae44f6844c32b3e9e30b242ed7938f8edf2b1799

data/lib/cfn-nag/cfn_nag.rb

@@ -135,12 +135,11 @@ class CfnNag
     )
 
     # this must come after - blacklist should always win
-    violations = filter_violations_by_blacklist(
+    filter_violations_by_blacklist(
       blacklist_definition: @config.blacklist_definition,
       rule_definitions: @config.custom_rule_loader.rule_definitions,
       violations: violations
     )
-    violations
   rescue StandardError => blacklist_or_profile_parse_error
     violations << fatal_violation(blacklist_or_profile_parse_error.to_s)
     violations

data/lib/cfn-nag/cfn_nag_config.rb

@@ -29,12 +29,6 @@ class CfnNagConfig
   end
   # rubocop:enable Metrics/ParameterLists
 
-  attr_reader :rule_arguments
-  attr_reader :rule_directory
-  attr_reader :custom_rule_loader
-  attr_reader :profile_definition
-  attr_reader :blacklist_definition
-  attr_reader :fail_on_warnings
-  attr_reader :rule_repositories
-  attr_reader :ignore_fatal
+  attr_reader :rule_arguments, :rule_directory, :custom_rule_loader, :profile_definition, :blacklist_definition, \
+              :fail_on_warnings, :rule_repositories, :ignore_fatal
 end

data/lib/cfn-nag/custom_rule_loader.rb

@@ -93,7 +93,7 @@ class CustomRuleLoader
       rescue ScriptError, StandardError => rule_error
         raise rule_error unless @isolate_custom_rule_exceptions
 
-        STDERR.puts rule_error
+        $stderr.puts rule_error
       end
     end
   end

data/lib/cfn-nag/custom_rules/DynamoDBBackupRule.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/truthy'
+require_relative 'base'
+
+class DynamoDBBackupRule < BaseRule
+  def rule_text
+    'DynamoDB table should have backup enabled, should be set using PointInTimeRecoveryEnabled'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W78'
+  end
+
+  def audit_impl(cfn_model)
+    violating_ddb_tables = cfn_model.resources_by_type('AWS::DynamoDB::Table').select do |table|
+      table.pointInTimeRecoverySpecification.nil? ||
+        !truthy?(table.pointInTimeRecoverySpecification['PointInTimeRecoveryEnabled'].to_s)
+    end
+
+    violating_ddb_tables.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/ECRRepositoryScanOnPushRule.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/truthy'
+require_relative 'base'
+
+class ECRRepositoryScanOnPushRule < BaseRule
+  def rule_text
+    'ECR Repository should have scanOnPush enabled'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W79'
+  end
+
+  def audit_impl(cfn_model)
+    violating_ecr_registries = cfn_model.resources_by_type('AWS::ECR::Repository').select do |registry|
+      registry.imageScanningConfiguration.nil? ||
+        !truthy?(registry.imageScanningConfiguration['scanOnPush'].to_s)
+    end
+
+    violating_ecr_registries.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2AccessLoggingRule.rb

@@ -29,10 +29,9 @@ class ElasticLoadBalancerV2AccessLoggingRule < BaseRule
   private
 
   def access_logging_is_false?(load_balancer)
-    false_access_log_attribute = load_balancer.loadBalancerAttributes.find do |load_balancer_attribute|
+    load_balancer.loadBalancerAttributes.find do |load_balancer_attribute|
       load_balancer_attribute['Key'] == 'access_logs.s3.enabled' && not_truthy?(load_balancer_attribute['Value'])
     end
-    false_access_log_attribute
   end
 
   def missing_access_logs?(load_balancer)

data/lib/cfn-nag/custom_rules/ElasticsearchDomainEncryptionAtRestOptionsRule.rb

@@ -2,7 +2,6 @@
 
 require 'cfn-nag/util/truthy'
 require 'cfn-nag/violation'
-require 'cfn-nag/util/truthy'
 require_relative 'base'
 
 class ElasticsearchDomainEncryptionAtRestOptionsRule < BaseRule

data/lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb

@@ -5,7 +5,7 @@ require_relative 'base'
 require 'cfn-nag/util/wildcard_patterns'
 
 class IamRolePassRoleWildcardResourceRule < BaseRule
-  IAM_ACTION_PATTERNS = wildcard_patterns('PassRole').map! { |x| 'iam:' + x } + ['*']
+  IAM_ACTION_PATTERNS = wildcard_patterns('PassRole').map! { |x| "iam:#{x}" } + ['*']
 
   def rule_text
     'IAM role should not allow * resource with PassRole action on its permissions policy'

data/lib/cfn-nag/custom_rules/LogsLogGroupRetentionRule.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/truthy'
+require_relative 'base'
+
+class LogsLogGroupRetentionRule < BaseRule
+  def rule_text
+    'CloudWatchLogs LogGroup should specify RetentionInDays to expire the log data'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W86'
+  end
+
+  def audit_impl(cfn_model)
+    violating_groups = cfn_model.resources_by_type('AWS::Logs::LogGroup').select do |group|
+      group.retentionInDays.nil?
+    end
+
+    violating_groups.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/RDSInstanceDeletionProtectionRule.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'base'
-require 'cfn-nag/util/truthy.rb'
+require 'cfn-nag/util/truthy'
 require 'cfn-nag/violation'
 
 class RDSInstanceDeletionProtectionRule < BaseRule

data/lib/cfn-nag/custom_rules/SPCMRule.rb

@@ -6,6 +6,7 @@ require_relative 'base'
 
 class SPCMRule < BaseRule
   attr_accessor :spcm_threshold
+
   DEFAULT_THRESHOLD = 25
 
   def rule_text

data/lib/cfn-nag/custom_rules/SecurityGroupEgressOpenToWorldRule.rb

@@ -25,16 +25,22 @@ class SecurityGroupEgressOpenToWorldRule < BaseRule
   def audit_impl(cfn_model)
     violating_security_groups = cfn_model.security_groups.select do |security_group|
       violating_egresses = security_group.egresses.select do |egress|
-        ip4_open?(egress) || ip6_open?(egress)
+        violating_egress(egress)
       end
 
       !violating_egresses.empty?
     end
 
     violating_egresses = cfn_model.standalone_egress.select do |standalone_egress|
-      ip4_open?(standalone_egress) || ip6_open?(standalone_egress)
+      violating_egress(standalone_egress)
     end
 
     violating_security_groups.map(&:logical_resource_id) + violating_egresses.map(&:logical_resource_id)
   end
+
+  private
+
+  def violating_egress(egress)
+    ip4_open?(egress) || ip6_open?(egress)
+  end
 end

data/lib/cfn-nag/custom_rules/SecurityGroupIngressCidrNon32Rule.rb

@@ -25,16 +25,22 @@ class SecurityGroupIngressCidrNon32Rule < BaseRule
   def audit_impl(cfn_model)
     violating_security_groups = cfn_model.security_groups.select do |security_group|
       violating_ingresses = security_group.ingresses.select do |ingress|
-        ip4_cidr_range?(ingress) || ip6_cidr_range?(ingress)
+        violating_ingress(ingress)
       end
 
       !violating_ingresses.empty?
     end
 
     violating_ingresses = cfn_model.standalone_ingress.select do |standalone_ingress|
-      ip4_cidr_range?(standalone_ingress) || ip6_cidr_range?(standalone_ingress)
+      violating_ingress(standalone_ingress)
     end
 
     violating_security_groups.map(&:logical_resource_id) + violating_ingresses.map(&:logical_resource_id)
   end
+
+  private
+
+  def violating_ingress(ingress)
+    ip4_cidr_range?(ingress) || ip6_cidr_range?(ingress)
+  end
 end

data/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb

@@ -26,16 +26,22 @@ class SecurityGroupIngressOpenToWorldRule < BaseRule
   def audit_impl(cfn_model)
     violating_security_groups = cfn_model.security_groups.select do |security_group|
       violating_ingresses = security_group.ingresses.select do |ingress|
-        ip4_open?(ingress) || ip6_open?(ingress)
+        violating_ingress(ingress)
       end
 
       !violating_ingresses.empty?
     end
 
     violating_ingresses = cfn_model.standalone_ingress.select do |standalone_ingress|
-      ip4_open?(standalone_ingress) || ip6_open?(standalone_ingress)
+      violating_ingress(standalone_ingress)
     end
 
     violating_security_groups.map(&:logical_resource_id) + violating_ingresses.map(&:logical_resource_id)
   end
+
+  private
+
+  def violating_ingress(ingress)
+    ip4_open?(ingress) || ip6_open?(ingress)
+  end
 end

data/lib/cfn-nag/custom_rules/SecurityGroupRuleDescriptionRule.rb

@@ -3,7 +3,7 @@
 require 'cfn-nag/violation'
 require_relative 'base'
 require 'cfn-nag/ip_addr'
-require 'cfn-nag/util/blank.rb'
+require 'cfn-nag/util/blank'
 
 class SecurityGroupRuleDescriptionRule < BaseRule
   def rule_text

data/lib/cfn-nag/custom_rules/boolean_base_rule.rb

@@ -2,7 +2,7 @@
 
 require 'cfn-nag/violation'
 require_relative 'base'
-require 'cfn-nag/util/truthy.rb'
+require 'cfn-nag/util/truthy'
 
 ##
 # Derive from this rule to ensure that a resource

data/lib/cfn-nag/custom_rules/passrole_base_rule.rb

@@ -5,7 +5,7 @@ require_relative 'base'
 require 'cfn-nag/util/wildcard_patterns'
 
 class PassRoleBaseRule < BaseRule
-  IAM_ACTION_PATTERNS = wildcard_patterns('PassRole').map { |pattern| 'iam:' + pattern } + ['*']
+  IAM_ACTION_PATTERNS = wildcard_patterns('PassRole').map { |pattern| "iam:#{pattern}" } + ['*']
 
   def policy_type
     raise 'must implement in subclass'

data/lib/cfn-nag/iam_complexity_metric/condition_metric.rb

@@ -41,9 +41,10 @@ class ConditionMetric
     result = []
     conditions.each do |_, expression|
       expression.each do |_, value|
-        if value.is_a? String
+        case value
+        when String
           result << value
-        elsif value.is_a? Array
+        when Array
           result += value
         end
       end

data/lib/cfn-nag/ip_addr.rb

@@ -47,9 +47,10 @@ module IpAddr
   # anything with it
   #
   def normalize_cidr_ip6(ingress)
-    if ingress.cidrIpv6.is_a?(Symbol)
+    case ingress.cidrIpv6
+    when Symbol
       ":#{ingress.cidrIpv6}"
-    elsif ingress.cidrIpv6.is_a?(String)
+    when String
       ingress.cidrIpv6
     end
   end

data/lib/cfn-nag/metadata.rb

@@ -13,7 +13,7 @@ module Metadata
       logical_resource_id = mangled_metadata.first
       mangled_rules = mangled_metadata[1]
 
-      STDERR.puts "#{logical_resource_id} has missing cfn_nag suppression rule id: #{mangled_rules}"
+      $stderr.puts "#{logical_resource_id} has missing cfn_nag suppression rule id: #{mangled_rules}"
     end
   end
 
@@ -46,7 +46,7 @@ module Metadata
     end
     if found_suppression_rule && print_suppression
       message = "Suppressing #{rule_id} on #{logical_resource_id} for reason: #{found_suppression_rule['reason']}"
-      STDERR.puts message
+      $stderr.puts message
     end
     !found_suppression_rule.nil?
   end

data/lib/cfn-nag/result_view/stdout_results.rb

@@ -27,7 +27,7 @@ class StdoutResults
   def render(results)
     results.each do |result|
       60.times { print '-' }
-      puts "\n" + result[:filename]
+      puts "\n#{result[:filename]}"
       60.times { print '-' }
 
       violations = result[:file_results][:violations]
@@ -45,6 +45,6 @@ class StdoutResults
   end
 
   def indent_multiline_string_with_prefix(prefix, multiline_string)
-    prefix + ' ' + multiline_string.gsub(/\n/, "\n#{prefix} ")
+    "#{prefix} #{multiline_string.gsub(/\n/, "\n#{prefix} ")}"
   end
 end

data/lib/cfn-nag/rule_repos/gem_based_rule_repo.rb

@@ -53,7 +53,7 @@ class GemBasedRuleRepo
     require rule_gem_name
     true
   rescue LoadError
-    STDERR.puts "Could not require #{rule_gem_name} - does the rule gem have a top level entry point?"
+    $stderr.puts "Could not require #{rule_gem_name} - does the rule gem have a top level entry point?"
     false
   end
 

data/lib/cfn-nag/rule_repository_loader.rb

@@ -33,7 +33,7 @@ class RuleRepositoryLoader
     end
 
     repo_class = class_from_name(rule_repository_definition['repo_class_name'])
-    if rule_repository_definition['repo_arguments']&.is_a?(Hash)
+    if rule_repository_definition['repo_arguments'].is_a?(Hash)
       repo_class.new(**to_sym_keys(rule_repository_definition['repo_arguments']))
     else
       repo_class.new

data/lib/cfn-nag/util/enforce_reference_parameter.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'cfn-nag/util/truthy.rb'
+require 'cfn-nag/util/truthy'
 
 # Returns false if the provided key_to_check is a no-echo parameter without a
 # default value, or pseudo parameter reference to 'AWS::NoValue'; true otherwise.

data/lib/cfn-nag/util/enforce_string_or_dynamic_reference.rb

@@ -9,17 +9,16 @@ def insecure_string_or_dynamic_reference?(_cfn_model, key_to_check)
 
   # Check if string starts with a Dynamic Reference pointing to SecretsManager
   # or SSM Secure
+  # &&
+  # Verify that the secure string ends properly with the double curly braces
   if key_to_check.start_with?(
     '{{resolve:secretsmanager:',
     '{{resolve:ssm-secure:'
-  )
-    # Verify that the secure string ends properly with the double curly braces
-    if key_to_check.end_with? '}}'
-      return false
-    end
+  ) && key_to_check.end_with?('}}')
+    return false
   end
 
-  # Retrun true if key_to_check is a string and is not calling a secured
+  # Return true if key_to_check is a string and is not calling a secured
   # dynamic reference pattern (Secrets Manager or SSM-Secure)
   true
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.6.10
+  version: 0.6.15
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-12 00:00:00.000000000 Z
+date: 2021-01-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.5.2
+        version: 0.5.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.5.2
+        version: 0.5.4
 - !ruby/object:Gem::Dependency
   name: logging
   requirement: !ruby/object:Gem::Requirement
@@ -203,6 +203,7 @@ files:
 - lib/cfn-nag/custom_rules/DirectoryServiceMicrosoftADPasswordRule.rb
 - lib/cfn-nag/custom_rules/DirectoryServiceSimpleADPasswordRule.rb
 - lib/cfn-nag/custom_rules/DocDBDBClusterMasterUserPasswordRule.rb
+- lib/cfn-nag/custom_rules/DynamoDBBackupRule.rb
 - lib/cfn-nag/custom_rules/DynamoDBBillingModeRule.rb
 - lib/cfn-nag/custom_rules/DynamoDBEncryptionRule.rb
 - lib/cfn-nag/custom_rules/EC2NetworkAclEntryDuplicateRule.rb
@@ -211,6 +212,7 @@ files:
 - lib/cfn-nag/custom_rules/EC2NetworkAclEntryPortRangeRule.rb
 - lib/cfn-nag/custom_rules/EC2NetworkAclEntryProtocolRule.rb
 - lib/cfn-nag/custom_rules/EC2SubnetMapPublicIpOnLaunchRule.rb
+- lib/cfn-nag/custom_rules/ECRRepositoryScanOnPushRule.rb
 - lib/cfn-nag/custom_rules/EFSFileSystemEncryptedRule.rb
 - lib/cfn-nag/custom_rules/EMRClusterKerberosAttributesADDomainJoinPasswordRule.rb
 - lib/cfn-nag/custom_rules/EMRClusterKerberosAttributesCrossRealmTrustPrincipalPasswordRule.rb
@@ -261,6 +263,7 @@ files:
 - lib/cfn-nag/custom_rules/LambdaPermissionEventSourceTokenRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb
+- lib/cfn-nag/custom_rules/LogsLogGroupRetentionRule.rb
 - lib/cfn-nag/custom_rules/ManagedBlockchainMemberMemberFabricConfigurationAdminPasswordRule.rb
 - lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb
 - lib/cfn-nag/custom_rules/MissingBucketPolicyRule.rb
@@ -381,7 +384,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubyforge_project: 
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: cfn-nag