cfn-nag 0.7.1 → 0.7.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ab64ee30c8cf02fc68ce82e0dfae7646e6bb55efce33e8dd580079ca66c05f3
-  data.tar.gz: 84ac64c3a0e15b7c1fded2d39c43831111cfc67cc4db8fd33ec67884876c1530
+  metadata.gz: 59c999774eab0a7ebd00d06aa55d9080218683d60a8a6a0eed160ffe5171617b
+  data.tar.gz: 4eb14549c72fe44b27941a90793c8a52271f5fcf4a9c7799b29c0800be2fd815
 SHA512:
-  metadata.gz: e6c6d54d97489a231e4e74c66317924d81893d4ed86785c6d3ec3160de260fae25917a6fe42920a333b2765162b2a7a919c4b817f6d66ad99eb4ce0e6b04fb6d
-  data.tar.gz: d163a820d2e9f75d518df8ad5cf2cc73e5f4cb326b60309e51007a5c6b426bf0985939c8f3fb230aafeb0940d62ab639927dea2997f177860ba079b159b7409c
+  metadata.gz: ff895bb892baaae4b1143daeac5c1dde170635e7c627ec3cd09249b28bfdc7b1eb37c71da271306552b03cfae080e4cf272d006536441531328a40c98f73f10c
+  data.tar.gz: 56289bf3957389c76477eb1b9fb32d44262b1bf98d711812f8f44bd078b93e5efe6d216cc519711a0a0303bc88bd90526f9e244a76f3e752af24d60ac8dee805

data/lib/cfn-nag/custom_rules/ApiGatewayCacheEncryptedRule.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ApiGatewayCacheEncryptedRule < BaseRule
+  def rule_text
+    'ApiGateway Deployment should have cache data encryption enabled when caching is enabled' \
+    ' in StageDescription properties'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W87'
+  end
+
+  def audit_impl(cfn_model)
+    violating_deployments = cfn_model.resources_by_type('AWS::ApiGateway::Deployment').select do |deployment|
+      violating_deployment?(deployment)
+    end
+
+    violating_deployments.map(&:logical_resource_id)
+  end
+
+  private
+
+  def violating_deployment?(deployment)
+    !deployment.stageDescription.nil? && truthy?(deployment.stageDescription['CachingEnabled']) \
+    && !truthy?(deployment.stageDescription['CacheDataEncrypted'])
+  end
+end

data/lib/cfn-nag/custom_rules/CloudfrontMinimumProtocolVersionRule.rb

@@ -28,11 +28,12 @@ class CloudfrontMinimumProtocolVersionRule < BaseRule
   private
 
   def tls_version?(viewer_certificate)
-    cert_has_bad_tls_version?(viewer_certificate) || override_tls_config?(viewer_certificate)
+    cert_has_bad_tls_version?(viewer_certificate['MinimumProtocolVersion']) || override_tls_config?(viewer_certificate)
   end
 
-  def cert_has_bad_tls_version?(viewer_certificate)
-    viewer_certificate['MinimumProtocolVersion'].nil? || viewer_certificate['MinimumProtocolVersion'] != 'TLSv1.2_2018'
+  def cert_has_bad_tls_version?(min_protocol_version)
+    min_protocol_version.nil? ||
+      (min_protocol_version.is_a?(String) && !min_protocol_version.start_with?('TLSv1.2'))
   end
 
   def override_tls_config?(viewer_certificate)

data/lib/cfn-nag/custom_rules/ECRRepositoryScanOnPushRule.rb

@@ -6,7 +6,7 @@ require_relative 'base'
 
 class ECRRepositoryScanOnPushRule < BaseRule
   def rule_text
-    'ECR Repository should have scanOnPush enabled'
+    'ECR Repository should have ScanOnPush enabled'
   end
 
   def rule_type
@@ -20,7 +20,7 @@ class ECRRepositoryScanOnPushRule < BaseRule
   def audit_impl(cfn_model)
     violating_ecr_registries = cfn_model.resources_by_type('AWS::ECR::Repository').select do |registry|
       registry.imageScanningConfiguration.nil? ||
-        !truthy?(registry.imageScanningConfiguration['scanOnPush'].to_s)
+        !truthy?(registry.imageScanningConfiguration['ScanOnPush'].to_s)
     end
 
     violating_ecr_registries.map(&:logical_resource_id)

data/lib/cfn-nag/custom_rules/KinesisFirehoseDeliveryStreamEncryptionRule.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class KinesisFirehoseDeliveryStreamEncryptionRule < BaseRule
+  def rule_text
+    'Kinesis Firehose DeliveryStream of type DirectPut should specify SSE.'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W88'
+  end
+
+  def audit_impl(cfn_model)
+    violating_delivery_streams =
+      cfn_model.resources_by_type('AWS::KinesisFirehose::DeliveryStream').select do |delivery_stream|
+        violating_delivery_stream?(delivery_stream)
+      end
+
+    violating_delivery_streams.map(&:logical_resource_id)
+  end
+
+  private
+
+  def violating_delivery_stream?(delivery_stream)
+    if delivery_stream.deliveryStreamType == 'KinesisStreamAsSource'
+      false
+    elsif delivery_stream.deliveryStreamEncryptionConfigurationInput.nil?
+      true
+    else
+      delivery_stream.deliveryStreamEncryptionConfigurationInput['KeyType'].nil?
+    end
+  end
+end

data/lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class LambdaFunctionInsideVPCRule < BaseRule
+  def rule_text
+    'Lambda functions should be deployed inside a VPC'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W89'
+  end
+
+  def audit_impl(cfn_model)
+    lambda_functions = cfn_model.resources_by_type('AWS::Lambda::Function')
+    violating_lambda_functions = lambda_functions.select do |lambda_function|
+      lambda_function.vpcConfig.nil?
+    end
+
+    violating_lambda_functions.map(&:logical_resource_id)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.7.6
 platform: ruby
 authors:
 - Eric Kascic
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-01-29 00:00:00.000000000 Z
+date: 2021-04-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -165,7 +165,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 description: Auditing tool for CloudFormation templates
-email: 
+email:
 executables:
 - cfn_nag
 - cfn_nag_rules
@@ -197,6 +197,7 @@ files:
 - lib/cfn-nag/custom_rules/AmplifyAppOauthTokenRule.rb
 - lib/cfn-nag/custom_rules/AmplifyBranchBasicAuthConfigPasswordRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayAccessLoggingRule.rb
+- lib/cfn-nag/custom_rules/ApiGatewayCacheEncryptedRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayDeploymentUsagePlanRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayMethodAuthorizationTypeRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewaySecurityPolicyRule.rb
@@ -275,10 +276,12 @@ files:
 - lib/cfn-nag/custom_rules/KMSKeyRotationRule.rb
 - lib/cfn-nag/custom_rules/KMSKeyWildcardPrincipalRule.rb
 - lib/cfn-nag/custom_rules/KendraIndexServerSideEncryptionConfigurationKmsKeyIdRule.rb
+- lib/cfn-nag/custom_rules/KinesisFirehoseDeliveryStreamEncryptionRule.rb
 - lib/cfn-nag/custom_rules/KinesisFirehoseDeliveryStreamRedshiftDestinationConfigurationPasswordRule.rb
 - lib/cfn-nag/custom_rules/KinesisFirehoseDeliveryStreamSplunkDestinationConfigurationHECTokenRule.rb
 - lib/cfn-nag/custom_rules/KinesisStreamStreamEncryptionRule.rb
 - lib/cfn-nag/custom_rules/LambdaFunctionCloudWatchLogsRule.rb
+- lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionEventSourceTokenRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb
@@ -388,7 +391,7 @@ homepage: https://github.com/stelligent/cfn_nag
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -404,9 +407,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: cfn-nag
 test_files: []