cfn-nag 0.7.3 → 0.7.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d145d8825a2b75a15637c38316311f3a81e34d4c0e4a0da762bb8736d8f92bbd
-  data.tar.gz: 0f86a5e05e4661ee957576eb00c82835917bd9d05ed130ecac583aa8591e98c2
+  metadata.gz: 687faf1b1a2510a790d5c225ea91dcaa18d3384bfc053279e6b4df606a21172a
+  data.tar.gz: 99cb292f48d8c2cada20d5fae525a7f23491903bfd79cffe2aeaf43326cbfd70
 SHA512:
-  metadata.gz: 1db97cdbc8e20ad8b4600668f13a80271aaa315cdff7c72881467e951f815e32e6929bd00edc4f28fd3b7b96fcd3163889d62a0f35bcc1f39d94d80733331fb9
-  data.tar.gz: 6640df3fcaf9f3745252975c1a62e3bfb499f7fdbb8d3f7c8e3c4f035a02ea70a1e0152686b6ec3555dda7fed3c8779b11068ef55bbef40eabfc059171ad93c5
+  metadata.gz: e3700d6df829ab53c3255499d4487badba2fba8ce83cd7af6c1455b6025aaca5156b1ae90c2e663eefad2ea2fb16d544e4dadd8b03443aa674185492a8be5d47
+  data.tar.gz: ee20bb214f2dbe6f97ea275cb07a6b5352c0c61bc9c1050e39a6c5c93f4e932103cbe9d103d8cb633513d71403a8863061a2689574e72b1466be32e35bffde1e

data/lib/cfn-nag/custom_rules/CloudfrontMinimumProtocolVersionRule.rb

@@ -28,11 +28,12 @@ class CloudfrontMinimumProtocolVersionRule < BaseRule
   private
 
   def tls_version?(viewer_certificate)
-    cert_has_bad_tls_version?(viewer_certificate) || override_tls_config?(viewer_certificate)
+    cert_has_bad_tls_version?(viewer_certificate['MinimumProtocolVersion']) || override_tls_config?(viewer_certificate)
   end
 
-  def cert_has_bad_tls_version?(viewer_certificate)
-    viewer_certificate['MinimumProtocolVersion'].nil? || viewer_certificate['MinimumProtocolVersion'] != 'TLSv1.2_2018'
+  def cert_has_bad_tls_version?(min_protocol_version)
+    min_protocol_version.nil? ||
+      (min_protocol_version.is_a?(String) && !min_protocol_version.start_with?('TLSv1.2'))
   end
 
   def override_tls_config?(viewer_certificate)

data/lib/cfn-nag/custom_rules/DMSReplicationInstanceNotPublicRule.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/util/truthy'
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class DMSReplicationInstanceNotPublicRule < BaseRule
+  def rule_text
+    'Database Migration Service replication instances are public, property PubliclyAccessible should be set to false'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W91'
+  end
+
+  def audit_impl(cfn_model)
+    violating_replications = cfn_model.resources_by_type('AWS::DMS::ReplicationInstance').select do |replication|
+      replication.publiclyAccessible.nil? || truthy?(replication.publiclyAccessible)
+    end
+
+    violating_replications.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/ECRRepositoryScanOnPushRule.rb

@@ -6,7 +6,7 @@ require_relative 'base'
 
 class ECRRepositoryScanOnPushRule < BaseRule
   def rule_text
-    'ECR Repository should have scanOnPush enabled'
+    'ECR Repository should have ScanOnPush enabled'
   end
 
   def rule_type
@@ -20,7 +20,7 @@ class ECRRepositoryScanOnPushRule < BaseRule
   def audit_impl(cfn_model)
     violating_ecr_registries = cfn_model.resources_by_type('AWS::ECR::Repository').select do |registry|
       registry.imageScanningConfiguration.nil? ||
-        !truthy?(registry.imageScanningConfiguration['scanOnPush'].to_s)
+        !truthy?(registry.imageScanningConfiguration['ScanOnPush'].to_s)
     end
 
     violating_ecr_registries.map(&:logical_resource_id)

data/lib/cfn-nag/custom_rules/ElasticsearchDomainInsideVPCRule.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ElasticsearchDomainInsideVPCRule < BaseRule
+  def rule_text
+    'ElasticsearchcDomain should be inside vpc, should specify VPCOptions'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W90'
+  end
+
+  def audit_impl(cfn_model)
+    violating_domains = cfn_model.resources_by_type('AWS::Elasticsearch::Domain').select do |domain|
+      domain.vPCOptions.nil?
+    end
+
+    violating_domains.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class LambdaFunctionInsideVPCRule < BaseRule
+  def rule_text
+    'Lambda functions should be deployed inside a VPC'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W89'
+  end
+
+  def audit_impl(cfn_model)
+    lambda_functions = cfn_model.resources_by_type('AWS::Lambda::Function')
+    violating_lambda_functions = lambda_functions.select do |lambda_function|
+      lambda_function.vpcConfig.nil?
+    end
+
+    violating_lambda_functions.map(&:logical_resource_id)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.7.3
+  version: 0.7.8
 platform: ruby
 authors:
 - Eric Kascic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-26 00:00:00.000000000 Z
+date: 2021-04-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -217,6 +217,7 @@ files:
 - lib/cfn-nag/custom_rules/DLMLifecyclePolicyCrossRegionCopyEncryptionRule.rb
 - lib/cfn-nag/custom_rules/DMSEndpointMongoDbSettingsPasswordRule.rb
 - lib/cfn-nag/custom_rules/DMSEndpointPasswordRule.rb
+- lib/cfn-nag/custom_rules/DMSReplicationInstanceNotPublicRule.rb
 - lib/cfn-nag/custom_rules/DirectoryServiceMicrosoftADPasswordRule.rb
 - lib/cfn-nag/custom_rules/DirectoryServiceSimpleADPasswordRule.rb
 - lib/cfn-nag/custom_rules/DocDBDBClusterMasterUserPasswordRule.rb
@@ -247,6 +248,7 @@ files:
 - lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerProtocolRule.rb
 - lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerSslPolicyRule.rb
 - lib/cfn-nag/custom_rules/ElasticsearchDomainEncryptionAtRestOptionsRule.rb
+- lib/cfn-nag/custom_rules/ElasticsearchDomainInsideVPCRule.rb
 - lib/cfn-nag/custom_rules/ElasticsearchDomainNodeToNodeEncryptionOptionsRule.rb
 - lib/cfn-nag/custom_rules/GameLiftFleetInboundPortRangeRule.rb
 - lib/cfn-nag/custom_rules/IAMUserLoginProfilePasswordRule.rb
@@ -281,6 +283,7 @@ files:
 - lib/cfn-nag/custom_rules/KinesisFirehoseDeliveryStreamSplunkDestinationConfigurationHECTokenRule.rb
 - lib/cfn-nag/custom_rules/KinesisStreamStreamEncryptionRule.rb
 - lib/cfn-nag/custom_rules/LambdaFunctionCloudWatchLogsRule.rb
+- lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionEventSourceTokenRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb