cfn-nag 0.7.6 → 0.7.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 59c999774eab0a7ebd00d06aa55d9080218683d60a8a6a0eed160ffe5171617b
-  data.tar.gz: 4eb14549c72fe44b27941a90793c8a52271f5fcf4a9c7799b29c0800be2fd815
+  metadata.gz: 5e26fcc50c0e47513f3539dadfa072f4888ed2bd776e8388966a7648b9fb3286
+  data.tar.gz: dec97316b7808511cad74995edf289bb6669325503362991dd237296d8ac63a0
 SHA512:
-  metadata.gz: ff895bb892baaae4b1143daeac5c1dde170635e7c627ec3cd09249b28bfdc7b1eb37c71da271306552b03cfae080e4cf272d006536441531328a40c98f73f10c
-  data.tar.gz: 56289bf3957389c76477eb1b9fb32d44262b1bf98d711812f8f44bd078b93e5efe6d216cc519711a0a0303bc88bd90526f9e244a76f3e752af24d60ac8dee805
+  metadata.gz: 2c7490492ca3676096d36e9280a88ca9cef7ce28873920eb49e2e99982d5b3d2cfe88c9331feef1e8c01249d6955579f4e8e7b4aba53343a5de6db2d5101a76f
+  data.tar.gz: d7316a5e3eef79703043f5e3e4af7a4ab777fbe6de389d3ce5f0cfed40db2f72fac32b64e8bc123081861d63d751a4bf3f5209ec7d5f9475cbe332f50deb9ae8

data/lib/cfn-nag/custom_rules/DMSReplicationInstanceNotPublicRule.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/util/truthy'
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class DMSReplicationInstanceNotPublicRule < BaseRule
+  def rule_text
+    'Database Migration Service replication instances are public, property PubliclyAccessible should be set to false'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W91'
+  end
+
+  def audit_impl(cfn_model)
+    violating_replications = cfn_model.resources_by_type('AWS::DMS::ReplicationInstance').select do |replication|
+      replication.publiclyAccessible.nil? || truthy?(replication.publiclyAccessible)
+    end
+
+    violating_replications.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/ElasticsearchDomainInsideVPCRule.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ElasticsearchDomainInsideVPCRule < BaseRule
+  def rule_text
+    'ElasticsearchcDomain should be inside vpc, should specify VPCOptions'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W90'
+  end
+
+  def audit_impl(cfn_model)
+    violating_domains = cfn_model.resources_by_type('AWS::Elasticsearch::Domain').select do |domain|
+      domain.vPCOptions.nil?
+    end
+
+    violating_domains.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/LambdaFunctionReservedConcurrentExecutionsRule.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class LambdaFunctionReservedConcurrentExecutionsRule < BaseRule
+  def rule_text
+    'Lambda functions should define ReservedConcurrentExecutions to reserve simultaneous executions'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W92'
+  end
+
+  def audit_impl(cfn_model)
+    lambda_functions = cfn_model.resources_by_type('AWS::Lambda::Function')
+    violating_lambda_functions = lambda_functions.select do |lambda_function|
+      lambda_function.reservedConcurrentExecutions.nil?
+    end
+
+    violating_lambda_functions.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/rule_repos/file_based_rule_repo.rb

@@ -52,7 +52,7 @@ class FileBasedRuleRepo
 
     rule_filenames = discover_rule_filenames(rule_directory)
     rule_filenames.each do |rule_filename|
-      require(rule_filename)
+      require(File.absolute_path(rule_filename))
       rule_classname = File.basename(rule_filename, '.rb')
 
       rule_classes << Object.const_get(rule_classname)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.7.6
+  version: 0.7.11
 platform: ruby
 authors:
 - Eric Kascic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-04-05 00:00:00.000000000 Z
+date: 2021-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -217,6 +217,7 @@ files:
 - lib/cfn-nag/custom_rules/DLMLifecyclePolicyCrossRegionCopyEncryptionRule.rb
 - lib/cfn-nag/custom_rules/DMSEndpointMongoDbSettingsPasswordRule.rb
 - lib/cfn-nag/custom_rules/DMSEndpointPasswordRule.rb
+- lib/cfn-nag/custom_rules/DMSReplicationInstanceNotPublicRule.rb
 - lib/cfn-nag/custom_rules/DirectoryServiceMicrosoftADPasswordRule.rb
 - lib/cfn-nag/custom_rules/DirectoryServiceSimpleADPasswordRule.rb
 - lib/cfn-nag/custom_rules/DocDBDBClusterMasterUserPasswordRule.rb
@@ -247,6 +248,7 @@ files:
 - lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerProtocolRule.rb
 - lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerSslPolicyRule.rb
 - lib/cfn-nag/custom_rules/ElasticsearchDomainEncryptionAtRestOptionsRule.rb
+- lib/cfn-nag/custom_rules/ElasticsearchDomainInsideVPCRule.rb
 - lib/cfn-nag/custom_rules/ElasticsearchDomainNodeToNodeEncryptionOptionsRule.rb
 - lib/cfn-nag/custom_rules/GameLiftFleetInboundPortRangeRule.rb
 - lib/cfn-nag/custom_rules/IAMUserLoginProfilePasswordRule.rb
@@ -282,6 +284,7 @@ files:
 - lib/cfn-nag/custom_rules/KinesisStreamStreamEncryptionRule.rb
 - lib/cfn-nag/custom_rules/LambdaFunctionCloudWatchLogsRule.rb
 - lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb
+- lib/cfn-nag/custom_rules/LambdaFunctionReservedConcurrentExecutionsRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionEventSourceTokenRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionInvokeFunctionActionRule.rb
 - lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb