cfn-nag 0.8.5 → 0.8.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c39c81a107025c553d08bce79ffdf244838c3e26fd1a853814f367a1abf732a7
-  data.tar.gz: d000e3ff73010f5796d2821a30d94dd361607384aaafeab64843af3d54913e3b
+  metadata.gz: f4a16eb5cda1347c3d70d1dba6c5408df9cc1eb6fd59ddf9ceab8bc35e4c2a1f
+  data.tar.gz: acf74edd1722eb6703cb9b3984c0c6656f154564fdb8e4ad758ce00c60a0d52c
 SHA512:
-  metadata.gz: 5d3b5cea49310d56c8735e16b49ca7bbbd605d8d00dd52bb1f243d1a39c52f3b9d01db3089fd248006939c873f33706fef01d014d0b7fc87095683eb62e3c20d
-  data.tar.gz: cc016234fbbc9c19c39ff7655667f58961a7abfd236285c4a148b13f846130f6fc007a3eabc8c7f9bd523363d1759749f889d453104a5dc9f165775318cdcd4a
+  metadata.gz: ce414a1ff11e5a981b410d6dd0f37ae8e677a333aafe66de03fd50cac3fb7d9edc46a229708950cfd03965d1b972f449308c7d241f6869d59159c889b4fc2ca2
+  data.tar.gz: 7ddefcb9485dd9283fca42013fdcf0975358ebb7026acdc6038e38d7438489b8a9367b866bbe7d79e2572907e02b90af212a89ca64a9eb23f7d7d4a6e568af00

data/lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb

@@ -23,7 +23,7 @@ class IamRolePassRoleWildcardResourceRule < BaseRule
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
       violating_policies = role.policy_objects.select do |policy|
         violating_statements = policy.policy_document.statements.select do |statement|
-          passrole_action?(statement) && wildcard_resource?(statement)
+          statement.effect == 'Allow' && passrole_action?(statement) && wildcard_resource?(statement)
         end
         !violating_statements.empty?
       end

data/lib/cfn-nag/custom_rules/passrole_base_rule.rb

@@ -16,7 +16,7 @@ class PassRoleBaseRule < BaseRule
 
     violating_policies = policies.select do |policy|
       violating_statements = policy.policy_document.statements.select do |statement|
-        passrole_action?(statement) && wildcard_resource?(statement)
+        statement.effect == 'Allow' && passrole_action?(statement) && wildcard_resource?(statement)
       end
       !violating_statements.empty?
     end

data/lib/cfn-nag/version.rb

@@ -2,5 +2,5 @@
 
 module CfnNagVersion
   # This is managed at release time via scripts/publish.sh
-  VERSION = '0.8.5'
+  VERSION = '0.8.9'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.8.5
+  version: 0.8.9
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-10-27 00:00:00.000000000 Z
+date: 2022-01-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake