cfn-nag 0.8.8 → 0.8.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 735dbd2dbf597b2da5cc262af063155a84c0189262214bd64bc5584b9ad3b2e2
-  data.tar.gz: 106a0f471c6db4c1c8d5958d3d720694aae6d56f09135f6c81112e5b55240ce9
+  metadata.gz: f4a16eb5cda1347c3d70d1dba6c5408df9cc1eb6fd59ddf9ceab8bc35e4c2a1f
+  data.tar.gz: acf74edd1722eb6703cb9b3984c0c6656f154564fdb8e4ad758ce00c60a0d52c
 SHA512:
-  metadata.gz: 55338fd7776fec785e0ddf95c7df5f151f7c08b66f0a16dbe666e628e8d96186a2bcd5ffb321325a1b4376248f0b3ef662c313e7ecc84690f6c493406aec5e6e
-  data.tar.gz: ed07441a28f36e3ec63bcb5774bcc3b6991b731de5bba511e95f59d86a51a5796797111ed4acc0511f9d769ab6894aa1037061797072fcbb63ffd1f9c512e7cb
+  metadata.gz: ce414a1ff11e5a981b410d6dd0f37ae8e677a333aafe66de03fd50cac3fb7d9edc46a229708950cfd03965d1b972f449308c7d241f6869d59159c889b4fc2ca2
+  data.tar.gz: 7ddefcb9485dd9283fca42013fdcf0975358ebb7026acdc6038e38d7438489b8a9367b866bbe7d79e2572907e02b90af212a89ca64a9eb23f7d7d4a6e568af00

data/lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb

@@ -23,7 +23,7 @@ class IamRolePassRoleWildcardResourceRule < BaseRule
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
       violating_policies = role.policy_objects.select do |policy|
         violating_statements = policy.policy_document.statements.select do |statement|
-          passrole_action?(statement) && wildcard_resource?(statement)
+          statement.effect == 'Allow' && passrole_action?(statement) && wildcard_resource?(statement)
         end
         !violating_statements.empty?
       end

data/lib/cfn-nag/custom_rules/passrole_base_rule.rb

@@ -16,7 +16,7 @@ class PassRoleBaseRule < BaseRule
 
     violating_policies = policies.select do |policy|
       violating_statements = policy.policy_document.statements.select do |statement|
-        passrole_action?(statement) && wildcard_resource?(statement)
+        statement.effect == 'Allow' && passrole_action?(statement) && wildcard_resource?(statement)
       end
       !violating_statements.empty?
     end

data/lib/cfn-nag/version.rb

@@ -2,5 +2,5 @@
 
 module CfnNagVersion
   # This is managed at release time via scripts/publish.sh
-  VERSION = '0.8.8'
+  VERSION = '0.8.9'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.8.8
+  version: 0.8.9
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-11-04 00:00:00.000000000 Z
+date: 2022-01-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake