cfn-nag 0.0.15 → 0.0.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 321aab48e50c578d52366929c70c050feb20b027
-  data.tar.gz: 100ef582f666736c16cfdc52a44db75ba23f7438
+  metadata.gz: 3c770e0365059a4da534e9dd5c6cf5ccd9e7bdfc
+  data.tar.gz: 8f930ab8307b6248ae4940a17f8d9b4ed85b4e92
 SHA512:
-  metadata.gz: 4ff24d952355ccdcfa55b488777f3f0e19ae9efdb37091b2df85538bfdb2d626456fd3012c8ccf4425d916e3b877f43fd81cfc3770cb00f99664a9d8f1075b04
-  data.tar.gz: 8c1e4d0849c2a07560b3005bc869d24e10a481181c47fb7b8d69ccc4ee30aed498431d0507cf53f7b1ca168d3284111aad310cabe1833a98dfc53d21091ab12b
+  metadata.gz: cd100b68be2758194ecd45141e821fcbc6845e4f56204dbee2444913524714ecd317a8c41af36cca9fc35aaa59dff5488b3946d819b1dabaaaa9cca562a078d2
+  data.tar.gz: 464fad5e55f3d090078ed7a520304fc392d3f2106497b01bfaa2c6e4440fd3d328de5b4022dcdf8639e4e83cd4324894ceb5dac754d212e124dbf32e85a6edd6

data/lib/json_rules/basic_rules.rb

@@ -6,6 +6,9 @@ raw_fatal_assertion jq: '.Resources|length > 0',
   AWS::IAM::Role
   AWS::IAM::Policy
   AWS::IAM::ManagedPolicy
+  AWS::S3::BucketPolicy
+  AWS::SQS::QueuePolicy
+  AWS::SNS::TopicPolicy
   AWS::IAM::UserToGroupAddition
   AWS::EC2::SecurityGroup
   AWS::EC2::SecurityGroupIngress
@@ -22,7 +25,7 @@ missing_reference_jq = <<END
     )
     -
     (
-      ["AWS::AccountId","AWS::StackName","AWS::Region","AWS::StackId","AWS::NoValue"] +
+      ["AWS::AccountId","AWS::StackName","AWS::Region","AWS::StackId","AWS::NoValue","AWS::NotificationARNs"] +
       ([.Resources|keys]|flatten) +
       (if .Parameters? then ([.Parameters|keys]|flatten) else [] end)
     )

data/lib/json_rules/iam_policy_rules.rb

@@ -1,8 +1,8 @@
 wildcard_action_filter = <<END
 def wildcard_action:
   if .Statement|type == "object"
-  then select(.Statement.Effect == "Allow" and .Statement|if .Action|type=="string" then select(.Action == "*") else select(.Action|index("*")) end)
-  else select(.Statement[]|if .Action|type=="string" then select(.Effect == "Allow" and .Action == "*") else select(.Effect == "Allow" and (.Action|index("*"))) end)
+  then select(.Statement.Effect == "Allow" and (if .Statement.Action|type=="string" then (.Statement.Action == "*") else (.Statement.Action|indices("*")|length > 0) end))
+  else select(.Statement[]|.Effect == "Allow" and (if .Action|type=="string" then (.Action == "*") else (.Action|indices("*")|length > 0) end))
   end;
 END
 
@@ -24,12 +24,11 @@ violation jq: wildcard_action_filter +
               "[#{resources_by_type('AWS::IAM::ManagedPolicy')}|select(.Properties.PolicyDocument|wildcard_action)]|map(.LogicalResourceId) ",
           message: 'IAM managed policy should not allow * action'
 
-
 wildcard_resource_filter = <<END
 def wildcard_resource:
   if .Statement|type == "object"
-  then select(.Statement.Effect == "Allow" and .Statement|if .Resource|type=="string" then select(.Resource == "*") else select(.Resource|index("*")) end)
-  else select(.Statement[]|if .Resource|type=="string" then select(.Effect == "Allow" and .Resource == "*") else (if .Resource|type=="array" then select(.Effect == "Allow" and (.Resource|index("*"))) else false end) end)
+  then select(.Statement.Effect == "Allow" and (if .Statement.Resource|type=="string" then (.Statement.Resource == "*") else (.Statement.Resource|indices("*")|length > 0) end))
+  else select(.Statement[]|.Effect == "Allow" and (if .Resource|type=="string" then (.Resource == "*") else (.Statement.Resource|indices("*")|length > 0) end))
   end;
 END
 
@@ -50,7 +49,7 @@ allow_not_action_filter = <<END
 def allow_not_action:
   if .Statement|type == "object"
   then select(.Statement.Effect == "Allow" and .Statement.NotAction != null)
-  else select(.Statement[]|select(.NotAction != null and .Effect == "Allow"))
+  else select(.Statement[]|(.Effect == "Allow" and .NotAction != null))
   end;
 END
 
@@ -73,12 +72,23 @@ warning jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::IAM::ManagedPolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'IAM managed policy should not allow Allow+NotAction'
 
+warning jq: allow_not_action_filter +
+            "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
+        message: 'SQS Queue policy should not allow Allow+NotAction'
+
+warning jq: allow_not_action_filter +
+            "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
+        message: 'SNS Topic policy should not allow Allow+NotAction'
+
+warning jq: allow_not_action_filter +
+            "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
+        message: 'S3 Bucket policy should not allow Allow+NotAction'
 
 allow_not_resource_filter = <<END
 def allow_not_resource:
   if .Statement|type == "object"
   then select(.Statement.Effect == "Allow" and .Statement.NotResource != null)
-  else select(.Statement[]|select(.NotResource != null and .Effect == "Allow"))
+  else select(.Statement[]|(.Effect == "Allow" and .NotResource != null))
   end;
 END
 
@@ -101,10 +111,22 @@ allow_not_principal_filter = <<END
 def allow_not_principal:
   if .Statement|type == "object"
   then select(.Statement.Effect == "Allow" and .Statement.NotPrincipal != null)
-  else select(.Statement[]|select(.NotPrincipal != null and .Effect == "Allow"))
+  else select(.Statement[]|(.Effect == "Allow" and .NotPrincipal != null))
   end;
 END
 
 violation jq: allow_not_principal_filter +
               "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.AssumeRolePolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
           message: 'IAM role should not allow Allow+NotPrincipal in its trust policy'
+
+violation jq: allow_not_principal_filter +
+              "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
+          message: 'SQS Queue policy should not allow Allow+NotPrincipal'
+
+violation jq: allow_not_principal_filter +
+              "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
+          message: 'SNS Topic policy should not allow Allow+NotPrincipal'
+
+violation jq: allow_not_principal_filter +
+              "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
+          message: 'S3 Bucket policy should not allow Allow+NotPrincipal'

data/lib/json_rules/s3_bucket_rules.rb

@@ -4,4 +4,43 @@ warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | selec
 
 violation jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::S3::Bucket")|'\
               'select(.Properties.AccessControl? == "PublicReadWrite")]|map(.LogicalResourceId) ',
-          message: 'S3 Bucket should not have a public read-write acl'
+          message: 'S3 Bucket should not have a public read-write acl'
+
+
+
+s3_wildcard_action_filter = <<END
+def s3_wildcard_action:
+  if .Statement|type == "object"
+  then select(.Statement.Effect == "Allow" and (if .Statement.Action|type=="string" then (.Statement.Action == "s3:*" or .Statement.Action == "*") else ((.Statement.Action|indices("s3:*")|length > 0) or (.Statement.Action|indices("*")|length > 0)) end))
+  else select(.Statement[]|.Effect == "Allow" and (if .Action|type=="string" then (.Action == "s3:*" or .Action == "*") else ((.Action|indices("s3:*")|length > 0) or (.Action|indices("*")|length > 0)) end))
+  end;
+END
+
+s3_wildcard_principal_filter = <<END
+def s3_wildcard_principal:
+  if .Statement|type == "object"
+  then select(.Statement.Effect == "Allow" and (.Statement.Principal?|type=="string") and (.Statement.Principal == "*") )
+  else select(.Statement[]|.Effect == "Allow" and ((.Principal?|type=="string") and (.Principal == "*")) )
+  end;
+END
+
+s3_wildcard_aws_principal_filter = <<END
+def s3_wildcard_aws_principal:
+  if .Statement|type == "object"
+  then select(.Statement.Effect == "Allow" and (.Statement.Principal?|type=="object") and (.Statement.Principal.AWS == "*"))
+  else select(.Statement[]|(.Effect == "Allow" and (.Principal?|type=="object") and (.Principal.AWS == "*")))
+  end;
+END
+
+
+violation jq: s3_wildcard_action_filter +
+              "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|s3_wildcard_action)]|map(.LogicalResourceId) ",
+          message: 'S3 Bucket policy should not allow * action'
+
+violation jq: s3_wildcard_principal_filter +
+              "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|s3_wildcard_principal)]|map(.LogicalResourceId) ",
+          message: 'S3 Bucket policy should not allow * principal'
+
+violation jq: s3_wildcard_aws_principal_filter +
+              "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|s3_wildcard_aws_principal)]|map(.LogicalResourceId) ",
+          message: 'S3 Bucket policy should not allow * AWS principal'

data/lib/json_rules/sns_rules.rb

@@ -0,0 +1,27 @@
+sns_wildcard_principal_filter = <<END
+def sns_wildcard_principal:
+  if .Statement|type == "object"
+  then select(.Statement.Effect == "Allow" and (.Statement.Principal?|type=="string") and (.Statement.Principal == "*"))
+  else select(.Statement[]|(.Effect == "Allow" and (.Principal?|type=="string") and (.Principal == "*")))
+  end;
+END
+
+sns_wildcard_aws_principal_filter = <<END
+def sns_wildcard_aws_principal:
+  if .Statement|type == "object"
+  then select(.Statement.Effect == "Allow" and (.Statement.Principal?|type=="object") and (.Statement.Principal.AWS == "*"))
+  else select(.Statement[]|(.Effect == "Allow" and (.Principal?|type=="object") and (.Principal.AWS == "*")))
+  end;
+END
+
+# i guess we could have principal "AWS": ["1111111111", "*", "222222222222"]... or ["*","arn:..."]
+
+#sns action wildcard doesnt seem to be accepted by sns so dont sweat it
+
+violation jq: sns_wildcard_principal_filter +
+              "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|sns_wildcard_principal)]|map(.LogicalResourceId) ",
+          message: 'SNS topic policy should not allow * principal'
+
+violation jq: sns_wildcard_aws_principal_filter +
+              "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|sns_wildcard_aws_principal)]|map(.LogicalResourceId) ",
+          message: 'SNS topic policy should not allow * AWS principal'

data/lib/json_rules/sqs_rules.rb

@@ -0,0 +1,23 @@
+sqs_wildcard_action_filter = <<END
+def sqs_wildcard_action:
+  if .Statement|type == "object"
+  then select(.Statement.Effect == "Allow" and (if .Statement.Action|type=="string" then (.Statement.Action == "sqs:*") else (.Statement.Action|indices("sqs:*")|length > 0) end))
+  else select(.Statement[]|.Effect == "Allow" and (if .Action|type=="string" then (.Action == "sqs:*") else (.Action|indices("sqs:*")|length > 0) end))
+  end;
+END
+
+sqs_wildcard_principal_filter = <<END
+def sqs_wildcard_principal:
+  if .Statement|type == "object"
+  then select(.Statement.Effect == "Allow" and (.Statement.Principal?|type=="string") and (.Statement.Principal == "*") )
+  else select(.Statement[]|.Effect == "Allow" and ((.Principal?|type=="string") and (.Principal == "*")) )
+  end;
+END
+
+violation jq: sqs_wildcard_action_filter +
+              "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|sqs_wildcard_action)]|map(.LogicalResourceId) ",
+          message: 'SQS Queue policy should not allow * action'
+
+violation jq: sqs_wildcard_principal_filter +
+              "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|sqs_wildcard_principal)]|map(.LogicalResourceId) ",
+          message: 'SQS Queue policy should not allow * principal'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.0.15
+  version: 0.0.16
 platform: ruby
 authors:
 - someguy
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-29 00:00:00.000000000 Z
+date: 2016-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logging
@@ -60,6 +60,8 @@ files:
 - lib/json_rules/loadbalancer_rules.rb
 - lib/json_rules/port_rules.rb
 - lib/json_rules/s3_bucket_rules.rb
+- lib/json_rules/sns_rules.rb
+- lib/json_rules/sqs_rules.rb
 - lib/model/cfn_model.rb
 - lib/model/iam_user_parser.rb
 - lib/model/security_group_parser.rb