cfn-nag 0.0.31 → 0.0.32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 56dbe4fbd39baa55a57bf08c76b3ded48d248259
-  data.tar.gz: 8453582e991ff40398cc05a0ebee7ef64d5b4291
+  metadata.gz: 0ba52e35e95e5c8578b6de099bbfa001b8fd6bb2
+  data.tar.gz: e707b8a4f2ba1dfb6df1aa226d249220f212a0c7
 SHA512:
-  metadata.gz: ee486be9d272ed90df3f5137358ecf33c719cec14b21acf2f9a9b6669d94ca9f7f227d0bc3916a8a02e368a519c7d07fa2582f529841e088318ba91f235013fd
-  data.tar.gz: d7394d24c0735afc252ffcd59e8d6dfa3419dc358c0dda691d1cfd6e061e01e1eec575e980967fda4418098c7a70ea734a5fac9a00f90acbd157bee26702f410
+  metadata.gz: 745edfacf8508b1479588d13fa31dc3f8adc5d694406e768960a8dc6327469cd00d5ff7e8c69bdff1cc61d2eaed10a4f08fd5bbcd4100138d4e23fc93183a26e
+  data.tar.gz: a5981057d39a088953c11d33726858d0589b7d0ac8e1bf45a3cbbabfbaf4b150d834c146ea9a9608c705fa72787553e738ecc692a79aba5d0739d841c81d163e

data/lib/cfn_nag.rb

@@ -1,10 +1,8 @@
 require_relative 'rule'
-require_relative 'custom_rules/security_group_missing_egress'
-require_relative 'custom_rules/user_missing_group'
+require_relative 'custom_rule_loader'
 require_relative 'model/cfn_model'
 require_relative 'result_view/simple_stdout_results'
 require_relative 'result_view/json_results'
-require_relative 'custom_rules/unencrypted_s3_put_allowed'
 require 'tempfile'
 
 class CfnNag
@@ -13,11 +11,6 @@ class CfnNag
   def initialize
     @warning_registry = []
     @violation_registry = []
-    @custom_rule_registry = [
-      SecurityGroupMissingEgressRule,
-      UserMissingGroupRule,
-      UnencryptedS3PutObjectAllowedRule
-    ]
   end
 
   def dump_rules
@@ -108,7 +101,7 @@ class CfnNag
 
     generic_json_rules(input_json, rule_directories) unless @stop_processing == true
 
-    custom_rules input_json unless @stop_processing == true
+    @violations += custom_rules input_json unless @stop_processing == true
 
     {
       failure_count: Rule::count_failures(@violations),
@@ -208,10 +201,6 @@ class CfnNag
   end
 
   def custom_rules(input_json)
-    cfn_model = CfnModel.new.parse(input_json)
-    @custom_rule_registry.each do |rule_class|
-      audit_result = rule_class.new.audit(cfn_model)
-      @violations << audit_result unless audit_result.nil?
-    end
+    CustomRuleLoader.new.custom_rules(input_json)
   end
 end

data/lib/custom_rule_loader.rb

@@ -0,0 +1,52 @@
+require_relative 'model/parser_registry'
+require_relative 'model/cfn_model'
+
+class CustomRuleLoader
+
+  @custom_rule_directory = '/var/lib/cfn_nag_plugins'
+
+  def self.custom_rule_directory=(directory)
+    @custom_rule_directory = directory
+  end
+
+  def self.custom_rule_directory
+    @custom_rule_directory
+  end
+
+  def initialize
+    @custom_rule_registry = [
+      SecurityGroupMissingEgressRule,
+      UserMissingGroupRule,
+      UnencryptedS3PutObjectAllowedRule
+    ]
+    @violations = []
+  end
+
+  def custom_rules(input_json)
+    discover_rules
+    @custom_rule_registry.each do |rule_class|
+      rule = rule_class.new
+      if rule.respond_to? 'custom_parsers'
+        rule.custom_parsers.each do |custom_parser|
+          ParserRegistry.instance.add_parser custom_parser[0], custom_parser[1]
+        end
+      end
+
+      cfn_model = CfnModel.new.parse(input_json)
+      audit_result = rule_class.new.audit(cfn_model)
+      @violations << audit_result unless audit_result.nil?
+    end
+    @violations
+  end
+
+  private
+
+  def discover_rules(rule_directory: CustomRuleLoader.custom_rule_directory)
+    rules = Dir[File.join(rule_directory, '*Rule.rb')].sort
+
+    rules.each do |rule|
+      require(rule)
+      @custom_rule_registry << Object.const_get(File.basename(rule, '.rb'))
+    end
+  end
+end

data/lib/model/cfn_model.rb

@@ -1,7 +1,5 @@
 require 'json'
-require_relative 'security_group_parser'
-require_relative 'iam_user_parser'
-require_relative 's3_bucket_policy_parser'
+require_relative 'parser_registry'
 
 # consider a canonical form for template too...
 # always transform optional things into more general forms....
@@ -9,14 +7,6 @@ require_relative 's3_bucket_policy_parser'
 
 class CfnModel
   def initialize
-    @parser_registry = {
-      'AWS::EC2::SecurityGroup' => SecurityGroupParser,
-      'AWS::EC2::SecurityGroupIngress' => SecurityGroupXgressParser,
-      'AWS::EC2::SecurityGroupEgress' => SecurityGroupXgressParser,
-      'AWS::IAM::User' => IamUserParser,
-      'AWS::IAM::UserToGroupAddition' => IamUserToGroupAdditionParser,
-      'AWS::S3::BucketPolicy' => S3BucketPolicyParser
-    }
     @dangling_ingress_or_egress_rules = []
     @dangler = Object.new
   end
@@ -26,6 +16,8 @@ class CfnModel
     self
   end
 
+
+
   def security_groups
     fail 'must call parse first' unless @json_hash
     security_groups_hash = resources_by_type('AWS::EC2::SecurityGroup')
@@ -51,6 +43,17 @@ class CfnModel
     bucket_policy_hash.values
   end
 
+  def resources_by_type(resource_type)
+    resources_map = {}
+    resources.each do |resource_name, resource|
+      if resource['Type'] == resource_type
+        resource_parser = ParserRegistry.instance.registry[resource_type].new
+        resources_map[resource_name] = resource_parser.parse(resource_name, resource)
+      end
+    end
+    resources_map
+  end
+
   private
 
   def resolve_user_logical_resource_id(user)
@@ -120,16 +123,7 @@ class CfnModel
     @json_hash['Resources']
   end
 
-  def resources_by_type(resource_type)
-    resources_map = {}
-    resources.each do |resource_name, resource|
-      if resource['Type'] == resource_type
-        resource_parser = @parser_registry[resource_type].new
-        resources_map[resource_name] = resource_parser.parse(resource_name, resource)
-      end
-    end
-    resources_map
-  end
+
 end
 
 class SecurityGroup

data/lib/model/parser_registry.rb

@@ -0,0 +1,31 @@
+require_relative 'security_group_parser'
+require_relative 'iam_user_parser'
+require_relative 's3_bucket_policy_parser'
+require_relative 'parser_registry'
+
+class ParserRegistry
+  attr_reader :registry
+
+  def initialize
+    @registry = {
+      'AWS::EC2::SecurityGroup' => SecurityGroupParser,
+      'AWS::EC2::SecurityGroupIngress' => SecurityGroupXgressParser,
+      'AWS::EC2::SecurityGroupEgress' => SecurityGroupXgressParser,
+      'AWS::IAM::User' => IamUserParser,
+      'AWS::IAM::UserToGroupAddition' => IamUserToGroupAdditionParser,
+      'AWS::S3::BucketPolicy' => S3BucketPolicyParser
+    }
+  end
+
+  def self.instance
+    if @instance.nil?
+      @instance = ParserRegistry.new
+    end
+    @instance
+  end
+
+  def add_parser(resource_name, parser)
+    @registry[resource_name] = parser
+  end
+
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.0.31
+  version: 0.0.32
 platform: ruby
 authors:
 - someguy
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-07 00:00:00.000000000 Z
+date: 2017-02-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logging
@@ -49,6 +49,7 @@ files:
 - bin/cfn_nag
 - bin/cfn_nag_rules
 - lib/cfn_nag.rb
+- lib/custom_rule_loader.rb
 - lib/custom_rules/security_group_missing_egress.rb
 - lib/custom_rules/unencrypted_s3_put_allowed.rb
 - lib/custom_rules/user_missing_group.rb
@@ -68,6 +69,7 @@ files:
 - lib/model/action_parser.rb
 - lib/model/cfn_model.rb
 - lib/model/iam_user_parser.rb
+- lib/model/parser_registry.rb
 - lib/model/s3_bucket_policy.rb
 - lib/model/s3_bucket_policy_parser.rb
 - lib/model/security_group_parser.rb