cfn-nag 0.0.34 → 0.0.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 54f56e1bc63397251c05089f1350fed67080b941
-  data.tar.gz: 625d5593cd5a4ac8c048d0ab413979805d526370
+  metadata.gz: 599ac76a7c5bb73f2e8ad348f408f1945c9556c8
+  data.tar.gz: 13521f759054aba5f2abcd434e71b46c36b95dc7
 SHA512:
-  metadata.gz: f45991e43fb6ac8f6991e96beac5c5c758a8ccdfc2cff3bed0f26153e05e5cd15a808b659dc90ba6d93d17839f2f94b9e496695af315b6b104584411e4139612
-  data.tar.gz: 300743ae7f6a3eb7e02047676ee3002a64a46fea761775a5fcffe01d81792e0ee7bc31a8ba6ab01255670bd9933c894133ae197358f66fdd0efc3a56f1094c7d
+  metadata.gz: 02d05593b7c89b552b8b5ffe3c0cbb353b9a3d80f15c27a3920279b88a57f0639026b5eb220adaaff5b4ad8cbdd6172f0d2a38931789147e0f7fc73e2167bd26
+  data.tar.gz: 4ad062cf1e1040dd21549569d3ebc621dd8c63005851f6c9bdcb5858eb5294cdfdeec1ad0e235f93c3e111412c35e786ebc31e0c5ed3aa49f6fdfc801a242b8a

data/bin/cfn_nag

@@ -7,13 +7,22 @@ opts = Trollop::options do
   opt :input_json_path, 'CloudFormation template to nag on or directory of templates - all *.json and *.template recursively', type: :io, required: true
   opt :output_format, 'Format of results: [txt, json]', type: :string, default: 'txt'
   opt :debug, 'Enable debug output', type: :boolean, required: false, default: false
-  opt :rule_directory, 'Extra rule directories', type: :strings, require: false, default: [], multi: true
+  opt :rule_directory, 'Extra rule directories', type: :strings, required: false, default: [], multi: true
+  opt :profile_path, 'Path to a profile file', type: :io, required: false, default: nil
 end
 
 Trollop::die(:output_format,
              'Must be txt or json') unless %w(txt json).include?(opts[:output_format])
 
 CfnNag::configure_logging(opts)
-exit CfnNag.new.audit(input_json_path: opts[:input_json_path],
-                      output_format: opts[:output_format],
-                      rule_directories: opts[:rule_directory])
+
+profile_definition = nil
+unless opts[:profile_path].nil?
+  profile_definition = IO.read(opts[:profile_path])
+end
+
+cfn_nag = CfnNag.new(profile_definition: profile_definition)
+
+exit cfn_nag.audit(input_json_path: opts[:input_json_path],
+                   output_format: opts[:output_format],
+                   rule_directories: opts[:rule_directory])

data/bin/cfn_nag_rules

@@ -1,4 +1,17 @@
 #!/usr/bin/env ruby
+require 'trollop'
 require 'cfn_nag'
 
-CfnNag.new.dump_rules
+opts = Trollop::options do
+  opt :rule_directory, 'Extra rule directories', type: :strings, required: false, default: [], multi: true
+  opt :profile_path, 'Path to a profile file', type: :io, required: false, default: nil
+end
+
+profile_definition = nil
+unless opts[:profile_path].nil?
+  profile_definition = IO.read(opts[:profile_path])
+end
+
+cfn_nag = CfnNag.new(profile_definition: profile_definition)
+
+cfn_nag.dump_rules(rule_directories: opts[:rule_directory])

data/lib/cfn_nag.rb

@@ -1,5 +1,7 @@
 require_relative 'rule'
 require_relative 'custom_rule_loader'
+require_relative 'rule_registry'
+require_relative 'profile_loader'
 require_relative 'model/cfn_model'
 require_relative 'result_view/simple_stdout_results'
 require_relative 'result_view/json_results'
@@ -8,12 +10,17 @@ require 'tempfile'
 class CfnNag
   include Rule
 
-  def initialize
+  def initialize(profile_definition: nil)
     @warning_registry = []
     @violation_registry = []
+    @rule_registry = RuleRegistry.new
+    @custom_rule_loader = CustomRuleLoader.new(@rule_registry)
+    @profile_definition = profile_definition
   end
 
-  def dump_rules
+  def dump_rules(rule_directories: [])
+    validate_extra_rule_directories(rule_directories)
+
     dummy_cfn = <<-END
       {
         "Resources": {
@@ -30,18 +37,32 @@ class CfnNag
     Tempfile.open('tempfile') do |dummy_cfn_template|
       dummy_cfn_template.write dummy_cfn
       dummy_cfn_template.rewind
-      audit_file(input_json_path: dummy_cfn_template.path, rule_directories: [])
+      audit_file(input_json_path: dummy_cfn_template.path,
+                 rule_directories: rule_directories)
     end
 
-    CustomRuleLoader.new.custom_rule_registry.each do |rule_class|
-      @violation_registry << rule_class.new.rule_text
+    profile = nil
+    unless @profile_definition.nil?
+      profile = ProfileLoader.new(@rule_registry).load(profile_definition: @profile_definition)
     end
 
     puts 'WARNING VIOLATIONS:'
-    puts @warning_registry.sort
-    puts
+    @rule_registry.warnings.sort {|left, right| left.id <=> right.id}.each do |warning|
+      if profile.nil?
+        puts "#{warning.id} #{warning.message}"
+      else
+        puts "#{warning.id} #{warning.message}" if profile.execute_rule?(warning.id)
+      end
+
+    end
     puts 'FAILING VIOLATIONS:'
-    puts @violation_registry.sort
+    @rule_registry.failings.sort {|left, right| left.id <=> right.id}.each do |failing|
+      if profile.nil?
+        puts "#{failing.id} #{failing.message}"
+      else
+        puts "#{failing.id} #{failing.message}" if profile.execute_rule?(failing.id)
+      end
+    end
   end
 
   def audit(input_json_path:,
@@ -88,12 +109,14 @@ class CfnNag
     logger.add_appenders Logging.appenders.stdout
   end
 
-  def audit_template(input_json:, rule_directories: [])
+  def audit_template(input_json:,
+                     rule_directories: [])
     @stop_processing = false
     @violations = []
 
     unless legal_json?(input_json)
-      @violations << Violation.new(type: Violation::FAILING_VIOLATION,
+      @violations << Violation.new(id: 'FATAL',
+                                   type: Violation::FAILING_VIOLATION,
                                    message: 'not even legit JSON',
                                    violating_code: input_json)
       @stop_processing = true
@@ -103,6 +126,8 @@ class CfnNag
 
     @violations += custom_rules input_json unless @stop_processing == true
 
+    @violations = filter_violations_by_profile @violations
+
     {
       failure_count: Rule::count_failures(@violations),
       violations: @violations
@@ -111,6 +136,17 @@ class CfnNag
 
   private
 
+  def filter_violations_by_profile(violations)
+    profile = nil
+    unless @profile_definition.nil?
+      profile = ProfileLoader.new(@rule_registry).load(profile_definition: @profile_definition)
+    end
+
+    violations.reject do |violation|
+      not profile.nil? and not profile.execute_rule?(violation.id)
+    end
+  end
+
   def validate_extra_rule_directories(rule_directories)
     rule_directories.flatten.each do |rule_directory|
       fail "Not a real directory #{rule_directory}" unless File.directory? rule_directory
@@ -118,11 +154,13 @@ class CfnNag
   end
 
 
-  def render_results(aggregate_results:,output_format:)
+  def render_results(aggregate_results:,
+                     output_format:)
     results_renderer(output_format).new.render(aggregate_results)
   end
 
-  def audit_file(input_json_path:, rule_directories:)
+  def audit_file(input_json_path:,
+                 rule_directories:)
     audit_template(input_json: IO.read(input_json_path),
                    rule_directories: rule_directories)
   end
@@ -169,21 +207,11 @@ class CfnNag
     not system("#{command} > /dev/null 2>&1").nil?
   end
 
-  def jruby_in_a_jar?
-    __dir__.start_with? '/uri:classloader'
-  end
-
   def generic_json_rules(input_json, rule_directories)
     unless command? 'jq'
       fail 'jq executable must be available in PATH'
     end
-
-    if jruby_in_a_jar?
-      rules = %w(basic_rules cfn_rules cidr_rules cloudfront_rules ebs_rules iam_policy_rules iam_user_rules lambda_rules loadbalancer_rules port_rules s3_bucket_rules sns_rules sqs_rules)
-      rules = rules.map { |rule| File.join(__dir__, 'json_rules', "#{rule}.rb")[1..-1] }
-    else
-      rules = Dir[File.join(__dir__, 'json_rules', '*.rb')].sort
-    end
+    rules = Dir[File.join(__dir__, 'json_rules', '*.rb')].sort
 
     rules.each do |rule_file|
       @input_json = input_json
@@ -201,6 +229,6 @@ class CfnNag
   end
 
   def custom_rules(input_json)
-    CustomRuleLoader.new.custom_rules(input_json)
+    @custom_rule_loader.custom_rules(input_json)
   end
 end

data/lib/custom_rule_loader.rb

@@ -18,19 +18,26 @@ class CustomRuleLoader
     @custom_rule_directory
   end
 
-  def initialize
+  def initialize(rule_registry)
     @custom_rule_registry = [
       SecurityGroupMissingEgressRule,
       UserMissingGroupRule,
       UnencryptedS3PutObjectAllowedRule
     ]
     @violations = []
+    @rule_registry = rule_registry
+    discover_rules
   end
 
   def custom_rules(input_json)
-    discover_rules
+    @violations = []
+
     @custom_rule_registry.each do |rule_class|
       rule = rule_class.new
+      @rule_registry.definition(id: rule.rule_id,
+                                type: rule.rule_type,
+                                message: rule.rule_text)
+
       if rule.respond_to? 'custom_parsers'
         rule.custom_parsers.each do |custom_parser|
           ParserRegistry.instance.add_parser custom_parser[0], custom_parser[1]

data/lib/custom_rules/security_group_missing_egress.rb

@@ -6,6 +6,14 @@ class SecurityGroupMissingEgressRule
     'Missing egress rule means all traffic is allowed outbound.  Make this explicit if it is desired configuration'
   end
 
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F1000'
+  end
+
   def audit(cfn_model)
     logical_resource_ids = []
     cfn_model.security_groups.each do |security_group|
@@ -15,7 +23,8 @@ class SecurityGroupMissingEgressRule
     end
 
     if logical_resource_ids.size > 0
-      Violation.new(type: Violation::FAILING_VIOLATION,
+      Violation.new(id: rule_id,
+                    type: rule_type,
                     message: rule_text,
                     logical_resource_ids: logical_resource_ids)
     else

data/lib/custom_rules/unencrypted_s3_put_allowed.rb

@@ -7,6 +7,14 @@ class UnencryptedS3PutObjectAllowedRule
     'It appears that the S3 Bucket Policy allows s3:PutObject without server-side encryption'
   end
 
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W1000'
+  end
+
   def audit(cfn_model)
     logical_resource_ids = []
     cfn_model.bucket_policies.each do |bucket_policy|
@@ -19,7 +27,8 @@ class UnencryptedS3PutObjectAllowedRule
     end
 
     if logical_resource_ids.size > 0
-      Violation.new(type: Violation::WARNING,
+      Violation.new(id: rule_id,
+                    type: rule_type,
                     message: rule_text,
                     logical_resource_ids: logical_resource_ids)
     else

data/lib/custom_rules/user_missing_group.rb

@@ -6,6 +6,14 @@ class UserMissingGroupRule
     'User is not assigned to a group'
   end
 
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F2000'
+  end
+
   def audit(cfn_model)
     logical_resource_ids = []
     cfn_model.iam_users.each do |iam_user|
@@ -15,7 +23,8 @@ class UserMissingGroupRule
     end
 
     if logical_resource_ids.size > 0
-      Violation.new(type: Violation::FAILING_VIOLATION,
+      Violation.new(id: rule_id,
+                    type: rule_type,
                     message: rule_text,
                     logical_resource_ids: logical_resource_ids)
     else

data/lib/json_rules/basic_rules.rb

@@ -1,4 +1,5 @@
-raw_fatal_assertion jq: '.Resources|length > 0',
+raw_fatal_assertion id: 'FATAL',
+                    jq: '.Resources|length > 0',
                     message: 'A CloudFormation template must have at least 1 resource'
 
 
@@ -14,7 +15,8 @@ raw_fatal_assertion jq: '.Resources|length > 0',
   AWS::EC2::SecurityGroupIngress
   AWS::EC2::SecurityGroupEgress
 ).each do |resource_must_have_properties|
-  fatal_violation jq: "[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == \"#{resource_must_have_properties}\" and .Properties == null)]|map(.LogicalResourceId)",
+  fatal_violation id: 'FATAL',
+                  jq: "[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == \"#{resource_must_have_properties}\" and .Properties == null)]|map(.LogicalResourceId)",
                   message: "#{resource_must_have_properties} must have Properties"
 end
 
@@ -32,7 +34,8 @@ missing_reference_jq = <<END
   )|if length==0 then false else . end
 END
 
-raw_fatal_violation jq: missing_reference_jq,
+raw_fatal_violation id: 'FATAL',
+                    jq: missing_reference_jq,
                     message: 'All Ref and Fn::GetAtt must reference existing logical resource ids'
 
 
@@ -40,6 +43,7 @@ raw_fatal_violation jq: missing_reference_jq,
   AWS::EC2::SecurityGroupIngress
   AWS::EC2::SecurityGroupEgress
 ).each do |xgress|
-  fatal_violation jq: "[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == \"#{xgress}\" and .Properties.GroupName != null)]|map(.LogicalResourceId)",
+  fatal_violation id: 'FATAL',
+                  jq: "[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == \"#{xgress}\" and .Properties.GroupName != null)]|map(.LogicalResourceId)",
                   message: "#{xgress} must not have GroupName - EC2 classic is a no-go!"
 end

data/lib/json_rules/cfn_rules.rb

@@ -1,3 +1,4 @@
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Metadata."AWS::CloudFormation::Authentication") ]|'\
+warning id: 'W1',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Metadata."AWS::CloudFormation::Authentication") ]|'\
               'map(.LogicalResourceId) ',
         message: 'Specifying credentials in the template itself is probably not the safest thing'

data/lib/json_rules/cidr_rules.rb

@@ -1,31 +1,38 @@
 ##### inline ingress
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupIngress|type == "object"))|select(.Properties.SecurityGroupIngress.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
+warning id: 'W2',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupIngress|type == "object"))|select(.Properties.SecurityGroupIngress.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
         message: 'Security Groups found with cidr open to world on ingress.  This should never be true on instance.  Permissible on ELB'
 
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupIngress|type == "array"))|first(select(.Properties.SecurityGroupIngress[].CidrIp? == "0.0.0.0/0"))]|map(.LogicalResourceId)',
+warning id: 'W3',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupIngress|type == "array"))|first(select(.Properties.SecurityGroupIngress[].CidrIp? == "0.0.0.0/0"))]|map(.LogicalResourceId)',
         message: 'Security Groups found with cidr open to world on ingress array.  This should never be true on instance.  Permissible on ELB'
 
 ##### external ingress
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupIngress")|select(.Properties.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
+warning id: 'W4',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupIngress")|select(.Properties.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
         message: 'Security Group Standalone Ingress found with cidr open to world. This should never be true on instance.  Permissible on ELB'
 
 
 ###### inline egress
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupEgress|type == "object"))|select(.Properties.SecurityGroupEgress.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
+warning id: 'W5',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupEgress|type == "object"))|select(.Properties.SecurityGroupEgress.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
         message: 'Security Groups found with cidr open to world on egress'
 
 
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupEgress|type == "array"))|first(select(.Properties.SecurityGroupEgress[].CidrIp? == "0.0.0.0/0"))]|map(.LogicalResourceId)',
+warning id: 'W6',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroup" and (.Properties.SecurityGroupEgress|type == "array"))|first(select(.Properties.SecurityGroupEgress[].CidrIp? == "0.0.0.0/0"))]|map(.LogicalResourceId)',
         message: 'Security Groups found with cidr open to world on egress array'
 
 
 ##### external egress
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupEgress")|select(.Properties.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
+warning id: 'W7',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupEgress")|select(.Properties.CidrIp? == "0.0.0.0/0")]|map(.LogicalResourceId)',
         message: 'Security Group Standalone Egress found with cidr open to world.'
 
 
 # BEWARE with escapes \d -> \\\d because of how the escapes get munged from ruby through to shell
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupIngress" and .Properties.CidrIp|type == "string")|select(.Properties.CidrIp | test("^\\\d{1,3}\\\.\\\d{1,3}\\\.\\\d{1,3}\\\.\\\d{1,3}/(?!32)$") )]|map(.LogicalResourceId)',
+warning id: 'W8',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupIngress" and .Properties.CidrIp|type == "string")|select(.Properties.CidrIp | test("^\\\d{1,3}\\\.\\\d{1,3}\\\.\\\d{1,3}\\\.\\\d{1,3}/(?!32)$") )]|map(.LogicalResourceId)',
         message: 'Security Group Standalone Ingress cidr found that is not /32'
 
 non_32_cidr_jq_expression = <<END
@@ -57,5 +64,6 @@ non_32_cidr_jq_expression = <<END
   ]|map(.LogicalResourceId)
 END
 
-warning jq: non_32_cidr_jq_expression,
+warning id: 'W9',
+        jq: non_32_cidr_jq_expression,
         message: 'Security Groups found with cidr that is not /32'

data/lib/json_rules/cloudfront_rules.rb

@@ -1,3 +1,4 @@
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::CloudFront::Distribution")|'\
+warning id: 'W10',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::CloudFront::Distribution")|'\
               'select(.Properties.DistributionConfig.Logging == null)]|map(.LogicalResourceId) ',
         message: 'CloudFront Distribution should enable access logging'

data/lib/json_rules/ebs_rules.rb

@@ -1,3 +1,4 @@
-violation jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::Volume")|'\
+violation id: 'F1',
+          jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::Volume")|'\
               'select(.Properties.Encrypted == null or .Properties.Encrypted == false)]|map(.LogicalResourceId) ',
           message: 'EBS volume should have server-side encryption enabled'

data/lib/json_rules/iam_policy_rules.rb

@@ -6,21 +6,25 @@ def wildcard_action:
   end;
 END
 
-violation jq: wildcard_action_filter +
+violation id: 'F2',
+          jq: wildcard_action_filter +
              "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.AssumeRolePolicyDocument|wildcard_action)]|map(.LogicalResourceId) ",
           message: 'IAM role should not allow * action on its trust policy'
 
-violation jq: wildcard_action_filter +
+violation id: 'F3',
+          jq: wildcard_action_filter +
               "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.Policies !=null)|select(.Properties.Policies[].PolicyDocument|wildcard_action)]|map(.LogicalResourceId)",
           message: 'IAM role should not allow * action on its permissions policy'
 
 
-violation jq: wildcard_action_filter +
+violation id: 'F4',
+          jq: wildcard_action_filter +
               "[#{resources_by_type('AWS::IAM::Policy')}|select(.Properties.PolicyDocument|wildcard_action)]|map(.LogicalResourceId) ",
           message: 'IAM policy should not allow * action'
 
 
-violation jq: wildcard_action_filter +
+violation id: 'F5',
+          jq: wildcard_action_filter +
               "[#{resources_by_type('AWS::IAM::ManagedPolicy')}|select(.Properties.PolicyDocument|wildcard_action)]|map(.LogicalResourceId) ",
           message: 'IAM managed policy should not allow * action'
 
@@ -32,16 +36,19 @@ def wildcard_resource:
   end;
 END
 
-warning jq: wildcard_resource_filter +
+warning id: 'W11',
+        jq: wildcard_resource_filter +
             "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.Policies !=null)|select(.Properties.Policies[].PolicyDocument|wildcard_resource)]|map(.LogicalResourceId)",
         message: 'IAM role should not allow * resource on its permissions policy'
 
 
-warning jq: wildcard_resource_filter +
+warning id: 'W12',
+        jq: wildcard_resource_filter +
             "[#{resources_by_type('AWS::IAM::Policy')}|select(.Properties.PolicyDocument|wildcard_resource)]|map(.LogicalResourceId)",
         message: 'IAM policy should not allow * resource'
 
-warning jq: wildcard_resource_filter +
+warning id: 'W13',
+        jq: wildcard_resource_filter +
             "[#{resources_by_type('AWS::IAM::ManagedPolicy')}|select(.Properties.PolicyDocument|wildcard_resource)]|map(.LogicalResourceId)",
         message: 'IAM managed policy should not allow * resource'
 
@@ -53,34 +60,41 @@ def allow_not_action:
   end;
 END
 
-warning jq: allow_not_action_filter +
+warning id: 'W14',
+        jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.AssumeRolePolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'IAM role should not allow Allow+NotAction on trust permissinos'
 
 
-warning jq: allow_not_action_filter +
+warning id: 'W15',
+        jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.Policies !=null)|select(.Properties.Policies[].PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'IAM role should not allow Allow+NotAction'
 
 
-warning jq: allow_not_action_filter +
+warning id: 'W16',
+        jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::IAM::Policy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'IAM policy should not allow Allow+NotAction'
 
 
-warning jq: allow_not_action_filter +
+warning id: 'W17',
+        jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::IAM::ManagedPolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'IAM managed policy should not allow Allow+NotAction'
 
-warning jq: allow_not_action_filter +
+warning id: 'W18',
+        jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'SQS Queue policy should not allow Allow+NotAction'
 
-warning jq: allow_not_action_filter +
+warning id: 'W19',
+        jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'SNS Topic policy should not allow Allow+NotAction'
 
-warning jq: allow_not_action_filter +
+warning id: 'W20',
+        jq: allow_not_action_filter +
             "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|allow_not_action)]|map(.LogicalResourceId)",
         message: 'S3 Bucket policy should not allow Allow+NotAction'
 
@@ -92,17 +106,20 @@ def allow_not_resource:
   end;
 END
 
-warning jq: allow_not_resource_filter +
+warning id: 'W21',
+        jq: allow_not_resource_filter +
             "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.Policies !=null)|select(.Properties.Policies[].PolicyDocument|allow_not_resource)]|map(.LogicalResourceId)",
         message: 'IAM role should not allow Allow+NotResource'
 
 
-warning jq: allow_not_resource_filter +
+warning id: 'W22',
+        jq: allow_not_resource_filter +
             "[#{resources_by_type('AWS::IAM::Policy')}|select(.Properties.PolicyDocument|allow_not_resource)]|map(.LogicalResourceId)",
         message: 'IAM policy should not allow Allow+NotResource'
 
 
-warning jq: allow_not_resource_filter +
+warning id: 'W23',
+        jq: allow_not_resource_filter +
            "[#{resources_by_type('AWS::IAM::ManagedPolicy')}|select(.Properties.PolicyDocument|allow_not_resource)]|map(.LogicalResourceId)",
         message: 'IAM managed policy should not allow Allow+NotResource'
 
@@ -115,18 +132,22 @@ def allow_not_principal:
   end;
 END
 
-violation jq: allow_not_principal_filter +
+violation id: 'F6',
+          jq: allow_not_principal_filter +
               "[#{resources_by_type('AWS::IAM::Role')}|select(.Properties.AssumeRolePolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
           message: 'IAM role should not allow Allow+NotPrincipal in its trust policy'
 
-violation jq: allow_not_principal_filter +
+violation id: 'F7',
+          jq: allow_not_principal_filter +
               "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
           message: 'SQS Queue policy should not allow Allow+NotPrincipal'
 
-violation jq: allow_not_principal_filter +
+violation id: 'F8',
+          jq: allow_not_principal_filter +
               "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
           message: 'SNS Topic policy should not allow Allow+NotPrincipal'
 
-violation jq: allow_not_principal_filter +
+violation id: 'F9',
+          jq: allow_not_principal_filter +
               "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|allow_not_principal)]|map(.LogicalResourceId)",
           message: 'S3 Bucket policy should not allow Allow+NotPrincipal'

data/lib/json_rules/iam_user_rules.rb

@@ -1,12 +1,15 @@
-violation jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::IAM::User")|'\
+violation id: 'F10',
+          jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::IAM::User")|'\
               'select(.Properties.Policies|length > 0)]|map(.LogicalResourceId) ',
           message: 'IAM user should not have any directly attached policies.  Should be on group'
 
-violation jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::IAM::Policy")|'\
+violation id: 'F11',
+          jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::IAM::Policy")|'\
               'select(.Properties.Users|length > 0)]|map(.LogicalResourceId) ',
           message: 'IAM policy should not apply directly to users.  Should be on group'
 
-violation jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::IAM::ManagedPolicy")|'\
+violation id: 'F12',
+          jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::IAM::ManagedPolicy")|'\
               'select(.Properties.Users|length > 0)]|map(.LogicalResourceId) ',
           message: 'IAM managed policy should not apply directly to users.  Should be on group'
 

data/lib/json_rules/lambda_rules.rb

@@ -1,7 +1,9 @@
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::Lambda::Permission")|'\
+warning id: 'W24',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::Lambda::Permission")|'\
               'select(.Properties.Action != "lambda:InvokeFunction")]|map(.LogicalResourceId) ',
         message: 'Lambda permission beside InvokeFunction might not be what you want?  Not sure!?'
 
-violation jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::Lambda::Permission")|'\
+violation id: 'F13',
+          jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::Lambda::Permission")|'\
               'select(.Properties.Principal == "*")]|map(.LogicalResourceId) ',
         message: 'Lambda permission principal should not be wildcard'

data/lib/json_rules/loadbalancer_rules.rb

@@ -1,7 +1,9 @@
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::ElasticLoadBalancing::LoadBalancer")|'\
+warning id: 'W25',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::ElasticLoadBalancing::LoadBalancer")|'\
               'select(.Properties.AccessLoggingPolicy == null)]|map(.LogicalResourceId) ',
         message: 'Elastic Load Balancer should have access logging configured'
 
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::ElasticLoadBalancing::LoadBalancer")|'\
+warning id: 'W26',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::ElasticLoadBalancing::LoadBalancer")|'\
               'select(.Properties.AccessLoggingPolicy?.Enabled == false)]|map(.LogicalResourceId) ',
         message: 'Elastic Load Balancer should have access logging enabled'

data/lib/json_rules/port_rules.rb

@@ -1,4 +1,5 @@
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | '\
+warning id: 'W27',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | '\
             'select(.Type == "AWS::EC2::SecurityGroup")| '\
             'if (.Properties.SecurityGroupIngress|type == "object") '\
             'then select(.Properties.SecurityGroupIngress.ToPort != .Properties.SecurityGroupIngress.FromPort) '\
@@ -10,10 +11,12 @@ warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | '\
             ']|map(.LogicalResourceId)',
         message:  'Security Groups found ingress with port range instead of just a single port'
 
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupIngress")|select(.Properties.ToPort != .Properties.FromPort)]|map(.LogicalResourceId)',
+warning id: 'W28',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupIngress")|select(.Properties.ToPort != .Properties.FromPort)]|map(.LogicalResourceId)',
         message:  'Security Group ingress with port range instead of just a single port'
 
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | '\
+warning id: 'W29',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | '\
             'select(.Type == "AWS::EC2::SecurityGroup")| '\
             'if (.Properties.SecurityGroupEgress|type == "object") '\
             'then select(.Properties.SecurityGroupEgress.ToPort != .Properties.SecurityGroupEgress.FromPort) '\
@@ -25,5 +28,6 @@ warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | '\
             ']|map(.LogicalResourceId)',
         message:  'Security Groups found egress with port range instead of just a single port'
 
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupEgress")|select(.Properties.ToPort != .Properties.FromPort)]|map(.LogicalResourceId)',
+warning id: 'W30',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::EC2::SecurityGroupEgress")|select(.Properties.ToPort != .Properties.FromPort)]|map(.LogicalResourceId)',
         message:  'Security Group egress with port range instead of just a single port'

data/lib/json_rules/s3_bucket_rules.rb

@@ -1,8 +1,10 @@
-warning jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::S3::Bucket")|'\
+warning id: 'W31',
+        jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::S3::Bucket")|'\
               'select(.Properties.AccessControl? == "PublicRead")]|map(.LogicalResourceId) ',
         message: 'S3 Bucket likely should not have a public read acl'
 
-violation jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::S3::Bucket")|'\
+violation id: 'F14',
+          jq: '[.Resources|with_entries(.value.LogicalResourceId = .key)[] | select(.Type == "AWS::S3::Bucket")|'\
               'select(.Properties.AccessControl? == "PublicReadWrite")]|map(.LogicalResourceId) ',
           message: 'S3 Bucket should not have a public read-write acl'
 
@@ -33,14 +35,17 @@ def s3_wildcard_aws_principal:
 END
 
 
-violation jq: s3_wildcard_action_filter +
+violation id: 'F15',
+          jq: s3_wildcard_action_filter +
               "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|s3_wildcard_action)]|map(.LogicalResourceId) ",
           message: 'S3 Bucket policy should not allow * action'
 
-violation jq: s3_wildcard_principal_filter +
+violation id: 'F16',
+          jq: s3_wildcard_principal_filter +
               "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|s3_wildcard_principal)]|map(.LogicalResourceId) ",
           message: 'S3 Bucket policy should not allow * principal'
 
-violation jq: s3_wildcard_aws_principal_filter +
+violation id: 'F17',
+          jq: s3_wildcard_aws_principal_filter +
               "[#{resources_by_type('AWS::S3::BucketPolicy')}|select(.Properties.PolicyDocument|s3_wildcard_aws_principal)]|map(.LogicalResourceId) ",
           message: 'S3 Bucket policy should not allow * AWS principal'

data/lib/json_rules/sns_rules.rb

@@ -18,10 +18,12 @@ END
 
 #sns action wildcard doesnt seem to be accepted by sns so dont sweat it
 
-violation jq: sns_wildcard_principal_filter +
+violation id: 'F18',
+          jq: sns_wildcard_principal_filter +
               "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|sns_wildcard_principal)]|map(.LogicalResourceId) ",
           message: 'SNS topic policy should not allow * principal'
 
-violation jq: sns_wildcard_aws_principal_filter +
+violation id: 'F19',
+          jq: sns_wildcard_aws_principal_filter +
               "[#{resources_by_type('AWS::SNS::TopicPolicy')}|select(.Properties.PolicyDocument|sns_wildcard_aws_principal)]|map(.LogicalResourceId) ",
           message: 'SNS topic policy should not allow * AWS principal'

data/lib/json_rules/sqs_rules.rb

@@ -14,10 +14,12 @@ def sqs_wildcard_principal:
   end;
 END
 
-violation jq: sqs_wildcard_action_filter +
+violation id: 'F20',
+          jq: sqs_wildcard_action_filter +
               "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|sqs_wildcard_action)]|map(.LogicalResourceId) ",
           message: 'SQS Queue policy should not allow * action'
 
-violation jq: sqs_wildcard_principal_filter +
+violation id: 'F21',
+          jq: sqs_wildcard_principal_filter +
               "[#{resources_by_type('AWS::SQS::QueuePolicy')}|select(.Properties.PolicyDocument|sqs_wildcard_principal)]|map(.LogicalResourceId) ",
           message: 'SQS Queue policy should not allow * principal'

data/lib/profile.rb

@@ -0,0 +1,18 @@
+require 'set'
+
+class Profile
+
+  attr_reader :rule_ids
+
+  def initialize
+    @rule_ids = Set.new
+  end
+
+  def add_rule(rule_id)
+    @rule_ids << rule_id
+  end
+
+  def execute_rule?(rule_id)
+    @rule_ids.include? rule_id
+  end
+end

data/lib/profile_loader.rb

@@ -0,0 +1,27 @@
+require_relative 'profile'
+
+class ProfileLoader
+
+  def initialize(rules_registry)
+    @rules_registry = rules_registry
+  end
+
+  def load(profile_definition:)
+
+    if profile_definition.nil? or profile_definition.strip == ''
+      raise 'Empty profile'
+    end
+
+    new_profile = Profile.new
+
+    profile_definition.each_line do |line|
+      rule_id = line.chomp
+      if @rules_registry.by_id(rule_id) == []
+        raise "#{rule_id} is not a legal rule identifier"
+      else
+        new_profile.add_rule rule_id
+      end
+    end
+    new_profile
+  end
+end

data/lib/result_view/simple_stdout_results.rb

@@ -9,7 +9,7 @@ class SimpleStdoutResults
       (1..60).each { print '-' }
 
       result[:file_results][:violations].each do |violation|
-        message message_type: violation.type,
+        message message_type: "#{violation.type} #{violation.id}",
                 message: violation.message,
                 logical_resource_ids: violation.logical_resource_ids,
                 violating_code: violation.violating_code

data/lib/rule.rb

@@ -16,8 +16,10 @@ module Rule
     "#{resources}| select(.Type == \"#{resource}\")"
   end
 
-  def warning(jq:, message:)
-    @warning_registry << message
+  def warning(id:, jq:, message:)
+    warning_def = @rule_registry.definition(id: id,
+                                            type: Violation::WARNING,
+                                            message: message)
 
     return if @stop_processing
 
@@ -30,50 +32,57 @@ module Rule
     resource_ids = parse_logical_resource_ids(stdout)
     new_warnings = resource_ids.size
     if result == 0 and new_warnings > 0
-      add_violation(type: Violation::WARNING,
+      add_violation(id: warning_def.id,
+                    type: Violation::WARNING,
                     message: message,
                     logical_resource_ids: resource_ids)
     end
   end
 
-  def raw_fatal_assertion(jq:, message:)
-    failing_rule(jq_expression: jq,
+  def raw_fatal_assertion(id:, jq:, message:)
+    failing_rule(id: id,
+                 jq_expression: jq,
                  fail_if_found: false,
                  fatal: true,
                  message: message,
                  raw: true)
   end
 
-  def fatal_assertion(jq:, message:)
-    failing_rule(jq_expression: jq,
+  def fatal_assertion(id:, jq:, message:)
+    failing_rule(id: id,
+                 jq_expression: jq,
                  fail_if_found: false,
                  fatal: true,
                  message: message)
   end
 
-  def raw_fatal_violation(jq:, message:)
-    failing_rule(jq_expression: jq,
+  def raw_fatal_violation(id:, jq:, message:)
+    failing_rule(id: id,
+                 jq_expression: jq,
                  fail_if_found: true,
                  fatal: true,
                  message: message,
                  raw: true)
   end
 
-  def fatal_violation(jq:, message:)
-    failing_rule(jq_expression: jq,
+  def fatal_violation(id:, jq:, message:)
+    failing_rule(id: id,
+                 jq_expression: jq,
                  fail_if_found: true,
                  fatal: true,
                  message: message)
   end
 
-  def violation(jq:, message:)
-    failing_rule(jq_expression: jq,
+  def violation(id:, jq:, message:)
+    failing_rule(id: id,
+                 jq_expression: jq,
                  fail_if_found: true,
                  message: message)
   end
 
-  def assertion(jq:, message:)
-    failing_rule(jq_expression: jq,
+  def assertion(id:, jq:, message:)
+    failing_rule(id: id,
+                 jq_expression: jq,
                  fail_if_found: false,
                  message: message)
   end
@@ -108,11 +117,17 @@ module Rule
     end
   end
 
-  def add_violation(type:,
+  # this is to record a violation as opposed to "registering" a violation
+  #
+  # not super keen on this looking at it after the fact.... @violations
+  # will have to live in the object this Rule is mixed into i.e. CfnNag
+  def add_violation(id:,
+                    type:,
                     message:,
                     logical_resource_ids: nil,
                     violating_code: nil)
-    violation = Violation.new(type: type,
+    violation = Violation.new(id: id,
+                              type: type,
                               message: message,
                               logical_resource_ids: logical_resource_ids,
                               violating_code: violating_code)
@@ -135,12 +150,17 @@ module Rule
   #      failure count by 1
   #
   # fatal: if true, any match of the rule causes immediate shutdown to avoid more complicated downstream error checking
-  def failing_rule(jq_expression:,
+  def failing_rule(id:,
+                   jq_expression:,
                    fail_if_found:,
                    message:,
                    fatal: false,
                    raw: false)
-    @violation_registry << message
+
+    fail_def =  @rule_registry.definition(id: id,
+                                          type: Violation::FAILING_VIOLATION,
+                                          message: message)
+
     return if @stop_processing
 
     Logging.logger['log'].debug jq_expression
@@ -152,7 +172,8 @@ module Rule
        (not fail_if_found and result != 0)
 
       if raw
-        add_violation(type: Violation::FAILING_VIOLATION,
+        add_violation(id: fail_def.id,
+                      type: Violation::FAILING_VIOLATION,
                       message: message,
                       violating_code: stdout)
 
@@ -163,7 +184,8 @@ module Rule
         resource_ids = parse_logical_resource_ids(stdout)
 
         if resource_ids.size > 0
-          add_violation(type: Violation::FAILING_VIOLATION,
+          add_violation(id: fail_def.id,
+                        type: Violation::FAILING_VIOLATION,
                         message: message,
                         logical_resource_ids: resource_ids)
 

data/lib/rule_registry.rb

@@ -0,0 +1,45 @@
+require_relative 'violation'
+
+class RuleRegistry
+
+  attr_reader :rules
+
+  def initialize
+    @rules = []
+  end
+
+  def definition(id:,
+                 type:,
+                 message:)
+    violation_def = Violation.new(id: id,
+                                  type: type,
+                                  message: message)
+    existing_def = @rules.find { |definition| definition == violation_def }
+
+    if existing_def.nil?
+      add_rule violation_def
+    else
+      existing_def
+    end
+  end
+
+  # FATAL applies to multiple rules
+  def by_id(id)
+    @rules.select { |rule| rule.id == id }
+  end
+
+  def warnings
+    @rules.select { |rule| rule.type == Violation::WARNING }
+  end
+
+  def failings
+    @rules.select { |rule| rule.type == Violation::FAILING_VIOLATION }
+  end
+
+  private
+
+  def add_rule(violation_def)
+    @rules << violation_def
+    violation_def
+  end
+end

data/lib/violation.rb

@@ -1,14 +1,17 @@
 require 'json'
+
 class Violation
   WARNING = 'WARN'
   FAILING_VIOLATION = 'FAIL'
 
-  attr_reader :type, :message, :logical_resource_ids, :violating_code
+  attr_reader :id, :type, :message, :logical_resource_ids, :violating_code
 
-  def initialize(type:,
+  def initialize(id:,
+                 type:,
                  message:,
                  logical_resource_ids: nil,
                  violating_code: nil)
+    @id = id
     @type = type
     @message = message
     @logical_resource_ids = logical_resource_ids
@@ -19,11 +22,12 @@ class Violation
   end
 
   def to_s
-    puts "#{@type} #{@message} #{@logical_resource_ids} #{@violating_code}"
+    puts "#{@id} #{@type} #{@message} #{@logical_resource_ids} #{@violating_code}"
   end
 
   def to_h
     {
+      id: @id,
       type: @type,
       message: @message,
       logical_resource_ids: @logical_resource_ids,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.0.34
+  version: 0.0.35
 platform: ruby
 authors:
 - someguy
@@ -73,9 +73,12 @@ files:
 - lib/model/s3_bucket_policy.rb
 - lib/model/s3_bucket_policy_parser.rb
 - lib/model/security_group_parser.rb
+- lib/profile.rb
+- lib/profile_loader.rb
 - lib/result_view/json_results.rb
 - lib/result_view/simple_stdout_results.rb
 - lib/rule.rb
+- lib/rule_registry.rb
 - lib/violation.rb
 homepage: https://github.com/stelligent/cfn_nag
 licenses: