cfn-nag 0.0.6 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7833544e3b4320a57b9f59b63ca2d0d84cf1edce
-  data.tar.gz: 4c62a7a3ebd450650943cf9133c77b2567d8a91c
+  metadata.gz: 56cf57973ea5a51f6165d0355ac413e2f7b19e71
+  data.tar.gz: 9f7a7d3c17486bc4bde0c8bd1dd31ea387c7f2cb
 SHA512:
-  metadata.gz: a21b9bdb4501e68f750fa6749a10d203f54c552312fd80cc011eec1d05cb31cc61a6551cfacdbd8c73c8b4ab03322f8268685adf4f16fb9d2c56ebad8515a26a
-  data.tar.gz: 47ed2d380831246c3d08159c8db668f6d1613eaa9e4563558dd8a342519b13ffd2f551bc1888e88778f6f642487d720ff01607ff706dea95cf2c02c796cd6ac9
+  metadata.gz: 4fa7690fd912219ec16df21316844c2453881dd19bb76651f91d8d5c438a1e811c525d724120301b026f7e1c1a915c77e657d66d0814d4795f9b1e88d32541be
+  data.tar.gz: 0c1fda4f9df20aa7e7c0e8372fe41374c2c09eb9a8f6b426e6c765e3144f7d0ba00bc0fbee0345a1e3b8298b27f31fc190b50bfe9a8e727595ecd346b4a89201

data/bin/cfn_nag

@@ -4,7 +4,7 @@ require 'cfn_nag'
 require 'logging'
 
 opts = Trollop::options do
-  opt :input_json, 'Cloudformation template to nag on', type: :string, required: true
+  opt :input_json_path, 'Cloudformation template to nag on or directory of templates - all *.json and *.template recursively', type: :io, required: true
   opt :output_format, 'Format of results: [txt, json]', type: :string, default: 'txt'
   opt :debug, 'Enable debug output', type: :boolean, required: false, default: false
 end
@@ -13,5 +13,5 @@ Trollop::die(:output_format,
              'Must be txt or json') unless %w(txt json).include?(opts[:output_format])
 
 CfnNag::configure_logging(opts)
-exit CfnNag.new.audit(input_json_path: opts[:input_json],
-                      output_format: opts[:output_format])
+exit CfnNag.new.audit(input_json_path: opts[:input_json_path],
+                      output_format: opts[:output_format])

data/lib/cfn_nag.rb

@@ -10,17 +10,20 @@ class CfnNag
 
   def audit(input_json_path:,
             output_format:'txt')
-    fail 'not even legit JSON' unless legal_json?(input_json_path)
-
-    @violations = []
 
-    generic_json_rules input_json_path
+    templates = discover_templates(input_json_path)
 
-    custom_rules input_json_path
+    aggregate_results = []
+    templates.each do |template|
+      aggregate_results << {
+        filename: template,
+        file_results: audit_file(input_json_path: template)
+      }
+    end
 
-    results_renderer(output_format).new.render(@violations)
+    results_renderer(output_format).new.render(aggregate_results)
 
-    Rule::count_failures(@violations)
+    aggregate_results.inject(0) { |total_failure_count, results| total_failure_count + results[:file_results][:failure_count] }
   end
 
   def self.configure_logging(opts)
@@ -36,6 +39,42 @@ class CfnNag
 
   private
 
+  def audit_file(input_json_path:)
+    fail 'not even legit JSON' unless legal_json?(input_json_path)
+    @stop_processing = false
+    @violations = []
+
+    generic_json_rules input_json_path
+
+    custom_rules input_json_path unless @stop_processing == true
+
+    {
+      failure_count: Rule::count_failures(@violations),
+      violations: @violations
+    }
+  end
+
+  def discover_templates(input_json_path)
+    if ::File.directory? input_json_path
+      templates = find_templates_in_directory(directory: input_json_path)
+    elsif ::File.file? input_json_path
+      templates = [input_json_path]
+    else
+      fail "#{input_json_path} is not a proper path"
+    end
+    templates
+  end
+
+  def find_templates_in_directory(directory:,
+                                  cfn_extensions: %w(json template))
+
+    templates = []
+    cfn_extensions.each do |cfn_extension|
+      templates += Dir[File.join(directory, "**/*.#{cfn_extension}")]
+    end
+    templates
+  end
+
   def results_renderer(output_format)
     registry = {
       'txt' => SimpleStdoutResults,

data/lib/result_view/json_results.rb

@@ -1,15 +1,12 @@
 require 'json'
+
 class JsonResults
+  def render(results)
 
-  def render(violations)
-    violations_hashes = violations.map do |violation|
-      {
-        type: violation.type,
-        message: violation.message,
-        logical_resource_ids: violation.logical_resource_ids,
-        violating_code: violation.violating_code
-      }
+    hashified_results = results.each do |result|
+      result[:file_results][:violations] = result[:file_results][:violations].map { |violation| violation.to_h }
     end
-    puts JSON.pretty_generate(violations_hashes)
+
+    puts JSON.pretty_generate(hashified_results)
   end
 end

data/lib/result_view/simple_stdout_results.rb

@@ -2,16 +2,21 @@ require 'rule'
 
 class SimpleStdoutResults
 
-  def render(violations)
-    violations.each do |violation|
-      message message_type: violation.type,
-              message: violation.message,
-              logical_resource_ids: violation.logical_resource_ids,
-              violating_code: violation.violating_code
+  def render(results)
+    results.each do |result|
+      (1..60).each { print '-' }
+      puts "\n" + result[:filename]
+      (1..60).each { print '-' }
+
+      result[:file_results][:violations].each do |violation|
+        message message_type: violation.type,
+                message: violation.message,
+                logical_resource_ids: violation.logical_resource_ids,
+                violating_code: violation.violating_code
+      end
+      puts "\nViolations count: #{Rule::count_failures(result[:file_results][:violations])}"
+      puts "Warnings count: #{Rule::count_warnings(result[:file_results][:violations])}"
     end
-
-    puts "Violations count: #{Rule::count_warnings(violations)}"
-    puts "Warnings count: #{Rule::count_failures(violations)}"
   end
 
   private

data/lib/rule.rb

@@ -17,6 +17,8 @@ module Rule
   end
 
   def warning(jq:, message:)
+    return if @stop_processing
+
     Logging.logger['log'].debug jq
 
     stdout = jq_command(@input_json_path, jq)
@@ -37,7 +39,7 @@ module Rule
                  fail_if_found: false,
                  fatal: true,
                  message: message,
-                 message_type: Violation::FATAL_VIOLATION,
+                 message_type: Violation::FAILING_VIOLATION,
                  raw: true)
   end
 
@@ -46,7 +48,7 @@ module Rule
                  fail_if_found: false,
                  fatal: true,
                  message: message,
-                 message_type: Violation::FATAL_VIOLATION)
+                 message_type: Violation::FAILING_VIOLATION)
   end
 
   def raw_fatal_violation(jq:, message:)
@@ -54,7 +56,7 @@ module Rule
                  fail_if_found: true,
                  fatal: true,
                  message: message,
-                 message_type: Violation::FATAL_VIOLATION,
+                 message_type: Violation::FAILING_VIOLATION,
                  raw: true)
   end
 
@@ -63,7 +65,7 @@ module Rule
                  fail_if_found: true,
                  fatal: true,
                  message: message,
-                 message_type: Violation::FATAL_VIOLATION)
+                 message_type: Violation::FAILING_VIOLATION)
   end
 
   def violation(jq:, message:)
@@ -143,6 +145,8 @@ module Rule
                    message_type:,
                    fatal: false,
                    raw: false)
+    return if @stop_processing
+
     Logging.logger['log'].debug jq_expression
 
     stdout = jq_command(@input_json_path, jq_expression)
@@ -157,7 +161,7 @@ module Rule
                       violating_code: stdout)
 
         if fatal
-          exit 1
+          @stop_processing = true
         end
       else
         resource_ids = parse_logical_resource_ids(stdout)
@@ -168,7 +172,7 @@ module Rule
                         logical_resource_ids: resource_ids)
 
           if fatal
-            exit 1
+            @stop_processing = true
           end
         end
       end

data/lib/violation.rb

@@ -1,7 +1,6 @@
-
+require 'json'
 class Violation
   WARNING = 'warning'
-  FATAL_VIOLATION = 'fatal violation'
   FAILING_VIOLATION = 'failing violation'
 
   attr_reader :type, :message, :logical_resource_ids, :violating_code
@@ -14,9 +13,21 @@ class Violation
     @message = message
     @logical_resource_ids = logical_resource_ids
     @violating_code = violating_code
+
+    fail if @type.nil?
+    fail if @message.nil?
   end
 
   def to_s
     puts "#{@type} #{@message} #{@logical_resource_ids} #{@violating_code}"
   end
+
+  def to_h
+    {
+      type: @type,
+      message: @message,
+      logical_resource_ids: @logical_resource_ids,
+      violating_code: @violating_code
+    }
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
 platform: ruby
 authors:
 - someguy