cfn-nag 0.1.8 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: bd5906c9788032280ede5ed4140f22b9654044a2
-  data.tar.gz: 1afc86b72e29a99ec4a91566b00ff2ee5b973078
+  metadata.gz: 9afa055a091cce26ce861f4788565f5e4be10fee
+  data.tar.gz: 0bd54fe8e8c9c4fc7d53e2aa755051c11becd143
 SHA512:
-  metadata.gz: e4bbe81af76602d8c5bdb0705bf5fd92b898bf5a11d630a644d97f557ba5cf772272649483aaadbc58f9e4872bee768a6e919b38f2c0681f0f9e0dd4e7cd5eba
-  data.tar.gz: c5b85b35db56051f6196ab02a60c665592768ae2e15f5ef3d49440c6a1bf0232789b603f58b048394d9d73ce3c01d659c01c2853b55de0b9329a8112bbcfd980
+  metadata.gz: ac0a50f49100462562dc74c792bd4c367018c931a8d01ad7e534d910b21116cc2b93abb4c2f64d164f9c432e81fc6a07bc4b9457f6238fb23257806998c6e2f4
+  data.tar.gz: cf262ff579adfc1072673cf8c9ef34cb7785035c2c460120a7b211f8e37574981d895c88920f4f4c7ead50eb5c0b5a7fc7fd7bae52ac75b40a2bb761ab7f5efd

data/lib/cfn-nag/custom_rules/IamManagedPolicyNotActionRule.rb

@@ -17,7 +17,7 @@ class IamManagedPolicyNotActionRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
-      !policy.policyDocument.allows_not_action.empty?
+      !policy.policy_document.allows_not_action.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamManagedPolicyNotResourceRule.rb

@@ -17,7 +17,7 @@ class IamManagedPolicyNotResourceRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
-      !policy.policyDocument.allows_not_resource.empty?
+      !policy.policy_document.allows_not_resource.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardActionRule.rb

@@ -17,7 +17,7 @@ class IamManagedPolicyWildcardActionRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
-      !policy.policyDocument.wildcard_allowed_actions.empty?
+      !policy.policy_document.wildcard_allowed_actions.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamManagedPolicyWildcardResourceRule.rb

@@ -17,7 +17,7 @@ class IamManagedPolicyWildcardResourceRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::ManagedPolicy').select do |policy|
-      !policy.policyDocument.wildcard_allowed_resources.empty?
+      !policy.policy_document.wildcard_allowed_resources.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamPolicyNotActionRule.rb

@@ -17,7 +17,7 @@ class IamPolicyNotActionRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
-      !policy.policyDocument.allows_not_action.empty?
+      !policy.policy_document.allows_not_action.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamPolicyNotResourceRule.rb

@@ -17,7 +17,7 @@ class IamPolicyNotResourceRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
-      !policy.policyDocument.allows_not_resource.empty?
+      !policy.policy_document.allows_not_resource.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamPolicyWildcardActionRule.rb

@@ -17,7 +17,7 @@ class IamPolicyWildcardActionRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
-      !policy.policyDocument.wildcard_allowed_actions.empty?
+      !policy.policy_document.wildcard_allowed_actions.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamPolicyWildcardResourceRule.rb

@@ -17,7 +17,7 @@ class IamPolicyWildcardResourceRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::IAM::Policy').select do |policy|
-      !policy.policyDocument.wildcard_allowed_resources.empty?
+      !policy.policy_document.wildcard_allowed_resources.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamRoleNotActionOnPermissionsPolicyRule.rb

@@ -17,8 +17,8 @@ class IamRoleNotActionOnPermissionsPolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
-      violating_policies = role.policies.select do |policy|
-        !policy.policyDocument.allows_not_action.empty?
+      violating_policies = role.policy_objects.select do |policy|
+        !policy.policy_document.allows_not_action.empty?
       end
       !violating_policies.empty?
     end

data/lib/cfn-nag/custom_rules/IamRoleNotActionOnTrustPolicyRule.rb

@@ -17,7 +17,7 @@ class IamRoleNotActionOnTrustPolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
-      !role.assumeRolePolicyDocument.allows_not_action.empty?
+      !role.assume_role_policy_document.allows_not_action.empty?
     end
 
     violating_roles.map { |role| role.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamRoleNotPrincipalOnTrustPolicyRule.rb

@@ -17,7 +17,7 @@ class IamRoleNotPrincipalOnTrustPolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
-      !role.assumeRolePolicyDocument.allows_not_principal.empty?
+      !role.assume_role_policy_document.allows_not_principal.empty?
     end
 
     violating_roles.map { |role| role.logical_resource_id }

data/lib/cfn-nag/custom_rules/IamRoleNotResourceOnPermissionsPolicyRule.rb

@@ -17,8 +17,8 @@ class IamRoleNotResourceOnPermissionsPolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
-      violating_policies = role.policies.select do |policy|
-        !policy.policyDocument.allows_not_resource.empty?
+      violating_policies = role.policy_objects.select do |policy|
+        !policy.policy_document.allows_not_resource.empty?
       end
       !violating_policies.empty?
     end

data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnPermissionsPolicyRule.rb

@@ -17,8 +17,8 @@ class IamRoleWildcardActionOnPermissionsPolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
-      violating_policies = role.policies.select do |policy|
-        !policy.policyDocument.wildcard_allowed_actions.empty?
+      violating_policies = role.policy_objects.select do |policy|
+        !policy.policy_document.wildcard_allowed_actions.empty?
       end
       !violating_policies.empty?
     end

data/lib/cfn-nag/custom_rules/IamRoleWildcardActionOnTrustPolicyRule.rb

@@ -17,7 +17,7 @@ class IamRoleWildcardActionOnTrustPolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
-      !role.assumeRolePolicyDocument.wildcard_allowed_actions.empty?
+      !role.assume_role_policy_document.wildcard_allowed_actions.empty?
     end
 
     violating_roles.map { |role| role.logical_resource_id}

data/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb

@@ -17,8 +17,8 @@ class IamRoleWildcardResourceOnPermissionsPolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role|
-      violating_policies = role.policies.select do |policy|
-        !policy.policyDocument.wildcard_allowed_resources.empty?
+      violating_policies = role.policy_objects.select do |policy|
+        !policy.policy_document.wildcard_allowed_resources.empty?
       end
       !violating_policies.empty?
     end

data/lib/cfn-nag/custom_rules/S3BucketPolicyNotActionRule.rb

@@ -17,7 +17,7 @@ class S3BucketPolicyNotActionRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::S3::BucketPolicy').select do |policy|
-      !policy.policyDocument.allows_not_action.empty?
+      !policy.policy_document.allows_not_action.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/S3BucketPolicyNotPrincipalRule.rb

@@ -17,7 +17,7 @@ class S3BucketPolicyNotPrincipalRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::S3::BucketPolicy').select do |policy|
-      !policy.policyDocument.allows_not_principal.empty?
+      !policy.policy_document.allows_not_principal.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardActionRule.rb

@@ -20,7 +20,7 @@ class S3BucketPolicyWildcardActionRule < BaseRule
 
     cfn_model.resources_by_type('AWS::S3::BucketPolicy').each do |bucket_policy|
 
-      if !bucket_policy.policyDocument.wildcard_allowed_actions.empty?
+      if !bucket_policy.policy_document.wildcard_allowed_actions.empty?
         logical_resource_ids << bucket_policy.logical_resource_id
       end
     end

data/lib/cfn-nag/custom_rules/S3BucketPolicyWildcardPrincipalRule.rb

@@ -19,7 +19,7 @@ class S3BucketPolicyWildcardPrincipalRule < BaseRule
     logical_resource_ids = []
 
     cfn_model.resources_by_type('AWS::S3::BucketPolicy').each do |topic_policy|
-      if !topic_policy.policyDocument.wildcard_allowed_principals.empty?
+      if !topic_policy.policy_document.wildcard_allowed_principals.empty?
         logical_resource_ids << topic_policy.logical_resource_id
       end
     end

data/lib/cfn-nag/custom_rules/SecurityGroupEgressOpenToWorldRule.rb

@@ -22,7 +22,7 @@ class SecurityGroupEgressOpenToWorldRule < BaseRule
   def audit_impl(cfn_model)
     logical_resource_ids = []
     cfn_model.security_groups.each do |security_group|
-      violating_egresses = security_group.securityGroupEgress.select do |egress|
+      violating_egresses = security_group.egresses.select do |egress|
         ip4_open?(egress) || ip6_open?(egress)
       end
 

data/lib/cfn-nag/custom_rules/SecurityGroupEgressPortRangeRule.rb

@@ -20,7 +20,7 @@ class SecurityGroupEgressPortRangeRule < BaseRule
   def audit_impl(cfn_model)
     logical_resource_ids = []
     cfn_model.security_groups.each do |security_group|
-      violating_egresses = security_group.securityGroupEgress.select do |egress|
+      violating_egresses = security_group.egresses.select do |egress|
         egress.fromPort != egress.toPort
       end
 

data/lib/cfn-nag/custom_rules/SecurityGroupIngressCidrNon32Rule.rb

@@ -22,7 +22,7 @@ class SecurityGroupIngressCidrNon32Rule < BaseRule
   def audit_impl(cfn_model)
     logical_resource_ids = []
     cfn_model.security_groups.each do |security_group|
-      violating_ingresses = security_group.securityGroupIngress.select do |ingress|
+      violating_ingresses = security_group.ingresses.select do |ingress|
         ip4_cidr_range?(ingress) || ip6_cidr_range?(ingress)
       end
 

data/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb

@@ -22,7 +22,7 @@ class SecurityGroupIngressOpenToWorldRule < BaseRule
   def audit_impl(cfn_model)
     logical_resource_ids = []
     cfn_model.security_groups.each do |security_group|
-      violating_ingresses = security_group.securityGroupIngress.select do |ingress|
+      violating_ingresses = security_group.ingresses.select do |ingress|
         ip4_open?(ingress) || ip6_open?(ingress)
       end
 

data/lib/cfn-nag/custom_rules/SecurityGroupIngressPortRangeRule.rb

@@ -20,7 +20,7 @@ class SecurityGroupIngressPortRangeRule < BaseRule
   def audit_impl(cfn_model)
     logical_resource_ids = []
     cfn_model.security_groups.each do |security_group|
-      violating_ingresses = security_group.securityGroupIngress.select do |ingress|
+      violating_ingresses = security_group.ingresses.select do |ingress|
         ingress.fromPort != ingress.toPort
       end
 

data/lib/cfn-nag/custom_rules/SecurityGroupMissingEgressRule.rb

@@ -18,7 +18,7 @@ class SecurityGroupMissingEgressRule < BaseRule
   def audit_impl(cfn_model)
     logical_resource_ids = []
     cfn_model.security_groups.each do |security_group|
-      if security_group.securityGroupEgress.empty?
+      if security_group.egresses.empty?
         logical_resource_ids << security_group.logical_resource_id
       end
     end

data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotActionRule.rb

@@ -17,7 +17,7 @@ class SnsTopicPolicyNotActionRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::SNS::TopicPolicy').select do |policy|
-      !policy.policyDocument.allows_not_action.empty?
+      !policy.policy_document.allows_not_action.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/SnsTopicPolicyNotPrincipalRule.rb

@@ -17,7 +17,7 @@ class SnsTopicPolicyNotPrincipalRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::SNS::TopicPolicy').select do |policy|
-      !policy.policyDocument.allows_not_principal.empty?
+      !policy.policy_document.allows_not_principal.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/SnsTopicPolicyWildcardPrincipalRule.rb

@@ -19,7 +19,7 @@ class SnsTopicPolicyWildcardPrincipalRule < BaseRule
     logical_resource_ids = []
 
     cfn_model.resources_by_type('AWS::SNS::TopicPolicy').each do |topic_policy|
-      if !topic_policy.policyDocument.wildcard_allowed_principals.empty?
+      if !topic_policy.policy_document.wildcard_allowed_principals.empty?
         logical_resource_ids << topic_policy.logical_resource_id
       end
     end

data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotActionRule.rb

@@ -17,7 +17,7 @@ class SqsQueuePolicyNotActionRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::SQS::QueuePolicy').select do |policy|
-      !policy.policyDocument.allows_not_action.empty?
+      !policy.policy_document.allows_not_action.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/SqsQueuePolicyNotPrincipalRule.rb

@@ -17,7 +17,7 @@ class SqsQueuePolicyNotPrincipalRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_policies = cfn_model.resources_by_type('AWS::SQS::QueuePolicy').select do |policy|
-      !policy.policyDocument.allows_not_principal.empty?
+      !policy.policy_document.allows_not_principal.empty?
     end
 
     violating_policies.map { |policy| policy.logical_resource_id }

data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardActionRule.rb

@@ -20,7 +20,7 @@ class SqsQueuePolicyWildcardActionRule < BaseRule
 
     cfn_model.resources_by_type('AWS::SQS::QueuePolicy').each do |queue_policy|
 
-      if !queue_policy.policyDocument.wildcard_allowed_actions.empty?
+      if !queue_policy.policy_document.wildcard_allowed_actions.empty?
         logical_resource_ids << queue_policy.logical_resource_id
       end
     end

data/lib/cfn-nag/custom_rules/SqsQueuePolicyWildcardPrincipalRule.rb

@@ -19,7 +19,7 @@ class SqsQueuePolicyWildcardPrincipalRule < BaseRule
     logical_resource_ids = []
 
     cfn_model.resources_by_type('AWS::SQS::QueuePolicy').each do |topic_policy|
-      if !topic_policy.policyDocument.wildcard_allowed_principals.empty?
+      if !topic_policy.policy_document.wildcard_allowed_principals.empty?
         logical_resource_ids << topic_policy.logical_resource_id
       end
     end

data/lib/cfn-nag/custom_rules/UserHasInlinePolicyRule.rb

@@ -17,7 +17,7 @@ class UserHasInlinePolicyRule < BaseRule
 
   def audit_impl(cfn_model)
     violating_users = cfn_model.iam_users.select do |iam_user|
-      iam_user.policies.size > 0
+      iam_user.policy_objects.size > 0
     end
 
     violating_users.map { |violating_user| violating_user.logical_resource_id }

data/lib/cfn-nag/custom_rules/UserMissingGroupRule.rb

@@ -18,7 +18,7 @@ class UserMissingGroupRule < BaseRule
   def audit_impl(cfn_model)
     logical_resource_ids = []
     cfn_model.iam_users.each do |iam_user|
-      if iam_user.groups.empty?
+      if iam_user.group_names.empty?
         logical_resource_ids << iam_user.logical_resource_id
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.3.0
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-19 00:00:00.000000000 Z
+date: 2017-08-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logging
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.8
+        version: 0.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.8
+        version: 0.1.2
 - !ruby/object:Gem::Dependency
   name: jmespath
   requirement: !ruby/object:Gem::Requirement