cfn-nag 0.3.10 → 0.3.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3c3a861a811bf0119e1a57ace0afd754bbdcb70a
-  data.tar.gz: fa4e2b55a38e1992ebe5473287c1c7342f97a168
+  metadata.gz: d28e143a404043d2d72720c13b3185b7fb150846
+  data.tar.gz: 054364ac8afe5ae75fd4d4afdc1920d42fcc8c58
 SHA512:
-  metadata.gz: a33c84416c3759da2d6f7f1c246f58227d71d5e7141f8fada3a148e3f1c37b3efa1edeebe64cbb33830eda0ef85209f27a25c980b80a93b939b2f38b357b5705
-  data.tar.gz: b8e534a94801cd6f1b6945bb3495a743fd85cad56da730390307fb4fb37d1fb86c1096e500ae3884a885813dcbbe6159900731f519e67f7b4254ad496f1623e2
+  metadata.gz: 55346cb4a2298a66d24ed27b5bb151be4a598586e09d925ac998223c6d1a8d4e4886751d02eb8327a93244f454a00ac611c0c8ef9929885258a21677278a405d
+  data.tar.gz: b5b11a2eafdc8d814a3fcbdaad095fbf985980571d67b8b2c9ce861af7efd6edd898030841c8e115aaaa14cfc3d97f8bae980acb63e204ecd94fa06d1db5babe

data/bin/cfn_nag

@@ -8,6 +8,8 @@ opts = Trollop::options do
   usage '[options] <cloudformation template path ...>|<cloudformation template in STDIN>'
 
   opt :debug, 'Enable debug output', type: :boolean, required: false, default: false
+  opt :allow_suppression, 'Allow using Metadata to suppress violations', type: :boolean, required: false, default: true
+  opt :print_suppression, 'Emit suppressions to stderr', type: :boolean, required: false, default: false
   opt :rule_directory, 'Extra rule directory', type: :io, required: false, default: nil
   opt :profile_path, 'Path to a profile file', type: :io, required: false, default: nil
 end
@@ -20,7 +22,9 @@ unless opts[:profile_path].nil?
 end
 
 cfn_nag = CfnNag.new(profile_definition: profile_definition,
-                     rule_directory: opts[:rule_directory])
+                     rule_directory: opts[:rule_directory],
+                     allow_suppression: opts[:allow_suppression],
+                     print_suppression: opts[:print_suppression])
 
 # trollop appears to pop args off of ARGV
 # ARGF concatenates which we don't want

data/bin/cfn_nag_scan

@@ -10,6 +10,8 @@ opts = Trollop::options do
   opt :debug, 'Enable debug output', type: :boolean, required: false, default: false
   opt :rule_directory, 'Extra rule directory', type: :io, required: false, default: nil
   opt :profile_path, 'Path to a profile file', type: :io, required: false, default: nil
+  opt :allow_suppression, 'Allow using Metadata to suppress violations', type: :boolean, required: false, default: true
+  opt :print_suppression, 'Emit suppressions to stderr', type: :boolean, required: false, default: false
 end
 
 Trollop::die(:output_format,
@@ -23,7 +25,9 @@ unless opts[:profile_path].nil?
 end
 
 cfn_nag = CfnNag.new(profile_definition: profile_definition,
-                     rule_directory: opts[:rule_directory])
+                     rule_directory: opts[:rule_directory],
+                     allow_suppression: opts[:allow_suppression],
+                     print_suppression: opts[:print_suppression])
 
 exit cfn_nag.audit_aggregate_across_files_and_render_results(input_path: opts[:input_path],
                                                              output_format: opts[:output_format])

data/lib/cfn-nag/cfn_nag.rb

@@ -9,9 +9,13 @@ require 'logging'
 
 class CfnNag
   def initialize(profile_definition: nil,
-                 rule_directory: nil)
+                 rule_directory: nil,
+                 allow_suppression: true,
+                 print_suppression: false)
     @rule_directory = rule_directory
-    @custom_rule_loader = CustomRuleLoader.new(rule_directory: rule_directory)
+    @custom_rule_loader = CustomRuleLoader.new(rule_directory: rule_directory,
+                                               allow_suppression: allow_suppression,
+                                               print_suppression: print_suppression)
     @profile_definition = profile_definition
   end
 

data/lib/cfn-nag/custom_rule_loader.rb

@@ -9,8 +9,12 @@ require 'cfn-nag/jmes_path_discovery'
 # apply these rules to a CfnModel object
 #
 class CustomRuleLoader
-  def initialize(rule_directory: nil)
+  def initialize(rule_directory: nil,
+                 allow_suppression: true,
+                 print_suppression: false)
     @rule_directory = rule_directory
+    @allow_suppression = allow_suppression
+    @print_suppression = print_suppression
     validate_extra_rule_directory rule_directory
   end
 
@@ -34,13 +38,19 @@ class CustomRuleLoader
     rule_registry
   end
 
+
   def execute_custom_rules(cfn_model)
     Logging.logger['log'].debug "cfn_model: #{cfn_model}"
 
     violations = []
 
+    validate_cfn_nag_metadata(cfn_model)
+
     discover_rule_classes(@rule_directory).each do |rule_class|
-      audit_result = rule_class.new.audit(cfn_model)
+      filtered_cfn_model = cfn_model_with_suppressed_resources_removed cfn_model: cfn_model,
+                                                                       rule_id: rule_class.new.rule_id,
+                                                                       allow_suppression: @allow_suppression
+      audit_result = rule_class.new.audit(filtered_cfn_model)
       violations << audit_result unless audit_result.nil?
     end
 
@@ -56,6 +66,66 @@ class CustomRuleLoader
 
   private
 
+  def rules_to_suppress(resource)
+    if resource.metadata && resource.metadata['cfn_nag'] && resource.metadata['cfn_nag']['rules_to_suppress']
+      resource.metadata['cfn_nag']['rules_to_suppress']
+    else
+      nil
+    end
+  end
+
+  def validate_cfn_nag_metadata(cfn_model)
+    mangled_metadatas = []
+    cfn_model.resources.each do |logical_resource_id, resource|
+      resource_rules_to_suppress = rules_to_suppress resource
+      if resource_rules_to_suppress.nil?
+        next
+      else
+        mangled_rules = resource_rules_to_suppress.select do |rule_to_suppress|
+          rule_to_suppress['id'].nil?
+        end
+        unless mangled_rules.empty?
+          mangled_metadatas << [logical_resource_id, mangled_rules]
+        end
+      end
+    end
+    mangled_metadatas.each do |mangled_metadata|
+      logical_resource_id = mangled_metadata.first
+      mangled_rules = mangled_metadata[1]
+
+      STDERR.puts "#{logical_resource_id} has missing cfn_nag suppression rule id: #{mangled_rules}"
+    end
+  end
+
+  def suppress_resource?(rules_to_suppress, rule_id, logical_resource_id)
+    found_suppression_rule = rules_to_suppress.find do |rule_to_suppress|
+      next if rule_to_suppress['id'].nil?
+      rule_to_suppress['id'] == rule_id
+    end
+    if found_suppression_rule && @print_suppression
+      STDERR.puts "Suppressing #{rule_id} on #{logical_resource_id} for reason: #{found_suppression_rule['reason']}"
+    end
+    !found_suppression_rule.nil?
+  end
+
+  def cfn_model_with_suppressed_resources_removed(cfn_model:,
+                                                  rule_id:,
+                                                  allow_suppression:)
+    return cfn_model unless allow_suppression
+
+    cfn_model = cfn_model.copy
+
+    cfn_model.resources.delete_if do |logical_resource_id, resource|
+      rules_to_suppress = rules_to_suppress resource
+      if rules_to_suppress.nil?
+        false
+      else
+        suppress_resource?(rules_to_suppress, rule_id, logical_resource_id)
+      end
+    end
+    cfn_model
+  end
+
   def validate_extra_rule_directory(rule_directory)
     unless rule_directory.nil?
       fail "Not a real directory #{rule_directory}" unless File.directory? rule_directory

data/lib/cfn-nag/jmes_path_evaluator.rb

@@ -1,6 +1,9 @@
 require 'jmespath'
 require 'logging'
 
+##
+# THIS DOES NOT RESPECT SUPPRESSIONS!!!!!!
+##
 class JmesPathEvaluator
   def initialize(cfn_model)
     @cfn_model = cfn_model

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.3.10
+  version: 0.3.11
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-15 00:00:00.000000000 Z
+date: 2017-11-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logging
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.1.9
+        version: 0.1.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.1.9
+        version: 0.1.11
 - !ruby/object:Gem::Dependency
   name: jmespath
   requirement: !ruby/object:Gem::Requirement