cfn-nag 0.3.43 → 0.3.44

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 431c10516146893563f42ae5a75a3fdb9019b03ae6feb03dcd16e5cb804a4b99
-  data.tar.gz: c0f24c8a080c368ea450344b3f981797d72b3c696ab8b1fd66c99060dfb822ef
+  metadata.gz: d94e81c63455c6eda830af691fecf9da6bbec732818c879fd77b24341443b834
+  data.tar.gz: 170e6a4f324a2b58e19f38e9c36ab3c27c31daf2144ea0d94630de3ce661438f
 SHA512:
-  metadata.gz: 615aa2c6fae2c0b3b1b951812fb68953cf2c7700926314c5f8babc03286b0bf1d8b7e209cf925b481f475b19ba30f46a4ef2d4315762de7bab091f2fbf3d486f
-  data.tar.gz: 41002ed03b0a00deb1a1d40bceb8fa02ce5d25fd723d9c90c356a64060ccdb4a02583c74681afbe3c580363ca311b3de37d0b94c9f03cd11520cd4696c5011d7
+  metadata.gz: 735a3bdfbbff963559a7eacabea92a28fe6f5451bf9aabadb05b6e94921d98d369b3c37d2d747a060b111e1886d19fed4461cdde1001d250a12e271b53a8197a
+  data.tar.gz: 2b8412e8c7d1aae3371d177045ddb14e2c7c71ecc312d7fa910dbdee592853abd2e995bc538f481f0f02cd19c971c2194e01bd99afcb20c988c8a58260725018

data/lib/cfn-nag/cfn_nag.rb

@@ -7,6 +7,7 @@ require_relative 'result_view/json_results'
 require 'cfn-model'
 require 'logging'
 
+# Top-level CfnNag class for running profiles
 class CfnNag
   def initialize(profile_definition: nil,
                  rule_directory: nil,
@@ -42,6 +43,8 @@ class CfnNag
     end
   end
 
+  # rubocop:disable Metrics/MethodLength
+
   ##
   # Given a file or directory path, return aggregate results
   #
@@ -59,6 +62,9 @@ class CfnNag
     end
     aggregate_results
   end
+  # rubocop:enable Metrics/MethodLength
+
+  # rubocop:disable Metrics/MethodLength
 
   ##
   # Given cloudformation json/yml, run all the rules against it
@@ -69,29 +75,21 @@ class CfnNag
   # Return a hash with failure count
   #
   def audit(cloudformation_string:, parameter_values_string: nil)
-    stop_processing = false
     violations = []
-
-    begin
-      cfn_model = CfnParser.new.parse cloudformation_string,
-                                      parameter_values_string
-    rescue Psych::SyntaxError, ParserError => parser_error
-      violations << Violation.new(id: 'FATAL',
-                                  type: Violation::FAILING_VIOLATION,
-                                  message: parser_error.to_s)
-      stop_processing = true
-    end
-
-    unless stop_processing == true
-      violations += @custom_rule_loader.execute_custom_rules(cfn_model)
-      violations = filter_violations_by_profile violations
-    end
-
-    {
-      failure_count: Violation.count_failures(violations),
-      violations: violations
-    }
+    cfn_model = CfnParser.new.parse cloudformation_string,
+                                    parameter_values_string
+    violations += @custom_rule_loader.execute_custom_rules(cfn_model)
+    violations = filter_violations_by_profile violations
+    { failure_count: Violation.count_failures(violations),
+      violations: violations }
+  rescue Psych::SyntaxError, ParserError => parser_error
+    violations << Violation.new(id: 'FATAL',
+                                type: Violation::FAILING_VIOLATION,
+                                message: parser_error.to_s)
+    { failure_count: Violation.count_failures(violations),
+      violations: violations }
   end
+  # rubocop:enable Metrics/MethodLength
 
   def self.configure_logging(opts)
     logger = Logging.logger['log']

data/lib/cfn-nag/custom_rule_loader.rb

@@ -24,10 +24,8 @@ class CustomRuleLoader
     rule_registry = RuleRegistry.new
 
     discover_rule_classes(@rule_directory).each do |rule_class|
-      rule = rule_class.new
-      rule_registry.definition(id: rule.rule_id,
-                               type: rule.rule_type,
-                               message: rule.rule_text)
+      rule_registry
+        .definition(**rule_registry_from_rule_class(rule_class))
     end
 
     discover_jmespath_filenames(@rule_directory).each do |jmespath_file|
@@ -47,6 +45,33 @@ class CustomRuleLoader
 
     validate_cfn_nag_metadata(cfn_model)
 
+    filter_rule_classes cfn_model, violations
+
+    filter_jmespath_filenames cfn_model, violations
+
+    violations
+  end
+
+  private
+
+  def rule_registry_from_rule_class(rule_class)
+    rule = rule_class.new
+    { id: rule.rule_id,
+      type: rule.rule_type,
+      message: rule.rule_text }
+  end
+
+  def filter_jmespath_filenames(cfn_model, violations)
+    discover_jmespath_filenames(@rule_directory).each do |jmespath_file|
+      evaluator = JmesPathEvaluator.new cfn_model
+      evaluator.instance_eval do
+        eval IO.read jmespath_file
+      end
+      violations += evaluator.violations
+    end
+  end
+
+  def filter_rule_classes(cfn_model, violations)
     discover_rule_classes(@rule_directory).each do |rule_class|
       begin
         filtered_cfn_model = cfn_model_with_suppressed_resources_removed \
@@ -55,26 +80,12 @@ class CustomRuleLoader
         audit_result = rule_class.new.audit(filtered_cfn_model)
         violations << audit_result unless audit_result.nil?
       rescue Exception => exception
-        if @isolate_custom_rule_exceptions
-          STDERR.puts exception
-        else
-          raise exception
-        end
+        raise exception unless @isolate_custom_rule_exceptions
+        STDERR.puts exception
       end
     end
-
-    discover_jmespath_filenames(@rule_directory).each do |jmespath_file|
-      evaluator = JmesPathEvaluator.new cfn_model
-      evaluator.instance_eval do
-        eval IO.read jmespath_file
-      end
-      violations += evaluator.violations
-    end
-    violations
   end
 
-  private
-
   def rules_to_suppress(resource)
     if resource.metadata &&
        resource.metadata['cfn_nag'] &&
@@ -84,19 +95,18 @@ class CustomRuleLoader
     end
   end
 
+  # XXX given mangled_metadatas is never used or returned,
+  # STDERR emit can be moved to unless block
   def validate_cfn_nag_metadata(cfn_model)
     mangled_metadatas = []
     cfn_model.resources.each do |logical_resource_id, resource|
       resource_rules_to_suppress = rules_to_suppress resource
-      if resource_rules_to_suppress.nil?
-        next
-      else
-        mangled_rules = resource_rules_to_suppress.select do |rule_to_suppress|
-          rule_to_suppress['id'].nil?
-        end
-        unless mangled_rules.empty?
-          mangled_metadatas << [logical_resource_id, mangled_rules]
-        end
+      next if resource_rules_to_suppress.nil?
+      mangled_rules = resource_rules_to_suppress.select do |rule_to_suppress|
+        rule_to_suppress['id'].nil?
+      end
+      unless mangled_rules.empty?
+        mangled_metadatas << [logical_resource_id, mangled_rules]
       end
     end
     mangled_metadatas.each do |mangled_metadata|

data/lib/cfn-nag/custom_rules/CloudFormationAuthenticationRule.rb

@@ -1,6 +1,7 @@
 require 'cfn-nag/violation'
 require_relative 'base'
 
+# Rule to ensure credentials are not specified in template
 class CloudFormationAuthenticationRule < BaseRule
   def rule_text
     'Specifying credentials in the template itself ' \

data/lib/cfn-nag/custom_rules/CloudFrontDistributionAccessLoggingRule.rb

@@ -1,6 +1,7 @@
 require 'cfn-nag/violation'
 require_relative 'base'
 
+# Rule class to ensure a CF distribution has logging
 class CloudFrontDistributionAccessLoggingRule < BaseRule
   def rule_text
     'CloudFront Distribution should enable access logging'

data/lib/cfn-nag/custom_rules/base.rb

@@ -1,5 +1,6 @@
 require 'cfn-nag/violation'
 
+# Base class all Rules should subclass
 class BaseRule
   ##
   # Returns a collection of logical resource ids
@@ -14,12 +15,10 @@ class BaseRule
   #
   def audit(cfn_model)
     logical_resource_ids = audit_impl(cfn_model)
-
-    unless logical_resource_ids.empty?
-      Violation.new(id: rule_id,
-                    type: rule_type,
-                    message: rule_text,
-                    logical_resource_ids: logical_resource_ids)
-    end
+    return if logical_resource_ids.empty?
+    Violation.new(id: rule_id,
+                  type: rule_type,
+                  message: rule_text,
+                  logical_resource_ids: logical_resource_ids)
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.3.43
+  version: 0.3.44
 platform: ruby
 authors:
 - Eric Kascic