cfn-nag 0.3.59 → 0.3.60

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e3ab3f6d8d4ddb702efc139f20ae9eb6384173b700f325b85dc4737d97317b2
-  data.tar.gz: 3a24984e9d46ce1d96eabbbe642160c87acc78d05e0e13d08d6616757a086d9d
+  metadata.gz: d4eacba2d71f8eb632f29c28caff7581ebb1cf71feeaa19dba7862374158d9a3
+  data.tar.gz: d88d3e7a663382e0f752a97007a9d77ca438ad5c52b3d33617ed410010afd1f5
 SHA512:
-  metadata.gz: 2d74fe99000484b05d0ada5a3aebf68857bc7d58a735e19b2f0eb871b3a307df101eec92304d8bd2143ffdde44d495acc79292df38f9bedeec3282839e249c8a
-  data.tar.gz: a905b3a2de76264e2d08113bfa453ed0d846bbee9325da74d3232244bc7bf5a48550203b4ee20971583336bcd63ea0d35c3a50339b4e8950fb406b9e84a7587c
+  metadata.gz: 70637b52376a724b66acb967be404dcb909533ccf917dcfbfcf9e9661eefc76753b52a7af11087162111ba17697ea6da60ac0ff44fbab3fb19dd0389d207e9f0
+  data.tar.gz: 1a3b52785ef6a0f81f33f88fb8a24eb1223cfc126bd7fb968fac173bab7e0983500a9bab220e7d654e3551774e6cf9d2cf4788614471414797ae95aadc2fbdd1

data/lib/cfn-nag/custom_rules/RDSDBClusterStorageEncryptedRule.rb

@@ -0,0 +1,27 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class RDSDBClusterStorageEncryptedRule < BaseRule
+  def rule_text
+    'RDS DBCluster should have StorageEncrypted enabled'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F26'
+  end
+
+  def audit_impl(cfn_model)
+    resources = cfn_model.resources_by_type('AWS::RDS::DBCluster')
+
+    violating_clusters = resources.select do |cluster|
+      cluster.storageEncrypted.nil? ||
+        cluster.storageEncrypted.to_s.casecmp('false').zero?
+    end
+
+    violating_clusters.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/RDSDBInstanceStorageEncryptedRule.rb

@@ -0,0 +1,27 @@
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class RDSDBInstanceStorageEncryptedRule < BaseRule
+  def rule_text
+    'RDS DBInstance should have StorageEncrypted enabled'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F27'
+  end
+
+  def audit_impl(cfn_model)
+    resources = cfn_model.resources_by_type('AWS::RDS::DBInstance')
+
+    violating_instances = resources.select do |instance|
+      instance.storageEncrypted.nil? ||
+        instance.storageEncrypted.to_s.casecmp('false').zero?
+    end
+
+    violating_instances.map(&:logical_resource_id)
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.3.59
+  version: 0.3.60
 platform: ruby
 authors:
 - Eric Kascic
@@ -162,6 +162,8 @@ files:
 - lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb
 - lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb
 - lib/cfn-nag/custom_rules/PolicyOnUserRule.rb
+- lib/cfn-nag/custom_rules/RDSDBClusterStorageEncryptedRule.rb
+- lib/cfn-nag/custom_rules/RDSDBInstanceStorageEncryptedRule.rb
 - lib/cfn-nag/custom_rules/RDSInstanceMasterUserPasswordRule.rb
 - lib/cfn-nag/custom_rules/RDSInstanceMasterUsernameRule.rb
 - lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb