cfn-nag 0.3.83 → 0.3.84

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8d3b970a7aeeb42d037205cd1f44c7c327d15fbac6551c96f312cde588ddb00
-  data.tar.gz: bf67abaf6433d2b69e658bd86b9a58d3bc973a6cc33ca2189d764ac1c75a608a
+  metadata.gz: c33a8491cb7b894b90e448cca20e52df0618e8ba032cfd9e9b292ae356bb9f05
+  data.tar.gz: b77cf4ffc9fe149b6db4eb1b61560d967c7d21b32060d9fdf5044880ba8dc149
 SHA512:
-  metadata.gz: c9dd9cebb3ea1617b5f947b43729201fb76439fac31edf42ded0b8fd9c3796153d01d706c5560bebc50ca1166967e9678ca0b8f5e2d6cea8ff9a037f0d366bf9
-  data.tar.gz: 1eec841711c4237ff3f456e7cc7491e3dc6304fa1f9a057222a30d8fb2efb6ce083b6d2a813c5121601638ccb22dfcca2c4710eb969fd465e25166d2675f8264
+  metadata.gz: 1a247df6f2e830516644ba5d288d65457ac60baf213ff0cab4e9affed7c3a795f4ba52a6c77b6bb323372f2578f95c55e47ec518cb16e5a88296a843e8422335
+  data.tar.gz: 350713a1fb6bada81699cba627e1ef9f22b5d050b88f9c77dbd2699c9b389eea54a3ceb37ea19e0bf6c398f1fe001677d25458779a301d4e46d2bf81f0c602c4

data/lib/cfn-nag/custom_rules/ResourceWithExplicitNameRule.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ResourceWithExplicitNameRule < BaseRule
+  # The values of this hash are camel-cased, due to cfn-model returning
+  # camel cased values. E.g. GroupName in CloudFormation is returned by
+  # cfn-model as groupName, RoleName is returned as roleName, etc.
+  RESOURCE_NAME_MAPPING = {
+    'AWS::ApiGateway::ApiKey' => 'name',
+    'AWS::CloudWatch::Alarm' => 'alarmName',
+    'AWS::CodeDeploy::DeploymentConfig' => 'deploymentConfigName',
+    'AWS::CodeDeploy::DeploymentGroup' => 'deploymentGroupName',
+    'AWS::DynamoDB::Table' => 'tableName',
+    'AWS::EC2::SecurityGroup' => 'groupName',
+    'AWS::ECR::Repository' => 'repositoryName',
+    'AWS::ElasticLoadBalancingV2::LoadBalancer' => 'name',
+    'AWS::Elasticsearch::Domain' => 'domainName',
+    'AWS::IAM::Group' => 'groupName',
+    'AWS::IAM::ManagedPolicy' => 'managedPolicyName',
+    'AWS::IAM::Role' => 'roleName',
+    'AWS::Kinesis::Stream' => 'name',
+    'AWS::RDS::DBInstance' => 'dBInstanceIdentifier'
+  }.freeze
+
+  def rule_text
+    'Resource found with an explicit name, this disallows updates that ' \
+    'require replacement of this resource'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W28'
+  end
+
+  def audit_impl(cfn_model)
+    violating_resources = []
+
+    RESOURCE_NAME_MAPPING.each do |cfn_resource, key_name|
+      resources = cfn_model.resources_by_type(cfn_resource)
+                           .select do |resource|
+        explicitly_set_resource_name?(resource, key_name)
+      end
+
+      violating_resources << resources.map(&:logical_resource_id)
+    end
+
+    violating_resources.flatten
+  end
+
+  private
+
+  def explicitly_set_resource_name?(resource, key_name)
+    !resource.send(key_name).nil?
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.3.83
+  version: 0.3.84
 platform: ruby
 authors:
 - Eric Kascic
@@ -174,6 +174,7 @@ files:
 - lib/cfn-nag/custom_rules/RDSInstanceMasterUsernameRule.rb
 - lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb
 - lib/cfn-nag/custom_rules/RedshiftClusterEncryptedRule.rb
+- lib/cfn-nag/custom_rules/ResourceWithExplicitNameRule.rb
 - lib/cfn-nag/custom_rules/S3BucketPolicyNotActionRule.rb
 - lib/cfn-nag/custom_rules/S3BucketPolicyNotPrincipalRule.rb
 - lib/cfn-nag/custom_rules/S3BucketPolicyWildcardActionRule.rb