cfn-nag 0.4.9 → 0.4.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0a90e09ae75e36f29393f58e8ebf4bb760412a12c69a11003d78ea66ab21492
-  data.tar.gz: 65a8f4267aa774711a9187fa4b5b0d1381daaf2115cbc01045a389122c1f3801
+  metadata.gz: a7c5be6d25789f38b37bbde75e1b732dbec718ef49f0121efbd61f4032cd1f37
+  data.tar.gz: 48f3345f39d00e23b7448b5316dc5e77993afd087974c237fb7e655c2a7cb73c
 SHA512:
-  metadata.gz: 883b3336ebc81586edad1b2b766133dbaed59d8c8241bc82420c02afd66eb3142b1c593ccdc989a46715831f13cc56b7e6d5f8020522f3bc70da16e3dc96cac3
-  data.tar.gz: 984513bf48cf99a90b9bc79e8cc83132f1bf32ae08d95270843fe7e21eeaf01aa6fe3c35a40edebf5f4ac2bb7e62661d070a80a19b7e34271637e092caa28c8f
+  metadata.gz: 84f04c28790ed9efc963455ca677acb1886f3b4af262efb0ac32e078d367393c7f6eca51bf59ac49ee97f0bb68133af4d2adde192535656483ec64c149cda9e8
+  data.tar.gz: bfa559caa6910cf0e1f49d03499b3254c13857c6ae677f61697a932c41a629be88e8803caddfd775bc88773664cea092f4c2c8ae7d709b55bd5973f3263372c9

data/lib/cfn-nag/custom_rules/EFSFileSystemEncryptedRule.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require_relative 'base'
+require_relative 'boolean_base_rule'
 
-class EFSFileSystemEncryptedRule < BaseRule
+class EFSFileSystemEncryptedRule < BooleanBaseRule
   def rule_text
     'EFS FileSystem should have encryption enabled'
   end
@@ -16,14 +16,11 @@ class EFSFileSystemEncryptedRule < BaseRule
     'F32'
   end
 
-  def audit_impl(cfn_model)
-    resources = cfn_model.resources_by_type('AWS::EFS::FileSystem')
-
-    violating_filesystems = resources.select do |filesystem|
-      filesystem.encrypted.nil? ||
-        filesystem.encrypted.to_s.casecmp('false').zero?
-    end
+  def resource_type
+    'AWS::EFS::FileSystem'
+  end
 
-    violating_filesystems.map(&:logical_resource_id)
+  def boolean_property
+    :encrypted
   end
 end

data/lib/cfn-nag/custom_rules/ElastiCacheReplicationGroupAtRestEncryptionRule.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require_relative 'base'
+require_relative 'boolean_base_rule'
 
-class ElastiCacheReplicationGroupAtRestEncryptionRule < BaseRule
+class ElastiCacheReplicationGroupAtRestEncryptionRule < BooleanBaseRule
   def rule_text
     'ElastiCache ReplicationGroup should have encryption enabled for at rest'
   end
@@ -16,14 +16,11 @@ class ElastiCacheReplicationGroupAtRestEncryptionRule < BaseRule
     'F25'
   end
 
-  def audit_impl(cfn_model)
-    resources = cfn_model.resources_by_type('AWS::ElastiCache::ReplicationGroup')
-
-    violating_groups = resources.select do |group|
-      group.atRestEncryptionEnabled.nil? ||
-        group.atRestEncryptionEnabled.to_s.casecmp('false').zero?
-    end
+  def resource_type
+    'AWS::ElastiCache::ReplicationGroup'
+  end
 
-    violating_groups.map(&:logical_resource_id)
+  def boolean_property
+    :atRestEncryptionEnabled
   end
 end

data/lib/cfn-nag/custom_rules/ElastiCacheReplicationGroupTransitEncryptionRule.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require_relative 'base'
+require_relative 'boolean_base_rule'
 
-class ElastiCacheReplicationGroupTransitEncryptionRule < BaseRule
+class ElastiCacheReplicationGroupTransitEncryptionRule < BooleanBaseRule
   def rule_text
     'ElastiCache ReplicationGroup should have encryption enabled for in transit'
   end
@@ -16,14 +16,11 @@ class ElastiCacheReplicationGroupTransitEncryptionRule < BaseRule
     'F24'
   end
 
-  def audit_impl(cfn_model)
-    resources = cfn_model.resources_by_type('AWS::ElastiCache::ReplicationGroup')
-
-    violating_groups = resources.select do |group|
-      group.transitEncryptionEnabled.nil? ||
-        group.transitEncryptionEnabled.to_s.casecmp('false').zero?
-    end
+  def resource_type
+    'AWS::ElastiCache::ReplicationGroup'
+  end
 
-    violating_groups.map(&:logical_resource_id)
+  def boolean_property
+    :transitEncryptionEnabled
   end
 end

data/lib/cfn-nag/custom_rules/NeptuneDBClusterStorageEncryptedRule.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require_relative 'base'
+require_relative 'boolean_base_rule'
 
-class NeptuneDBClusterStorageEncryptedRule < BaseRule
+class NeptuneDBClusterStorageEncryptedRule < BooleanBaseRule
   def rule_text
     'Neptune database cluster storage should have encryption enabled'
   end
@@ -16,14 +16,11 @@ class NeptuneDBClusterStorageEncryptedRule < BaseRule
     'F30'
   end
 
-  def audit_impl(cfn_model)
-    resources = cfn_model.resources_by_type('AWS::Neptune::DBCluster')
-
-    violating_storage = resources.select do |filesystem|
-      filesystem.storageEncrypted.nil? ||
-        filesystem.storageEncrypted.to_s.casecmp('false').zero?
-    end
+  def resource_type
+    'AWS::Neptune::DBCluster'
+  end
 
-    violating_storage.map(&:logical_resource_id)
+  def boolean_property
+    :storageEncrypted
   end
 end

data/lib/cfn-nag/custom_rules/RDSDBClusterStorageEncryptedRule.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require_relative 'base'
+require_relative 'boolean_base_rule'
 
-class RDSDBClusterStorageEncryptedRule < BaseRule
+class RDSDBClusterStorageEncryptedRule < BooleanBaseRule
   def rule_text
     'RDS DBCluster should have StorageEncrypted enabled'
   end
@@ -16,14 +16,11 @@ class RDSDBClusterStorageEncryptedRule < BaseRule
     'F26'
   end
 
-  def audit_impl(cfn_model)
-    resources = cfn_model.resources_by_type('AWS::RDS::DBCluster')
-
-    violating_clusters = resources.select do |cluster|
-      cluster.storageEncrypted.nil? ||
-        cluster.storageEncrypted.to_s.casecmp('false').zero?
-    end
+  def resource_type
+    'AWS::RDS::DBCluster'
+  end
 
-    violating_clusters.map(&:logical_resource_id)
+  def boolean_property
+    :storageEncrypted
   end
 end

data/lib/cfn-nag/custom_rules/RDSDBInstanceStorageEncryptedRule.rb

@@ -20,11 +20,7 @@ class RDSDBInstanceStorageEncryptedRule < BaseRule
     resources = cfn_model.resources_by_type('AWS::RDS::DBInstance')
 
     violating_instances = resources.select do |instance|
-      instance.dBClusterIdentifier.nil? &&
-        (
-          instance.storageEncrypted.nil? ||
-          instance.storageEncrypted.to_s.casecmp('false').zero?
-        )
+      instance.dBClusterIdentifier.nil? && not_truthy?(instance.storageEncrypted)
     end
 
     violating_instances.map(&:logical_resource_id)

data/lib/cfn-nag/custom_rules/RedshiftClusterEncryptedRule.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require_relative 'base'
+require_relative 'boolean_base_rule'
 
-class RedshiftClusterEncryptedRule < BaseRule
+class RedshiftClusterEncryptedRule < BooleanBaseRule
   def rule_text
     'Redshift Cluster should have encryption enabled'
   end
@@ -16,14 +16,11 @@ class RedshiftClusterEncryptedRule < BaseRule
     'F28'
   end
 
-  def audit_impl(cfn_model)
-    resources = cfn_model.resources_by_type('AWS::Redshift::Cluster')
-
-    violating_clusters = resources.select do |cluster|
-      cluster.encrypted.nil? ||
-        cluster.encrypted.to_s.casecmp('false').zero?
-    end
+  def resource_type
+    'AWS::Redshift::Cluster'
+  end
 
-    violating_clusters.map(&:logical_resource_id)
+  def boolean_property
+    :encrypted
   end
 end

data/lib/cfn-nag/custom_rules/boolean_base_rule.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+require 'cfn-nag/util/truthy.rb'
+
+class BooleanBaseRule < BaseRule
+  def resource_type
+    raise 'must implement in subclass'
+  end
+
+  def boolean_property
+    raise 'must implement in subclass'
+  end
+
+  def audit_impl(cfn_model)
+    resources = cfn_model.resources_by_type(resource_type)
+
+    violating_resources = resources.select do |resource|
+      not_truthy?(resource.send(boolean_property))
+    end
+
+    violating_resources.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/util/truthy.rb

@@ -5,3 +5,7 @@
 def truthy?(string)
   string.to_s.casecmp('true').zero?
 end
+
+def not_truthy?(string)
+  string.nil? || string.to_s.casecmp('false').zero?
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.4.9
+  version: 0.4.10
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-06-03 00:00:00.000000000 Z
+date: 2019-06-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -220,6 +220,7 @@ files:
 - lib/cfn-nag/custom_rules/WafWebAclDefaultActionRule.rb
 - lib/cfn-nag/custom_rules/WorkspacesWorkspaceEncryptionRule.rb
 - lib/cfn-nag/custom_rules/base.rb
+- lib/cfn-nag/custom_rules/boolean_base_rule.rb
 - lib/cfn-nag/ip_addr.rb
 - lib/cfn-nag/jmes_path_discovery.rb
 - lib/cfn-nag/jmes_path_evaluator.rb