cfn-nag 0.4.16 → 0.4.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 25cd64f494aff69c5b5c9c0ffab18be84fa05833bc4360a5d6da12d188a36711
-  data.tar.gz: 021026b278fb868306ae7153049bc1137cb5ef8268c475469eb2d225ac9d7762
+  metadata.gz: c8f64b2627c295ba7c869af59479c05a32add6651102f524774042a087803688
+  data.tar.gz: b2f81c63e51e30e38127d6c0ec30ae586714fbaaf4b919afd7ec2c0e85a62fb2
 SHA512:
-  metadata.gz: c7a921d40e9e739c0b1c333e7af2e1665487222097cebadca4e1bb47a36c90e2118a6f8f7d801ebf06645a8c62102500b619dcd803aca690ead02c09063b77e0
-  data.tar.gz: e995d6228f02f2be0662d25081e9a98d6600dd7ac8245688b38bb574b14704562a3219c4d702b8111a44a006514e856d59fc366ddd77dfa88c9e97ccd9efe4d3
+  metadata.gz: aad7022cf2aab396e0dd035652f9a42527a83ccf49247554d4b19fbd9030890d926aa922b36c831fea88b223734ed29d628ee9df09442293f62a5f2f484c9b07
+  data.tar.gz: 1116091a6da82d47ec44633c41e1fc4a1e9486602b88521dce3a0ada014153ddcfc5ef42eeb570708cb5041ade79063913dbb3539a0a0a471b02536908cd8b80

data/lib/cfn-nag/custom_rules/DirectoryServiceSimpleADPasswordRule.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require 'cfn-nag/util/enforce_noecho_parameter'
+require 'cfn-nag/util/enforce_reference_parameter'
+require 'cfn-nag/util/enforce_string_or_dynamic_reference'
 require_relative 'base'
 
 # Rule class to fail on DirectoryService::SimpleAD password in template
@@ -24,8 +25,8 @@ class DirectoryServiceSimpleADPasswordRule < BaseRule
       if ad.password.nil?
         false
       else
-        !no_echo_parameter_without_default?(cfn_model,
-                                            ad.password)
+        insecure_parameter?(cfn_model, ad.password) ||
+          insecure_string_or_dynamic_reference?(cfn_model, ad.password)
       end
     end
     violating_ad.map(&:logical_resource_id)

data/lib/cfn-nag/custom_rules/RDSDBClusterMasterUserPasswordRule.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/enforce_reference_parameter'
+require 'cfn-nag/util/enforce_string_or_dynamic_reference'
+require_relative 'base'
+
+class RDSDBClusterMasterUserPasswordRule < BaseRule
+  def rule_text
+    'RDS DB Cluster master user password must be Ref to NoEcho Parameter. ' \
+    'Default credentials are not recommended'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F34'
+  end
+
+  def audit_impl(cfn_model)
+    rds_dbclusters = cfn_model.resources_by_type('AWS::RDS::DBCluster')
+    violating_rdsclusters = rds_dbclusters.select do |cluster|
+      if cluster.masterUserPassword.nil?
+        false
+      else
+        insecure_parameter?(cfn_model, cluster.masterUserPassword) ||
+          insecure_string_or_dynamic_reference?(cfn_model, cluster.masterUserPassword)
+      end
+    end
+
+    violating_rdsclusters.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/RDSInstanceMasterUserPasswordRule.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require 'cfn-nag/util/enforce_noecho_parameter.rb'
+require 'cfn-nag/util/enforce_reference_parameter'
+require 'cfn-nag/util/enforce_string_or_dynamic_reference'
 require_relative 'base'
 
 class RDSInstanceMasterUserPasswordRule < BaseRule
@@ -28,8 +29,8 @@ class RDSInstanceMasterUserPasswordRule < BaseRule
       if instance.masterUserPassword.nil?
         false
       else
-        !no_echo_parameter_without_default?(cfn_model,
-                                            instance.masterUserPassword)
+        insecure_parameter?(cfn_model, instance.masterUserPassword) ||
+          insecure_string_or_dynamic_reference?(cfn_model, instance.masterUserPassword)
       end
     end
 

data/lib/cfn-nag/custom_rules/RDSInstanceMasterUsernameRule.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require 'cfn-nag/util/enforce_noecho_parameter'
+require 'cfn-nag/util/enforce_reference_parameter'
+require 'cfn-nag/util/enforce_string_or_dynamic_reference'
 require_relative 'base'
 
 # cfn_nag rules related to RDS Instance master username
@@ -30,8 +31,8 @@ class RDSInstanceMasterUsernameRule < BaseRule
       if instance.masterUsername.nil?
         false
       else
-        !no_echo_parameter_without_default?(cfn_model,
-                                            instance.masterUsername)
+        insecure_parameter?(cfn_model, instance.masterUsername) ||
+          insecure_string_or_dynamic_reference?(cfn_model, instance.masterUsername)
       end
     end
 

data/lib/cfn-nag/util/enforce_reference_parameter.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/util/truthy.rb'
+
+# Returns false if the provided key_to_check is a no-echo parameter
+# without a default value; true otherwise.
+# Only applicable for a hash
+def insecure_parameter?(cfn_model, key_to_check)
+  # We only want to perform the check against a hash
+  return false unless key_to_check.is_a? Hash
+
+  # We don't care if any other intrinsic function is used here. We only want to
+  # verify that Ref is being used properly
+  return false unless key_to_check.key? 'Ref'
+
+  # Check if the key parameter is Ref and if that corresponding reference is
+  # setup securely by stating NoEcho=true & Default is not present
+  if cfn_model.parameters.key? key_to_check['Ref']
+    parameter = cfn_model.parameters[key_to_check['Ref']]
+    if truthy?(parameter.noEcho) && parameter.default.nil?
+      return false
+    end
+  end
+
+  # Return true if key_to_check is a hash and/or a key Ref that does not have
+  # the NoEcho parameter set to true and a Default parameter that is not nil
+  true
+end

data/lib/cfn-nag/util/enforce_string_or_dynamic_reference.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# Returns false if the provided key_to_check is a dynamic reference
+# to SSM Secure or Secrets Manager; true otherwise.
+# Only applicable for a string
+def insecure_string_or_dynamic_reference?(_cfn_model, key_to_check)
+  # We only want to perform the check agains a string
+  return false unless key_to_check.is_a? String
+
+  # Check if string starts with a Dynamic Reference pointing to SecretsManager
+  # or SSM Secure
+  if key_to_check.start_with?(
+    '{{resolve:secretsmanager:',
+    '{{resolve:ssm-secure:'
+  )
+    # Verify that the secure string ends properly with the double curly braces
+    if key_to_check.end_with? '}}'
+      return false
+    end
+  end
+
+  # Retrun true if key_to_check is a string and is not calling a secured
+  # dynamic reference pattern (Secrets Manager or SSM-Secure)
+  true
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.4.16
+  version: 0.4.17
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-06-19 00:00:00.000000000 Z
+date: 2019-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -188,6 +188,7 @@ files:
 - lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb
 - lib/cfn-nag/custom_rules/NeptuneDBClusterStorageEncryptedRule.rb
 - lib/cfn-nag/custom_rules/PolicyOnUserRule.rb
+- lib/cfn-nag/custom_rules/RDSDBClusterMasterUserPasswordRule.rb
 - lib/cfn-nag/custom_rules/RDSDBClusterStorageEncryptedRule.rb
 - lib/cfn-nag/custom_rules/RDSDBInstanceStorageEncryptedRule.rb
 - lib/cfn-nag/custom_rules/RDSInstanceMasterUserPasswordRule.rb
@@ -233,7 +234,8 @@ files:
 - lib/cfn-nag/rule_id_set.rb
 - lib/cfn-nag/rule_registry.rb
 - lib/cfn-nag/template_discovery.rb
-- lib/cfn-nag/util/enforce_noecho_parameter.rb
+- lib/cfn-nag/util/enforce_reference_parameter.rb
+- lib/cfn-nag/util/enforce_string_or_dynamic_reference.rb
 - lib/cfn-nag/util/truthy.rb
 - lib/cfn-nag/violation.rb
 - lib/cfn-nag/violation_filtering.rb

data/lib/cfn-nag/util/enforce_noecho_parameter.rb

@@ -1,24 +0,0 @@
-# frozen_string_literal: true
-
-require 'cfn-nag/util/truthy.rb'
-
-# Migrated from multiple classes, with some modifications
-# Returns true if the provided key_to_check is a no-echo parameter
-# without a default value; false otherwise.
-def no_echo_parameter_without_default?(cfn_model, key_to_check)
-  if key_to_check.is_a? Hash
-    if key_to_check.key? 'Ref'
-      if cfn_model.parameters.key? key_to_check['Ref']
-        parameter = cfn_model.parameters[key_to_check['Ref']]
-
-        return truthy?(parameter.noEcho) && parameter.default.nil?
-      else
-        return false
-      end
-    else
-      return false
-    end
-  end
-  # String or anything weird will fall through here
-  false
-end