cfn-nag 0.4.28 → 0.4.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f4ecf712c97dd6ed7c5ddcf6a2ce4dad39bed49126cda319b5ed745e7f9cfe7
-  data.tar.gz: ebf786e319e90aa28b8da6c214ee0ec4f44ec1aa54ab8dd9f35bb5e537414ec3
+  metadata.gz: '011839ee5d19c5990b7fb7b28a87b961336cf98a35a3a7fa5792e01e5d9470cc'
+  data.tar.gz: b04751c2b454226955d2b6aac10ee005338c9a5cb2aa0f3c34bfd5ca216138b6
 SHA512:
-  metadata.gz: 1730e2a044e598aeba8505dfa7ea891b61475ca64dfca3cc3630aa25509cf8c2cec2add50bc8efbb20e19a840a27e93a4a6727d8dfd1b9060b0832b019628f7f
-  data.tar.gz: 8d4a72cf87fab25fb416042ee00a0a19309c253e512e93db24979767e6cc4028683c94457a01d60de546480755d36ebb27e35aba1a14ef02e6cb0d06916b7b98
+  metadata.gz: 98a9ffb0a8d6888eabf60416c88e1ad05626eacf0bf279a05ac973f7140702eec5cc9915acf2464176e1bb43bbccc8decac5dac048a62b6ae95e5fc16f196de8
+  data.tar.gz: 2c16cc585f3d22f7912d32d38202fe67297ab3c10927f4f5e329384fa0916052cf633027349fbc92db9be496959f0f9346eee423886f8ceef95ab1f3a2e324a8

data/lib/cfn-nag/custom_rules/AmplifyAppBasicAuthConfigPasswordRule.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'password_base_rule'
+
+class AmplifyAppBasicAuthConfigPasswordRule < PasswordBaseRule
+  def rule_text
+    'Amplify App BasicAuthConfig Password must not be a plaintext string ' \
+    'or a Ref to a NoEcho Parameter with a Default value.'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F50'
+  end
+
+  def resource_type
+    'AWS::Amplify::App'
+  end
+
+  def password_property
+    :basicAuthConfig
+  end
+
+  def sub_property_name
+    'Password'
+  end
+end

data/lib/cfn-nag/custom_rules/password_base_rule.rb

@@ -14,19 +14,49 @@ class PasswordBaseRule < BaseRule
     raise 'must implement in subclass'
   end
 
+  def sub_property_name; end
+
   def audit_impl(cfn_model)
     resources = cfn_model.resources_by_type(resource_type)
 
     violating_resources = resources.select do |resource|
-      if resource.send(password_property).nil?
+      if verify_parameter_exists(resource, password_property, sub_property_name)
         false
       else
-        insecure_parameter?(cfn_model, resource.send(password_property)) ||
-          insecure_string_or_dynamic_reference?(cfn_model,
-                                                resource.send(password_property))
+        verify_insecure_string_and_parameter(
+          cfn_model, resource, password_property, sub_property_name
+        )
       end
     end
 
     violating_resources.map(&:logical_resource_id)
   end
 end
+
+private
+
+def verify_parameter_exists(resource, password_property, sub_property_name)
+  if sub_property_name.nil?
+    resource.send(password_property).nil?
+  else
+    resource.send(password_property)[sub_property_name].nil?
+  end
+end
+
+def verify_insecure_string_and_parameter(
+  cfn_model, resource, password_property, sub_property_name
+)
+  if sub_property_name.nil?
+    insecure_parameter?(cfn_model, resource.send(password_property)) ||
+      insecure_string_or_dynamic_reference?(
+        cfn_model, resource.send(password_property)
+      )
+  else
+    insecure_parameter?(
+      cfn_model, resource.send(password_property)[sub_property_name]
+    ) ||
+      insecure_string_or_dynamic_reference?(
+        cfn_model, resource.send(password_property)[sub_property_name]
+      )
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.4.28
+  version: 0.4.29
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-07-02 00:00:00.000000000 Z
+date: 2019-07-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -170,6 +170,7 @@ files:
 - lib/cfn-nag/cfn_nag_logging.rb
 - lib/cfn-nag/cli_options.rb
 - lib/cfn-nag/custom_rule_loader.rb
+- lib/cfn-nag/custom_rules/AmplifyAppBasicAuthConfigPasswordRule.rb
 - lib/cfn-nag/custom_rules/BatchJobDefinitionContainerPropertiesPrivilegedRule.rb
 - lib/cfn-nag/custom_rules/CloudFormationAuthenticationRule.rb
 - lib/cfn-nag/custom_rules/CloudFrontDistributionAccessLoggingRule.rb