cfn-nag 0.4.32 → 0.4.33

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0a6819df2c336e0bb1ef07b208904b86f57a2196662d3d19400af8f1a3e6685
-  data.tar.gz: 6aaf41ba6de74d2e23e4be417f1921e642bb541b86394906c1e6bc3704e0901f
+  metadata.gz: 1ec5b3cfc2ced9f607e73fbed7b089eea84557790e9437fd561f45f0e6c4b9ab
+  data.tar.gz: 36dc09072565257d707f06a1b90372a32cb50250a2e0eb1771696ac1e86b2a42
 SHA512:
-  metadata.gz: f51b67dc85200d5d349ac0bbbd26585a1956dddb23dba4b1c210f8527b74050b4e3bc1f17a6a975b192945836165714c20ab4e5e8d605e75c6f3d74821fe293c
-  data.tar.gz: f74dd428e534d1df734f7bb13e087a67c30af46d5b7e755ebc056e9dac3ec99bc551fc84aa791d6f31b0b203894deeeb4ede05a5a4bfca32b59e0ea38f5f7457
+  metadata.gz: a55bce3659d9275f43acfa7be9972da439d8f3a334d3154ab72a841694a91663143f04a28a154fc5709a0c66159ad60c5f1c59443d927b0819d21d0ab451f216
+  data.tar.gz: 56589b4434346cb1ba5428c0e3bad1f1a15a41bf96d4024f990f8d67ab1a7ec04708e00f6dc958ea606b11b048677fcc3b8992944bfeff96534ab0737513f729

data/lib/cfn-nag/custom_rules/EbsVolumeEncryptionKeyRule.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class EbsVolumeEncryptionKeyRule < BaseRule
+  def rule_text
+    'EBS Volume should specify a KmsKeyId value'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W37'
+  end
+
+  def audit_impl(cfn_model)
+    violating_volumes = cfn_model.resources_by_type('AWS::EC2::Volume')
+                                 .select do |volume|
+      volume.kmsKeyId.nil? || volume.kmsKeyId == { 'Ref' => 'AWS::NoValue' }
+    end
+
+    violating_volumes.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb

@@ -1,13 +1,21 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/violation'
-require_relative 'base'
+require_relative 'boolean_base_rule'
 
-class EbsVolumeHasSseRule < BaseRule
+class EbsVolumeHasSseRule < BooleanBaseRule
   def rule_text
     'EBS volume should have server-side encryption enabled'
   end
 
+  def resource_type
+    'AWS::EC2::Volume'
+  end
+
+  def boolean_property
+    :encrypted
+  end
+
   def rule_type
     Violation::FAILING_VIOLATION
   end
@@ -15,13 +23,4 @@ class EbsVolumeHasSseRule < BaseRule
   def rule_id
     'F1'
   end
-
-  def audit_impl(cfn_model)
-    violating_volumes = cfn_model.resources_by_type('AWS::EC2::Volume')
-                                 .select do |volume|
-      volume.encrypted.nil? || volume.encrypted.to_s.casecmp('false').zero?
-    end
-
-    violating_volumes.map(&:logical_resource_id)
-  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.4.32
+  version: 0.4.33
 platform: ruby
 authors:
 - Eric Kascic
@@ -180,6 +180,7 @@ files:
 - lib/cfn-nag/custom_rules/DirectoryServiceSimpleADPasswordRule.rb
 - lib/cfn-nag/custom_rules/EC2SubnetMapPublicIpOnLaunchRule.rb
 - lib/cfn-nag/custom_rules/EFSFileSystemEncryptedRule.rb
+- lib/cfn-nag/custom_rules/EbsVolumeEncryptionKeyRule.rb
 - lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb
 - lib/cfn-nag/custom_rules/ElastiCacheReplicationGroupAtRestEncryptionRule.rb
 - lib/cfn-nag/custom_rules/ElastiCacheReplicationGroupTransitEncryptionRule.rb