cfn-nag 0.4.43 → 0.4.44

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 94151e341aa4f36814724846e921cc4a0e6e453be46fbc800e8f6011be413894
-  data.tar.gz: 88712f5ea9c1861b1318abbfb2ff403b9ca6a59a18bd78765ae22f2d4326351c
+  metadata.gz: dfe0f378872eb729bd6a95f0f6519a75172246c92c3d94aff16dd14dff767ce4
+  data.tar.gz: 46e41d43c4f81813a15f2238c8b7825f052c858c197a50c0534d82d25da785de
 SHA512:
-  metadata.gz: 0a1a7a9cbde4bfe502341687f651d28c1228ff3e88719a1dc687b5bc176241ac1e1b89fb1a22e690922741ce425a4ee3dd1a8a73399d9723262a6a508eeb76f8
-  data.tar.gz: da3ab99232f0b93c5332f6ec78d2a2142f3b54f0cf3c609de85012ba020b417d5a3be556b7d799800cf5c4b33027b8704a8facff7ecca34cdd21bdf901d67f96
+  metadata.gz: 28ef39b807d418e3426cf770726ed095af0e213f62daa18dd9fa144402ace1184445604c05db8bacad89865feeee4bc9ec465526b6ecc51a8dd17c1ae76f5e50
+  data.tar.gz: deeb5de0c7536af52920a2cbf5a6a47dbdd0a9a9dbf0b7ffc8c3125c7c2cc18ece26429ecf95b1af3a450e88432f1939ffab665eec63485f1bd9f6b805e5fe14

data/lib/cfn-nag/custom_rules/AmazonMQBrokerUserPasswordRule.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/enforce_reference_parameter'
+require 'cfn-nag/util/enforce_string_or_dynamic_reference'
+require_relative 'base'
+
+class AmazonMQBrokerUserPasswordRule < BaseRule
+
+  def rule_text
+    'Amazon MQ Broker resource Users property should exist and its Password property value ' +
+    'should not show password in plain text, resolve an unsecure ssm string, or have a default value for parameter.'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F52'
+  end
+
+  def audit_impl(cfn_model)
+    brokers = cfn_model.resources_by_type('AWS::AmazonMQ::Broker')
+    violating_brokers = brokers.select do |mq_broker|
+      violating_users?(cfn_model, mq_broker)
+    end
+    violating_brokers.map(&:logical_resource_id)
+  end
+
+  private
+
+  def user_has_insecure_password?(cfn_model, user)
+    if user.has_key? 'Password'
+      if insecure_parameter?(cfn_model, user['Password'])
+        true
+      elsif insecure_string_or_dynamic_reference?(cfn_model, user['Password'])
+        true
+      elsif user['Password'].nil?
+        true
+      end
+    else
+      true    
+    end
+  end
+
+  def violating_users?(cfn_model, mq_broker)
+    if !mq_broker.users.nil?
+      violating_users = mq_broker.users.select do |user|
+        user_has_insecure_password?(cfn_model, user)
+      end
+      !violating_users.empty?
+    else
+      true
+    end
+  end 
+end

data/lib/cfn-nag/custom_rules/IamUserLoginProfilePasswordResetRule.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/truthy'
+require_relative 'base'
+
+class IamUserLoginProfilePasswordResetRule < BaseRule
+  def rule_text
+    'IAM User Login Profile should exist and have PasswordResetRequired property set to true'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W50'
+  end
+
+  def audit_impl(cfn_model)
+    violating_iam_users = cfn_model.resources_by_type('AWS::IAM::User').select do |iam_user|
+      violating_iam_users?(iam_user)
+    end
+
+    violating_iam_users.map(&:logical_resource_id)
+  end
+
+  private
+
+  def iam_user_password_reset_required_key?(login_profile)
+    if login_profile.has_key? 'PasswordResetRequired'
+      if login_profile['PasswordResetRequired'].nil?
+        true
+      elsif not_truthy?(login_profile['PasswordResetRequired'])
+        true
+      end
+    else
+      true
+    end
+  end
+
+  def violating_iam_users?(iam_user)
+    if !iam_user.loginProfile.nil?
+      iam_user_password_reset_required_key?(iam_user.loginProfile)
+    else
+      false
+    end
+  end     
+end

data/lib/cfn-nag/custom_rules/IamUserLoginProfilePasswordRule.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/enforce_reference_parameter'
+require 'cfn-nag/util/enforce_string_or_dynamic_reference'
+require_relative 'base'
+
+class IamUserLoginProfilePasswordRule < BaseRule
+  def rule_text
+    'If the IAM user LoginProile property exists, then its Password value should not ' +
+    'show password in plain text, resolve an unsecure ssm string, or have a default value for parameter.'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F51'
+  end
+
+  def audit_impl(cfn_model)
+    resources = cfn_model.resources_by_type('AWS::IAM::User')
+    violating_resources = resources.select do |iam_user|
+      violating_users?(cfn_model, iam_user)
+    end
+    violating_resources.map(&:logical_resource_id)
+  end
+
+  private
+  
+  def iam_user_has_insecure_password?(cfn_model, login_profile)
+    if login_profile.has_key? 'Password'
+      if insecure_parameter?(cfn_model, login_profile['Password'])
+        true
+      elsif insecure_string_or_dynamic_reference?(cfn_model, login_profile['Password'])
+        true
+      elsif login_profile['Password'].nil?
+        true
+      end
+    else
+      true    
+    end
+  end
+
+  def violating_users?(cfn_model, iam_user)
+    if !iam_user.loginProfile.nil?
+      iam_user_has_insecure_password?(cfn_model, iam_user.loginProfile)
+    else
+      false
+    end
+  end 
+end

data/lib/cfn-nag/custom_rules/OpsWorksStackRdsDbInstancePasswordRule.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/util/enforce_reference_parameter'
+require 'cfn-nag/util/enforce_string_or_dynamic_reference'
+require_relative 'base'
+
+class OpsWorksStackRdsDbInstancePasswordRule < BaseRule
+
+  def rule_text
+    'OpsWorks Stack RDS DBInstance Password property should not show password ' +
+    'in plain text, resolve an unsecure ssm string, or have a default value for parameter.'
+  end
+
+  def rule_type
+    Violation::FAILING_VIOLATION
+  end
+
+  def rule_id
+    'F54'
+  end
+
+  def audit_impl(cfn_model)
+    opsworks_stacks = cfn_model.resources_by_type('AWS::OpsWorks::Stack')
+    violating_opsworks_stacks = opsworks_stacks.select do |opsworks_stack|
+      violating_db_instances?(cfn_model, opsworks_stack)
+    end
+    violating_opsworks_stacks.map(&:logical_resource_id)
+  end
+
+  private 
+
+  def db_instance_has_insecure_password?(cfn_model, dbinstance)
+    if dbinstance.has_key? 'DbPassword'
+      if insecure_parameter?(cfn_model, dbinstance['DbPassword'])
+        true
+      elsif insecure_string_or_dynamic_reference?(cfn_model, dbinstance['DbPassword'])
+        true
+      elsif dbinstance['DbPassword'].nil?
+        true
+      end
+    else
+      true    
+    end
+  end
+
+  def violating_db_instances?(cfn_model, opsworks_stack)
+    if !opsworks_stack.rdsDbInstances.nil?
+      violating_dbinstances = opsworks_stack.rdsDbInstances.select do |dbinstance|
+        db_instance_has_insecure_password?(cfn_model, dbinstance)
+      end
+      !violating_dbinstances.empty?
+    else
+      false
+    end
+  end 
+end 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.4.43
+  version: 0.4.44
 platform: ruby
 authors:
 - Eric Kascic
@@ -170,6 +170,7 @@ files:
 - lib/cfn-nag/cfn_nag_logging.rb
 - lib/cfn-nag/cli_options.rb
 - lib/cfn-nag/custom_rule_loader.rb
+- lib/cfn-nag/custom_rules/AmazonMQBrokerUserPasswordRule.rb
 - lib/cfn-nag/custom_rules/AmplifyAppBasicAuthConfigPasswordRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayAccessLoggingRule.rb
 - lib/cfn-nag/custom_rules/BatchJobDefinitionContainerPropertiesPrivilegedRule.rb
@@ -206,6 +207,8 @@ files:
 - lib/cfn-nag/custom_rules/IamRoleWildcardActionOnPermissionsPolicyRule.rb
 - lib/cfn-nag/custom_rules/IamRoleWildcardActionOnTrustPolicyRule.rb
 - lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb
+- lib/cfn-nag/custom_rules/IamUserLoginProfilePasswordResetRule.rb
+- lib/cfn-nag/custom_rules/IamUserLoginProfilePasswordRule.rb
 - lib/cfn-nag/custom_rules/IotPolicyWildcardActionRule.rb
 - lib/cfn-nag/custom_rules/IotPolicyWildcardResourceRule.rb
 - lib/cfn-nag/custom_rules/KMSKeyRotationRule.rb
@@ -213,6 +216,7 @@ files:
 - lib/cfn-nag/custom_rules/LambdaPermissionWildcardPrincipalRule.rb
 - lib/cfn-nag/custom_rules/ManagedPolicyOnUserRule.rb
 - lib/cfn-nag/custom_rules/NeptuneDBClusterStorageEncryptedRule.rb
+- lib/cfn-nag/custom_rules/OpsWorksStackRdsDbInstancePasswordRule.rb
 - lib/cfn-nag/custom_rules/PolicyOnUserRule.rb
 - lib/cfn-nag/custom_rules/RDSDBClusterMasterUserPasswordRule.rb
 - lib/cfn-nag/custom_rules/RDSDBClusterStorageEncryptedRule.rb