cfn-nag 0.4.7 → 0.4.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dde33b49425ca0e1a6934b7e12dc42f0c5cd1e31eb3acd68d68855bf9b14eb1b
-  data.tar.gz: 32aada5f010677e26eb6f9eb78d248bd6c775e3507a1026cc088ec934042dc2f
+  metadata.gz: 6d85a44eca7647f151c4cdc8824e7ce8664eeafda1739cbdabeae094ba1a0831
+  data.tar.gz: 92375694b6b968bdc588229e7c4d50ae6feba4aeb05b4e7d450d1060444aa938
 SHA512:
-  metadata.gz: 0b92f6565787554d80446906103ede76aaa37bc3bdf89b612d6be2c3fa80304b618b7eef8b49f22da7f95648321103b27ce1622b031c3101ce086859d92aa851
-  data.tar.gz: aaecb9016668eb6193e7bab33df27be0285d35b02b641e54a364d252e9d10aba7fd02ff59df86c8cc31201f2483e296d7ecea64f35be910a36314030c66531c5
+  metadata.gz: a95e5fb81745dc369c348acbc0cf2a605e9638bf74a8586c20da8fbc0a1ad24a8d9734226f5cbc805a02edb2bf2b701453649cadad267047ada5ba935407eec4
+  data.tar.gz: 121fc4bdc07e51b00cf8fb7b33598a47af5b58b14f5f0f7056b122005b4ebd851feb5831750de0f29ac01187239e395d6cdf0d4460bd7fc7f636bedc351b96f1

data/bin/cfn_nag

@@ -1,110 +1,11 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require 'trollop'
 require 'cfn-nag'
 require 'logging'
 require 'json'
 require 'rubygems/specification'
 
-# rubocop:disable Metrics/BlockLength
-opts = Trollop.options do
-  options_message = '[options] <cloudformation template path ...>|' \
-                    '<cloudformation template in STDIN>'
-  custom_rule_exceptions_message = 'Isolate custom rule exceptions - ' \
-                                   'just emit the exception without stack ' \
-                                   ' trace and keep chugging'
-  usage options_message
-  version Gem::Specification.find_by_name('cfn-nag').version
+exec = CfnNagExecutor.new
 
-  opt :debug,
-      'Enable debug output',
-      type: :boolean,
-      required: false,
-      default: false
-  opt :allow_suppression,
-      'Allow using Metadata to suppress violations',
-      type: :boolean,
-      required: false,
-      default: true
-  opt :print_suppression,
-      'Emit suppressions to stderr',
-      type: :boolean,
-      required: false,
-      default: false
-  opt :rule_directory,
-      'Extra rule directory',
-      type: :io,
-      required: false,
-      default: nil
-  opt :profile_path,
-      'Path to a profile file',
-      type: :io,
-      required: false,
-      default: nil
-  opt :blacklist_path,
-      'Path to a blacklist file',
-      type: :io,
-      required: false,
-      default: nil
-  opt :parameter_values_path,
-      'Path to a JSON file to pull Parameter values from',
-      type: :io,
-      required: false,
-      default: nil
-  opt :isolate_custom_rule_exceptions,
-      custom_rule_exceptions_message,
-      type: :boolean,
-      required: false,
-      default: false
-  opt :fail_on_warnings,
-      'Treat warnings as failing violations',
-      type: :boolean,
-      required: false,
-      default: false
-end
-# rubocop:enable Metrics/BlockLength
-
-CfnNagLogging.configure_logging(opts)
-
-profile_definition = nil
-unless opts[:profile_path].nil?
-  profile_definition = IO.read(opts[:profile_path])
-end
-
-blacklist_definition = nil
-unless opts[:blacklist_path].nil?
-  blacklist_definition = IO.read(opts[:blacklist_path])
-end
-
-parameter_values_string = nil
-unless opts[:parameter_values_path].nil?
-  parameter_values_string = IO.read(opts[:parameter_values_path])
-end
-
-cfn_nag = CfnNag.new(
-  profile_definition: profile_definition,
-  blacklist_definition: blacklist_definition,
-  rule_directory: opts[:rule_directory],
-  allow_suppression: opts[:allow_suppression],
-  print_suppression: opts[:print_suppression],
-  isolate_custom_rule_exceptions: opts[:isolate_custom_rule_exceptions]
-)
-
-total_failure_count = 0
-until ARGF.closed? || ARGF.eof?
-  results = cfn_nag.audit(cloudformation_string: ARGF.file.read,
-                          parameter_values_string: parameter_values_string)
-  ARGF.close
-
-  total_failure_count += if opts[:fail_on_warnings]
-                           results[:violations].length
-                         else
-                           results[:failure_count]
-                         end
-
-  results[:violations] = results[:violations].map(&:to_h)
-  puts JSON.pretty_generate(results)
-end
-
-exit total_failure_count
+exit exec.scan(options_type: 'file')

data/bin/cfn_nag_scan

@@ -1,113 +1,13 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require 'trollop'
 require 'cfn-nag'
 require 'logging'
 require 'json'
 require 'rubygems/specification'
 
-# rubocop:disable Metrics/BlockLength
-opts = Trollop.options do
-  version Gem::Specification.find_by_name('cfn-nag').version
+exec = CfnNagExecutor.new
 
-  input_path_message = 'CloudFormation template to nag on or directory of ' \
-                       'templates.  Default is all *.json, *.yaml, *.yml ' \
-                       'and *.template recursively, but can be constrained ' \
-                       'by --template-pattern'
-
-  custom_rule_exceptions_message = 'Isolate custom rule exceptions - just ' \
-                                   'emit the exception without stack trace ' \
-                                   'and keep chugging'
-
-  template_pattern_message = 'Within the --input-path, match files to scan ' \
-                             'against this regular expression'
-
-  opt :input_path,
-      input_path_message,
-      type: :io,
-      required: true
-  opt :output_format,
-      'Format of results: [txt, json]',
-      type: :string,
-      default: 'txt'
-  opt :debug,
-      'Enable debug output',
-      type: :boolean,
-      required: false,
-      default: false
-  opt :rule_directory,
-      'Extra rule directory',
-      type: :io,
-      required: false,
-      default: nil
-  opt :profile_path,
-      'Path to a profile file',
-      type: :io,
-      required: false,
-      default: nil
-  opt :blacklist_path,
-      'Path to a blacklist file',
-      type: :io,
-      required: false,
-      default: nil
-  opt :parameter_values_path,
-      'Path to a JSON file to pull Parameter values from',
-      type: :io,
-      required: false,
-      default: nil
-  opt :allow_suppression,
-      'Allow using Metadata to suppress violations',
-      type: :boolean,
-      required: false,
-      default: true
-  opt :print_suppression,
-      'Emit suppressions to stderr',
-      type: :boolean,
-      required: false,
-      default: false
-  opt :isolate_custom_rule_exceptions,
-      custom_rule_exceptions_message,
-      type: :boolean,
-      required: false,
-      default: false
-  opt :template_pattern,
-      template_pattern_message,
-      type: :string,
-      required: false,
-      default: '..*\.json|..*\.yaml|..*\.yml|..*\.template'
-end
-# rubocop:enable Metrics/BlockLength
-
-unless %w[txt json].include?(opts[:output_format])
-  Trollop.die(:output_format,
-              'Must be txt or json')
-end
-
-CfnNagLogging.configure_logging(opts)
-
-profile_definition = nil
-unless opts[:profile_path].nil?
-  profile_definition = IO.read(opts[:profile_path])
-end
-
-blacklist_definition = nil
-unless opts[:blacklist_path].nil?
-  blacklist_definition = IO.read(opts[:blacklist_path])
-end
-
-cfn_nag = CfnNag.new(
-  profile_definition: profile_definition,
-  blacklist_definition: blacklist_definition,
-  rule_directory: opts[:rule_directory],
-  allow_suppression: opts[:allow_suppression],
-  print_suppression: opts[:print_suppression],
-  isolate_custom_rule_exceptions: opts[:isolate_custom_rule_exceptions]
-)
-
-exit cfn_nag.audit_aggregate_across_files_and_render_results(
-  input_path: opts[:input_path],
-  output_format: opts[:output_format],
-  parameter_values_path: opts[:parameter_values_path],
-  template_pattern: opts[:template_pattern]
+exit exec.scan(
+  options_type: 'scan'
 )

data/lib/cfn-nag.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'cfn-nag/cfn_nag'
+require 'cfn-nag/cfn_nag_executor'
 require 'cfn-nag/cfn_nag_logging'
 require 'cfn-nag/violation'
 require 'cfn-nag/rule_dumper'

data/lib/cfn-nag/cfn_nag.rb

@@ -12,24 +12,9 @@ require 'cfn-model'
 class CfnNag
   include ViolationFiltering
 
-  # rubocop:disable Metrics/ParameterLists
-  def initialize(profile_definition: nil,
-                 blacklist_definition: nil,
-                 rule_directory: nil,
-                 allow_suppression: true,
-                 print_suppression: false,
-                 isolate_custom_rule_exceptions: false)
-    @rule_directory = rule_directory
-    @custom_rule_loader = CustomRuleLoader.new(
-      rule_directory: rule_directory,
-      allow_suppression: allow_suppression,
-      print_suppression: print_suppression,
-      isolate_custom_rule_exceptions: isolate_custom_rule_exceptions
-    )
-    @profile_definition = profile_definition
-    @blacklist_definition = blacklist_definition
+  def initialize(config:)
+    @config = config
   end
-  # rubocop:enable Metrics/ParameterLists
 
   ##
   # Given a file or directory path, emit aggregate results to stdout
@@ -48,7 +33,11 @@ class CfnNag
                    output_format: output_format)
 
     aggregate_results.inject(0) do |total_failure_count, results|
-      total_failure_count + results[:file_results][:failure_count]
+      if @config.fail_on_warnings
+        total_failure_count + results[:file_results][:violations].length
+      else
+        total_failure_count + results[:file_results][:failure_count]
+      end
     end
   end
 
@@ -87,7 +76,7 @@ class CfnNag
       cfn_model = CfnParser.new.parse cloudformation_string,
                                       parameter_values_string,
                                       true
-      violations += @custom_rule_loader.execute_custom_rules(cfn_model)
+      violations += @config.custom_rule_loader.execute_custom_rules(cfn_model)
 
       violations = filter_violations_by_blacklist_and_profile(violations)
       violations = mark_line_numbers(violations, cfn_model)
@@ -115,15 +104,15 @@ class CfnNag
 
   def filter_violations_by_blacklist_and_profile(violations)
     violations = filter_violations_by_profile(
-      profile_definition: @profile_definition,
-      rule_definitions: @custom_rule_loader.rule_definitions,
+      profile_definition: @config.profile_definition,
+      rule_definitions: @config.custom_rule_loader.rule_definitions,
       violations: violations
     )
 
     # this must come after - blacklist should always win
     violations = filter_violations_by_blacklist(
-      blacklist_definition: @blacklist_definition,
-      rule_definitions: @custom_rule_loader.rule_definitions,
+      blacklist_definition: @config.blacklist_definition,
+      rule_definitions: @config.custom_rule_loader.rule_definitions,
       violations: violations
     )
     violations

data/lib/cfn-nag/cfn_nag_config.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+class CfnNagConfig
+  # rubocop:disable Metrics/ParameterLists
+  def initialize(profile_definition: nil,
+                 blacklist_definition: nil,
+                 rule_directory: nil,
+                 allow_suppression: true,
+                 print_suppression: false,
+                 isolate_custom_rule_exceptions: false,
+                 fail_on_warnings: false)
+    @rule_directory = rule_directory
+    @custom_rule_loader = CustomRuleLoader.new(
+      rule_directory: rule_directory,
+      allow_suppression: allow_suppression,
+      print_suppression: print_suppression,
+      isolate_custom_rule_exceptions: isolate_custom_rule_exceptions
+    )
+    @profile_definition = profile_definition
+    @blacklist_definition = blacklist_definition
+    @fail_on_warnings = fail_on_warnings
+  end
+  # rubocop:enable Metrics/ParameterLists
+
+  attr_reader :rule_directory
+  attr_reader :custom_rule_loader
+  attr_reader :profile_definition
+  attr_reader :blacklist_definition
+  attr_reader :fail_on_warnings
+end

data/lib/cfn-nag/cfn_nag_executor.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require 'trollop'
+require 'cfn-nag/cli_options'
+require 'cfn-nag/cfn_nag_config'
+
+class CfnNagExecutor
+  def initialize
+    @profile_definition = nil
+    @blacklist_definition = nil
+    @parameter_values_string = nil
+  end
+
+  def scan(options_type:)
+    options = Options.for(options_type)
+    validate_options(options)
+    execute_io_options(options)
+
+    CfnNagLogging.configure_logging(options)
+
+    cfn_nag = CfnNag.new(
+      config: cfn_nag_config(options)
+    )
+
+    options_type == 'scan' ? execute_aggregate_scan(cfn_nag, options) : execute_file_or_piped_scan(cfn_nag, options)
+  end
+
+  private
+
+  def execute_file_or_piped_scan(cfn_nag, opts)
+    total_failure_count = 0
+    until argf_finished?
+      results = cfn_nag.audit(cloudformation_string: argf_read,
+                              parameter_values_string: @parameter_values_string)
+      argf_close
+
+      total_failure_count += if opts[:fail_on_warnings]
+                               results[:violations].length
+                             else
+                               results[:failure_count]
+                             end
+
+      results[:violations] = results[:violations].map(&:to_h)
+      puts JSON.pretty_generate(results)
+    end
+    total_failure_count
+  end
+
+  def execute_aggregate_scan(cfn_nag, opts)
+    cfn_nag.audit_aggregate_across_files_and_render_results(
+      input_path: opts[:input_path],
+      output_format: opts[:output_format],
+      parameter_values_path: opts[:parameter_values_path],
+      template_pattern: opts[:template_pattern]
+    )
+  end
+
+  def validate_options(opts)
+    unless opts[:output_format].nil? || %w[txt json].include?(opts[:output_format])
+      Trollop.die(:output_format,
+                  'Must be txt or json')
+    end
+  end
+
+  def execute_io_options(opts)
+    unless opts[:profile_path].nil?
+      @profile_definition = IO.read(opts[:profile_path])
+    end
+
+    unless opts[:blacklist_path].nil?
+      @blacklist_definition = IO.read(opts[:blacklist_path])
+    end
+
+    unless opts[:parameter_values_path].nil?
+      @parameter_values_string = IO.read(opts[:parameter_values_path])
+    end
+  end
+
+  def cfn_nag_config(opts)
+    CfnNagConfig.new(
+      profile_definition: @profile_definition,
+      blacklist_definition: @blacklist_definition,
+      rule_directory: opts[:rule_directory],
+      allow_suppression: opts[:allow_suppression],
+      print_suppression: opts[:print_suppression],
+      isolate_custom_rule_exceptions: opts[:isolate_custom_rule_exceptions],
+      fail_on_warnings: opts[:fail_on_warnings]
+    )
+  end
+
+  def argf_finished?
+    ARGF.closed? || ARGF.eof?
+  end
+
+  def argf_close
+    ARGF.close
+  end
+
+  def argf_read
+    ARGF.file.read
+  end
+end

data/lib/cfn-nag/cli_options.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require 'trollop'
+
+# rubocop:disable Metrics/ClassLength
+class Options
+  @custom_rule_exceptions_message = 'Isolate custom rule exceptions - just ' \
+                                   'emit the exception without stack trace ' \
+                                   'and keep chugging'
+
+  @version = Gem::Specification.find_by_name('cfn-nag').version
+
+  def self.for(type)
+    case type
+    when 'file'
+      file_options
+    when 'scan'
+      scan_options
+    else
+      raise "Unsupported Options type #{type}; use 'file' or 'scan'"
+    end
+  end
+
+  # rubocop:disable Metrics/BlockLength
+  # rubocop:disable Metrics/MethodLength
+  def self.file_options
+    options_message = '[options] <cloudformation template path ...>|' \
+                        '<cloudformation template in STDIN>'
+    custom_rule_exceptions_message = @custom_rule_exceptions_message
+    version = @version
+
+    Trollop.options do
+      usage options_message
+      version version
+
+      opt :debug,
+          'Enable debug output',
+          type: :boolean,
+          required: false,
+          default: false
+      opt :allow_suppression,
+          'Allow using Metadata to suppress violations',
+          type: :boolean,
+          required: false,
+          default: true
+      opt :print_suppression,
+          'Emit suppressions to stderr',
+          type: :boolean,
+          required: false,
+          default: false
+      opt :rule_directory,
+          'Extra rule directory',
+          type: :io,
+          required: false,
+          default: nil
+      opt :profile_path,
+          'Path to a profile file',
+          type: :io,
+          required: false,
+          default: nil
+      opt :blacklist_path,
+          'Path to a blacklist file',
+          type: :io,
+          required: false,
+          default: nil
+      opt :parameter_values_path,
+          'Path to a JSON file to pull Parameter values from',
+          type: :io,
+          required: false,
+          default: nil
+      opt :isolate_custom_rule_exceptions,
+          custom_rule_exceptions_message,
+          type: :boolean,
+          required: false,
+          default: false
+      opt :fail_on_warnings,
+          'Treat warnings as failing violations',
+          type: :boolean,
+          required: false,
+          default: false
+      opt :output_format,
+          'Format of results: [txt, json]',
+          type: :string,
+          default: 'txt'
+    end
+  end
+
+  def self.scan_options
+    input_path_message = 'CloudFormation template to nag on or directory of ' \
+                         'templates.  Default is all *.json, *.yaml, *.yml ' \
+                         'and *.template recursively, but can be constrained ' \
+                         'by --template-pattern'
+
+    template_pattern_message = 'Within the --input-path, match files to scan ' \
+                               'against this regular expression'
+
+    custom_rule_exceptions_message = @custom_rule_exceptions_message
+    version = @version
+
+    Trollop.options do
+      version version
+      opt :input_path,
+          input_path_message,
+          type: :io,
+          required: true
+      opt :output_format,
+          'Format of results: [txt, json]',
+          type: :string,
+          default: 'txt'
+      opt :debug,
+          'Enable debug output',
+          type: :boolean,
+          required: false,
+          default: false
+      opt :rule_directory,
+          'Extra rule directory',
+          type: :io,
+          required: false,
+          default: nil
+      opt :profile_path,
+          'Path to a profile file',
+          type: :io,
+          required: false,
+          default: nil
+      opt :blacklist_path,
+          'Path to a blacklist file',
+          type: :io,
+          required: false,
+          default: nil
+      opt :parameter_values_path,
+          'Path to a JSON file to pull Parameter values from',
+          type: :io,
+          required: false,
+          default: nil
+      opt :allow_suppression,
+          'Allow using Metadata to suppress violations',
+          type: :boolean,
+          required: false,
+          default: true
+      opt :print_suppression,
+          'Emit suppressions to stderr',
+          type: :boolean,
+          required: false,
+          default: false
+      opt :isolate_custom_rule_exceptions,
+          custom_rule_exceptions_message,
+          type: :boolean,
+          required: false,
+          default: false
+      opt :template_pattern,
+          template_pattern_message,
+          type: :string,
+          required: false,
+          default: '..*\.json|..*\.yaml|..*\.yml|..*\.template'
+      opt :fail_on_warnings,
+          'Treat warnings as failing violations',
+          type: :boolean,
+          required: false,
+          default: false
+    end
+  end
+  # rubocop:enable Metrics/BlockLength
+  # rubocop:enable Metrics/MethodLength
+end
+# rubocop:enable Metrics/ClassLength

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.4.7
+  version: 0.4.8
 platform: ruby
 authors:
 - Eric Kascic
@@ -151,7 +151,10 @@ files:
 - lib/cfn-nag.rb
 - lib/cfn-nag/blacklist_loader.rb
 - lib/cfn-nag/cfn_nag.rb
+- lib/cfn-nag/cfn_nag_config.rb
+- lib/cfn-nag/cfn_nag_executor.rb
 - lib/cfn-nag/cfn_nag_logging.rb
+- lib/cfn-nag/cli_options.rb
 - lib/cfn-nag/custom_rule_loader.rb
 - lib/cfn-nag/custom_rules/BatchJobDefinitionContainerPropertiesPrivilegedRule.rb
 - lib/cfn-nag/custom_rules/CloudFormationAuthenticationRule.rb