cfn-nag 0.5.10 → 0.5.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 49056f7c35d518daf6ffea04c5bad7627b40252c24d1e59a7ee5daece6e23235
-  data.tar.gz: bf127e2ce2d316de7a15731042f882b441f03087207bdc267e7c2fb42ede44b1
+  metadata.gz: 1c92064a9d6c14b799b8845927912b5e9da2018ea586dfee6c1574f59c7b39c0
+  data.tar.gz: d6f30de67f4876246d5f6c1b762f47a3b156590adc8e18b83fc299447d8dd2a3
 SHA512:
-  metadata.gz: 2dd96572fa02263506f8a82cd737ca5d1ce5d14ae17679245952594a74b3a715a45697f744a3eb0a0445191c69c7b520b89e5dc55e4051a8d3f110fefd604e1e
-  data.tar.gz: 5b5aaadb45c63d28b28230021edaf1672bad5211a423a6e93d97ebcce68bc2354e222397492f490784a0a112ec7a21c7cb039ce3f695c41c81b56ebabe8ee2d5
+  metadata.gz: f0c0044110327dfb23994f7d07eecf80b5b931f9dda3c1c8e2ce80ebe85e11916b6cd2d4fdf1a2bc99da7259c22f7eff3e3846caeb3e00c055a78885928776a9
+  data.tar.gz: 36096f45dd3ec9cf7af1da93a0fbfef71a5e4d167da339d668a27ad476589a1864b5080ca1968057f3569725fdd57f887c290dbb6f7e93feb152f53ca708c511

data/lib/cfn-nag/custom_rules/ApiGatewayMethodAuthorizationTypeRule.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ApiGatewayMethodAuthorizationTypeRule < BaseRule
+  def rule_text
+    "AWS::ApiGateway::Method should not have AuthorizationType set to 'NONE'. "
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W59'
+  end
+
+  def audit_impl(cfn_model)
+    violating_deployments = cfn_model.resources_by_type('AWS::ApiGateway::Method').select do |method|
+      method.authorizationType.nil? || method.authorizationType.to_s.casecmp('none').zero?
+    end
+
+    violating_deployments.map(&:logical_resource_id)
+  end
+end

data/lib/cfn-nag/custom_rules/ApiGatewaySecurityPolicyRule.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ApiGatewaySecurityPolicyRule < BaseRule
+  def rule_text
+    'ApiGateway SecurityPolicy should use TLS 1.2'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W62'
+  end
+
+  def audit_impl(cfn_model)
+    violating_domains = cfn_model.resources_by_type('AWS::ApiGateway::DomainName').select do |domain|
+      domain.securityPolicy.nil? || domain.securityPolicy == 'TLS_1_0'
+    end
+
+    violating_domains.map(&:logical_resource_id)
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.5.10
+  version: 0.5.11
 platform: ruby
 authors:
 - Eric Kascic
@@ -181,6 +181,8 @@ files:
 - lib/cfn-nag/custom_rules/AmplifyAppOauthTokenRule.rb
 - lib/cfn-nag/custom_rules/AmplifyBranchBasicAuthConfigPasswordRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayAccessLoggingRule.rb
+- lib/cfn-nag/custom_rules/ApiGatewayMethodAuthorizationTypeRule.rb
+- lib/cfn-nag/custom_rules/ApiGatewaySecurityPolicyRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayV2AccessLoggingRule.rb
 - lib/cfn-nag/custom_rules/AppStreamDirectoryConfigServiceAccountCredentialsAccountPasswordRule.rb
 - lib/cfn-nag/custom_rules/BatchJobDefinitionContainerPropertiesPrivilegedRule.rb