cfn-nag 0.5.28 → 0.5.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c4a52da85cbdeefb7d7283f69fc753bad3123fc3a24794c1b6be64711491f0b
-  data.tar.gz: ff67b04edb5444d1c1686ec1db1873cfd0938259f2bebf7c3b8c9a1a38e4ef7e
+  metadata.gz: 6c3d6f5ec2ba6ffde6f2cd53128c4daa7549288509bb845f96c7523cbb3336a9
+  data.tar.gz: 4be67a19a9e8f59c7ba4e656aa78480a586583f171e7358626ee7ee217241704
 SHA512:
-  metadata.gz: ee1342976006ea4fddf47a9154961540e5d59160721e28de1ba4b0dcb0743bb177f9fbe15494cd158f403d06c17208649809a2d836d40d5b37d81a8da9c64421
-  data.tar.gz: c5bc544b1dc4b8a18c89317395a5ca3fde8e8e081b167cf065bb231055de243fb0d938228edae44528188718075f439ab3a335130172c738e6f947dafda5064f
+  metadata.gz: 4fc9edc0e7d726e08af73dc73728fbe8a121531abf7f007f9f26508881ebc15a3acd751c3baa51b05d0eef1af1aae996ee0661b5995e543be7d6150982e76f65
+  data.tar.gz: 2ce54994df8076d40a7870b81c9b5ca84d51738ee8b0d6a667402ccdac280aa984c9b116a034945abb5188198587dcc06f5eef16e3b757e8d542bdcf069a5012

data/lib/cfn-nag/custom_rules/ApiGatewayAccessLoggingRule.rb

@@ -5,7 +5,8 @@ require_relative 'base'
 
 class ApiGatewayAccessLoggingRule < BaseRule
   def rule_text
-    'ApiGateway should have access logging configured'
+    'ApiGateway Deployment resource should have AccessLogSetting property configured when creating an ' \
+    'API Stage itself (through specifying the StageName and StageDescription properties).'
   end
 
   def rule_type
@@ -17,10 +18,32 @@ class ApiGatewayAccessLoggingRule < BaseRule
   end
 
   def audit_impl(cfn_model)
+    stage_deployment_ids = stage_deployments_with_logging(cfn_model)
+
     violating_deployments = cfn_model.resources_by_type('AWS::ApiGateway::Deployment').select do |deployment|
-      deployment.stageDescription.nil? || deployment.stageDescription['AccessLogSetting'].nil?
+      violating_deployment?(deployment, stage_deployment_ids)
     end
 
     violating_deployments.map(&:logical_resource_id)
   end
+
+  private
+
+  def violating_deployment?(deployment, stage_deployment_ids)
+    if deployment.stageDescription.nil?
+      !stage_deployment_ids.include?(deployment.logical_resource_id)
+    else
+      deployment.stageDescription['AccessLogSetting'].nil?
+    end
+  end
+
+  def stage_deployments_with_logging(cfn_model)
+    stage_deployment_ids = []
+    cfn_model.resources_by_type('AWS::ApiGateway::Stage').each do |stage|
+      unless stage.accessLogSetting.nil? && stage.deploymentId.nil?
+        stage_deployment_ids.push(References.resolve_resource_id(stage.deploymentId))
+      end
+    end
+    stage_deployment_ids
+  end
 end

data/lib/cfn-nag/custom_rules/ApiGatewayStageAccessLoggingRule.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class ApiGatewayStageAccessLoggingRule < BaseRule
+  def rule_text
+    'AWS::ApiGateway::Stage should have the AccessLogSetting property defined.'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W69'
+  end
+
+  def audit_impl(cfn_model)
+    violating_api_gateway_stages = cfn_model.resources_by_type('AWS::ApiGateway::Stage').select do |api_stage|
+      api_stage.accessLogSetting.nil?
+    end
+
+    violating_api_gateway_stages.map(&:logical_resource_id)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.5.28
+  version: 0.5.29
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-17 00:00:00.000000000 Z
+date: 2020-03-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -184,6 +184,7 @@ files:
 - lib/cfn-nag/custom_rules/ApiGatewayDeploymentUsagePlanRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayMethodAuthorizationTypeRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewaySecurityPolicyRule.rb
+- lib/cfn-nag/custom_rules/ApiGatewayStageAccessLoggingRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayStageUsagePlanRule.rb
 - lib/cfn-nag/custom_rules/ApiGatewayV2AccessLoggingRule.rb
 - lib/cfn-nag/custom_rules/AppStreamDirectoryConfigServiceAccountCredentialsAccountPasswordRule.rb