cfn-nag 0.5.33 → 0.5.34

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d26301e0a7300e00b20d5e36cbea860498138a5a6b58b11700de040221820c22
-  data.tar.gz: f31fd4913ebade626ac34ff207fffb3d1c2fc3203a24ea08cebd860505156685
+  metadata.gz: e1deb828110ef98e15fcffe2c1f3645fcb35570a40d37b85178361c31e015218
+  data.tar.gz: c721f2801a1d26453df7ade776dcfea8cca18970176dff171e7348a29bb5cc1e
 SHA512:
-  metadata.gz: e908b0a203b5722fb5d3131d9d3f27361d14a6bba959a7cd7f00a755d70d472583743c9258e7fe695eda3ee9c107e946e9e1ef5072e2dfa4c34533da1eecf98e
-  data.tar.gz: eb0ee9d5cba3dd1eb202d0c5be20c5b1b4a83ca25a6142b208d0898f1c66e69f3b010a493f89da9324e15a9071c264e1099a99d23372823a9bc28ae11477fd8b
+  metadata.gz: e3e088f5addf8a9372ba584f9bcbbe15b89c94419577c9c546e84fa20967107b5da2ded0a6cd4edf5894e65656a084a2aee3d7290499cab1586877049454ca78
+  data.tar.gz: 907006ecef680f5f3d971c4396cf6f5fa58c379f8dd9e6206f70090a69fd3a08f2072916ed51a29f6c0c2ea280c2af831ceec5b9bd069c805dcba73540d77731

data/lib/cfn-nag/custom_rules/CloudfrontMinimumProtocolVersionRule.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require_relative 'base'
+
+class CloudfrontMinimumProtocolVersionRule < BaseRule
+  def rule_text
+    'Cloudfront should use minimum protocol version TLS 1.2'
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W70'
+  end
+
+  def audit_impl(cfn_model)
+    violating_distributions = cfn_model.resources_by_type('AWS::CloudFront::Distribution')
+                                       .select do |dist|
+      dist.distributionConfig['ViewerCertificate'].nil? || tls_version?(dist.distributionConfig['ViewerCertificate'])
+    end
+
+    violating_distributions.map(&:logical_resource_id)
+  end
+
+  private
+
+  def tls_version?(viewer_certificate)
+    cert_has_bad_tls_version?(viewer_certificate) || override_tls_config?(viewer_certificate)
+  end
+
+  def cert_has_bad_tls_version?(viewer_certificate)
+    viewer_certificate['MinimumProtocolVersion'].nil? || viewer_certificate['MinimumProtocolVersion'] != 'TLSv1.2_2018'
+  end
+
+  def override_tls_config?(viewer_certificate)
+    !viewer_certificate['CloudFrontDefaultCertificate'].nil? && viewer_certificate['CloudFrontDefaultCertificate']
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.5.33
+  version: 0.5.34
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-27 00:00:00.000000000 Z
+date: 2020-04-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -191,6 +191,7 @@ files:
 - lib/cfn-nag/custom_rules/BatchJobDefinitionContainerPropertiesPrivilegedRule.rb
 - lib/cfn-nag/custom_rules/CloudFormationAuthenticationRule.rb
 - lib/cfn-nag/custom_rules/CloudFrontDistributionAccessLoggingRule.rb
+- lib/cfn-nag/custom_rules/CloudfrontMinimumProtocolVersionRule.rb
 - lib/cfn-nag/custom_rules/CodeBuildEncryptionKeyRule.rb
 - lib/cfn-nag/custom_rules/CodePipelineWebhookAuthenticationConfigurationSecretTokenRule.rb
 - lib/cfn-nag/custom_rules/CognitoIdentityPoolAllowUnauthenticatedIdentitiesRule.rb