cfn-nag 0.5.61 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9730b5f935f661789abf3aa45239a0f7715c35c95842644aeec25f98a7c3c6ce
-  data.tar.gz: 4a2f9453cc6d9074f4e3ea19b78514fddcd5fc5d8d9269babe8187bebd549482
+  metadata.gz: ce61954c2ef415db38dfd9173ab93fb92145a7a2cf5778901bad880d3aabc762
+  data.tar.gz: 8296a1bea671a836e464db5f9a4573d7b64ba87be90e841ce2ef5e823b61b49a
 SHA512:
-  metadata.gz: 6dc61c128936866f2e0bf34e7e442e4a71366fa0f9b9c41fe972142aafffd51f7155e3aec488b5742ae5b019b484245a1fa7c6555979de3b709e68ab30081553
-  data.tar.gz: 54431e5bc771b2ca296dfb94ddcb1202da16d7ced5f1c88c28a00bd2d9d7f3b36600edb6449f210244d6c55a22addfa6a293a6a0dc9ad2c5318eb047d74e03e1
+  metadata.gz: 4d07a9749c20b7083b9f01b479e20ffdcc327be635d9285e3f7175f8be39c87d7d66fc5fd5d1a7d728d399d9d5fc96a92d7ea42ac90014b79528bcdf2a4786e7
+  data.tar.gz: 227ef815606ef8eb763b1523de73ba0f4a0e8c6791afd809699057e41f37694ead17bd1714725838328516c45a369118852e5fadb76e334c75dde009ba459ed2

data/bin/spcm_scan

@@ -0,0 +1,69 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'cfn-nag/iam_complexity_metric/spcm'
+require 'cfn-nag/iam_complexity_metric/html_results_renderer'
+require 'optimist'
+require 'json'
+
+# rubocop:disable Metrics/BlockLength
+opts = Optimist.options do
+  opt :parameter_values_path,
+      'Path to a JSON file to pull Parameter values from',
+      type: :string,
+      required: false,
+      default: nil
+  opt :condition_values_path,
+      'Path to a JSON file to pull Condition values from',
+      type: :string,
+      required: false,
+      default: nil
+  opt :input_path,
+      'CloudFormation template to measure SPCM on or directory of templates.',
+      type: :string,
+      required: true
+  opt :template_pattern,
+      'Within the --input-path, match files to scan against this regular expression',
+      type: :string,
+      required: false,
+      default: '..*\.json|..*\.yaml|..*\.yml|..*\.template'
+  opt :ignore_templates_without_iam,
+      'Within the --input-path ignore files without IAM role/policy resources',
+      type: :boolean,
+      required: false,
+      default: true
+  opt :output_format,
+      'Format of results: [json, html]',
+      type: :string,
+      default: 'json'
+end
+# rubocop:enable Metrics/BlockLength
+
+def read_conditionally(path)
+  unless path.nil?
+    IO.read(path)
+  end
+end
+
+parameter_values_string = read_conditionally(opts[:parameter_values_path])
+
+condition_values_string = read_conditionally(opts[:condition_values_path])
+
+metrics = SPCM.new.aggregate_metrics(
+  input_path: opts[:input_path],
+  parameter_values_path: parameter_values_string,
+  condition_values_path: condition_values_string,
+  template_pattern: opts[:template_pattern]
+)
+
+if opts[:ignore_templates_without_iam]
+  metrics = metrics.select do |metric|
+    metric[:file_results]['AWS::IAM::Role'] != {} || metric[:file_results]['AWS::IAM::Policy'] != {}
+  end
+end
+
+if opts[:output_format] == 'json'
+  puts JSON.generate(metrics)
+else
+  puts HtmlRenderer.new.render(results: metrics)
+end

data/lib/cfn-nag/cfn_nag.rb

@@ -87,6 +87,7 @@ class CfnNag
                                       parameter_values_string,
                                       true,
                                       condition_values_string
+      CustomRuleLoader.rule_arguments = @config.rule_arguments
       violations += @config.custom_rule_loader.execute_custom_rules(
         cfn_model,
         @config.custom_rule_loader.rule_definitions

data/lib/cfn-nag/cfn_nag_config.rb

@@ -9,7 +9,8 @@ class CfnNagConfig
                  print_suppression: false,
                  isolate_custom_rule_exceptions: false,
                  fail_on_warnings: false,
-                 rule_repository_definitions: [])
+                 rule_repository_definitions: [],
+                 rule_arguments: {})
     @rule_directory = rule_directory
     @custom_rule_loader = CustomRuleLoader.new(
       rule_directory: rule_directory,
@@ -22,9 +23,11 @@ class CfnNagConfig
     @blacklist_definition = blacklist_definition
     @fail_on_warnings = fail_on_warnings
     @rule_repositories = rule_repositories
+    @rule_arguments = rule_arguments
   end
   # rubocop:enable Metrics/ParameterLists
 
+  attr_reader :rule_arguments
   attr_reader :rule_directory
   attr_reader :custom_rule_loader
   attr_reader :profile_definition

data/lib/cfn-nag/cfn_nag_executor.rb

@@ -11,6 +11,7 @@ class CfnNagExecutor
     @parameter_values_string = nil
     @condition_values_string = nil
     @rule_repository_definitions = []
+    @rule_arguments_string = nil
   end
 
   def scan(options_type:)
@@ -77,6 +78,12 @@ class CfnNagExecutor
       Optimist.die(:output_format,
                    'Must be colortxt, txt, or json')
     end
+
+    opts[:rule_arguments]&.each do |rule_argument|
+      unless rule_argument.include?(':')
+        Optimist.die(:rule_arguments, 'Must be of form name:value')
+      end
+    end
   end
 
   def execute_io_options(opts)
@@ -88,6 +95,8 @@ class CfnNagExecutor
 
     @condition_values_string = read_conditionally(opts[:condition_values_path])
 
+    @rule_arguments_string = read_conditionally(opts[:rule_arguments_path])
+
     opts[:rule_repository]&.each do |rule_repository|
       @rule_repository_definitions << IO.read(rule_repository)
     end
@@ -99,6 +108,17 @@ class CfnNagExecutor
     end
   end
 
+  def merge_rule_arguments(opts)
+    rule_arguments = {}
+    rule_arguments = JSON.parse(@rule_arguments_string) if @rule_arguments_string
+    opts[:rule_arguments]&.each do |rule_argument|
+      name = rule_argument.split(':')[0]
+      value = rule_argument.split(':')[1]
+      rule_arguments[name] = value
+    end
+    rule_arguments
+  end
+
   def cfn_nag_config(opts)
     CfnNagConfig.new(
       profile_definition: @profile_definition,
@@ -108,7 +128,8 @@ class CfnNagExecutor
       print_suppression: opts[:print_suppression],
       isolate_custom_rule_exceptions: opts[:isolate_custom_rule_exceptions],
       fail_on_warnings: opts[:fail_on_warnings],
-      rule_repository_definitions: @rule_repository_definitions
+      rule_repository_definitions: @rule_repository_definitions,
+      rule_arguments: merge_rule_arguments(opts)
     )
   end
 

data/lib/cfn-nag/cli_options.rb

@@ -91,6 +91,15 @@ class Options
           'Path(s) to a rule repository to include in rule discovery',
           type: :strings,
           required: false
+      opt :rule_arguments,
+          'Rule arguments to inject into interested rules',
+          type: :strings,
+          required: false
+      opt :rule_arguments_path,
+          'Path to a rule arguments to inject into interested rules',
+          type: :string,
+          required: false,
+          default: nil
     end
   end
 
@@ -175,6 +184,15 @@ class Options
           'Path(s)s to rule repository to include in rule discovery',
           type: :strings,
           required: false
+      opt :rule_arguments,
+          'Rule arguments to inject into interested rules',
+          type: :strings,
+          required: false
+      opt :rule_arguments_path,
+          'Path to a rule arguments to inject into interested rules',
+          type: :string,
+          required: false,
+          default: nil
     end
   end
   # rubocop:enable Metrics/BlockLength

data/lib/cfn-nag/custom_rule_loader.rb

@@ -7,12 +7,22 @@ require_relative 'rule_repos/file_based_rule_repo'
 require_relative 'rule_repos/gem_based_rule_repo'
 require_relative 'rule_repos/s3_based_rule_repo'
 require_relative 'rule_repository_loader'
+require_relative 'metadata'
 
 ##
 # This object can discover the internal and custom user-provided rules and
 # apply these rules to a CfnModel object
 #
 class CustomRuleLoader
+  include Metadata
+
+  # k,v for injection into rules that can respond to k
+  @rule_arguments = {}
+
+  class << self
+    attr_accessor :rule_arguments
+  end
+
   def initialize(rule_directory: nil,
                  allow_suppression: true,
                  print_suppression: false,
@@ -58,6 +68,14 @@ class CustomRuleLoader
 
   private
 
+  def inject_rule_arguments_into_rule(rule)
+    self.class.rule_arguments.each do |rule_argument_name, rule_argument_value|
+      if rule.respond_to?("#{rule_argument_name}=".to_sym)
+        rule.send "#{rule_argument_name}=".to_sym, rule_argument_value
+      end
+    end
+  end
+
   # rubocop:disable Style/RedundantBegin
   def filter_rule_classes(cfn_model, violations, rules_registry)
     rules_registry.rule_classes.each do |rule_class|
@@ -65,9 +83,12 @@ class CustomRuleLoader
         filtered_cfn_model = cfn_model_with_suppressed_resources_removed(
           cfn_model: cfn_model,
           rule_id: rule_class.new.rule_id,
-          allow_suppression: @allow_suppression
+          allow_suppression: @allow_suppression,
+          print_suppression: @print_suppression
         )
-        audit_result = rule_class.new.audit(filtered_cfn_model)
+        rule = rule_class.new
+        inject_rule_arguments_into_rule(rule)
+        audit_result = rule.audit(filtered_cfn_model)
         violations << audit_result unless audit_result.nil?
       rescue ScriptError, StandardError => rule_error
         raise rule_error unless @isolate_custom_rule_exceptions
@@ -77,74 +98,4 @@ class CustomRuleLoader
     end
   end
   # rubocop:enable Style/RedundantBegin
-
-  def rules_to_suppress(resource)
-    if resource.metadata &&
-       resource.metadata['cfn_nag'] &&
-       resource.metadata['cfn_nag']['rules_to_suppress']
-
-      resource.metadata['cfn_nag']['rules_to_suppress']
-    end
-  end
-
-  def collect_mangled_metadata(cfn_model)
-    mangled_metadatas = []
-    cfn_model.resources.each do |logical_resource_id, resource|
-      resource_rules_to_suppress = rules_to_suppress resource
-      next if resource_rules_to_suppress.nil?
-
-      mangled_rules = resource_rules_to_suppress.select do |rule_to_suppress|
-        rule_to_suppress['id'].nil?
-      end
-      unless mangled_rules.empty?
-        mangled_metadatas << [logical_resource_id, mangled_rules]
-      end
-    end
-    mangled_metadatas
-  end
-
-  # XXX given mangled_metadatas is never used or returned,
-  # STDERR emit can be moved to unless block
-  def validate_cfn_nag_metadata(cfn_model)
-    mangled_metadatas = collect_mangled_metadata(cfn_model)
-    mangled_metadatas.each do |mangled_metadata|
-      logical_resource_id = mangled_metadata.first
-      mangled_rules = mangled_metadata[1]
-
-      STDERR.puts "#{logical_resource_id} has missing cfn_nag suppression " \
-                  "rule id: #{mangled_rules}"
-    end
-  end
-
-  def suppress_resource?(rules_to_suppress, rule_id, logical_resource_id)
-    found_suppression_rule = rules_to_suppress.find do |rule_to_suppress|
-      next if rule_to_suppress['id'].nil?
-
-      rule_to_suppress['id'] == rule_id
-    end
-    if found_suppression_rule && @print_suppression
-      message = "Suppressing #{rule_id} on #{logical_resource_id} for " \
-                "reason: #{found_suppression_rule['reason']}"
-      STDERR.puts message
-    end
-    !found_suppression_rule.nil?
-  end
-
-  def cfn_model_with_suppressed_resources_removed(cfn_model:,
-                                                  rule_id:,
-                                                  allow_suppression:)
-    return cfn_model unless allow_suppression
-
-    cfn_model = cfn_model.copy
-
-    cfn_model.resources.delete_if do |logical_resource_id, resource|
-      rules_to_suppress = rules_to_suppress resource
-      if rules_to_suppress.nil?
-        false
-      else
-        suppress_resource?(rules_to_suppress, rule_id, logical_resource_id)
-      end
-    end
-    cfn_model
-  end
 end

data/lib/cfn-nag/custom_rules/SPCMRule.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/violation'
+require 'cfn-nag/iam_complexity_metric/spcm'
+require_relative 'base'
+
+class SPCMRule < BaseRule
+  attr_accessor :spcm_threshold
+  DEFAULT_THRESHOLD = 25
+
+  def rule_text
+    "SPCM for IAM policy document is higher than #{spcm_threshold || DEFAULT_THRESHOLD}"
+  end
+
+  def rule_type
+    Violation::WARNING
+  end
+
+  def rule_id
+    'W76'
+  end
+
+  def audit_impl(cfn_model)
+    logical_resource_ids = []
+    begin
+      policy_documents = SPCM.new.metric_impl(cfn_model)
+    rescue StandardError => catch_all_exception
+      puts "Experimental SPCM rule is failing. Please report #{catch_all_exception} with the violating template"
+      policy_documents = {}
+    end
+
+    threshold = spcm_threshold.nil? ? DEFAULT_THRESHOLD : spcm_threshold.to_i
+    logical_resource_ids += violating_policy_resources(policy_documents, threshold)
+    logical_resource_ids += violating_role_resources(policy_documents, threshold)
+
+    logical_resource_ids
+  end
+
+  private
+
+  def violating_role_resources(policy_documents, threshold)
+    logical_resource_ids = []
+
+    # unfortunately the line numbers will break if we don't return
+    # the logical resource id - so there isn't a good way to communicate
+    # the specific policy within the role that is offending
+    policy_documents['AWS::IAM::Role'].each do |logical_resource_id, policies|
+      policies.each do |_, metric|
+        if metric >= threshold
+          logical_resource_ids << logical_resource_id
+        end
+      end
+    end
+    logical_resource_ids
+  end
+
+  def violating_policy_resources(policy_documents, threshold)
+    logical_resource_ids = []
+    policy_documents['AWS::IAM::Policy'].each do |logical_resource_id, metric|
+      if metric >= threshold
+        logical_resource_ids << logical_resource_id
+      end
+    end
+    logical_resource_ids
+  end
+end

data/lib/cfn-nag/custom_rules/SecretsManagerSecretKmsKeyIdRule.rb

@@ -5,15 +5,16 @@ require_relative 'boolean_base_rule'
 
 class SecretsManagerSecretKmsKeyIdRule < BooleanBaseRule
   def rule_text
-    'Secrets Manager Secret should explicitly specify KmsKeyId'
+    'Secrets Manager Secret should explicitly specify KmsKeyId.' \
+    ' Besides control of the key this will allow the secret to be shared cross-account'
   end
 
   def rule_type
-    Violation::FAILING_VIOLATION
+    Violation::WARNING
   end
 
   def rule_id
-    'F81'
+    'W77'
   end
 
   def resource_type

data/lib/cfn-nag/iam_complexity_metric/condition_metric.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require_relative 'weights'
+require 'set'
+
+class ConditionMetric
+  include Weights
+
+  # rubocop:disable Metrics/AbcSize
+  def metric(statement)
+    return 0 if statement.condition.nil?
+
+    aggregate = 0
+    aggregate += statement.condition.size * weights[:Condition]
+    aggregate += confusing_value_operators(statement.condition)
+    aggregate += if_exists_operators(statement.condition)
+    aggregate += weights[:Null] if null_operator?(statement.condition)
+    aggregate += values_with_policy_tags(statement.condition)
+    aggregate
+  end
+  # rubocop:enable Metrics/AbcSize
+
+  private
+
+  def values_with_policy_tags(conditions)
+    all_values(conditions).reduce(0) do |aggregate, value|
+      aggregate + (contains_policy_tag?(value) ? weights[:PolicyVariables] : 0)
+    end
+  end
+
+  def contains_policy_tag?(value)
+    strip_special_characters(value).match(/.*\$\{.+\}.*/)
+  end
+
+  def strip_special_characters(value)
+    special_characters.each do |special_character|
+      value = value.gsub("${#{special_character}}", '')
+    end
+    value
+  end
+
+  def all_values(conditions)
+    result = []
+    conditions.each do |_, expression|
+      expression.each do |_, value|
+        if value.is_a? String
+          result << value
+        elsif value.is_a? Array
+          result += value
+        end
+      end
+    end
+    result
+  end
+
+  def special_characters
+    %w[$ * ?]
+  end
+
+  def null_operator?(conditions)
+    conditions.find { |operator, _| operator == 'Null' }
+  end
+
+  def if_exists_operators(conditions)
+    conditions.reduce(0) do |aggregate, condition|
+      operator = condition[0]
+      aggregate + (if_exists_operator?(operator) ? weights[:IfExists] : 0)
+    end
+  end
+
+  def if_exists_operator?(operator)
+    operator.end_with? 'IfExists'
+  end
+
+  def confusing_value_operators(conditions)
+    conditions.reduce(0) do |aggregate, condition|
+      operator = condition[0]
+      aggregate + (confusing_value_operator?(operator) ? weights[:Condition] : 0)
+    end
+  end
+
+  def confusing_value_operator?(operator)
+    %w[ForAllValues ForAnyValues].find { |prefix| operator.start_with? prefix }
+  end
+end

data/lib/cfn-nag/iam_complexity_metric/html_results_renderer.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+class HtmlRenderer
+  def render(results:)
+    output = '<html><body><table>'
+    results.each do |result|
+      output += '<tr><td><table><tr><td>'
+      output += result[:filename]
+      output += '</td></tr><tr><td>'
+      output += render_policy(result)
+      output += render_role(result)
+      output += '</td></tr></table></td></tr>'
+    end
+    output += '</table></body></html>'
+    output
+  end
+
+  private
+
+  def render_policy(result)
+    output = ''
+    if result[:file_results]['AWS::IAM::Policy'] != {}
+      output += '<ul>'
+      result[:file_results]['AWS::IAM::Policy'].each do |k, v|
+        output += "<li>#{k}=#{v}</li>"
+      end
+      output += '</ul>'
+    end
+    output
+  end
+
+  def render_role(result)
+    output = ''
+    if result[:file_results]['AWS::IAM::Role'] != {}
+      output += '<ul>'
+      result[:file_results]['AWS::IAM::Role'].each do |role_id, policy_map|
+        policy_map.each do |policy_name, metric|
+          output += "<li>#{role_id}/#{policy_name}=#{metric}</li>"
+        end
+      end
+      output += '</ul>'
+    end
+    output
+  end
+end

data/lib/cfn-nag/iam_complexity_metric/policy_document_metric.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require_relative 'statement_metric'
+
+class PolicyDocumentMetric
+  def metric(policy_document)
+    policy_document.statements.reduce(0) do |aggregate, statement|
+      aggregate + StatementMetric.new.metric(statement)
+    end
+  end
+end

data/lib/cfn-nag/iam_complexity_metric/spcm.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require 'cfn-nag/template_discovery'
+require 'cfn-model'
+require_relative 'policy_document_metric'
+
+class SPCM
+  DEFAULT_TEMPLATE_PATTERN = '..*\.json$|..*\.yaml$|..*\.yml$|..*\.template$'
+
+  def aggregate_metrics(input_path:,
+                        parameter_values_path: nil,
+                        condition_values_path: nil,
+                        template_pattern: DEFAULT_TEMPLATE_PATTERN)
+    parameter_values_string = parameter_values_path.nil? ? nil : IO.read(parameter_values_path)
+    condition_values_string = condition_values_path.nil? ? nil : IO.read(condition_values_path)
+
+    templates = TemplateDiscovery.new.discover_templates(input_json_path: input_path,
+                                                         template_pattern: template_pattern)
+    aggregate_results = []
+    templates.each do |template|
+      aggregate_results << {
+        filename: template,
+        file_results: metric(
+          cloudformation_string: IO.read(template),
+          parameter_values_string: parameter_values_string,
+          condition_values_string: condition_values_string
+        )
+      }
+    end
+    aggregate_results
+  end
+
+  def metric(cloudformation_string:, parameter_values_string: nil, condition_values_string: nil)
+    cfn_model = CfnParser.new.parse cloudformation_string,
+                                    parameter_values_string,
+                                    false,
+                                    condition_values_string
+
+    metric_impl(cfn_model)
+  end
+
+  def metric_impl(cfn_model)
+    policy_documents = {
+      'AWS::IAM::Policy' => {},
+      'AWS::IAM::Role' => {}
+    }
+
+    cfn_model.resources_by_type('AWS::IAM::Policy').each do |policy|
+      update_policy_metric(policy_documents, policy)
+    end
+
+    cfn_model.resources_by_type('AWS::IAM::Role').each do |role|
+      role.policy_objects.each do |policy|
+        update_role_policy_metric(policy_documents, role, policy)
+      end
+    end
+
+    policy_documents
+  end
+
+  private
+
+  def update_policy_metric(policy_documents, policy)
+    metric = PolicyDocumentMetric.new.metric(policy.policy_document)
+    policy_documents['AWS::IAM::Policy'][policy.logical_resource_id] = metric
+  end
+
+  def update_role_policy_metric(policy_documents, role, policy)
+    metric = PolicyDocumentMetric.new.metric(policy.policy_document)
+
+    if policy_documents['AWS::IAM::Role'][role.logical_resource_id]
+      policy_documents['AWS::IAM::Role'][role.logical_resource_id][policy.policy_name.to_s] = metric
+    else
+      policy_documents['AWS::IAM::Role'][role.logical_resource_id] = {
+        policy.policy_name.to_s => metric
+      }
+    end
+  end
+end

data/lib/cfn-nag/iam_complexity_metric/statement_metric.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative 'weights'
+require_relative 'condition_metric'
+require 'set'
+
+class StatementMetric
+  include Weights
+
+  # rubocop:disable Metrics/AbcSize
+  def metric(statement)
+    aggregate = weights[:Base_Statement]
+
+    aggregate += effect_metrics(statement)
+    aggregate += inversion_metrics(statement)
+    aggregate += extra_service_count(statement) * weights[:Extra_Service]
+    aggregate += misaligned_resource_action_count(statement) * weights[:Resource_Action_NotAligned]
+    aggregate += mixed_wildcard(statement) * weights[:Mixed_Wildcard]
+
+    aggregate += ConditionMetric.new.metric(statement) unless statement.condition.nil?
+
+    aggregate
+  end
+  # rubocop:enable Metrics/AbcSize
+
+  private
+
+  def effect_metrics(statement)
+    aggregate = 0
+    aggregate += weights[:Deny] if statement.effect == 'Deny'
+    aggregate += weights[:Allow] if statement.effect == 'Allow'
+    aggregate
+  end
+
+  def inversion_metrics(statement)
+    aggregate = 0
+    aggregate += weights[:NotAction] unless statement.not_actions.empty?
+    aggregate += weights[:NotResource] unless statement.not_resources.empty?
+    aggregate
+  end
+
+  def mixed_wildcard(statement)
+    count = 0
+    count += 1 if action_service_names(statement).include?('*') && action_service_names(statement).size > 1
+    count += 1 if resource_service_names(statement).include?('*') && resource_service_names(statement).size > 1
+    count
+  end
+
+  def misaligned_resource_action_count(statement)
+    return 0 if resource(statement) == ['*'] || action(statement) == ['*']
+
+    resource_service_names = resource(statement).map { |resource_arn| resource_service_name(resource_arn) }
+    action_service_names = action(statement).map { |action| action_service_name(action) }
+
+    (set_without_wildcard(resource_service_names) - set_without_wildcard(action_service_names)).size
+  end
+
+  # rubocop:disable Naming/AccessorMethodName
+  def set_without_wildcard(array)
+    Set.new(array).delete('*')
+  end
+  # rubocop:enable Naming/AccessorMethodName
+
+  def extra_service_count(statement)
+    service_names = Set.new(action_service_names(statement) + resource_service_names(statement)).delete('*')
+    [service_names.size - 1, 0].max
+  end
+
+  def action_service_names(statement)
+    action(statement).map { |action| action_service_name(action) }
+  end
+
+  def resource_service_names(statement)
+    resource(statement).map { |resource_arn| resource_service_name(resource_arn) }
+  end
+
+  def action_service_name(action)
+    return '*' if action == '*'
+
+    return action unless action.is_a?(String)
+
+    action.split(':')[0]
+  end
+
+  def resource_service_name(resource_arn)
+    return '*' if resource_arn == '*'
+
+    return resource_arn unless resource_arn.is_a?(String)
+
+    resource_arn.split(':')[2]
+  end
+
+  def action(statement)
+    return statement.actions unless statement.actions.empty?
+
+    statement.not_actions
+  end
+
+  def resource(statement)
+    return statement.resources unless statement.resources.empty?
+
+    statement.not_resources
+  end
+end

data/lib/cfn-nag/iam_complexity_metric/weights.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Weights
+  def weights
+    {
+      Base_Statement: 1,
+      Allow: 0,
+      Deny: 1,
+      NotAction: 1,
+      NotResource: 1,
+      Mixed_Wildcard: 1,
+
+      Extra_Service: 2,
+      Resource_Action_NotAligned: 1,
+
+      Condition: 2,
+      IfExists: 1,
+      Null: 1,
+      PolicyVariables: 1
+    }
+  end
+end

data/lib/cfn-nag/metadata.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require 'cfn-model'
+
+##
+# Mix-in with metadata handling routines for the CustomRuleLoader
+module Metadata
+  # XXX given mangled_metadatas is never used or returned,
+  # STDERR emit can be moved to unless block
+  def validate_cfn_nag_metadata(cfn_model)
+    mangled_metadatas = collect_mangled_metadata(cfn_model)
+    mangled_metadatas.each do |mangled_metadata|
+      logical_resource_id = mangled_metadata.first
+      mangled_rules = mangled_metadata[1]
+
+      STDERR.puts "#{logical_resource_id} has missing cfn_nag suppression rule id: #{mangled_rules}"
+    end
+  end
+
+  def cfn_model_with_suppressed_resources_removed(cfn_model:,
+                                                  rule_id:,
+                                                  allow_suppression:,
+                                                  print_suppression:)
+    return cfn_model unless allow_suppression
+
+    cfn_model = cfn_model.copy
+
+    cfn_model.resources.delete_if do |logical_resource_id, resource|
+      rules_to_suppress = rules_to_suppress resource
+      if rules_to_suppress.nil?
+        false
+      else
+        suppress_resource?(rules_to_suppress, rule_id, logical_resource_id, print_suppression)
+      end
+    end
+    cfn_model
+  end
+
+  private
+
+  def suppress_resource?(rules_to_suppress, rule_id, logical_resource_id, print_suppression)
+    found_suppression_rule = rules_to_suppress.find do |rule_to_suppress|
+      next if rule_to_suppress['id'].nil?
+
+      rule_to_suppress['id'] == rule_id
+    end
+    if found_suppression_rule && print_suppression
+      message = "Suppressing #{rule_id} on #{logical_resource_id} for reason: #{found_suppression_rule['reason']}"
+      STDERR.puts message
+    end
+    !found_suppression_rule.nil?
+  end
+
+  def rules_to_suppress(resource)
+    if resource.metadata &&
+       resource.metadata['cfn_nag'] &&
+       resource.metadata['cfn_nag']['rules_to_suppress']
+
+      resource.metadata['cfn_nag']['rules_to_suppress']
+    end
+  end
+
+  def collect_mangled_metadata(cfn_model)
+    mangled_metadatas = []
+    cfn_model.resources.each do |logical_resource_id, resource|
+      resource_rules_to_suppress = rules_to_suppress resource
+      next if resource_rules_to_suppress.nil?
+
+      mangled_rules = resource_rules_to_suppress.select do |rule_to_suppress|
+        rule_to_suppress['id'].nil?
+      end
+      unless mangled_rules.empty?
+        mangled_metadatas << [logical_resource_id, mangled_rules]
+      end
+    end
+    mangled_metadatas
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-nag
 version: !ruby/object:Gem::Version
-  version: 0.5.61
+  version: 0.6.0
 platform: ruby
 authors:
 - Eric Kascic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-06 00:00:00.000000000 Z
+date: 2020-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -156,12 +156,14 @@ executables:
 - cfn_nag
 - cfn_nag_rules
 - cfn_nag_scan
+- spcm_scan
 extensions: []
 extra_rdoc_files: []
 files:
 - bin/cfn_nag
 - bin/cfn_nag_rules
 - bin/cfn_nag_scan
+- bin/spcm_scan
 - lib/cfn-nag.rb
 - lib/cfn-nag/base_rule.rb
 - lib/cfn-nag/blacklist_loader.rb
@@ -295,6 +297,7 @@ files:
 - lib/cfn-nag/custom_rules/S3BucketPolicyWildcardPrincipalRule.rb
 - lib/cfn-nag/custom_rules/S3BucketPublicReadAclRule.rb
 - lib/cfn-nag/custom_rules/S3BucketPublicReadWriteAclRule.rb
+- lib/cfn-nag/custom_rules/SPCMRule.rb
 - lib/cfn-nag/custom_rules/SageMakerEndpointConfigKmsKeyIdRule.rb
 - lib/cfn-nag/custom_rules/SageMakerNotebookInstanceKmsKeyIdRule.rb
 - lib/cfn-nag/custom_rules/SecretsManagerSecretKmsKeyIdRule.rb
@@ -327,7 +330,14 @@ files:
 - lib/cfn-nag/custom_rules/password_base_rule.rb
 - lib/cfn-nag/custom_rules/resource_base_rule.rb
 - lib/cfn-nag/custom_rules/sub_property_with_list_password_base_rule.rb
+- lib/cfn-nag/iam_complexity_metric/condition_metric.rb
+- lib/cfn-nag/iam_complexity_metric/html_results_renderer.rb
+- lib/cfn-nag/iam_complexity_metric/policy_document_metric.rb
+- lib/cfn-nag/iam_complexity_metric/spcm.rb
+- lib/cfn-nag/iam_complexity_metric/statement_metric.rb
+- lib/cfn-nag/iam_complexity_metric/weights.rb
 - lib/cfn-nag/ip_addr.rb
+- lib/cfn-nag/metadata.rb
 - lib/cfn-nag/profile_loader.rb
 - lib/cfn-nag/result_view/colored_stdout_results.rb
 - lib/cfn-nag/result_view/json_results.rb