Class: CfnNag

Inherits:
Object
  • Object
show all
Includes:
ViolationFiltering
Defined in:
lib/cfn-nag/cfn_nag.rb

Overview

Top-level CfnNag class for running profiles

Instance Method Summary collapse

Methods included from ViolationFiltering

#filter_violations_by_blacklist, #filter_violations_by_profile

Constructor Details

#initialize(profile_definition: nil, blacklist_definition: nil, rule_directory: nil, allow_suppression: true, print_suppression: false, isolate_custom_rule_exceptions: false) ⇒ CfnNag

rubocop:disable Metrics/ParameterLists



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 
# File 'lib/cfn-nag/cfn_nag.rb', line 16

def initialize(profile_definition: nil,
               blacklist_definition: nil,
               rule_directory: nil,
               allow_suppression: true,
               print_suppression: false,
               isolate_custom_rule_exceptions: false)
  @rule_directory = rule_directory
  @custom_rule_loader = CustomRuleLoader.new(
    rule_directory: rule_directory,
    allow_suppression: allow_suppression,
    print_suppression: print_suppression,
    isolate_custom_rule_exceptions: isolate_custom_rule_exceptions
  )
  @profile_definition = profile_definition
  @blacklist_definition = blacklist_definition
end

Instance Method Details

#audit(cloudformation_string:, parameter_values_string: nil) ⇒ Object

Given cloudformation json/yml, run all the rules against it

Optionally include JSON with Parameters key to substitute into cfn_model.parameters

Return a hash with failure count



83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'lib/cfn-nag/cfn_nag.rb', line 83

def audit(cloudformation_string:, parameter_values_string: nil)
  violations = []

  begin
    cfn_model = CfnParser.new.parse cloudformation_string,
                                    parameter_values_string,
                                    true
    violations += @custom_rule_loader.execute_custom_rules(cfn_model)

    violations = filter_violations_by_blacklist_and_profile(violations)
    violations = mark_line_numbers(violations, cfn_model)
  rescue Psych::SyntaxError, ParserError => parser_error
    violations << fatal_violation(parser_error.to_s)
  rescue JSON::ParserError => json_parameters_error
    error = "JSON Parameter values parse error: #{json_parameters_error}"
    violations << fatal_violation(error)
  end

  audit_result(violations)
end

#audit_aggregate_across_files(input_path:, parameter_values_path: nil, template_pattern: '..*\.json|..*\.yaml|..*\.yml|..*\.template') ⇒ Object

Given a file or directory path, return aggregate results



58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/cfn-nag/cfn_nag.rb', line 58

def audit_aggregate_across_files(input_path:,
                                 parameter_values_path: nil,
                                 template_pattern: '..*\.json|..*\.yaml|..*\.yml|..*\.template')
  parameter_values_string = parameter_values_path.nil? ? nil : IO.read(parameter_values_path)
  templates = TemplateDiscovery.new.discover_templates(input_json_path: input_path,
                                                       template_pattern: template_pattern)
  aggregate_results = []
  templates.each do |template|
    aggregate_results << {
      filename: template,
      file_results: audit(cloudformation_string: IO.read(template),
                          parameter_values_string: parameter_values_string)
    }
  end
  aggregate_results
end

#audit_aggregate_across_files_and_render_results(input_path:, output_format: 'txt', parameter_values_path: nil, template_pattern: '..*\.json|..*\.yaml|..*\.yml|..*\.template') ⇒ Object

Given a file or directory path, emit aggregate results to stdout

Return an aggregate failure count (for exit code usage)



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
# File 'lib/cfn-nag/cfn_nag.rb', line 39

def audit_aggregate_across_files_and_render_results(input_path:,
                                                    output_format: 'txt',
                                                    parameter_values_path: nil,
                                                    template_pattern: '..*\.json|..*\.yaml|..*\.yml|..*\.template')
  aggregate_results = audit_aggregate_across_files input_path: input_path,
                                                   parameter_values_path: parameter_values_path,
                                                   template_pattern: template_pattern

  render_results(aggregate_results: aggregate_results,
                 output_format: output_format)

  aggregate_results.inject(0) do |total_failure_count, results|
    total_failure_count + results[:file_results][:failure_count]
  end
end