Comments (2)
Hey @Aaron-Garrett I think i was able to come up with a rule to help you with this specific use case. I think one issue with the logic in your original rule was to do with the way if intrinsic functions is mapped to their json equivalent..
In this case your first if
function maps to this in json format
{
"Fn::If": [
"CreateDevRole",
{
"Fn::Sub": "arn:aws:iam::${AWS::AccountId}:policy/aws-allowed-policies"
},
{
"Ref": "AWS::NoValue"
}
]
}
It's important to note here when evaluating this mapped if
function that youre comparing a value (in this case a list where some elements are strings, some elements are maps/structs) to an array of regex. This will always pass in this case due to the contents of the list.
Heres the rule, i have added some comments to help clear things up
let aws_iam_entities_no_managed_policy = Resources.*[
Type in [ /AWS::IAM::User/,
/AWS::IAM::Role/,
/AWS::IAM::Group/ ]
Metadata.guard.SuppressedRules not exists or
Metadata.guard.SuppressedRules.* != "IAM_ONLY_ALLOW_ManagedPolicies"
]
let INVALID_VALUES = [/(?i)\/AWS/, /(?i)\/VMImportExportRoleForAWSConnector/]
rule IAM_ONLY_ALLOW_ManagedPolicies when %aws_iam_entities_no_managed_policy !empty {
let managed_policy_arns = %aws_iam_entities_no_managed_policy.Properties.ManagedPolicyArns
when %managed_policy_arns !empty {
check(%managed_policy_arns)
}
}
rule check(curr) {
# if is string, we can do direct comparison to the list of strings/regex
when %curr is_string {
%curr NOT IN %INVALID_VALUES
}
# if is_list or is_struct iterate and check each individual value
when %curr is_list OR %curr is_struct{
%curr.* {
check(this)
}
}
}
I hope this was helpful to you, please let me know if you have anymore questions.
from cloudformation-guard.
Hey @Aaron-Garrett just checking in to see if the information I provided was enough to help you resolve your issue here.
Please let us know if you need anymore help on this issue
from cloudformation-guard.
Related Issues (20)
- [BUG] Failed rule does not print details of the failure HOT 6
- [Enhancement] Add cspell action to check for spelling errors
- [Documentation] Update docs for all public facing functions, and structs
- [BUG] SAM CLI deployed lambda returns InvalidEntryPoint error HOT 3
- [Enhancement] Add support to retrieve the key of a given node HOT 1
- [BUG] '!=' does not work as expected even for same type while using 2 literals. HOT 2
- [Enhancement] Make variables mutable HOT 1
- [Enhancement] Support for CloudFormation Pseudo Parameters
- [GENERAL ISSUE] String concatenation with literal and variable HOT 2
- [BUG] OR is not working HOT 8
- [BUG] "true" does not equal true HOT 2
- Best practice for cfn-guard rules for CDK synthesized resources that are wrapped in a CustomResource, e.g. aws-eks.Cluster HOT 1
- [BUG] Problem with --show-summary HOT 2
- Question about specificity in wildcards. HOT 4
- [GENERAL ISSUE] cfn-guard and Terraform JSON output HOT 2
- [Enhancement] Introduce date-time and or parse_timestamp (to epoch) function (parser). HOT 1
- [BUG] cfn-guard-lambda breaks on parsing templates with `verbose: false` HOT 3
- Current tagging strategy does not work well with pre-commit autoupdate HOT 3
- [BUG] When using cfn-guard with pre-commit, repeated `--rules` are ignored HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cloudformation-guard.