[Enhancement] Regular expression inside json about cloudformation-guard HOT 5 CLOSED

With Guard 2.0 you can select keys for a map that match a regular expression. The above rule in 2.0 is as follows

AWS::IAM::Role Properties {
    Policies.*.PolicyDocument.Statement.*.Resource[ KEYS == /.+Sub/ ].* == "arn:aws:acm-pca:${AWS::Region}:${AWS::AccountId}:certificate-authority/as"
}

It would work for example given. However, it isn't correct as written. For AWS::IAM::Role the Resource attribute is multi-valued or in other words is an array of values. It is possible to have any of the following specified in a CFN template

"Resource": [
  {
      "Fn::Sub": "arn:aws:acm-pca:${AWS::Region}:${AWS::AccountId}:certificate-authority/as"
  },
  "aws:arn...."
]

or

"Resource": "aws:arn...."

or

"Resource": ["aws:arn...", "aws:arn"]

Here you are only interested in targeting those that contain a Fn::Sub reference. Here is the way to specify this in Guard 2.0

AWS::IAM::Role Properties {
    # 
    #  Select all Resource elements that have 'Fn::Sub'
    # 
    let resources = Policies.*.PolicyDocument.Statement.*.Resource[ 'Fn::Sub' EXISTS ]
    when %resources !EMPTY {
        %resources.* == "arn:aws:acm-pca:${AWS::Region}:${AWS::AccountId}:certificate-authority/as"
    }
}

How do we know if the rule really worked? You can unit test this rule with Guard 2.0. Here is a sample test suite

- input:
    Resources:
      role:
          Type: AWS::IAM::Role
          Properties: 
             Policies:
                 - PolicyDocument:
                     Statement:
                         - Resource: "aws:arn"
  expectations:
    rules:
        default: SKIP
- input:
    Resources:
      role:
          Type: AWS::IAM::Role
          Properties: 
             Policies:
                 - PolicyDocument:
                     Statement:
                         - Resource:
                             "Fn::Sub": "arn:aws:acm-pca:${AWS::Region}:${AWS::AccountId}:certificate-authority/as"
  expectations:
    rules:
        default: PASS
- input:
    Resources:
      role:
          Type: AWS::IAM::Role
          Properties: 
             Policies:
                 - PolicyDocument:
                     Statement:
                         - Resource:
                             - "Fn::Sub": "fail"
                             - "*"
  expectations:
    rules:
        default: FAIL
- input:
    Resources:
      role:
          Type: AWS::IAM::Role
          Properties: 
             Policies:
                 - PolicyDocument:
                     Statement:
                         - Resource:
                             - "aws:arn"
                             - "*"
  expectations:
    rules:
        default: SKIP

We are internally tracking a feature where this expression would simplify to

AWS::IAM::Role Properties {
    Policies.*.PolicyDocument.Statement.*.Resource[ 'Fn::Sub' EXISTS ].* ==  "arn:aws:acm-pca:${AWS::Region}:${AWS::AccountId}:certificate-authority/as"   
}

where it SKIPs the results if there are no such Resources present. For now, we need to use the when !EMPTY condition check.

from cloudformation-guard.

+1 Regex support will be great for complicated conditions

from cloudformation-guard.

We are providing enhanced property access feature in the next release of the tooling, as detailed in #115. We hope to encourage users to do these checks using the KEYS operator to avoid using regular expression inside of json. So instead of

AWS::IAM::Role Policies.*.PolicyDocument.Statement.*.Resource == {/.+Sub/: "arn:aws:acm-pca:${AWS::Region}:${AWS::AccountId}:certificate-authority/as"}

one could write in the new version of the rules language

AWS::IAM::Role Policies.*.PolicyDocument.Statement.*.Resource KEYS == /.+Sub/
AWS::IAM::Role Policies.*.PolicyDocument.Statement.*.Resource.* ==  "arn:aws:acm-pca:${AWS::Region}:${AWS::AccountId}:certificate-authority/as"
}

As of now, we have no plan to support regular expression for json keys as listed above.

from cloudformation-guard.

Attaching samples with tests
policies-examples.zip

from cloudformation-guard.

Resolving, please re-open if you needed any more support on this. thank you

from cloudformation-guard.