This repository has been archived by the owner on Jun 1, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Owen Rumney
authored
Dec 2, 2021
1 parent
0452c71
commit c6f5ba7
Showing
22 changed files
with
638 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/parser" | ||
| "github.com/aquasecurity/defsec/provider/aws/sam" | ||
| "github.com/aquasecurity/defsec/types" | ||
| ) | ||
|
|
||
| func getApis(cfFile parser.FileContext) (apis []sam.API) { | ||
|
|
||
| apiResources := cfFile.GetResourceByType("AWS::Serverless::Api") | ||
| for _, r := range apiResources { | ||
| api := sam.API{ | ||
| Metadata: r.Metadata(), | ||
| Name: r.GetStringProperty("Name", ""), | ||
| TracingEnabled: r.GetBoolProperty("TracingEnabled"), | ||
| DomainConfiguration: getDomainConfiguration(r), | ||
| AccessLogging: getAccessLogging(r), | ||
| RESTMethodSettings: getRestMethodSettings(r), | ||
| } | ||
|
|
||
| apis = append(apis, api) | ||
| } | ||
|
|
||
| return apis | ||
| } | ||
|
|
||
| func getRestMethodSettings(r *parser.Resource) (methodSettings sam.RESTMethodSettings) { | ||
|
|
||
| settings := r.GetProperty("MethodSettings") | ||
| if settings.IsNil() { | ||
| return sam.RESTMethodSettings{ | ||
| Metadata: r.Metadata(), | ||
| CacheDataEncrypted: types.BoolDefault(false, r.Metadata()), | ||
| LoggingEnabled: types.BoolDefault(false, r.Metadata()), | ||
| DataTraceEnabled: types.BoolDefault(false, r.Metadata()), | ||
| MetricsEnabled: types.BoolDefault(false, r.Metadata()), | ||
| } | ||
| } | ||
|
|
||
| loggingEnabled := types.BoolDefault(false, settings.Metadata()) | ||
| if settings.GetProperty("LoggingLevel").IsNotNil() { | ||
| loggingLevel := settings.GetProperty("LoggingLevel") | ||
| if settings.GetProperty("LoggingLevel").EqualTo("OFF", parser.IgnoreCase) { | ||
| loggingEnabled = types.BoolExplicit(false, loggingLevel.Metadata()) | ||
| } else { | ||
| loggingEnabled = types.BoolExplicit(true, loggingLevel.Metadata()) | ||
| } | ||
|
|
||
| } | ||
|
|
||
| return sam.RESTMethodSettings{ | ||
| Metadata: settings.Metadata(), | ||
| CacheDataEncrypted: settings.GetBoolProperty("CacheDataEncrypted"), | ||
| LoggingEnabled: loggingEnabled, | ||
| DataTraceEnabled: settings.GetBoolProperty("DataTraceEnabled"), | ||
| MetricsEnabled: settings.GetBoolProperty("MetricsEnabled"), | ||
| } | ||
|
|
||
| } | ||
|
|
||
| func getAccessLogging(r *parser.Resource) (accessLogging sam.AccessLogging) { | ||
|
|
||
| access := r.GetProperty("AccessLogSetting") | ||
| if access.IsNil() { | ||
| return sam.AccessLogging{ | ||
| Metadata: r.Metadata(), | ||
| CloudwatchLogGroupARN: types.StringDefault("", r.Metadata()), | ||
| } | ||
| } | ||
|
|
||
| return sam.AccessLogging{ | ||
| Metadata: access.Metadata(), | ||
| CloudwatchLogGroupARN: access.GetStringProperty("DestinationArn", ""), | ||
| } | ||
| } | ||
|
|
||
| func getDomainConfiguration(r *parser.Resource) (domainConfig sam.DomainConfiguration) { | ||
|
|
||
| domain := r.GetProperty("Domain") | ||
| if domain.IsNil() { | ||
| domainConfig.SecurityPolicy = types.StringDefault("TLS_1_0", r.Metadata()) | ||
| return domainConfig | ||
| } | ||
|
|
||
| return sam.DomainConfiguration{ | ||
| Metadata: domain.Metadata(), | ||
| Name: domain.GetStringProperty("DomainName", ""), | ||
| SecurityPolicy: domain.GetStringProperty("SecurityPolicy", "TLS_1_0"), | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "reflect" | ||
|
|
||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/debug" | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/parser" | ||
| "github.com/aquasecurity/defsec/provider/aws/sam" | ||
| ) | ||
|
|
||
| // Adapt ... | ||
| func Adapt(cfFile parser.FileContext) (sam sam.SAM) { | ||
| defer func() { | ||
| if r := recover(); r != nil { | ||
| metadata := cfFile.Metadata() | ||
| debug.Log("There were errors adapting %s from %s", reflect.TypeOf(sam), metadata.Range().GetFilename()) | ||
| } | ||
| }() | ||
|
|
||
| sam.APIs = getApis(cfFile) | ||
| return sam | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
47 changes: 47 additions & 0 deletions
47
internal/app/cfsec/rules/aws/sam/enable_access_logging_rule.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/rules" | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/scanner" | ||
| "github.com/aquasecurity/defsec/rules/aws/sam" | ||
| ) | ||
|
|
||
| func init() { | ||
| scanner.RegisterCheckRule(rules.Rule{ | ||
|
|
||
| BadExample: []string{ | ||
| `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Bad Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Bad SAM API example | ||
| StageName: Prod | ||
| TracingEnabled: false | ||
| `, | ||
| }, | ||
|
|
||
| GoodExample: []string{ | ||
| `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Good Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Good SAM API example | ||
| StageName: Prod | ||
| TracingEnabled: false | ||
| Domain: | ||
| SecurityPolicy: TLS_1_2 | ||
| AccessLogSetting: | ||
| DestinationArn: gateway-logging | ||
| Format: json | ||
| `, | ||
| }, | ||
|
|
||
| Base: sam.CheckEnableAccessLogging, | ||
| }) | ||
| } |
18 changes: 18 additions & 0 deletions
18
internal/app/cfsec/rules/aws/sam/enable_access_logging_rule_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/test" | ||
| "github.com/aquasecurity/defsec/rules/aws/sam" | ||
|
|
||
| "testing" | ||
| ) | ||
|
|
||
| func Test_CheckEnableAccessLogging_FailureExamples(t *testing.T) { | ||
| expectedCode := sam.CheckEnableAccessLogging.Rule().LongID() | ||
| test.RunFailureExamplesTest(t, expectedCode) | ||
| } | ||
|
|
||
| func Test_CheckEnableAccessLogging_PassedExamples(t *testing.T) { | ||
| expectedCode := sam.CheckEnableAccessLogging.Rule().LongID() | ||
| test.RunPassingExamplesTest(t, expectedCode) | ||
| } |
58 changes: 58 additions & 0 deletions
58
internal/app/cfsec/rules/aws/sam/enable_cache_encryption_rule.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/rules" | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/scanner" | ||
| "github.com/aquasecurity/defsec/rules/aws/sam" | ||
| ) | ||
|
|
||
| func init() { | ||
| scanner.RegisterCheckRule(rules.Rule{ | ||
|
|
||
| BadExample: []string{ | ||
| `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Bad Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Bad SAM API example | ||
| StageName: Prod | ||
| TracingEnabled: false | ||
| `, `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Bad Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Bad SAM API example | ||
| StageName: Prod | ||
| TracingEnabled: false | ||
| MethodSettings: | ||
| CacheDataEncrypted: false | ||
| `, | ||
| }, | ||
|
|
||
| GoodExample: []string{ | ||
| `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Good Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Good SAM API example | ||
| StageName: Prod | ||
| TracingEnabled: false | ||
| Domain: | ||
| SecurityPolicy: TLS_1_2 | ||
| MethodSettings: | ||
| CacheDataEncrypted: true | ||
| `, | ||
| }, | ||
|
|
||
| Base: sam.CheckEnableCacheEncryption, | ||
| }) | ||
| } |
18 changes: 18 additions & 0 deletions
18
internal/app/cfsec/rules/aws/sam/enable_cache_encryption_rule_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/test" | ||
| sam "github.com/aquasecurity/defsec/rules/aws/sam" | ||
|
|
||
| "testing" | ||
| ) | ||
|
|
||
| func Test_CheckEnableCacheEncryption_FailureExamples(t *testing.T) { | ||
| expectedCode := sam.CheckEnableCacheEncryption.Rule().LongID() | ||
| test.RunFailureExamplesTest(t, expectedCode) | ||
| } | ||
|
|
||
| func Test_CheckEnableCacheEncryption_PassedExamples(t *testing.T) { | ||
| expectedCode := sam.CheckEnableCacheEncryption.Rule().LongID() | ||
| test.RunPassingExamplesTest(t, expectedCode) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/rules" | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/scanner" | ||
| "github.com/aquasecurity/defsec/rules/aws/sam" | ||
| ) | ||
|
|
||
| func init() { | ||
| scanner.RegisterCheckRule(rules.Rule{ | ||
|
|
||
| BadExample: []string{ | ||
| `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Bad Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Bad SAM API example | ||
| StageName: Prod | ||
| TracingEnabled: false | ||
| `, `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Bad Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Bad SAM API example | ||
| StageName: Prod | ||
| `, | ||
| }, | ||
|
|
||
| GoodExample: []string{ | ||
| `--- | ||
| AWSTemplateFormatVersion: 2010-09-09 | ||
| Description: Good Example of SAM API | ||
| Resources: | ||
| ApiGatewayApi: | ||
| Type: AWS::Serverless::Api | ||
| Properties: | ||
| Name: Good SAM API example | ||
| StageName: Prod | ||
| TracingEnabled: true | ||
| `, | ||
| }, | ||
|
|
||
| Base: sam.CheckEnableTracing, | ||
| }) | ||
| } |
18 changes: 18 additions & 0 deletions
18
internal/app/cfsec/rules/aws/sam/enable_tracing_rule_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| package sam | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/cfsec/internal/app/cfsec/test" | ||
| sam "github.com/aquasecurity/defsec/rules/aws/sam" | ||
|
|
||
| "testing" | ||
| ) | ||
|
|
||
| func Test_CheckEnableTracing_FailureExamples(t *testing.T) { | ||
| expectedCode := sam.CheckEnableTracing.Rule().LongID() | ||
| test.RunFailureExamplesTest(t, expectedCode) | ||
| } | ||
|
|
||
| func Test_CheckEnableTracing_PassedExamples(t *testing.T) { | ||
| expectedCode := sam.CheckEnableTracing.Rule().LongID() | ||
| test.RunPassingExamplesTest(t, expectedCode) | ||
| } |
Oops, something went wrong.