diff --git a/.travis.yml b/.travis.yml index be6137961..c48d57e06 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,10 +1,7 @@ language: rust script: - - cd cfn-guard && cargo build --verbose --all && cargo test --verbose --all -script: - - cd cfn-guard-lambda && cargo build --verbose --all && cargo test --verbose --all -script: - - cd cfn-guard-rulegen && cargo build --verbose --all && cargo test --verbose --all -script: - - cd cfn-guard-rulegen-lambda && cargo build --verbose --all && cargo test --verbose --all \ No newline at end of file + - pushd cfn-guard && cargo build --verbose --all && cargo test --verbose --all; popd + - pushd cfn-guard-lambda && cargo build --verbose --all && cargo test --verbose --all; popd + - pushd cfn-guard-rulegen && cargo build --verbose --all && cargo test --verbose --all; popd + - pushd cfn-guard-rulegen-lambda && cargo build --verbose --all && cargo test --verbose --all; popd diff --git a/NOTICE b/NOTICE index 616fc5889..ba8da6855 100644 --- a/NOTICE +++ b/NOTICE @@ -1 +1,2 @@ +CloudFormation Guard Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. diff --git a/README.md b/README.md index 71e51ac59..0054aec61 100644 --- a/README.md +++ b/README.md @@ -2,9 +2,11 @@ This repo contains source code for the following tools: -* `CloudFormation Guard` A CLI tool that checks AWS CloudFormation templates for policy compliance using a simple, policy-as-code, declarative syntax -* `CloudFormation Guard Lambda` is the AWS Lambda version of `CloudFormation Guard` -* `CloudFormation Guard Rulegen` automatically generates CloudFormation Guard rules from existing CloudFormation templates +* `CloudFormation Guard` A CLI tool that + * Checks AWS CloudFormation templates for policy compliance using a simple, policy-as-code, declarative syntax + * Can autogenerate rules from existing CloudFormation templates +* `CloudFormation Guard Lambda` is the AWS Lambda version of CloudFormation Guard's `check` functionality +* `CloudFormation Guard Rulegen Lambda` is the AWS Lambda version of CloudFormation Guard's `rulegen` functionality ## How it works @@ -48,7 +50,7 @@ AWS::EC2::Volume Size <= 100 You can check the template to ensure that it adheres to the rules. ``` -$> cfn-guard -t Examples/ebs_volume_template.json -r Examples/ebs_volume_template.ruleset +$> cfn-guard check -t Examples/ebs_volume_template.json -r Examples/ebs_volume_template.ruleset [NewVolume2] failed because [Encrypted] is [false] and the permitted value is [true] [NewVolume] failed because [Encrypted] is [false] and the permitted value is [true] @@ -61,7 +63,7 @@ Number of failures: 3 CloudFormation Guard can be used to evaluate security best practices for infrastructure deployed via CloudFormation. A number of example rules are included: ``` -$> cfn-guard -t Examples/security_template.json -r Examples/security_rules.ruleset +$> cfn-guard check -t Examples/security_template.json -r Examples/security_rules.ruleset "[AmazonMQBroker] failed because [AutoMinorVersionUpgrade] is [false] and Version upgrades should be enabled to receive security updates" "[AmazonMQBroker] failed because [EncryptionOptions.UseAwsOwnedKey] is [true] and CMKs should be used instead of AWS-provided KMS keys" "[AmazonMQBroker] failed because [EngineVersion] is [5.15.9] and Broker engine version should be at least 5.15.10" @@ -71,12 +73,12 @@ $> cfn-guard -t Examples/security_template.json -r Examples/security_rules.rules More details on how to write rules and how the tool can work with build systems can be found [here](cfn-guard/README.md). ### Automatically Generating Rules -You can also use the `CloudFormation Guard Rulegen` tool to automatically generate rules from known-good CloudFormation templates. +You can also use the `CloudFormation Guard` tool to automatically generate rules from known-good CloudFormation templates. -Using the same template as above, `cfn-guard-rulegen` would produce: +Using the same template as above, `cfn-guard rulegen` would produce: ``` -$> cfn-guard-rulegen Examples/ebs_volume_template.json +$> cfn-guard rulegen Examples/ebs_volume_template.json AWS::EC2::Volume Encrypted == false AWS::EC2::Volume Size == 101 |OR| AWS::EC2::Volume Size == 99 AWS::EC2::Volume AvailabilityZone == us-west-2b |OR| AWS::EC2::Volume AvailabilityZone == us-west-2c @@ -84,9 +86,9 @@ AWS::EC2::Volume AvailabilityZone == us-west-2b |OR| AWS::EC2::Volume Availabili From there, you can pipe them into a file and add, edit or remove rules as you need. -### Checking templates using the Lambda +### Using the tool as an AWS Lambda -Everything that can be checked from the command-line version of the tool can be checked using [the Lambda version](./cfn-guard-lambda/README.md). +Everything that can be checked from the command-line version of the tool can be checked using [the Lambda version](./cfn-guard-lambda/README.md). The same is true for the [rulegen functionality](./cfn-guard-rulegen-lambda/README.md). ## Setting it up @@ -134,7 +136,7 @@ Details on how to build the tools and use them are available in each tool's READ [CloudFormation Guard Lambda](cfn-guard-lambda/README.md) -[CloudFormation Guard Rulegen](cfn-guard-rulegen/README.md) +[CloudFormation Guard Rulegen Lambda](cfn-guard-rulegen-lambda/README.md) ## Using the Makefile diff --git a/cfn-guard-lambda/Cargo.lock b/cfn-guard-lambda/Cargo.lock index 8f9091765..229056b28 100644 --- a/cfn-guard-lambda/Cargo.lock +++ b/cfn-guard-lambda/Cargo.lock @@ -27,6 +27,12 @@ dependencies = [ "winapi 0.3.8", ] +[[package]] +name = "ascii" +version = "0.9.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eab1c04a571841102f5345a8fc0f6bb3d31c315dec879b5c6e42e40ce7ffa34e" + [[package]] name = "atty" version = "0.2.14" @@ -80,6 +86,12 @@ dependencies = [ "iovec", ] +[[package]] +name = "cesu8" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c" + [[package]] name = "cfg-if" version = "0.1.10" @@ -88,9 +100,11 @@ checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822" [[package]] name = "cfn-guard" -version = "0.6.0" +version = "0.7.0" dependencies = [ + "cfn-guard-rulegen", "clap", + "jni", "lazy_static", "log", "regex", @@ -102,7 +116,7 @@ dependencies = [ [[package]] name = "cfn-guard-lambda" -version = "0.6.0" +version = "0.7.0" dependencies = [ "cfn-guard", "lambda_runtime", @@ -113,6 +127,18 @@ dependencies = [ "simple_logger", ] +[[package]] +name = "cfn-guard-rulegen" +version = "0.7.0" +dependencies = [ + "clap", + "log", + "serde", + "serde_json", + "serde_yaml", + "simple_logger", +] + [[package]] name = "chrono" version = "0.4.11" @@ -159,6 +185,19 @@ dependencies = [ "winapi 0.3.8", ] +[[package]] +name = "combine" +version = "3.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da3da6baa321ec19e1cc41d31bf599f00c783d0517095cdaf0332e3fe8d20680" +dependencies = [ + "ascii", + "byteorder", + "either", + "memchr", + "unreachable", +] + [[package]] name = "crossbeam-deque" version = "0.7.3" @@ -219,6 +258,16 @@ version = "1.5.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bb1f6b1ce1c140482ea30ddd3335fc0024ac7ee112895426e0a629a6c20adfe3" +[[package]] +name = "error-chain" +version = "0.12.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2d2f06b9cac1506ece98fe3231e3cc9c4410ec3d5b1f24ae1c8946f0742cdefc" +dependencies = [ + "backtrace", + "version_check", +] + [[package]] name = "failure" version = "0.1.8" @@ -395,6 +444,26 @@ version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b8b7a7c0c47db5545ed3fef7468ee7bb5b74691498139e4b3f6a20685dc6dd8e" +[[package]] +name = "jni" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1981310da491a4f0f815238097d0d43d8072732b5ae5f8bd0d8eadf5bf245402" +dependencies = [ + "cesu8", + "combine", + "error-chain", + "jni-sys", + "log", + "walkdir", +] + +[[package]] +name = "jni-sys" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" + [[package]] name = "kernel32-sys" version = "0.2.2" @@ -730,6 +799,15 @@ version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "71d301d4193d031abdd79ff7e3dd721168a9572ef3fe51a1517aba235bd8f86e" +[[package]] +name = "same-file" +version = "1.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502" +dependencies = [ + "winapi-util", +] + [[package]] name = "scopeguard" version = "1.1.0" @@ -1134,12 +1212,44 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "826e7639553986605ec5979c7dd957c7895e93eabed50ab2ffa7f6128a75097c" +[[package]] +name = "unreachable" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "382810877fe448991dfc7f0dd6e3ae5d58088fd0ea5e35189655f84e6814fa56" +dependencies = [ + "void", +] + [[package]] name = "vec_map" version = "0.8.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191" +[[package]] +name = "version_check" +version = "0.9.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b5a972e5669d67ba988ce3dc826706fb0a8b01471c088cb0b6110b805cc36aed" + +[[package]] +name = "void" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d" + +[[package]] +name = "walkdir" +version = "2.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "777182bc735b6424e1a57516d35ed72cb8019d85c8c9bf536dccb3445c1a2f7d" +dependencies = [ + "same-file", + "winapi 0.3.8", + "winapi-util", +] + [[package]] name = "want" version = "0.2.0" @@ -1179,6 +1289,15 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" +[[package]] +name = "winapi-util" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178" +dependencies = [ + "winapi 0.3.8", +] + [[package]] name = "winapi-x86_64-pc-windows-gnu" version = "0.4.0" diff --git a/cfn-guard-lambda/Cargo.toml b/cfn-guard-lambda/Cargo.toml index a9130376f..fc8863cf2 100644 --- a/cfn-guard-lambda/Cargo.toml +++ b/cfn-guard-lambda/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "cfn-guard-lambda" -version = "0.6.0" +version = "0.7.0" edition = "2018" [dependencies] diff --git a/cfn-guard-lambda/Makefile b/cfn-guard-lambda/Makefile index 455b19bdb..8ceb1d290 100644 --- a/cfn-guard-lambda/Makefile +++ b/cfn-guard-lambda/Makefile @@ -5,7 +5,7 @@ project_name = cfn-guard-lambda role_arn := ${CFN_GUARD_LAMBDA_ROLE_ARN} request_payload_fail = '{ "template": "{\n \"Resources\": {\n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}",\ "ruleSet": "let require_encryption = true\nlet disallowed_azs = [us-east-1a,us-east-1b,us-east-1c]\n\nAWS::EC2::Volume AvailabilityZone NOT_IN %disallowed_azs\nAWS::EC2::Volume Encrypted != %require_encryption\nAWS::EC2::Volume Size == 101 |OR| AWS::EC2::Volume Size == 99\nAWS::IAM::Role AssumeRolePolicyDocument.Version == 2012-10-18\nAWS::EC2::Volume Lorem == true\nAWS::EC2::Volume Encrypted == %ipsum\nAWS::EC2::Volume AvailabilityZone != /us-east-.*/",\ - "strict_checks": true}' + "strictChecks": true}' #====================================================================== # Request Payload Fail: @@ -49,7 +49,7 @@ request_payload_fail = '{ "template": "{\n \"Resources\": {\n \"NewVol request_payload_pass = '{ "template": "{\n \"Resources\": {\n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}",\ "ruleSet": "let require_encryption = true",\ - "strict_checks": true}' + "strictChecks": true}' #====================================================================== # Request Payload Pass @@ -83,7 +83,7 @@ request_payload_pass = '{ "template": "{\n \"Resources\": {\n \"NewVol request_payload_err = '{ "template": "{\n \"Resources\": \n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}",\ "ruleSet": "let require_encryption = true",\ - "strict_checks": true}' + "strictChecks": true}' #====================================================================== # Request Payload Fail diff --git a/cfn-guard-lambda/README.md b/cfn-guard-lambda/README.md index 42b3fdd32..82e082fab 100644 --- a/cfn-guard-lambda/README.md +++ b/cfn-guard-lambda/README.md @@ -74,7 +74,7 @@ aws lambda update-function-code --function-name cfn-guard-lambda --zip-file file "State": "Active", "LastUpdateStatus": "Successful" } -aws lambda invoke --function-name cfn-guard-lambda --payload '{ "template": "{\n \"Resources\": {\n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}", "ruleSet": "let require_encryption = true\nlet disallowed_azs = [us-east-1a,us-east-1b,us-east-1c]\n\nAWS::EC2::Volume AvailabilityZone NOT_IN %disallowed_azs\nAWS::EC2::Volume Encrypted != %require_encryption\nAWS::EC2::Volume Size == 101 |OR| AWS::EC2::Volume Size == 99\nAWS::IAM::Role AssumeRolePolicyDocument.Version == 2012-10-18\nAWS::EC2::Volume Lorem == true\nAWS::EC2::Volume Encrypted == %ipsum\nAWS::EC2::Volume AvailabilityZone != /us-east-.*/", "strict_checks": true}' output.json +aws lambda invoke --function-name cfn-guard-lambda --payload '{ "template": "{\n \"Resources\": {\n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}", "ruleSet": "let require_encryption = true\nlet disallowed_azs = [us-east-1a,us-east-1b,us-east-1c]\n\nAWS::EC2::Volume AvailabilityZone NOT_IN %disallowed_azs\nAWS::EC2::Volume Encrypted != %require_encryption\nAWS::EC2::Volume Size == 101 |OR| AWS::EC2::Volume Size == 99\nAWS::IAM::Role AssumeRolePolicyDocument.Version == 2012-10-18\nAWS::EC2::Volume Lorem == true\nAWS::EC2::Volume Encrypted == %ipsum\nAWS::EC2::Volume AvailabilityZone != /us-east-.*/", "strictChecks": true}' output.json { "StatusCode": 200, "ExecutedVersion": "$LATEST" @@ -95,9 +95,9 @@ cat output.json | jq '.' "[NewVolume] failed because it does not contain the required property of [Lorem]", "[NewVolume] failed because there is no value defined for [%ipsum] to check [Encrypted] against" ], - "exit_status": "FAIL" + "exitStatus": "FAIL" } -aws lambda invoke --function-name cfn-guard-lambda --payload '{ "template": "{\n \"Resources\": {\n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}", "ruleSet": "let require_encryption = true", "strict_checks": true}' output.json +aws lambda invoke --function-name cfn-guard-lambda --payload '{ "template": "{\n \"Resources\": {\n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}", "ruleSet": "let require_encryption = true", "strictChecks": true}' output.json { "StatusCode": 200, "ExecutedVersion": "$LATEST" @@ -105,9 +105,9 @@ aws lambda invoke --function-name cfn-guard-lambda --payload '{ "template": "{\n cat output.json | jq '.' { "message": [], - "exit_status": "PASS" + "exitStatus": "PASS" } -aws lambda invoke --function-name cfn-guard-lambda --payload '{ "template": "{\n \"Resources\": \n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}", "ruleSet": "let require_encryption = true", "strict_checks": true}' output.json +aws lambda invoke --function-name cfn-guard-lambda --payload '{ "template": "{\n \"Resources\": \n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}", "ruleSet": "let require_encryption = true", "strictChecks": true}' output.json { "StatusCode": 200, "ExecutedVersion": "$LATEST" @@ -117,7 +117,7 @@ cat output.json | jq '.' "message": [ "ERROR: Template file format was unreadable as json or yaml: while parsing a flow mapping, did not find expected ',' or '}' at line 3 column 21" ], - "exit_status": "ERR" + "exitStatus": "ERR" } ``` ## Calling the Lambda Function @@ -125,7 +125,7 @@ cat output.json | jq '.' Requests to `cfn-guard-lambda` require the following 3 fields: * `template` - The string version of the YAML or JSON CloudFormation Template * `ruleSet` - The string version of the rule set file -* `strict_checks` - A boolean indicating whether to apply [strict checks](../cfn-guard/README.md#about) +* `strictChecks` - A boolean indicating whether to apply [strict checks](../cfn-guard/README.md#about) #### Example There are example payloads in the [Makefile](Makefile). Here's one we use to test a rule set that should not pass: @@ -133,7 +133,7 @@ There are example payloads in the [Makefile](Makefile). Here's one we use to te ``` request_payload_fail = '{ "template": "{\n \"Resources\": {\n \"NewVolume\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 100,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n },\n \"NewVolume2\" : {\n \"Type\" : \"AWS::EC2::Volume\",\n \"Properties\" : {\n \"Size\" : 99,\n \"Encrypted\": true,\n \"AvailabilityZone\" : \"us-east-1b\"\n }\n } }\n}",\ "ruleSet": "let require_encryption = true\nlet disallowed_azs = [us-east-1a,us-east-1b,us-east-1c]\n\nAWS::EC2::Volume AvailabilityZone NOT_IN %disallowed_azs\nAWS::EC2::Volume Encrypted != %require_encryption\nAWS::EC2::Volume Size == 101 |OR| AWS::EC2::Volume Size == 99\nAWS::IAM::Role AssumeRolePolicyDocument.Version == 2012-10-18\nAWS::EC2::Volume Lorem == true\nAWS::EC2::Volume Encrypted == %ipsum\nAWS::EC2::Volume AvailabilityZone != /us-east-.*/",\ - "strict_checks": true}' + "strictChecks": true}' #====================================================================== # Request Payload Fail: diff --git a/cfn-guard-lambda/src/main.rs b/cfn-guard-lambda/src/main.rs index 442e0ecfa..b2da516d6 100644 --- a/cfn-guard-lambda/src/main.rs +++ b/cfn-guard-lambda/src/main.rs @@ -1,4 +1,5 @@ -// © Amazon Web Services, Inc. or its affiliates. All Rights Reserved. This AWS Content is provided subject to the terms of the AWS Customer Agreement available at http://aws.amazon.com/agreement or other written agreement between Customer and either Amazon Web Services, Inc. or Amazon Web Services EMEA SARL or both. +// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 use std::error::Error; @@ -14,12 +15,14 @@ struct CustomEvent { template: String, #[serde(rename = "ruleSet")] rule_set: String, + #[serde(rename = "strictChecks")] strict_checks: bool, } #[derive(Serialize)] struct CustomOutput { message: Vec, + #[serde(rename = "exitStatus")] exit_status: String, } diff --git a/cfn-guard-rulegen-lambda/Cargo.lock b/cfn-guard-rulegen-lambda/Cargo.lock index 6cb6134a2..49644d9eb 100644 --- a/cfn-guard-rulegen-lambda/Cargo.lock +++ b/cfn-guard-rulegen-lambda/Cargo.lock @@ -89,7 +89,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" [[package]] name = "cfn-guard-rulegen" -version = "0.6.0" +version = "0.7.0" dependencies = [ "clap 2.33.0 (registry+https://github.com/rust-lang/crates.io-index)", "log 0.4.7 (registry+https://github.com/rust-lang/crates.io-index)", @@ -101,9 +101,9 @@ dependencies = [ [[package]] name = "cfn-guard-rulegen-lambda" -version = "0.6.0" +version = "0.7.0" dependencies = [ - "cfn-guard-rulegen 0.6.0", + "cfn-guard-rulegen 0.7.0", "lambda_runtime 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)", "log 0.4.7 (registry+https://github.com/rust-lang/crates.io-index)", "serde 1.0.95 (registry+https://github.com/rust-lang/crates.io-index)", diff --git a/cfn-guard-rulegen-lambda/Cargo.toml b/cfn-guard-rulegen-lambda/Cargo.toml index d995eb978..1bb3caca8 100644 --- a/cfn-guard-rulegen-lambda/Cargo.toml +++ b/cfn-guard-rulegen-lambda/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "cfn-guard-rulegen-lambda" -version = "0.6.0" +version = "0.7.0" edition = "2018" [dependencies] diff --git a/cfn-guard-rulegen-lambda/src/main.rs b/cfn-guard-rulegen-lambda/src/main.rs index 7ae4b01e3..faa93639e 100644 --- a/cfn-guard-rulegen-lambda/src/main.rs +++ b/cfn-guard-rulegen-lambda/src/main.rs @@ -1,4 +1,5 @@ -// © 2019 Amazon Web Services, Inc. or its affiliates. All Rights Reserved. This AWS Content is provided subject to the terms of the AWS Customer Agreement available at http://aws.amazon.com/agreement or other written agreement between Customer and either Amazon Web Services, Inc. or Amazon Web Services EMEA SARL or both. +// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +// SPDX-License-Identifier: Apache-2.0 use std::error::Error; use cfn_guard_rulegen; diff --git a/cfn-guard-rulegen/Cargo.lock b/cfn-guard-rulegen/Cargo.lock index 18a368308..b25f3064f 100644 --- a/cfn-guard-rulegen/Cargo.lock +++ b/cfn-guard-rulegen/Cargo.lock @@ -40,7 +40,7 @@ checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822" [[package]] name = "cfn-guard-rulegen" -version = "0.6.0" +version = "0.7.0" dependencies = [ "clap", "log", diff --git a/cfn-guard-rulegen/Cargo.toml b/cfn-guard-rulegen/Cargo.toml index fbc22b4be..c1d27ed9b 100644 --- a/cfn-guard-rulegen/Cargo.toml +++ b/cfn-guard-rulegen/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "cfn-guard-rulegen" -version = "0.6.0" +version = "0.7.0" edition = "2018" [dependencies] diff --git a/cfn-guard-rulegen/README.md b/cfn-guard-rulegen/README.md deleted file mode 100644 index 7a9170515..000000000 --- a/cfn-guard-rulegen/README.md +++ /dev/null @@ -1,158 +0,0 @@ -# [PREVIEW] CloudFormation Guard Rulegen - -A CLI tool to automatically generate [CloudFormation Guard](https://github.com/aws-cloudformation/cloudformation-guard) rules from CloudFormation Templates. - -### Runtime Arguments - -Rulegen uses the Rust Clap library to parse arguments. Its `--help` output will show you what options are available: - -``` -$> cfn-guard-rulegen --help - -CloudFormation Guard RuleGen -Generate CloudFormation Guard rules from a CloudFormation template - -USAGE: - cfn-guard-rulegen [FLAGS]