Skip to content
This repository was archived by the owner on Jun 1, 2022. It is now read-only.

Commit fca3203

Browse files
author
Owen Rumney
authored
complete SAM checks (#29)
1 parent c6f5ba7 commit fca3203

51 files changed

Lines changed: 1331 additions & 93 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.16
44

55
require (
66
github.com/apparentlymart/go-cidr v1.1.0
7-
github.com/aquasecurity/defsec v0.0.38-0.20211202114943-52f01d551cdf
7+
github.com/aquasecurity/defsec v0.0.39
88
github.com/liamg/jfather v0.0.2
99
github.com/liamg/tml v0.4.0
1010
github.com/spf13/cobra v1.2.1

‎go.sum‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,30 @@ github.com/aquasecurity/defsec v0.0.38-0.20211202103545-b5b8849450c9 h1:fgGbzM/N
6262
github.com/aquasecurity/defsec v0.0.38-0.20211202103545-b5b8849450c9/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
6363
github.com/aquasecurity/defsec v0.0.38-0.20211202114943-52f01d551cdf h1:HD/CwABWPR1iD18Zaf/wPENN6rMKUmyD4RVnlfNMMHQ=
6464
github.com/aquasecurity/defsec v0.0.38-0.20211202114943-52f01d551cdf/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
65+
github.com/aquasecurity/defsec v0.0.38-0.20211202150847-444824e0b664 h1:YzvRYLmu3deyC4Wf6QrWvcb3iqgc2RTVHHiTykdZbcY=
66+
github.com/aquasecurity/defsec v0.0.38-0.20211202150847-444824e0b664/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
67+
github.com/aquasecurity/defsec v0.0.38-0.20211202151317-49073d729686 h1:Rf3UdwpQu6rqlUfSg6VcUABb587D4th8gN6H2m0ClrU=
68+
github.com/aquasecurity/defsec v0.0.38-0.20211202151317-49073d729686/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
69+
github.com/aquasecurity/defsec v0.0.38-0.20211202154419-d594e7f5da4a h1:WCMe4TmD/FFyo3PVNwFu2bCN7Qa55mACI/tN64b4+tI=
70+
github.com/aquasecurity/defsec v0.0.38-0.20211202154419-d594e7f5da4a/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
71+
github.com/aquasecurity/defsec v0.0.38-0.20211202154813-a8f06cb40d8d h1:OthlJ7rVpC0S8F+qUDuehcVEW/JG3CJ59vg2OdaKbpA=
72+
github.com/aquasecurity/defsec v0.0.38-0.20211202154813-a8f06cb40d8d/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
73+
github.com/aquasecurity/defsec v0.0.38-0.20211202160241-d83b25ead044 h1:rRKkBKMz0dZpMNEZq/kzI7DmvrUihrGeUSDVtct2ep0=
74+
github.com/aquasecurity/defsec v0.0.38-0.20211202160241-d83b25ead044/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
75+
github.com/aquasecurity/defsec v0.0.38-0.20211202161757-d84ca68f3ae0 h1:Q15KxrS4BSe3nnet/6tmUniq+aJcuLrEm5NLCSgkY7o=
76+
github.com/aquasecurity/defsec v0.0.38-0.20211202161757-d84ca68f3ae0/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
77+
github.com/aquasecurity/defsec v0.0.38-0.20211202165623-c5c733e8f427 h1:CEF+BseRwkazD+2KIeZaBDXFGhcRS0uEdzvx8ckQB4E=
78+
github.com/aquasecurity/defsec v0.0.38-0.20211202165623-c5c733e8f427/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
79+
github.com/aquasecurity/defsec v0.0.38-0.20211202165845-4b964f19ef54 h1:FMXpegDORcyzyS+Set/1UMEfpC+7jYcO1d5rO5RD+3s=
80+
github.com/aquasecurity/defsec v0.0.38-0.20211202165845-4b964f19ef54/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
81+
github.com/aquasecurity/defsec v0.0.38-0.20211202170330-25a726735d94 h1:gRwq7flkNBu01SccjpMn4H4MPSltmPqXx1px/E+j2zw=
82+
github.com/aquasecurity/defsec v0.0.38-0.20211202170330-25a726735d94/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
83+
github.com/aquasecurity/defsec v0.0.38-0.20211202171943-fc8aa959d2b3 h1:5mj9J/bd9NXS6/MWL7SYWCuX1WeBmB5uGX5UuT/t4/E=
84+
github.com/aquasecurity/defsec v0.0.38-0.20211202171943-fc8aa959d2b3/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
85+
github.com/aquasecurity/defsec v0.0.38 h1:nIxKDsJNatjbZ7XA6uQ0mnPSnKpCJsZt4CoDlr2UOBE=
86+
github.com/aquasecurity/defsec v0.0.38/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
87+
github.com/aquasecurity/defsec v0.0.39 h1:C89/VOojkIb0MZBXHZ/vrlSW+DeEy42w+mg6vwjenI4=
88+
github.com/aquasecurity/defsec v0.0.39/go.mod h1:csaBEcJ3AKy44expnW0dCANEZcS/c1vcJjwBCbnKWBM=
6589
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
6690
github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
6791
github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=

‎internal/app/cfsec/adapter/aws/sam/function.go‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package sam
2+
3+
import (
4+
"github.com/aquasecurity/cfsec/internal/app/cfsec/parser"
5+
"github.com/aquasecurity/cfsec/internal/app/cfsec/util"
6+
"github.com/aquasecurity/defsec/provider/aws/iam"
7+
"github.com/aquasecurity/defsec/provider/aws/sam"
8+
)
9+
10+
func getFunctions(cfFile parser.FileContext) (functions []sam.Function) {
11+
12+
functionResources := cfFile.GetResourceByType("AWS::Serverless::Function")
13+
for _, r := range functionResources {
14+
function := sam.Function{
15+
Metadata: r.Metadata(),
16+
FunctionName: r.GetStringProperty("FunctionName"),
17+
Tracing: r.GetStringProperty("Tracing", sam.TracingModePassThrough),
18+
}
19+
20+
setFunctionPolicies(r, &function)
21+
functions = append(functions, function)
22+
}
23+
24+
return functions
25+
}
26+
27+
func setFunctionPolicies(r *parser.Resource, function *sam.Function) {
28+
policies := r.GetProperty("Policies")
29+
if policies.IsNotNil() {
30+
if policies.IsString() {
31+
function.ManagedPolicies = append(function.ManagedPolicies, policies.AsStringValue())
32+
} else if policies.IsList() {
33+
for _, property := range policies.AsList() {
34+
if property.IsMap() {
35+
policyDoc, err := getPolicyDocument(property, r.SourceFormat())
36+
if err != nil {
37+
38+
function.ManagedPolicies = append(function.ManagedPolicies, property.AsStringValue())
39+
continue
40+
}
41+
function.Policies = append(function.Policies, *policyDoc)
42+
} else {
43+
function.ManagedPolicies = append(function.ManagedPolicies, property.AsStringValue())
44+
}
45+
46+
}
47+
}
48+
}
49+
}
50+
51+
func getPolicyDocument(policyProp *parser.Property, sourceFormat parser.SourceFormat) (*iam.PolicyDocument, error) {
52+
policyDoc := util.GetJsonBytes(policyProp, sourceFormat, true)
53+
54+
return iam.ParsePolicyDocument(policyDoc, policyProp.Metadata())
55+
}

‎internal/app/cfsec/adapter/aws/sam/http_api.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
package sam
2+
3+
import (
4+
"github.com/aquasecurity/cfsec/internal/app/cfsec/parser"
5+
"github.com/aquasecurity/defsec/provider/aws/sam"
6+
"github.com/aquasecurity/defsec/types"
7+
)
8+
9+
func getHttpApis(cfFile parser.FileContext) (apis []sam.HttpAPI) {
10+
11+
apiResources := cfFile.GetResourceByType("AWS::Serverless::HttpApi")
12+
for _, r := range apiResources {
13+
api := sam.HttpAPI{
14+
Metadata: r.Metadata(),
15+
Name: r.GetStringProperty("Name", ""),
16+
DomainConfiguration: getDomainConfiguration(r),
17+
AccessLogging: getAccessLogging(r),
18+
DefaultRouteSettings: getRouteSettings(r),
19+
}
20+
21+
apis = append(apis, api)
22+
}
23+
24+
return apis
25+
}
26+
27+
func getRouteSettings(r *parser.Resource) sam.RouteSettings {
28+
29+
route := r.GetProperty("DefaultRouteSettings")
30+
if route.IsNil() {
31+
return sam.RouteSettings{
32+
Metadata: r.Metadata(),
33+
LoggingEnabled: types.BoolDefault(false, r.Metadata()),
34+
DataTraceEnabled: types.BoolDefault(false, r.Metadata()),
35+
DetailedMetricsEnabled: types.BoolDefault(false, r.Metadata()),
36+
}
37+
}
38+
39+
return sam.RouteSettings{
40+
Metadata: route.Metadata(),
41+
LoggingEnabled: route.GetBoolProperty("LoggingLevel"),
42+
DataTraceEnabled: route.GetBoolProperty("DataTraceEnabled"),
43+
DetailedMetricsEnabled: route.GetBoolProperty("DetailedMetricsEnabled"),
44+
}
45+
}

‎internal/app/cfsec/adapter/aws/sam/sam.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,9 @@ func Adapt(cfFile parser.FileContext) (sam sam.SAM) {
1818
}()
1919

2020
sam.APIs = getApis(cfFile)
21+
sam.HttpAPIs = getHttpApis(cfFile)
22+
sam.Functions = getFunctions(cfFile)
23+
sam.StateMachines = getStateMachines(cfFile)
24+
sam.SimpleTables = getSimpleTables(cfFile)
2125
return sam
2226
}

‎internal/app/cfsec/adapter/aws/sam/state_machines.go‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package sam
2+
3+
import (
4+
"github.com/aquasecurity/cfsec/internal/app/cfsec/parser"
5+
"github.com/aquasecurity/defsec/provider/aws/sam"
6+
"github.com/aquasecurity/defsec/types"
7+
)
8+
9+
func getStateMachines(cfFile parser.FileContext) (stateMachines []sam.StateMachine) {
10+
11+
stateMachineResources := cfFile.GetResourceByType("AWS::Serverless::StateMachine")
12+
for _, r := range stateMachineResources {
13+
stateMachine := sam.StateMachine{
14+
Metadata: r.Metadata(),
15+
Name: r.GetStringProperty("Name"),
16+
LoggingConfiguration: sam.LoggingConfiguration{},
17+
Tracing: getTracingConfiguration(r),
18+
}
19+
20+
setStateMachinePolicies(r, &stateMachine)
21+
stateMachines = append(stateMachines, stateMachine)
22+
}
23+
24+
return stateMachines
25+
}
26+
27+
func getTracingConfiguration(r *parser.Resource) sam.TracingConfiguration {
28+
tracing := r.GetProperty("Tracing")
29+
if tracing.IsNil() {
30+
return sam.TracingConfiguration{
31+
Metadata: r.Metadata(),
32+
Enabled: types.BoolDefault(false, r.Metadata()),
33+
}
34+
}
35+
36+
return sam.TracingConfiguration{
37+
Metadata: tracing.Metadata(),
38+
Enabled: tracing.GetBoolProperty("Enabled"),
39+
}
40+
}
41+
42+
func setStateMachinePolicies(r *parser.Resource, stateMachine *sam.StateMachine) {
43+
policies := r.GetProperty("Policies")
44+
if policies.IsNotNil() {
45+
if policies.IsString() {
46+
stateMachine.ManagedPolicies = append(stateMachine.ManagedPolicies, policies.AsStringValue())
47+
} else if policies.IsList() {
48+
for _, property := range policies.AsList() {
49+
policyDoc, err := getPolicyDocument(property, r.SourceFormat())
50+
if err != nil {
51+
52+
stateMachine.ManagedPolicies = append(stateMachine.ManagedPolicies, property.AsStringValue())
53+
continue
54+
}
55+
stateMachine.Policies = append(stateMachine.Policies, *policyDoc)
56+
}
57+
}
58+
}
59+
}

‎internal/app/cfsec/adapter/aws/sam/tables.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package sam
2+
3+
import (
4+
"github.com/aquasecurity/cfsec/internal/app/cfsec/parser"
5+
"github.com/aquasecurity/defsec/provider/aws/sam"
6+
"github.com/aquasecurity/defsec/types"
7+
)
8+
9+
func getSimpleTables(cfFile parser.FileContext) (tables []sam.SimpleTable) {
10+
11+
tableResources := cfFile.GetResourceByType("AWS::Serverless::SimpleTable")
12+
for _, r := range tableResources {
13+
table := sam.SimpleTable{
14+
Metadata: r.Metadata(),
15+
TableName: r.GetStringProperty("TableName"),
16+
SSESpecification: getSSESpecification(r),
17+
}
18+
19+
tables = append(tables, table)
20+
}
21+
22+
return tables
23+
}
24+
25+
func getSSESpecification(r *parser.Resource) sam.SSESpecification {
26+
sse := r.GetProperty("SSESpecification")
27+
if sse.IsNil() {
28+
return sam.SSESpecification{
29+
Metadata: r.Metadata(),
30+
Enabled: types.BoolDefault(false, r.Metadata()),
31+
KMSMasterKeyID: types.StringDefault("", r.Metadata()),
32+
}
33+
}
34+
35+
return sam.SSESpecification{
36+
Metadata: sse.Metadata(),
37+
Enabled: sse.GetBoolProperty("SSEEnabled"),
38+
KMSMasterKeyID: sse.GetStringProperty("KMSMasterKeyID"),
39+
}
40+
}

internal/app/cfsec/rules/aws/sam/use_secure_tls_rule.go renamed to internal/app/cfsec/rules/aws/sam/api_use_secure_tls_rule.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,6 @@ Resources:
3939
`,
4040
},
4141

42-
Base: sam.CheckUseSecureTlsPolicy,
42+
Base: sam.CheckApiUseSecureTlsPolicy,
4343
})
4444
}

‎internal/app/cfsec/rules/aws/sam/api_use_secure_tls_rule_test.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package sam
2+
3+
import (
4+
"github.com/aquasecurity/cfsec/internal/app/cfsec/test"
5+
"github.com/aquasecurity/defsec/rules/aws/sam"
6+
7+
"testing"
8+
)
9+
10+
func Test_CheckApiUseSecureTlsPolicy_FailureExamples(t *testing.T) {
11+
expectedCode := sam.CheckApiUseSecureTlsPolicy.Rule().LongID()
12+
test.RunFailureExamplesTest(t, expectedCode)
13+
}
14+
15+
func Test_CheckApiUseSecureTlsPolicy_PassedExamples(t *testing.T) {
16+
expectedCode := sam.CheckApiUseSecureTlsPolicy.Rule().LongID()
17+
test.RunPassingExamplesTest(t, expectedCode)
18+
}

‎internal/app/cfsec/rules/aws/sam/enable_access_logging_rule_test.go‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

0 commit comments

Comments
 (0)