Skip to content

Commit ded116d

Browse files
phelewskiphelewski
authored
#503 adding rule for eks cluster encryption config provider (#505)
1 parent f98a736 commit ded116d

5 files changed

Lines changed: 149 additions & 0 deletions

File tree

‎lib/cfn-nag/custom_rules/EKSClusterEncryptionRule.rb‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# frozen_string_literal: true
2+
3+
require 'cfn-nag/violation'
4+
require_relative 'base'
5+
6+
class EKSClusterEncryptionRule < BaseRule
7+
def rule_text
8+
'EKS Cluster EncryptionConfig Provider should specify KeyArn to enable Encryption.'
9+
end
10+
11+
def rule_type
12+
Violation::WARNING
13+
end
14+
15+
def rule_id
16+
'W82'
17+
end
18+
19+
def audit_impl(cfn_model)
20+
violating_clusters = cfn_model.resources_by_type('AWS::EKS::Cluster').select do |cluster|
21+
if cluster.encryptionConfig.nil?
22+
true
23+
elsif violating_configs?(cluster)
24+
true
25+
else
26+
violating_providers?(cluster)
27+
end
28+
end
29+
30+
violating_clusters.map(&:logical_resource_id)
31+
end
32+
33+
private
34+
35+
def violating_configs?(cluster)
36+
violating_config = cluster.encryptionConfig.select do |config|
37+
config['Provider'].nil?
38+
end
39+
!violating_config.empty?
40+
end
41+
42+
def violating_providers?(cluster)
43+
violating_provider = cluster.encryptionConfig.select do |config|
44+
config['Provider']['KeyArn'].empty?
45+
end
46+
!violating_provider.empty?
47+
end
48+
end

‎spec/custom_rules/EKSClusterEncryptionRuleRule_spec.rb‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
require 'spec_helper'
2+
require 'password_rule_spec_helper'
3+
require 'cfn-model'
4+
require 'cfn-nag/custom_rules/EKSClusterEncryptionRule'
5+
6+
describe EKSClusterEncryptionRule do
7+
context 'EKS Cluster with no EncryptionConfig' do
8+
it 'Returns the logical resource ID of the offending EKS Cluster resource' do
9+
cfn_model = CfnParser.new.parse read_test_template(
10+
'yaml/eks_cluster/eks_cluster_encryptionconfig_not_set.yaml'
11+
)
12+
13+
actual_logical_resource_ids =
14+
EKSClusterEncryptionRule.new.audit_impl cfn_model
15+
expected_logical_resource_ids = %w[EKSCluster]
16+
17+
expect(actual_logical_resource_ids).to eq expected_logical_resource_ids
18+
end
19+
end
20+
21+
context 'EKS Cluster with EncryptionConfig Provider KeyArn set' do
22+
it 'Returns empty list' do
23+
cfn_model = CfnParser.new.parse read_test_template(
24+
'yaml/eks_cluster/eks_cluster_encryptionconfig_provider_keyarn_set.yaml'
25+
)
26+
27+
actual_logical_resource_ids =
28+
EKSClusterEncryptionRule.new.audit_impl cfn_model
29+
expected_logical_resource_ids = %w[]
30+
31+
expect(actual_logical_resource_ids).to eq expected_logical_resource_ids
32+
end
33+
end
34+
35+
context 'EKS Cluster EncryptionConfig with Provider not set' do
36+
it 'Returns the logical resource ID of the offending EKS Cluster resource' do
37+
cfn_model = CfnParser.new.parse read_test_template(
38+
'yaml/eks_cluster/eks_cluster_encryptionconfig_provider_not_set.yaml'
39+
)
40+
41+
actual_logical_resource_ids =
42+
EKSClusterEncryptionRule.new.audit_impl cfn_model
43+
expected_logical_resource_ids = %w[EKSCluster]
44+
45+
expect(actual_logical_resource_ids).to eq expected_logical_resource_ids
46+
end
47+
end
48+
end

‎spec/test_templates/yaml/eks_cluster/eks_cluster_encryptionconfig_not_set.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
Resources:
3+
EKSCluster:
4+
Type: AWS::EKS::Cluster
5+
Properties:
6+
Name: foobar
7+
Version: '1.14'
8+
RoleArn: >-
9+
arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-EXAMPLEBQ4PI
10+
ResourcesVpcConfig:
11+
SecurityGroupIds:
12+
- sg-foobar12
13+
SubnetIds:
14+
- subnet-foobar12
15+
- subnet-foobar34

‎spec/test_templates/yaml/eks_cluster/eks_cluster_encryptionconfig_provider_keyarn_set.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
Resources:
3+
EKSCluster:
4+
Type: AWS::EKS::Cluster
5+
Properties:
6+
Name: foobar
7+
Version: '1.14'
8+
RoleArn: >-
9+
arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-EXAMPLEBQ4PI
10+
ResourcesVpcConfig:
11+
SecurityGroupIds:
12+
- sg-foobar12
13+
SubnetIds:
14+
- subnet-foobar12
15+
- subnet-foobar34
16+
EncryptionConfig:
17+
- Provider:
18+
KeyArn: alias/SuperSecureKey
19+
Resources:
20+
- Foo: bar

‎spec/test_templates/yaml/eks_cluster/eks_cluster_encryptionconfig_provider_not_set.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
Resources:
3+
EKSCluster:
4+
Type: AWS::EKS::Cluster
5+
Properties:
6+
Name: foobar
7+
Version: '1.14'
8+
RoleArn: >-
9+
arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-EXAMPLEBQ4PI
10+
ResourcesVpcConfig:
11+
SecurityGroupIds:
12+
- sg-foobar12
13+
SubnetIds:
14+
- subnet-foobar12
15+
- subnet-foobar34
16+
EncryptionConfig:
17+
- Resources:
18+
- Foo: bar

0 commit comments

Comments
 (0)