aws-cloudformation / aws-cloudformation/cloudformation-guard

[Enhancement] Unit test shoud support invoking a rule that has an argument

Open
#333 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
1.4k
Forks
196
Avg merge
3d 6h
Merged PRs (30d)
5

Description

**Is your feature request related to a problem? Please describe.**

I'm creating cfn-guard rules for evaluating Resource Policies. I will use these rules from different entry points: CloudFormation and AWS Config. This means that the extraction path from these two use cases will be different.
However the Resource policy evaluation on the statements will be the exact same.
For this reason I've created rules with arguments to evaluate the policy.

However, I'm not able to do unit tests on rules that expect an argument.

**Describe the solution you'd like**

In the unit test file, I would like to be able to specify the argument, where this will be the value in the input. A nice feature would be if we could specify the extraction path such as $this/PolicyDocument

expectations:
rules:
check_principal_deny($this)

**Describe alternatives you've considered**

The alternative at the moment is to have tests duplicated from different extraction points, which makes hard to unit test and maintain it

Contributor guide

Open the contributing guide

Research direction

Start by locating the unit test file and the expectations.rules handling for parameterized calls such as check_principal_deny($this); inspect how extraction paths are represented. Done when tests can supply an argument or extraction path and reuse the same rule across entry points without duplicated tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security, testing
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.