aws-cloudformation / aws-cloudformation/cloudformation-guard

[Enhancement] Introduce Parameter Inputs for checking the CF scripts

Open
#39 24 comments 16 reactions 0 assignees View on GitHub
enhancement needs-research
Dominant language
Rust
Stars
1.4k
Forks
196
Avg merge
3d 6h
Merged PRs (30d)
5

Description

**Is your feature request related to a problem? Please describe.**
In its current form, cfn-guard checks the Cloudformation script without any input.

Example, Lets say I have a Cloudformation script similar to the following (simplified version)
``` yaml
Parameters:
RDSEncryption:
Type: String

Resources:
RDSPostgressDB:
Type: AWS::RDS::DBInstance
Properties:
StorageEncrypted: !Ref RDSEncryption
```

I want to create an RDS Database and I have a CF parameter input for encryption (true/false). Currently there is no way in cfn-guard to verify that the RDS will be created using encryption. I can only verify that the StorageEncrypted will have the value "RDSEncryption" (please correct me if I'm wrong)

**Describe the solution you'd like**
I would prefer an option to provide a json document with the CF parameter inputs and be able to check the Cloudformation script after all those values have been implemented.
The example I gave above would look like:

rules:
```
AWS::RDS::DBInstance StorageEncrypted == true
```

input.json:
``` json
[
{
"ParameterKey": "RDSEncryption",
"ParameterValue": "true"
}
]
```

cfn-guard:
``` bash
cargo run -- -t rds.yaml -r rules -i input.json
```
cfn-guard will change the `RDSEncryption` Rerefence with the input `true` and will be able to check against that

Contributor guide

Open the contributing guide

Research direction

Start at the cfn-guard CLI entry point shown in the proposed `cargo run -- -t rds.yaml -r rules -i input.json` command, then trace how the template and rules are parsed. Use the provided CloudFormation example and `input.json` as the acceptance case; done means the parameter reference is evaluated as `true` and the RDS encryption rule passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, rust
Domain
cli, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.