aws-cloudformation / aws-cloudformation/cloudformation-guard
[Enhancement] Introduce Parameter Inputs for checking the CF scripts
- Dominant language
- Rust
- Stars
- 1.4k
- Forks
- 196
- Avg merge
- 3d 6h
- Merged PRs (30d)
- 5
Description
**Is your feature request related to a problem? Please describe.**
In its current form, cfn-guard checks the Cloudformation script without any input.
Example, Lets say I have a Cloudformation script similar to the following (simplified version)
``` yaml
Parameters:
RDSEncryption:
Type: String
Resources:
RDSPostgressDB:
Type: AWS::RDS::DBInstance
Properties:
StorageEncrypted: !Ref RDSEncryption
```
I want to create an RDS Database and I have a CF parameter input for encryption (true/false). Currently there is no way in cfn-guard to verify that the RDS will be created using encryption. I can only verify that the StorageEncrypted will have the value "RDSEncryption" (please correct me if I'm wrong)
**Describe the solution you'd like**
I would prefer an option to provide a json document with the CF parameter inputs and be able to check the Cloudformation script after all those values have been implemented.
The example I gave above would look like:
rules:
```
AWS::RDS::DBInstance StorageEncrypted == true
```
input.json:
``` json
[
{
"ParameterKey": "RDSEncryption",
"ParameterValue": "true"
}
]
```
cfn-guard:
``` bash
cargo run -- -t rds.yaml -r rules -i input.json
```
cfn-guard will change the `RDSEncryption` Rerefence with the input `true` and will be able to check against that
Contributor guide
Research direction
Start at the cfn-guard CLI entry point shown in the proposed `cargo run -- -t rds.yaml -r rules -i input.json` command, then trace how the template and rules are parsed. Use the provided CloudFormation example and `input.json` as the acceptance case; done means the parameter reference is evaluated as `true` and the RDS encryption rule passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, rust
- Domain
- cli, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100