aws-cloudformation / aws-cloudformation/cloudformation-guard

[Enhancement] Support for CloudFormation Pseudo Parameters

Open
#480 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
1.4k
Forks
196
Avg merge
3d 6h
Merged PRs (30d)
5

Description

**Is your feature request related to a problem? Please describe.**
Validating Policies like :

- Effect: Deny
Principal:
AWS: "*"
Action:
- "s3:*"
Resource:
- Fn::Sub: "arn:${AWS::Partition}:s3:::local-${AWS::AccountId}-logs-${AWS::Region}/*"

Validation Output :
```
"Clause": {
"Binary": {
"context": " Resource[*] EQUALS \"*\"",
"messages": {
"custom_message": "",
"error_message": "Check was not compliant as property value [Path=/Resources/rLocalLogAggregregationBucketPolicy/Properties/PolicyDocument/Statement/0/Resource/0[L:337,C:16] Value={\"Fn::Sub\":\"arn:${AWS::Partition}:s3:::local-${AWS::AccountId}-logs-${AWS::Region}/*\"}] not equal to value [Path=[L:0,C:0] Value=\"*\"]. Error = [PathAwareValues are not comparable map, String]"
},
"check": {
"Resolved": {
"from": {
"path": "/Resources/rLocalLogAggregregationBucketPolicy/Properties/PolicyDocument/Statement/0/Resource/0",
"value": {
"Fn::Sub": "arn:${AWS::Partition}:s3:::local-${AWS::AccountId}-logs-${AWS::Region}/*"
}
},
```

**Describe the solution you'd like**

Support for CloudFormation [Pseudo Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html#cfn-pseudo-param-partition) like ${AWS::Partition} to validate CloudFormation templates using cfn-guard

Contributor guide

Open the contributing guide

Research direction

Start by tracing how cfn-guard validates the shown Resource value containing Fn::Sub and CloudFormation pseudo parameters such as AWS::Partition, AWS::AccountId, and AWS::Region. Done means the example policy can be validated without the reported map-versus-string comparability error, with coverage for pseudo-parameter substitutions.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, rust
Domain
cloud, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.