aws-cloudformation / aws-cloudformation/cloudformation-guard
[Enhancement] Support for CloudFormation Pseudo Parameters
- Dominant language
- Rust
- Stars
- 1.4k
- Forks
- 196
- Avg merge
- 3d 6h
- Merged PRs (30d)
- 5
Description
**Is your feature request related to a problem? Please describe.**
Validating Policies like :
- Effect: Deny
Principal:
AWS: "*"
Action:
- "s3:*"
Resource:
- Fn::Sub: "arn:${AWS::Partition}:s3:::local-${AWS::AccountId}-logs-${AWS::Region}/*"
Validation Output :
```
"Clause": {
"Binary": {
"context": " Resource[*] EQUALS \"*\"",
"messages": {
"custom_message": "",
"error_message": "Check was not compliant as property value [Path=/Resources/rLocalLogAggregregationBucketPolicy/Properties/PolicyDocument/Statement/0/Resource/0[L:337,C:16] Value={\"Fn::Sub\":\"arn:${AWS::Partition}:s3:::local-${AWS::AccountId}-logs-${AWS::Region}/*\"}] not equal to value [Path=[L:0,C:0] Value=\"*\"]. Error = [PathAwareValues are not comparable map, String]"
},
"check": {
"Resolved": {
"from": {
"path": "/Resources/rLocalLogAggregregationBucketPolicy/Properties/PolicyDocument/Statement/0/Resource/0",
"value": {
"Fn::Sub": "arn:${AWS::Partition}:s3:::local-${AWS::AccountId}-logs-${AWS::Region}/*"
}
},
```
**Describe the solution you'd like**
Support for CloudFormation [Pseudo Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html#cfn-pseudo-param-partition) like ${AWS::Partition} to validate CloudFormation templates using cfn-guard
Contributor guide
Research direction
Start by tracing how cfn-guard validates the shown Resource value containing Fn::Sub and CloudFormation pseudo parameters such as AWS::Partition, AWS::AccountId, and AWS::Region. Done means the example policy can be validated without the reported map-versus-string comparability error, with coverage for pseudo-parameter substitutions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, rust
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100