aws-cloudformation / aws-cloudformation/cloudformation-guard

[BUG] Suppression Rules Ignored For Certain Checks

Open
#636 9 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
1.4k
Forks
196
Avg merge
3d 6h
Merged PRs (30d)
5

Description

**Describe the bug**
Suppression rules on resources are being ignored for certain rules, resulting in a template failing validation. Most suppression rules are adhered and do not result in failures.

**To Reproduce**
Please supply:

```
Resources:
ElasticContainerTaskExecutionRole:
Type: AWS::IAM::Role
Metadata:
guard:
SuppressedRules:
- CFN_NO_EXPLICIT_RESOURCE_NAMES # Needlessly restrictive
Properties:
AssumeRolePolicyDocument:
Statement:
- Action:
- sts:AssumeRole
Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
RoleName: task-execution-role
```

Command:
```
cfn-guard validate --rules /home/redacted/development/aws-guard-rules-registry/rules/aws --data /home/redacted/development/ecs/task/product.template
```

Result:
```
/home/redacted/development/ecs/task/product.template Status = FAIL
FAILED rules
cfn_no_explicit_resource_names.guard/CFN_NO_EXPLICIT_RESOURCE_NAMES FAIL
---
Evaluating data /home/redacted/development/ecs/task/product.template against rules cfn_no_explicit_resource_names.guard
Number of non-compliant resources 2
Resource = ElasticContainerTaskExecutionRole {
Type = AWS::IAM::Role
Rule = CFN_NO_EXPLICIT_RESOURCE_NAMES {
ALL {
Check = RoleName EMPTY {
ComparisonError {
Error = Check was not compliant as property [/Resources/ElasticContainerTaskExecutionRole/Properties/RoleName[L:309,C:16]] was not empty.
PropertyPath = /Resources/ElasticContainerTaskExecutionRole/Properties/RoleName[L:309,C:16]
Operator = EMPTY
Code:
307. Service: ecs-tasks.amazonaws.com
308. ManagedPolicyArns:
309. - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
310. RoleName: task-execution-role
311.
312. ExternalRecordSet:

}
}
}
}
}
```

**Expected behavior**
Suppressing a rule on a resource should not result in failures.

**Operating System:**
Ubuntu

**OS Version**
24.04

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the provided CloudFormation YAML, the cfn-guard validate command, and the CFN_NO_EXPLICIT_RESOURCE_NAMES rule. Trace how resource-level SuppressedRules metadata is handled for this check, then verify that the command reports no failure for the suppressed rule while other rule behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, rust, yaml
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.