aws-cloudformation / aws-cloudformation/cloudformation-guard

--strict-checks in ruleset itself

Open
#97 2 comments 0 reactions 0 assignees View on GitHub
enhancement needs-research
Dominant language
Rust
Stars
1.4k
Forks
196
Avg merge
3d 6h
Merged PRs (30d)
5

Description

**Describe the bug**
What I found surprising is that checks for specific CFN properties are evaluated lazy. What I would expect instead is that across all resources the given rule would be enforced.

Example:

If I define a rule as below:

```
AWS::DynamoDB::Table BillingMode == PAY_PER_REQUEST
```

If the resource that it's being evaluated against does not define `BillingMode` the rule check will be successful, but in this particular case what I am really trying to do is achieve consistency across my template and specify certain behaviour which will be ignored.

**To Reproduce**
Please supply:

1. An example rule set and template that results in the error
1. The commands you used to invoke the tool
1. The output of a `-vvv` log level if it's not related to cfn-guard-lambda, or the relevant CloudWatch log messages if it is related to the lambda

**NOTE: Please be sure that the templates, rule sets and logs you provide as part of your bug report do not contain any sensitive information.**

I had defined a ruleset as follows:

```
AWS::DynamoDB::Table BillingMode == PAY_PER_REQUEST
```

and run it against the template:

```
Resources:
MyTable:
Type: AWS::DynamoDB::Table
Properties:
TableName: "MyTable"
AttributeDefinitions:
-
AttributeName: "Album"
AttributeType: "S"
-
AttributeName: "Artist"
AttributeType: "S"
KeySchema:
-
AttributeName: "Album"
KeyType: "HASH"
-
AttributeName: "Artist"
KeyType: "RANGE"
SSESpecification:
SSEEnabled: true
```

By running command:

```
cfn-guard check -r rule.ruleset -t emplate.yml
```

The end result was successful validation.

Instead I was expecting an error:
```
[MyTable] failed because [BillingMode] is [undefined] and the permitted value is [PAY_PER_REQUEST]
```

**Expected behavior**
A clear and concise description of what you expected to happen.

I wanted to propose a change on how the rule is being evaluated by allowing to specify strict matching attributes against the rules.

```
cfn-guard check --strict -r rule.ruleset -t template.yml
```

Optionally this should be enabled per ruleset file by specifying the mode as first instruction of ruleset

```
let mode = "strict" // or similar to JS `use strict`
```

or through alternative syntax.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Operating System:**
MacOS

**OS Version**
10.15.7

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Start with the cfn-guard check command and the rule-evaluation path described in the report. Reproduce the BillingMode example, then determine how strict matching should be selected through the CLI or ruleset; done means an undefined BillingMode fails with the expected diagnostic while existing non-strict behavior remains understood.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cli, security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.