diff --git a/lib/cfn-nag/custom_rules/ApiGatewayStageDataTraceEnabledRule.rb b/lib/cfn-nag/custom_rules/ApiGatewayStageDataTraceEnabledRule.rb new file mode 100644 index 00000000..f3bd450a --- /dev/null +++ b/lib/cfn-nag/custom_rules/ApiGatewayStageDataTraceEnabledRule.rb @@ -0,0 +1,32 @@ +require 'cfn-nag/violation' +require_relative 'sub_property_with_list_truthy_value_base_rule' + +# Checks for truthy (boolean true) 'MethodSettings.DataTraceEnabled' property +# Setting this value to true may unintentionally expose sensitive data in logs + +class ApiGatewayStageDataTraceEnabledRule < SubPropertyWithListTruthyValueBaseRule + def rule_text + 'AWS::ApiGateway::Stage should set DataTraceEnabled to false.' + end + + def rule_type + Violation::FAILING_VIOLATION + end + + def rule_id + 'CW4200' + end + + def resource_type + 'AWS::ApiGateway::Stage' + end + + def sublist_property + :methodSettings + end + + def sub_property_name + 'DataTraceEnabled' + end + +end diff --git a/lib/cfn-nag/custom_rules/sub_property_with_list_truthy_value_base_rule.rb b/lib/cfn-nag/custom_rules/sub_property_with_list_truthy_value_base_rule.rb new file mode 100644 index 00000000..8b6bfa8c --- /dev/null +++ b/lib/cfn-nag/custom_rules/sub_property_with_list_truthy_value_base_rule.rb @@ -0,0 +1,52 @@ +require 'cfn-nag/violation' +require 'cfn-nag/util/truthy' +require_relative 'base' + +# Returns "violating map" of sublist properties that are +# truthy (boolean true) + +class SubPropertyWithListTruthyValueBaseRule < BaseRule + def resource_type + raise 'must implement in subclass' + end + + + def sublist_property + raise 'must implement in subclass' + end + + + def sub_property_name; end + + def audit_impl(cfn_model) + resources = cfn_model.resources_by_type(resource_type) + + violating_resources = resources.select do |resource| + begin + truthy_subproperty_in_list( + cfn_model, resource, sublist_property, sub_property_name + ) + rescue + false + end + end + + violating_resources.map(&:logical_resource_id) + end + + + private + + def truthy_subproperty_in_list( + cfn_model, resource, sublist_property, sub_property_name + ) + property_list = resource.send(sublist_property) + return false unless property_list + + property_list.find do |property_element| + sub_value = property_element[sub_property_name] + truthy?(property_element[sub_property_name]) || property_element[sub_property_name].nil? + end + end + +end