All files / src plugin.ts

98.63% Statements 360/365
89.85% Branches 62/69
100% Functions 8/8
98.63% Lines 360/365

Press n or j to go to the next uncovered block, b, p or k for the previous block.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 3661x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 11x 11x 11x 10x 10x 11x 11x 11x 11x 11x 11x 11x 11x 11x     11x 11x 1x 1x 1x 1x 1x 1x 1x 37x 37x 23x 23x 37x 14x 16x 15x 15x 14x 14x 37x 1x 1x 11x 11x 11x 15x 15x 15x 15x 15x 11x 11x 11x 11x 11x 1x 1x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 15x 7x 7x 7x 7x 7x 7x 7x 7x 15x 1x 1x 1x 1x 1x 1x 1x 15x 15x 15x 15x 15x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 676x 676x 14x 14x 14x 14x 676x 293x 662x 16x 16x 353x 353x 1x 1x 1x 1x 1x 1x 16x 16x 86x 16x 16x 8x 10x 1x 1x 10x 9x 30x 30x 30x 30x 30x 9x 10x 8x 8x 8x 25x 25x 25x   8x 8x 1x 1x 1x 1x 293x 293x 293x 571x 571x 571x 571x 571x 571x 571x 7x 7x 7x 7x 7x 7x 7x     7x 7x 7x 7x 7x 571x 571x 571x 571x 571x 7x 7x 7x 7x 7x 7x 571x 571x 571x 571x 571x 571x 571x 19x 19x 19x 19x 19x 19x 19x 19x 19x 19x 19x 19x 571x 571x 571x 571x 571x 571x 237x 564x 564x 80x 80x 80x 80x 80x 80x 564x 237x 237x 293x 293x 293x  
import * as fs from 'fs';
import * as os from 'os';
import * as path from 'path';
import {
  IPolicyValidationPluginBeta1,
  IPolicyValidationContextBeta1,
  PolicyViolationBeta1,
  PolicyValidationPluginReportBeta1,
} from 'aws-cdk-lib';
import { ViolationCheck, GuardResult } from './check';
import { exec } from './utils';
 
export interface CfnGuardValidatorProps {
  /**
   * Enable the default Control Tower Guard rules
   *
   * @default true
   */
  readonly controlTowerRulesEnabled?: boolean;
 
  /**
   * List of rule names to disable
   *
   * @default - no rules are disabled
   */
  readonly disabledRules?: string[];
 
  /**
   * Local file paths to either a directory containing
   * guard rules, or to an individual guard rule file
   *
   * If the path is to a directory then the directory must
   * only contain guard rule and the plugin will use
   * all the rules in the directory
   *
   * @default - no local rules will be used
   */
  readonly rules?: string[];
}
 
/**
 * Configuration for running guard with
 * a single rule file against a single template
 */
interface GuardExecutionConfig {
  /**
   * The path to the CloudFormation template that should
   * be validated
   */
  readonly templatePath: string;
 
  /**
   * The path to the guard rule file
   */
  readonly rulePath: string;
}
 
/**
 * A validation plugin using CFN Guard
 */
export class CfnGuardValidator implements IPolicyValidationPluginBeta1 {
  public readonly name: string;
  private readonly rulesPaths: string[] = [];
  private readonly guard: string;
  private readonly disabledRules: string[];
  private readonly executionConfig: GuardExecutionConfig[] = [];
 
  constructor(props: CfnGuardValidatorProps = {}) {
    this.name = 'cdk-validator-cfnguard';
    this.disabledRules = props.disabledRules ?? [];
    if (props.controlTowerRulesEnabled ?? true) {
      this.rulesPaths.push(path.join(__dirname, '..', 'rules', 'control-tower'));
    }
    this.rulesPaths.push(...props.rules ?? []);
    const osPlatform = os.platform();
    // guard calls it ubuntu but seems to apply to all linux
    // https://github.com/aws-cloudformation/cloudformation-guard/blob/184002cdfc0ae9e29c61995aae41b7d1f1d3b26c/install-guard.sh#L43-L46
    const platform = osPlatform === 'linux'
      ? 'ubuntu'
      : osPlatform === 'darwin' ? 'macos' : undefined;
 
    if (!platform) {
      throw new Error(`${os.platform()} not supported, must be either 'darwin' or 'linux'`);
    }
    this.guard = path.join(__dirname, '..', 'bin', platform, 'cfn-guard');
  }
 
  /**
   * This is (hopefully) a temporary solution to https://github.com/aws-cloudformation/cloudformation-guard/issues/180
   * Rather than try and parse the output and split out the JSON entries we'll just
   * invoke guard separately for each rule.
   */
  private generateGuardExecutionConfig(filePath: string, templatePaths: string[]): void {
    const stat = fs.statSync(filePath);
    if (stat.isDirectory()) {
      const dir = fs.readdirSync(filePath);
      dir.forEach(d => this.generateGuardExecutionConfig(path.join(filePath, d), templatePaths));
    } else {
      templatePaths.forEach(template => {
        if (!this.disabledRules.includes(path.parse(filePath).name)) {
          this.executionConfig.push({ rulePath: filePath, templatePath: template });
        }
      });
    }
  }
 
  validate(context: IPolicyValidationContextBeta1): PolicyValidationPluginReportBeta1 {
    const templatePaths = context.templatePaths;
    this.rulesPaths.forEach(rule => this.generateGuardExecutionConfig(rule, templatePaths));
    const result = this.executionConfig.reduce((acc, config) => {
      const report = this.execGuard(config);
      return {
        violations: [...acc.violations, ...report.violations],
        success: acc.success === false ? false : report.success,
      };
    }, { violations: [], success: true } as Pick<PolicyValidationPluginReportBeta1, 'success' | 'violations'>);
    return {
      ...result,
    };
  }
 
  private execGuard(config: GuardExecutionConfig): Pick<PolicyValidationPluginReportBeta1, 'success' | 'violations'> {
    const flags = [
      'validate',
      '--rules',
      config.rulePath,
      '--data',
      config.templatePath,
      '--output-format',
      'json',
      '--show-summary',
      'none',
    ];
    const violations: PolicyViolationBeta1[] = [];
    let success: boolean;
    try {
      const result = exec([this.guard, ...flags], {
        json: true,
      });
      const guardResult: GuardResult = JSON.parse(JSON.stringify(result), reviver);
      if (!guardResult.not_compliant || guardResult.not_compliant.length === 0) {
        return { success: true, violations: [] };
      }
      success = false;
      guardResult.not_compliant.forEach((check) => {
        const violationCheck = new ViolationCheck(check, config.templatePath, config.rulePath);
        const violation = violationCheck.processCheck();
        violations.push(...violation);
      });
    } catch (e) {
      success = false;
      throw new Error(`
        CfnGuardValidator plugin failed processing cfn-guard results.
        Please create an issue https://github.com/cdklabs/cdk-validator-cfnguard/issues/new
        Rule: ${path.basename(config.rulePath)}
        Error: ${e}`);
    }
    return {
      success,
      violations: violations,
    };
  }
}
 
 
/**
 * Guard does not have a standard JSON schema and the schema
 * that is returned can be dependent on the type of rule or type
 * of check that was executed. The results are very much an attempt to
 * display the internals of guard to the user. Trying to make sense of that
 * can be difficult.
 *
 * The result structure can depend on the way that the rule was written. For example
 * I could write a rule like this:
 *
 *     rule MY_RULE {
 *       # This is a "check" and is a `Clause` type check
 *       Properties.SomeProp == true
 *     }
 *
 * Or I could write a rule like this:
 *
 *     rule MY_RULE {
 *       #  This is a "check" and is a `Rule` type check
 *       check(Properties)
 *     }
 *     rule check(properties) {
 *       properties.SomeProp == true
 *     }
 *
 * Both of the above examples are checking the same thing
 * but the schema that is returned is different because the
 * way the rule was written is different
 *
 * This reviver function is executed bottom up and is essentially
 * creating a new object with a well known schema that the rest of the
 * plugin can work with. It looks for certain fields that always appear in
 * the guard results, but appear in different locations. It finds those fields
 * and then pulls them up the object, dropping any fields that we don't
 * care about. For example guard may return
 *
 * {
 *   Clause: {
 *     Unary: {
 *       check: {
 *         UnResolved: {
 *           value: {
 *             traversed_to: {...} // we only care about this!!!
 *           }
 *         }
 *       }
 *     }
 *   }
 * }
 *
 * Or it may return
 *
 * {
 *   Rule: {
 *     checks: [{
 *       Block: {
 *         unresolved: {
 *           traversed_to: {...} // we only care about this!!!
 *         }
 *       }
 *     }]
 *   }
 * }
 *
 * In the above example we only care about the 'traversed_to' field,
 * so this reviver function will grab that field and pull it up the object, dropping
 * the fields we don't care about, ending with something like
 * {
 *   checks: [{
 *     resolved: false,
 *     traversed: {...}
 *   }]
 * }
 *
 */
function reviver(key: string, value: any): any {
  if (key === 'not_compliant') {
    // not_compliant can sometimes be an empty object (but not an Array), so we
    // process this value before diving into other object values to ensure this
    // one is always made into an Array
    return Object.values(value).map((v: any) => v.Rule);
  } else if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
    return extractNestedObject(value);
  } else if (key === 'checks' && Array.isArray(value)) {
    return extractNestedChecks(value.flatMap(v => v));
  }
  return value;
}
 
/**
 * Extract a nested 'checks' object. This also handles checks
 * nested within checks. It will grab the checks at the level below
 * and pull it up to the next level.
 */
function extractNestedChecks(checks: any[]): any[] {
  const containsNestedChecks = checks.some(check => Object.values(check).some((value: any) => {
    return typeof value === 'object' && value.hasOwnProperty('checks');
  }));
  if (containsNestedChecks) {
    return checks.flatMap(check => {
      if (Object.keys(check).includes('traversed')) {
        return check;
      }
      return Object.values(check).flatMap((checkValue: any) => {
        return Object.values(checkValue.checks ?? checkValue).flatMap((nestedCheckValue: any) => {
          return {
            ...nestedCheckValue,
            name: checkValue.name,
            messages: checkValue.messages ?? nestedCheckValue.messages,
          };
        });
      });
    });
  }
  return checks.flatMap(check => {
    if (Object.keys(check).includes('traversed')) {
      return check;
    }
    return Object.values(check);
  });
}
 
/**
 * Extract a nested object and pull it up a level
 */
function extractNestedObject(object: any): any {
  let newObject = object;
  Object.entries(object).forEach(([level1NestedKey, level1NestedValue]) => {
    const nestedValue = level1NestedValue as any;
    switch (level1NestedKey.toLowerCase()) {
      // this should always be found earlier than the rest since it appears
      // within the 'unresolved' and 'resolved' objects. The object
      // is slightly different for each case so here we create
      // a new object with the key 'traversed' with a consistent value
      case 'traversed_to':
        newObject = {
          traversed: {
            to: {
              path: nestedValue.path,
              value: nestedValue.value,
            },
            from: nestedValue.from ? {
              path: nestedValue.from.path,
              value: undefined,
            } : undefined,
          },
          messages: nestedValue.messages,
        };
        break;
      // This should be found in the "second" pass after the above
      // 'traversed_to' case has been executed. We take the new
      // object that was created in the `traversed_to` case and
      // a couple other fields, dropping the rest that we don't care about
      case 'unresolved':
        newObject = {
          resolved: false,
          traversed: nestedValue.traversed,
          messages: nestedValue.messages ?? object.messages,
        };
        break;
      // This should be found in the "second" pass after the above
      // 'traversed_to' case has been executed. We take the new
      // object that was created in the `traversed_to` case and
      // a couple other fields, dropping the rest that we don't care about
      // A check can either be resolved or unresolved
      case 'resolved':
      case 'inresolved':
        newObject = {
          resolved: true,
          traversed: {
            from: nestedValue.from,
            to: {
              path: nestedValue.from.path,
              value: nestedValue.to.value,
            },
          },
          messages: nestedValue.messages,
        };
        break;
    }
    // this check will be evaluated _after_ the 'traversed_to' check and _before_ the 'resolved'
    // and 'unresolved' checks above. There may be a case where 'traversed' is nested 2 (or 3 or 4) below
    // 'unresolved' or 'resolved' and this will keep pulling it up until it is just one below
    // and the above checks can work
    if (level1NestedValue !== null && typeof level1NestedValue === 'object' && !Array.isArray(level1NestedValue)) {
      Object.entries((level1NestedValue as object)).forEach(([level2NestedKey, level2NestedValue]) => {
        switch (level2NestedKey.toLowerCase()) {
          case 'traversed':
            newObject = {
              traversed: nestedValue.traversed,
              resolved: nestedValue.resolved,
              messages: nestedValue.messages ?? level2NestedValue.messages ?? object.messages,
            };
            break;
        }
      });
    }
  });
  return newObject;
}