Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: Skyscanner/cfripper
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 0.18.0
Choose a base ref
...
head repository: Skyscanner/cfripper
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: master
Choose a head ref
Loading
Showing with 11,286 additions and 2,845 deletions.
  1. +0 −4 .flake8
  2. +17 −0 .github/dependabot.yml
  3. +7 −0 .github/pull_request_template.md
  4. +19 −0 .github/release-drafter.yml
  5. +28 −0 .github/workflows/lint-and-test.yml
  6. +37 −0 .github/workflows/pypi-release.yml
  7. +38 −0 .github/workflows/release-drafter.yml
  8. +21 −0 .github/workflows/test-docs.yml
  9. +8 −4 .gitignore
  10. +5 −1 .readthedocs.yml → .readthedocs.yaml
  11. +0 −16 .travis.yml
  12. +380 −0 CHANGELOG.md
  13. +34 −40 Makefile
  14. +47 −13 README.md
  15. +4 −0 cfripper/__main__.py
  16. +0 −3 cfripper/__version__.py
  17. +37 −4 cfripper/boto3_client.py
  18. +101 −22 cfripper/cli.py
  19. +538 −0 cfripper/cloudformation_actions_only_accepts_wildcard.py
  20. +140 −52 cfripper/config/config.py
  21. +93 −0 cfripper/config/constants.py
  22. +85 −33 cfripper/config/filter.py
  23. +3 −0 cfripper/config/pluggy/__init__.py
  24. +12 −0 cfripper/config/pluggy/hookspec.py
  25. +23 −0 cfripper/config/pluggy/utils.py
  26. +92 −19 cfripper/config/regex.py
  27. +11 −3 cfripper/config/rule_config.py
  28. 0 cfripper/config/rule_configs/__init__.py
  29. +46 −0 cfripper/config/rule_configs/allow_http_ports_open_to_world.py
  30. +12 −0 cfripper/config/rule_configs/example_rules_config_for_cli.py
  31. +53 −0 cfripper/config/rule_configs/firehose_ips.py
  32. +0 −125 cfripper/config/whitelist.py
  33. +2 −0 cfripper/exceptions.py
  34. +0 −158 cfripper/main.py
  35. +1 −1 cfripper/model/enums.py
  36. +48 −97 cfripper/model/result.py
  37. +8 −3 cfripper/model/utils.py
  38. +6 −76 cfripper/rule_processor.py
  39. +63 −7 cfripper/rules/__init__.py
  40. +127 −42 cfripper/rules/base_rules.py
  41. +16 −3 cfripper/rules/cloudformation_authentication.py
  42. +153 −30 cfripper/rules/cross_account_trust.py
  43. +20 −6 cfripper/rules/ebs_volume_has_sse.py
  44. +26 −18 cfripper/rules/ec2_security_group.py
  45. +27 −10 cfripper/rules/hardcoded_RDS_password.py
  46. +65 −11 cfripper/rules/iam_roles.py
  47. +52 −0 cfripper/rules/kms_key_rotation_enabled.py
  48. +29 −9 cfripper/rules/kms_key_wildcard_principal.py
  49. +63 −3 cfripper/rules/managed_policy_on_user.py
  50. +63 −3 cfripper/rules/policy_on_user.py
  51. +31 −43 cfripper/rules/privilege_escalation.py
  52. +41 −0 cfripper/rules/public_elb_checker_rule.py
  53. +93 −0 cfripper/rules/rds_security_group.py
  54. +45 −25 cfripper/rules/s3_bucket_policy.py
  55. +63 −0 cfripper/rules/s3_lifecycle_configuration.py
  56. +63 −0 cfripper/rules/s3_object_versioning.py
  57. +95 −15 cfripper/rules/s3_public_access.py
  58. +74 −0 cfripper/rules/sns_topic_policy.py
  59. +0 −29 cfripper/rules/sns_topic_policy_not_principal.py
  60. +94 −31 cfripper/rules/sqs_queue_policy.py
  61. +45 −0 cfripper/rules/stack_name_matches_regex.py
  62. +39 −0 cfripper/rules/storage_encrypted_rule.py
  63. +73 −6 cfripper/rules/wildcard_policies.py
  64. +230 −51 cfripper/rules/wildcard_principals.py
  65. +196 −0 cfripper/rules/wildcard_resource_rule.py
  66. +4 −5 docs/{macros.py → __init__.py}
  67. +63 −2 docs/cli.md
  68. +69 −0 docs/examples.md
  69. +2 −22 docs/index.md
  70. +99 −0 docs/plugin.md
  71. +0 −67 docs/rule_config.md
  72. +75 −0 docs/rule_config_and_filters.md
  73. +1 −15 docs/rules.md
  74. +19 −10 mkdocs.yml
  75. +131 −8 pyproject.toml
  76. +76 −0 requirements-dev.txt
  77. +93 −0 requirements-docs.txt
  78. +19 −20 requirements.txt
  79. +0 −54 setup.py
  80. +0 −58 simulator/simulator.py
  81. +0 −103 simulator/test_cf_scripts/test.json
  82. +80 −126 tests/config/test_config.py
  83. +151 −41 tests/config/test_filter.py
  84. +100 −0 tests/config/test_pluggy.py
  85. +48 −14 tests/config/test_regex.py
  86. +43 −0 tests/conftest.py
  87. +88 −3 tests/model/test_principal_checking_rule.py
  88. +173 −14 tests/model/test_result.py
  89. +13 −434 tests/model/test_rule_processor.py
  90. +5 −0 tests/model/test_utils.py
  91. +29 −10 tests/rules/test_CloudFormationAuthenticationRule.py
  92. +299 −127 tests/rules/test_CrossAccountTrustRule.py
  93. +32 −8 tests/rules/test_EBSVolumeHasSSERule.py
  94. +114 −47 tests/rules/test_EC2SecurityGroupIngressOpenToWorld.py
  95. +47 −31 tests/rules/test_EC2SecurityGroupMissingEgressRule.py
  96. +183 −48 tests/rules/test_EC2SecurityGroupOpenToWorldRule.py
  97. +29 −9 tests/rules/test_FullWildcardPrincipal.py
  98. +544 −0 tests/rules/test_GenericCrossAccountTrustRule.py
  99. +54 −0 tests/rules/test_GenericResourceFullWildcardPrincipal.py
  100. +137 −0 tests/rules/test_GenericResourcePartialWildcardPrincipal.py
  101. +173 −0 tests/rules/test_GenericResourceWildcardPolicyRule.py
  102. +80 −0 tests/rules/test_GenericResourceWildcardPrincipal.py
  103. +31 −47 tests/rules/test_GenericWildcardPrincipal.py
  104. +89 −25 tests/rules/test_HardcodedRDSPasswordRule.py
  105. +57 −24 tests/rules/test_IAMRoleWildcardActionOnPolicyRule.py
  106. +69 −29 tests/rules/test_IAMRolesOverprivilegedRule.py
  107. +56 −0 tests/rules/test_KMSEnabledKeyRotationRule.py
  108. +49 −22 tests/rules/test_KMSKeyWildcardPrincipal.py
  109. +27 −10 tests/rules/test_ManagedPolicyOnUserRule.py
  110. +109 −20 tests/rules/test_PartialWildcardPrincipal.py
  111. +27 −10 tests/rules/test_PolicyOnUserRule.py
  112. +68 −7 tests/rules/test_PrivilegeEscalationRule.py
  113. +58 −0 tests/rules/test_PublicELBCheckerRule.py
  114. +73 −0 tests/rules/test_RDSSecurityGroupIngressOpenToWorldRule.py
  115. +36 −7 tests/rules/test_S3BucketPolicyPrincipalRule.py
  116. +59 −11 tests/rules/test_S3BucketPublicReadAclAndListStatementRule.py
  117. +42 −0 tests/rules/test_S3BucketPublicReadAclRule.py
  118. +26 −5 tests/rules/test_S3BucketPublicReadWriteAclRule.py
  119. +57 −23 tests/rules/test_S3CrossAccountTrustRule.py
  120. +57 −0 tests/rules/test_S3LifecycleConfigurationRule.py
  121. +42 −0 tests/rules/test_S3ObjectVersioningRule.py
  122. +41 −0 tests/rules/test_SNSTopicDangerousPolicyActionsRule.py
  123. +29 −11 tests/rules/test_SNSTopicPolicyNotPrincipalRule.py
  124. +95 −0 tests/rules/test_SQSDangerousPolicyActionsRule.py
  125. +29 −11 tests/rules/test_SQSQueuePolicyNotPrincipalRule.py
  126. +56 −13 tests/rules/test_SQSQueuePolicyPublicRule.py
  127. +60 −0 tests/rules/test_StackNameMatchesRegexRule.py
  128. +88 −0 tests/rules/test_StorageEncryptedRule.py
  129. +99 −23 tests/rules/test_WildcardPoliciesRule.py
  130. +857 −0 tests/rules/test_WildcardResourceRule.py
  131. +156 −15 tests/test_boto3_client.py
  132. +79 −0 tests/test_cli.py
  133. +3 −0 tests/test_files/config/rules_config_CrossAccountTrustRule.py
  134. +20 −0 tests/test_files/config/rules_config_invalid.py
  135. +15 −0 tests/test_files/filters/test_filter_1.py
  136. +9 −0 tests/test_files/invalid_filters/invalid_filters.py
  137. +0 −104 tests/test_main.py
  138. +20 −0 tests/test_templates/config/security_group_firehose_ips.json
  139. +21 −0 tests/test_templates/rules/CrossAccountTrustRule/es_domain_basic.yml
  140. +12 −0 tests/test_templates/rules/CrossAccountTrustRule/es_domain_without_access_policies.yml
  141. +12 −0 tests/test_templates/rules/CrossAccountTrustRule/generic_resource_no_policies.json
  142. +34 −0 tests/test_templates/rules/CrossAccountTrustRule/generic_resource_with_cross_account_policy.json
  143. +18 −0 tests/test_templates/rules/CrossAccountTrustRule/generic_resources_no_policies.json
  144. +61 −0 tests/test_templates/rules/CrossAccountTrustRule/generic_resources_with_cross_account_policies.json
  145. +39 −0 .../rules/CrossAccountTrustRule/generic_resources_with_mixed_cross_account_policy_and_no_policy.json
  146. +31 −0 tests/test_templates/rules/CrossAccountTrustRule/iam_role_to_jump_to_another_account.yaml
  147. +31 −0 tests/test_templates/rules/CrossAccountTrustRule/invalid_generic_resource.json
  148. +55 −0 tests/test_templates/rules/CrossAccountTrustRule/invalid_generic_resources.json
  149. +19 −0 tests/test_templates/rules/CrossAccountTrustRule/invalid_with_sts_es_domain.yml
  150. +19 −0 tests/test_templates/rules/CrossAccountTrustRule/invalid_with_sts_opensearch_domain.yml
  151. +9 −0 tests/test_templates/rules/CrossAccountTrustRule/kms_key_without_policy.yml
  152. +36 −0 tests/test_templates/rules/CrossAccountTrustRule/mixed_invalid_generic_resources.json
  153. +21 −0 tests/test_templates/rules/CrossAccountTrustRule/opensearch_domain_basic.yml
  154. +12 −0 tests/test_templates/rules/CrossAccountTrustRule/opensearch_domain_without_access_policies.yml
  155. +19 −0 tests/test_templates/rules/CrossAccountTrustRule/valid_with_sts_es_domain.yml
  156. +19 −0 tests/test_templates/rules/CrossAccountTrustRule/valid_with_sts_opensearch_domain.yml
  157. +9 −0 tests/test_templates/rules/EBSVolumeHasSSERule/bad_template.yaml
  158. +18 −0 ...test_templates/rules/EC2SecurityGroupOpenToWorldRule/invalid_security_group_no_ports_defined.json
  159. +19 −0 tests/test_templates/rules/EC2SecurityGroupOpenToWorldRule/invalid_security_group_port78_81.json
  160. 0 tests/test_templates/rules/{FullWilcardPrincipalRule → FullWildcardPrincipalRule}/bad_template.json
  161. 0 tests/test_templates/rules/{FullWilcardPrincipalRule → FullWildcardPrincipalRule}/good_template.json
  162. +1 −1 tests/test_templates/rules/GenericWildcardPrincipalRule/bad_template.json
  163. +21 −0 tests/test_templates/rules/GenericWildcardPrincipalRule/kms_replica_key.yaml
  164. +2 −2 ...itelisted_retrieved_correctly.json → wildcard_principal_rule_is_allowed_retrieved_correctly.json}
  165. +2 −2 tests/test_templates/rules/IAMRolesOverprivilegedRule/invalid_role_inline_policy_fn_if.json
  166. +16 −0 tests/test_templates/rules/KMSEnabledKeyRotation/bad_template_symmetric_keyspec_property.yaml
  167. +15 −0 tests/test_templates/rules/KMSEnabledKeyRotation/bad_template_symmetric_no_property.yaml
  168. +16 −0 tests/test_templates/rules/KMSEnabledKeyRotation/bad_template_symmetric_property.yaml
  169. +16 −0 tests/test_templates/rules/KMSEnabledKeyRotation/good_template.yaml
  170. +63 −0 tests/test_templates/rules/KMSKeyWildcardPrincipalRule/kms_key_with_wildcard_resource.json
  171. +9 −0 tests/test_templates/rules/KMSKeyWildcardPrincipalRule/kms_key_without_policy.yml
  172. +65 −0 tests/test_templates/rules/PartialWildcardPrincipalRule/aws_elb_template.yml
  173. +3 −1 tests/test_templates/rules/PartialWildcardPrincipalRule/bad_template.json
  174. +2 −1 tests/test_templates/rules/PartialWildcardPrincipalRule/good_template.json
  175. +20 −0 tests/test_templates/rules/PartialWildcardPrincipalRule/intra_account_root_access.yml
  176. +24 −0 tests/test_templates/rules/PrivilegeEscalationRule/privilege_escalation_role.yaml
  177. +29 −0 tests/test_templates/rules/PrivilegeEscalationRule/privilege_escalation_s3_bucket_policy.yaml
  178. +2 −1 tests/test_templates/rules/PrivilegeEscalationRule/valid_role_inline_policy.json
  179. +32 −0 tests/test_templates/rules/PublicELBCheckerRule/private_elb_instance.yml
  180. +34 −0 tests/test_templates/rules/PublicELBCheckerRule/private_elb_v2_instance.yml
  181. +32 −0 tests/test_templates/rules/PublicELBCheckerRule/public_facing_elb_instance.yml
  182. +34 −0 tests/test_templates/rules/PublicELBCheckerRule/public_facing_elb_v2_instance.yml
  183. +15 −0 tests/test_templates/rules/RDSSecurityGroupIngressOpenToWorldRule/rds_sg.yaml
  184. +11 −0 tests/test_templates/rules/RDSSecurityGroupIngressOpenToWorldRule/rds_sg_ingress.yaml
  185. +11 −0 tests/test_templates/rules/S3BucketPublicReadAclRule/bad_template.json
  186. +11 −45 tests/test_templates/rules/S3CrossAccountTrustRule/s3_bucket_cross_account.json
  187. +16 −46 tests/test_templates/rules/S3CrossAccountTrustRule/s3_bucket_cross_account_and_normal.json
  188. +8 −36 tests/test_templates/rules/S3CrossAccountTrustRule/s3_bucket_cross_account_from_aws_service.json
  189. +6 −0 tests/test_templates/rules/S3LifecycleConfiguration/bad_template_no_configurations.yaml
  190. +17 −0 tests/test_templates/rules/S3LifecycleConfiguration/good_template.yaml
  191. +20 −0 tests/test_templates/rules/S3ObjectVersioning/good_template.yaml
  192. +18 −0 tests/test_templates/rules/S3ObjectVersioning/no_versioning_defined.yaml
  193. +20 −0 tests/test_templates/rules/S3ObjectVersioning/status_suspended.yaml
  194. +19 −0 tests/test_templates/rules/SNSTopicDangerousPolicyActionsRule/bad_template.yaml
  195. +94 −0 tests/test_templates/rules/SQSDangerousPolicyActionsRule/sqs_policy.json
  196. +15 −0 tests/test_templates/rules/StorageEncryptedRule/aurora_engine_used.yml
  197. +18 −0 tests/test_templates/rules/StorageEncryptedRule/encrypted_db_resource.yml
  198. +17 −0 tests/test_templates/rules/StorageEncryptedRule/missing_storage_encrypted_flag.yml
  199. +16 −0 tests/test_templates/rules/StorageEncryptedRule/no_db_resource.yml
  200. +35 −0 tests/test_templates/rules/StorageEncryptedRule/two_resources_not_encrypted.yml
  201. +117 −0 tests/test_templates/rules/WildcardPoliciesRule/generic_with_wildcards.json
  202. +25 −0 ...t_templates/rules/WildcardResourceRule/iam_policy_with_wildcard_resource_and_wildcard_action.json
  203. +30 −0 ...les/WildcardResourceRule/iam_policy_with_wildcard_resource_and_wildcard_action_and_condition.json
  204. +24 −0 ...ldcardResourceRule/iam_policy_with_wildcard_resource_and_wildcard_action_without_policy_name.json
  205. +24 −0 ...t_templates/rules/WildcardResourceRule/iam_policy_with_wildcard_resource_without_policy_name.json
  206. +28 −0 tests/test_templates/rules/WildcardResourceRule/iam_user_with_wildcard_resource.json
  207. +61 −0 tests/test_templates/rules/WildcardResourceRule/multiple_resources_with_wildcard_resources.json
  208. +11 −0 tests/test_templates/rules/WildcardResourceRule/policy_with_invalid_string_policy_document.json
  209. +25 −0 tests/test_templates/rules/WildcardResourceRule/policy_with_s3_wildcard_and_all_buckets.json
  210. +11 −0 tests/test_templates/rules/WildcardResourceRule/policy_with_string_policy_document.json
  211. +8 −1 tests/utils.py
4 changes: 0 additions & 4 deletions .flake8

This file was deleted.

17 changes: 17 additions & 0 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

version: 2
updates:
- package-ecosystem: "pip" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "monthly"
open-pull-requests-limit: 1
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 1
7 changes: 7 additions & 0 deletions .github/pull_request_template.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Description

<!-- Please include a summary of the change, how this updates the current logic and which features are added or removed. Please also include relevant motivation and context. List any dependencies that are required for this change. -->

## Checklist

- [ ] I have updated the CHANGELOG.md file accordingly
19 changes: 19 additions & 0 deletions .github/release-drafter.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name-template: 'v$RESOLVED_VERSION'
tag-template: 'v$RESOLVED_VERSION'
change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
change-title-escapes: '\<*_&' # You can add # and @ to disable mentions, and add ` to disable code blocks.
version-resolver:
major:
labels:
- 'major'
minor:
labels:
- 'minor'
patch:
labels:
- 'patch'
default: patch
template: |
## Changes
$CHANGES
28 changes: 28 additions & 0 deletions .github/workflows/lint-and-test.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: Lint & Test

on: push

jobs:
build:
runs-on: ubuntu-latest

strategy:
fail-fast: false
matrix:
python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']

name: Python ${{ matrix.python-version }}

steps:
- uses: actions/checkout@v4

- name: Setup python
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}

- run: make install-dev

- run: make lint

- run: make coverage
37 changes: 37 additions & 0 deletions .github/workflows/pypi-release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: PyPI release

on:
release:
types: [published]

jobs:
pypi-publish:
name: Upload release to PyPI
runs-on: ubuntu-latest
environment:
name: pypi
url: https://pypi.org/p/cfripper
permissions:
id-token: write
steps:
- name: Checkout
uses: actions/checkout@v4

- name: Setup python
uses: actions/setup-python@v5
with:
python-version: '3.9'

- name: Install dependencies
run: |
python -m pip install -U pip setuptools
python -m pip install -U twine build setuptools-scm
- name: Build package
run: |
python -m setuptools_scm
python -m build
twine check --strict dist/*
- name: Publish distribution 📦 to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
38 changes: 38 additions & 0 deletions .github/workflows/release-drafter.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
name: Release Drafter

on:
push:
# branches to consider in the event; optional, defaults to all
branches:
- master
# pull_request event is required only for autolabeler
pull_request:
# Only following types are handled by the action, but one can default to all as well
types: [opened, reopened, synchronize]
# pull_request_target event is required for autolabeler to support PRs from forks
pull_request_target:
types: [opened, reopened, synchronize]

permissions:
contents: read

jobs:
update_release_draft:
permissions:
# write permission is required to create a github release
contents: write
# write permission is required for autolabeler
# otherwise, read permission is required at least
pull-requests: write
runs-on: ubuntu-latest
steps:
# Drafts your next Release notes as Pull Requests are merged into "master"
- uses: actions/create-github-app-token@v1
id: app-token
with:
app-id: ${{ vars.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- uses: release-drafter/release-drafter@v6
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
21 changes: 21 additions & 0 deletions .github/workflows/test-docs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: Test Docs

on: push

jobs:
build:
runs-on: ubuntu-latest

name: Test Docs

steps:
- uses: actions/checkout@v4

- name: Setup python
uses: actions/setup-python@v5
with:
python-version: 3.9

- run: make install-docs

- run: make test-docs
12 changes: 8 additions & 4 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
# IDEs
.idea/
.vscode/

@@ -7,6 +8,7 @@
# Virtualenv
venv

# Other
.DS_Store
.project
.pydevproject
@@ -44,10 +46,6 @@ MANIFEST
*.manifest
*.spec

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
@@ -71,3 +69,9 @@ venv/
ENV/
env.bak/
venv.bak/

# Snyk Code
.dccache

# MkDocs local builds
site/
6 changes: 5 additions & 1 deletion .readthedocs.yml → .readthedocs.yaml
Original file line number Diff line number Diff line change
@@ -5,8 +5,12 @@ mkdocs:

formats: all

build:
os: ubuntu-22.04
tools:
python: "3.9"

python:
version: 3.7
install:
- method: pip
path: .
16 changes: 0 additions & 16 deletions .travis.yml

This file was deleted.

Loading