Skip to content
This repository was archived by the owner on Oct 4, 2024. It is now read-only.

Commit d67387a

Browse files
petherspethers
committed
add rules
1 parent ea6beed commit d67387a

File tree

3 files changed

+100
-2
lines changed

3 files changed

+100
-2
lines changed

‎src/main/java/com/hack23/sonar/cloudformation/CloudformationQualityProfile.java

+6
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,10 @@ public final class CloudformationQualityProfile implements BuiltInQualityProfile
6868
SUPPORTED_RULES.add("F35");
6969
SUPPORTED_RULES.add("F36");
7070
SUPPORTED_RULES.add("F37");
71+
SUPPORTED_RULES.add("F38");
72+
SUPPORTED_RULES.add("F39");
73+
SUPPORTED_RULES.add("F40");
74+
SUPPORTED_RULES.add("F50");
7175

7276
SUPPORTED_RULES.add("F665");
7377
SUPPORTED_RULES.add("F1000");
@@ -101,6 +105,8 @@ public final class CloudformationQualityProfile implements BuiltInQualityProfile
101105
SUPPORTED_RULES.add("W33");
102106
SUPPORTED_RULES.add("W34");
103107
SUPPORTED_RULES.add("W35");
108+
SUPPORTED_RULES.add("W36");
109+
SUPPORTED_RULES.add("W37");
104110

105111
}
106112

‎src/main/resources/cloudformation-rules.xml

+93-1
Original file line numberDiff line numberDiff line change
@@ -552,6 +552,66 @@
552552
<tag>owasp-a6</tag>
553553
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
554554
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
555+
</rule>
556+
<rule>
557+
<key>F38</key>
558+
<name>IAM role should not allow * resource with PassRole action on its permissions policy.</name>
559+
<internalKey>F38</internalKey>
560+
<description>IAM role should not allow * resource with PassRole action on its permissions policy.</description>
561+
<severity>BLOCKER</severity>
562+
<cardinality>SINGLE</cardinality>
563+
<status>READY</status>
564+
<type>VULNERABILITY</type>
565+
<tag>security</tag>
566+
<tag>cfn-nag</tag>
567+
<tag>owasp-a6</tag>
568+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
569+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
570+
</rule>
571+
<rule>
572+
<key>F39</key>
573+
<name>IAM policy should not allow * resource with PassRole action.</name>
574+
<internalKey>F39</internalKey>
575+
<description>IAM policy should not allow * resource with PassRole action.</description>
576+
<severity>BLOCKER</severity>
577+
<cardinality>SINGLE</cardinality>
578+
<status>READY</status>
579+
<type>VULNERABILITY</type>
580+
<tag>security</tag>
581+
<tag>cfn-nag</tag>
582+
<tag>owasp-a6</tag>
583+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
584+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
585+
</rule>
586+
<rule>
587+
<key>F40</key>
588+
<name>IAM managed policy should not allow a * resource with PassRole action.</name>
589+
<internalKey>F40</internalKey>
590+
<description>IAM managed policy should not allow a * resource with PassRole action.</description>
591+
<severity>BLOCKER</severity>
592+
<cardinality>SINGLE</cardinality>
593+
<status>READY</status>
594+
<type>VULNERABILITY</type>
595+
<tag>security</tag>
596+
<tag>cfn-nag</tag>
597+
<tag>owasp-a6</tag>
598+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
599+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
600+
</rule>
601+
<rule>
602+
<key>F50</key>
603+
<name>Amplify App BasicAuthConfig Password must not be a plaintext string or a Ref to a NoEcho Parameter with a Default value.</name>
604+
<internalKey>F50</internalKey>
605+
<description>Amplify App BasicAuthConfig Password must not be a plaintext string or a Ref to a NoEcho Parameter with a Default value.</description>
606+
<severity>BLOCKER</severity>
607+
<cardinality>SINGLE</cardinality>
608+
<status>READY</status>
609+
<type>VULNERABILITY</type>
610+
<tag>security</tag>
611+
<tag>cfn-nag</tag>
612+
<tag>owasp-a6</tag>
613+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
614+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
555615
</rule>
556616
<rule>
557617
<key>F665</key>
@@ -1042,5 +1102,37 @@
10421102
<tag>owasp-a10</tag>
10431103
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
10441104
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
1045-
</rule>
1105+
</rule>
1106+
<rule>
1107+
<key>W36</key>
1108+
<name>Security group rules without a description</name>
1109+
<internalKey>W36</internalKey>
1110+
<description>Security group rules without a description obscure their purpose and may lead to bad practices in ensuring they only allow traffic from the ports and sources/destinations required.</description>
1111+
<severity>MAJOR</severity>
1112+
<cardinality>SINGLE</cardinality>
1113+
<status>READY</status>
1114+
<type>VULNERABILITY</type>
1115+
<tag>security</tag>
1116+
<tag>cfn-nag</tag>
1117+
<tag>owasp-a6</tag>
1118+
<tag>cweid-732</tag>
1119+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
1120+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
1121+
</rule>
1122+
<rule>
1123+
<key>W37</key>
1124+
<name>EBS Volume should specify a KmsKeyId value</name>
1125+
<internalKey>W37</internalKey>
1126+
<description>EBS Volume should specify a KmsKeyId value</description>
1127+
<severity>MAJOR</severity>
1128+
<cardinality>SINGLE</cardinality>
1129+
<status>READY</status>
1130+
<type>VULNERABILITY</type>
1131+
<tag>security</tag>
1132+
<tag>cfn-nag</tag>
1133+
<tag>owasp-a6</tag>
1134+
<tag>cweid-311</tag>
1135+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
1136+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
1137+
</rule>
10461138
</cloudformation-rules>

‎src/test/java/com/hack23/sonar/cloudformation/CloudformationQualityProfileTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public void defineTest() {
3939
final BuiltInQualityProfile qualityProfile = context.profile(CloudformationLanguage.KEY,"Cloudformation Rules");
4040
assertNotNull(qualityProfile);
4141
assertTrue(qualityProfile.isDefault());
42-
assertEquals(66,qualityProfile.rules().size());
42+
assertEquals(72,qualityProfile.rules().size());
4343

4444

4545
}

0 commit comments

Comments
 (0)