diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/query.rego b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/query.rego index 23bfaf7b392..c4268ea01f4 100644 --- a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/query.rego +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/query.rego @@ -5,17 +5,56 @@ import data.generic.common as common_lib CxPolicy[result] { document := input.document[i] resource := document.Resources[key] - resource.Type == "AWS::CloudWatch::Alarm" + resource.Type == "AWS::ApiGateway::Stage" properties := resource.Properties - not common_lib.valid_key(properties, "Metrics") + not common_lib.valid_key(properties, "MethodSettings") result := { "documentId": input.document[i].id, "searchKey": sprintf("Resources.%s.Properties", [key]), "issueType": "MissingAttribute", - "keyExpectedValue": sprintf("Resources.%s.Properties.Metrics should be defined", [key]), - "keyActualValue": sprintf("Resources.%s.Properties.Metrics is undefined", [key]), + "keyExpectedValue": sprintf("Resources.%s.Properties.MethodSettings should be defined", [key]), + "keyActualValue": sprintf("Resources.%s.Properties.MethodSettings is undefined", [key]), + "searchLine": common_lib.build_search_line(["Resources", key, "Properties"], []), + } +} + +CxPolicy[result] { + document := input.document[i] + resource := document.Resources[key] + resource.Type == "AWS::ApiGateway::Stage" + + methods := resource.Properties.MethodSettings + method := methods[idx] + not common_lib.valid_key(method, "MetricsEnabled") + + result := { + "documentId": input.document[i].id, + "searchKey": sprintf("Resources.%s.Properties.MethodSettings", [key]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("Resources.%s.Properties.MethodSettings[%d].MetricsEnabled should be set to true", [key, idx]), + "keyActualValue": sprintf("Resources.%s.Properties.MethodSettings[%d].MetricsEnabled is undefined", [key, idx]), + "searchLine": common_lib.build_search_line(["Resources", key, "Properties", "MethodSettings"], [idx]), + } +} + +CxPolicy[result] { + document := input.document[i] + resource := document.Resources[key] + resource.Type == "AWS::ApiGateway::Stage" + + methods := resource.Properties.MethodSettings + method := methods[idx] + method.MetricsEnabled == "false" + + result := { + "documentId": input.document[i].id, + "searchKey": sprintf("Resources.%s.Properties.MethodSettings", [key]), + "issueType": "MissingAttribute", + "keyExpectedValue": sprintf("Resources.%s.Properties.MethodSettings[%d].MetricsEnabled should be set to true", [key, idx]), + "keyActualValue": sprintf("Resources.%s.Properties.MethodSettings[%d].MetricsEnabled is set to false", [key, idx]), + "searchLine": common_lib.build_search_line(["Resources", key, "Properties", "MethodSettings", idx], ["MetricsEnabled"]), } } diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative1.yaml b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative1.yaml index 86b90a5b14a..1bb00d62c97 100644 --- a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative1.yaml +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative1.yaml @@ -1,29 +1,29 @@ AWSTemplateFormatVersion: 2010-09-09 -Description: Creating ECS service +Description: Creating TestDeployment Resources: - LambdaInvocationsAnomalyDetector: - Type: AWS::CloudWatch::AnomalyDetector + Prod: + Type: AWS::ApiGateway::Stage Properties: - MetricName: Invocations - Namespace: AWS/Lambda - Stat: Sum - - LambdaInvocationsAlarm: - Type: AWS::CloudWatch::Alarm - Properties: - AlarmDescription: Lambda invocations - AlarmName: LambdaInvocationsAlarm - ComparisonOperator: LessThanLowerOrGreaterThanUpperThreshold - EvaluationPeriods: 1 - Metrics: - - Expression: ANOMALY_DETECTION_BAND(m1, 2) - Id: ad1 - - Id: m1 - MetricStat: - Metric: - MetricName: Invocations - Namespace: AWS/Lambda - Period: !!int 86400 - Stat: Sum - ThresholdMetricId: ad1 - TreatMissingData: breaching + StageName: Prod + Description: Prod Stage + RestApiId: !Ref MyRestApi + DeploymentId: !Ref TestDeployment + DocumentationVersion: !Ref MyDocumentationVersion + ClientCertificateId: !Ref ClientCertificate + Variables: + Stack: Prod + MethodSettings: + - ResourcePath: / + HttpMethod: GET + MetricsEnabled: 'true' + DataTraceEnabled: 'false' + - ResourcePath: /stack + HttpMethod: POST + MetricsEnabled: 'true' + DataTraceEnabled: 'false' + ThrottlingBurstLimit: '999' + - ResourcePath: /stack + HttpMethod: GET + MetricsEnabled: 'true' + DataTraceEnabled: 'false' + ThrottlingBurstLimit: '555' diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative2.json b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative2.json index b5d15d62d25..2f5f864019f 100644 --- a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative2.json +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/negative2.json @@ -1,39 +1,47 @@ { "Resources": { - "LambdaInvocationsAnomalyDetector2": { - "Type": "AWS::CloudWatch::AnomalyDetector", + "Prod": { + "Type": "AWS::ApiGateway::Stage", "Properties": { - "MetricName": "Invocations", - "Namespace": "AWS/Lambda", - "Statistic": "Sum" - } - }, - "LambdaInvocationsAlarm2": { - "Type": "AWS::CloudWatch::Alarm", - "Properties": { - "AlarmDescription": "Lambda invocations", - "AlarmName": "LambdaInvocationsAlarm", - "ComparisonOperator": "LessThanLowerOrGreaterThanUpperThreshold", - "EvaluationPeriods": 1, - "Metrics": [ + "StageName": "Prod", + "Description": "Prod Stage", + "RestApiId": { + "Ref": "MyRestApi" + }, + "DeploymentId": { + "Ref": "TestDeployment" + }, + "DocumentationVersion": { + "Ref": "MyDocumentationVersion" + }, + "ClientCertificateId": { + "Ref": "ClientCertificate" + }, + "Variables": { + "Stack": "Prod" + }, + "MethodSettings": [ + { + "ResourcePath": "/", + "HttpMethod": "GET", + "MetricsEnabled": "true", + "DataTraceEnabled": "false" + }, { - "Expression": "ANOMALY_DETECTION_BAND(m1, 2)", - "Id": "ad1" + "ResourcePath": "/stack", + "HttpMethod": "POST", + "MetricsEnabled": "true", + "DataTraceEnabled": "false", + "ThrottlingBurstLimit": "999" }, { - "Id": "m1", - "MetricStat": { - "Metric": { - "MetricName": "Invocations", - "Namespace": "AWS/Lambda" - }, - "Period": 86400, - "Stat": "Sum" - } + "ResourcePath": "/stack", + "HttpMethod": "GET", + "MetricsEnabled": "true", + "DataTraceEnabled": "false", + "ThrottlingBurstLimit": "555" } - ], - "ThresholdMetricId": "ad1", - "TreatMissingData": "breaching" + ] } } } diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive1.yaml b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive1.yaml index d4c47b7c453..90aacac6e8e 100644 --- a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive1.yaml +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive1.yaml @@ -1,19 +1,28 @@ -AWSTemplateFormatVersion: "2010-09-09" -Description: Creating ECS service +AWSTemplateFormatVersion: 2010-09-09 +Description: Creating TestDeployment Resources: - LambdaInvocationsAnomalyDetector3: - Type: AWS::CloudWatch::AnomalyDetector + Prod: + Type: AWS::ApiGateway::Stage Properties: - MetricName: Invocations - Namespace: AWS/Lambda - Stat: Sum - - LambdaInvocationsAlarm3: - Type: AWS::CloudWatch::Alarm - Properties: - AlarmDescription: Lambda invocations - AlarmName: LambdaInvocationsAlarm - ComparisonOperator: LessThanLowerOrGreaterThanUpperThreshold - EvaluationPeriods: 1 - ThresholdMetricId: ad1 - TreatMissingData: breaching + StageName: Prod + Description: Prod Stage + RestApiId: !Ref MyRestApi + DeploymentId: !Ref TestDeployment + DocumentationVersion: !Ref MyDocumentationVersion + ClientCertificateId: !Ref ClientCertificate + Variables: + Stack: Prod + MethodSettings: + - ResourcePath: / + HttpMethod: GET + MetricsEnabled: 'false' + DataTraceEnabled: 'false' + - ResourcePath: /stack + HttpMethod: POST + DataTraceEnabled: 'false' + ThrottlingBurstLimit: '999' + - ResourcePath: /stack + HttpMethod: GET + MetricsEnabled: 'true' + DataTraceEnabled: 'false' + ThrottlingBurstLimit: '555' diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive2.json b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive2.json index cd8b8688adf..ac339a4ee96 100644 --- a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive2.json +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive2.json @@ -1,22 +1,46 @@ { "Resources": { - "LambdaInvocationsAnomalyDetector4": { - "Type": "AWS::CloudWatch::AnomalyDetector", + "Prod": { + "Type": "AWS::ApiGateway::Stage", "Properties": { - "MetricName": "Invocations", - "Namespace": "AWS/Lambda", - "Statistic": "Sum" - } - }, - "LambdaInvocationsAlarm4": { - "Type": "AWS::CloudWatch::Alarm", - "Properties": { - "AlarmDescription": "Lambda invocations", - "AlarmName": "LambdaInvocationsAlarm", - "ComparisonOperator": "LessThanLowerOrGreaterThanUpperThreshold", - "EvaluationPeriods": 1, - "ThresholdMetricId": "ad1", - "TreatMissingData": "breaching" + "StageName": "Prod", + "Description": "Prod Stage", + "RestApiId": { + "Ref": "MyRestApi" + }, + "DeploymentId": { + "Ref": "TestDeployment" + }, + "DocumentationVersion": { + "Ref": "MyDocumentationVersion" + }, + "ClientCertificateId": { + "Ref": "ClientCertificate" + }, + "Variables": { + "Stack": "Prod" + }, + "MethodSettings": [ + { + "ResourcePath": "/", + "HttpMethod": "GET", + "DataTraceEnabled": "false" + }, + { + "ResourcePath": "/stack", + "HttpMethod": "POST", + "MetricsEnabled": "false", + "DataTraceEnabled": "false", + "ThrottlingBurstLimit": "999" + }, + { + "ResourcePath": "/stack", + "HttpMethod": "GET", + "MetricsEnabled": "true", + "DataTraceEnabled": "false", + "ThrottlingBurstLimit": "555" + } + ] } } } diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive3.yaml b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive3.yaml new file mode 100644 index 00000000000..81953688ef8 --- /dev/null +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive3.yaml @@ -0,0 +1,14 @@ +AWSTemplateFormatVersion: 2010-09-09 +Description: Creating TestDeployment +Resources: + Prod: + Type: AWS::ApiGateway::Stage + Properties: + StageName: Prod + Description: Prod Stage + RestApiId: !Ref MyRestApi + DeploymentId: !Ref TestDeployment + DocumentationVersion: !Ref MyDocumentationVersion + ClientCertificateId: !Ref ClientCertificate + Variables: + Stack: Prod diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive4.json b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive4.json new file mode 100644 index 00000000000..81623b514ec --- /dev/null +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive4.json @@ -0,0 +1,26 @@ +{ + "Resources": { + "Prod": { + "Type": "AWS::ApiGateway::Stage", + "Properties": { + "StageName": "Prod", + "Description": "Prod Stage", + "RestApiId": { + "Ref": "MyRestApi" + }, + "DeploymentId": { + "Ref": "TestDeployment" + }, + "DocumentationVersion": { + "Ref": "MyDocumentationVersion" + }, + "ClientCertificateId": { + "Ref": "ClientCertificate" + }, + "Variables": { + "Stack": "Prod" + } + } + } + } +} diff --git a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive_expected_result.json b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive_expected_result.json index f1748d7eff5..8e2895e6052 100644 --- a/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive_expected_result.json +++ b/assets/queries/cloudFormation/cloudwatch_metrics_disabled/test/positive_expected_result.json @@ -2,13 +2,37 @@ { "queryName": "CloudWatch Metrics Disabled", "severity": "MEDIUM", - "line": 13, + "line": 18, "fileName": "positive1.yaml" }, { - "line": 13, - "fileName": "positive2.json", "queryName": "CloudWatch Metrics Disabled", - "severity": "MEDIUM" + "severity": "MEDIUM", + "line": 20, + "fileName": "positive1.yaml" + }, + { + "queryName": "CloudWatch Metrics Disabled", + "severity": "MEDIUM", + "line": 25, + "fileName": "positive2.json" + }, + { + "queryName": "CloudWatch Metrics Disabled", + "severity": "MEDIUM", + "line": 32, + "fileName": "positive2.json" + }, + { + "queryName": "CloudWatch Metrics Disabled", + "severity": "MEDIUM", + "line": 6, + "fileName": "positive3.yaml" + }, + { + "queryName": "CloudWatch Metrics Disabled", + "severity": "MEDIUM", + "line": 5, + "fileName": "positive4.json" } ] diff --git a/e2e/fixtures/E2E_CLI_040_RESULT.html b/e2e/fixtures/E2E_CLI_040_RESULT.html old mode 100644 new mode 100755 index 6d05b12554e..44e804098a1 --- a/e2e/fixtures/E2E_CLI_040_RESULT.html +++ b/e2e/fixtures/E2E_CLI_040_RESULT.html @@ -1,11 +1,11 @@ -KICS Scan Result
KICS REPORT08/27/2021 11:19KICS.IO
KICS vdevelopment +KICS Scan Result
KICS REPORT09/10/2021 13:07KICS.IO
KICS vdevelopment Scanned paths: fixtures/samples/positive.yaml -Platforms: CloudFormationStart time: 11:19:26, Aug 27 2021 -End time: 11:19:30, Aug 27 2021

Vulnerabilities:

4 -HIGH
12 +Platforms: CloudFormationStart time: 13:07:06, Sep 10 2021 +End time: 13:07:08, Sep 10 2021

Vulnerabilities:

4 +HIGH
11 MEDIUM
5 LOW
0 -INFO
21 +INFO
20 TOTAL

ALB Listening on HTTP

Platform: CloudFormation Category: Networking and Firewall
All Application Load Balancers (ALB) should block connection requests over HTTPhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-elb-listener.html#cfn-ec2-elb-listener-protocol
Results (1)
File: fixtures/samples/positive.yaml Line 104
Expected: 'Resources.ALBListener.Protocol' not equal to 'HTTP' @@ -23,10 +23,7 @@ Found: 'Resources.ECSALB' does not have an 'internal' scheme and a 'WebACLAssociation' associated
85 - Name: my-vol
86 ECSALB:
87 Type: AWS::ElasticLoadBalancingV2::LoadBalancer

Auto Scaling Group With No Associated ELB

Platform: CloudFormation Category: Availability
AWS Auto Scaling Groups must have associated ELBs to ensure high availability and improve application performance. This means the attribute 'LoadBalancerNames' must be defined and not empty.https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-as-group.html
Results (1)
File: fixtures/samples/positive.yaml Line 131
Expected: 'Resources.ECSAutoScalingGroup.Properties.LoadBalancerNames' is defined -Found: 'Resources.ECSAutoScalingGroup.Properties.LoadBalancerNames' is not defined
130 Type: AWS::AutoScaling::AutoScalingGroup
131 Properties:
132 VPCZoneIdentifier: !Ref 'SubnetId'

CloudWatch Metrics Disabled

Platform: CloudFormation -Category: Observability
Checks if CloudWatch Metrics is Enabledhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cw-alarm.html
Results (1)
File: fixtures/samples/positive.yaml -Line 211
Expected: Resources.ALB500sAlarmScaleUp.Properties.Metrics should be defined -Found: Resources.ALB500sAlarmScaleUp.Properties.Metrics is undefined
210 Type: AWS::CloudWatch::Alarm
211 Properties:
212 EvaluationPeriods: 1

ECS Service Without Running Tasks

Platform: CloudFormation +Found: 'Resources.ECSAutoScalingGroup.Properties.LoadBalancerNames' is not defined
130 Type: AWS::AutoScaling::AutoScalingGroup
131 Properties:
132 VPCZoneIdentifier: !Ref 'SubnetId'

ECS Service Without Running Tasks

Platform: CloudFormation Category: Availability
ECS Service should have at least 1 task runninghttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html#cfn-ecs-service-deploymentconfiguration
Results (1)
File: fixtures/samples/positive.yaml Line 159
Expected: Resources.service.Properties.DeploymentConfiguration is defined and not null Found: Resources.service.Properties.DeploymentConfiguration is undefined or null
158 Type: AWS::ECS::Service
159 Properties:
160 Cluster: !Ref 'ECSCluster'

ELB With Security Group Without Inbound Rules

Platform: CloudFormation @@ -40,29 +37,29 @@ Line 167
Expected: 'Resources.service.Properties.TaskDefinition' refers to a TaskDefinition with Role Found: 'Resources.service.Properties.TaskDefinition' does not refer to a TaskDefinition with Role
166 Role: !Ref 'ECSServiceRole'
167 TaskDefinition: !Ref 'TaskDefinition'
168 ECSServiceRole:

Security Group Ingress With Port Range

Platform: CloudFormation Category: Networking and Firewall
AWS Security Group Ingress should have a single porthttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html
Results (3)
File: fixtures/samples/positive.yaml -Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.FromPort is equal to Resources.EcsSecurityGroupALBports.Properties.ToPort -Found: Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures/samples/positive.yaml Line 19
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.FromPort is equal to Resources.EcsSecurityGroupHTTPinbound02.Properties.ToPort Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.FromPort is not equal to Resources.EcsSecurityGroupHTTPinbound02.Properties.ToPort
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures/samples/positive.yaml +Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.FromPort is equal to Resources.EcsSecurityGroupALBports.Properties.ToPort +Found: Resources.EcsSecurityGroupALBports.Properties.FromPort is not equal to Resources.EcsSecurityGroupALBports.Properties.ToPort
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures/samples/positive.yaml Line 27
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort Found: Resources.EcsSecurityGroupSSHinbound.Properties.FromPort is not equal to Resources.EcsSecurityGroupSSHinbound.Properties.ToPort
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'

Unrestricted Security Group Ingress

Platform: CloudFormation Category: Networking and Firewall
AWS Security Group Ingress CIDR should not be open to the worldhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html
Results (2)
File: fixtures/samples/positive.yaml -Line 24
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is not open to the world (0.0.0.0/0) -Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is open to the world (0.0.0.0/0)
23 ToPort: 0
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:
File: fixtures/samples/positive.yaml Line 32
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is not open to the world (0.0.0.0/0) -Found: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is open to the world (0.0.0.0/0)
31 ToPort: 0
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:

ECS Task Definition HealthCheck Missing

Platform: CloudFormation +Found: Resources.EcsSecurityGroupSSHinbound.Properties.CidrIp is open to the world (0.0.0.0/0)
31 ToPort: 0
32 CidrIp: 0.0.0.0/0
33 EcsSecurityGroupALBports:
File: fixtures/samples/positive.yaml +Line 24
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is not open to the world (0.0.0.0/0) +Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.CidrIp is open to the world (0.0.0.0/0)
23 ToPort: 0
24 CidrIp: 0.0.0.0/0
25 EcsSecurityGroupSSHinbound:

ECS Task Definition HealthCheck Missing

Platform: CloudFormation Category: Observability
Amazon ECS must have the HealthCheck property defined to give more control over monitoring the health of taskshttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-healthcheck.html
Results (2)
File: fixtures/samples/positive.yaml Line 51
Expected: 'Resources.TaskDefinition.Properties.ContainerDefinitions' contains 'HealthCheck' property Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
50 ContainerDefinitions:
51 - Name: simple-app
52 Cpu: 10
File: fixtures/samples/positive.yaml Line 67
Expected: 'Resources.TaskDefinition.Properties.ContainerDefinitions' contains 'HealthCheck' property Found: 'Resources.TaskDefinition.Properties.ContainerDefinitions' doesn't contain 'HealthCheck' property
66 - ContainerPort: 80
67 - Name: busybox
68 Cpu: 10

Security Group Rule Without Description

Platform: CloudFormation Category: Best Practices
AWS Security Group Rule should have description definedhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html
Results (3)
File: fixtures/samples/positive.yaml +Line 19
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is set +Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is undefined
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures/samples/positive.yaml Line 27
Expected: Resources.EcsSecurityGroupSSHinbound.Properties.Description is set Found: Resources.EcsSecurityGroupSSHinbound.Properties.Description is undefined
26 Type: AWS::EC2::SecurityGroupIngress
27 Properties:
28 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures/samples/positive.yaml Line 35
Expected: Resources.EcsSecurityGroupALBports.Properties.Description is set -Found: Resources.EcsSecurityGroupALBports.Properties.Description is undefined
34 Type: AWS::EC2::SecurityGroupIngress
35 Properties:
36 GroupId: !Ref 'EcsSecurityGroup'
File: fixtures/samples/positive.yaml -Line 19
Expected: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is set -Found: Resources.EcsSecurityGroupHTTPinbound02.Properties.Description is undefined
18 Type: AWS::EC2::SecurityGroupIngress
19 Properties:
20 GroupId: !Ref 'EcsSecurityGroup'
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love:
KICS is open and will always stay such. Both the scanning engine and the security queries are clear and open for the software development community.
Spread the love:
The KICS project is powered by Checkmarx, global leader of Application Security Testing
+
The KICS project is powered by Checkmarx, global leader of Application Security Testing
\ No newline at end of file