cdk-nag
Version:
Check CDK v2 applications for best practices using a combination on available rule packs.
62 lines • 7.65 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
/*
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
SPDX-License-Identifier: Apache-2.0
*/
const path_1 = require("path");
const aws_cdk_lib_1 = require("aws-cdk-lib");
const aws_apigateway_1 = require("aws-cdk-lib/aws-apigateway");
const aws_apigatewayv2_1 = require("aws-cdk-lib/aws-apigatewayv2");
const aws_sam_1 = require("aws-cdk-lib/aws-sam");
const nag_rules_1 = require("../../nag-rules");
const isJSON = (str) => {
try {
JSON.parse(str);
}
catch (e) {
return false;
}
return true;
};
/**
* API Gateway logs are configured in JSON format.
* @param node the CfnResource to check
*/
exports.default = Object.defineProperty((node) => {
if (node instanceof aws_sam_1.CfnApi ||
node instanceof aws_sam_1.CfnHttpApi ||
node instanceof aws_apigateway_1.CfnStage) {
const accessLogSetting = aws_cdk_lib_1.Stack.of(node).resolve(node.accessLogSetting);
if (!accessLogSetting) {
return nag_rules_1.NagRuleCompliance.NOT_APPLICABLE;
}
if (isJSON(accessLogSetting.format)) {
return nag_rules_1.NagRuleCompliance.COMPLIANT;
}
return nag_rules_1.NagRuleCompliance.NON_COMPLIANT;
}
else if (node instanceof aws_apigateway_1.CfnDeployment) {
const stageDescription = aws_cdk_lib_1.Stack.of(node).resolve(node.stageDescription);
const accessLogSetting = stageDescription.accessLogSetting;
if (!accessLogSetting) {
return nag_rules_1.NagRuleCompliance.NOT_APPLICABLE;
}
if (isJSON(accessLogSetting.format)) {
return nag_rules_1.NagRuleCompliance.COMPLIANT;
}
return nag_rules_1.NagRuleCompliance.NON_COMPLIANT;
}
else if (node instanceof aws_apigatewayv2_1.CfnStage) {
const accessLogSetting = aws_cdk_lib_1.Stack.of(node).resolve(node.accessLogSettings);
if (!accessLogSetting) {
return nag_rules_1.NagRuleCompliance.NOT_APPLICABLE;
}
if (isJSON(accessLogSetting.format)) {
return nag_rules_1.NagRuleCompliance.COMPLIANT;
}
return nag_rules_1.NagRuleCompliance.NON_COMPLIANT;
}
return nag_rules_1.NagRuleCompliance.NOT_APPLICABLE;
}, 'name', { value: (0, path_1.parse)(__filename).name });
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQVBJR1dTdHJ1Y3R1cmVkTG9nZ2luZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9ydWxlcy9hcGlndy9BUElHV1N0cnVjdHVyZWRMb2dnaW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUE7OztFQUdFO0FBQ0YsK0JBQTZCO0FBQzdCLDZDQUFpRDtBQUNqRCwrREFBcUU7QUFDckUsbUVBQXNFO0FBQ3RFLGlEQUF5RDtBQUN6RCwrQ0FBb0Q7QUFFcEQsTUFBTSxNQUFNLEdBQUcsQ0FBQyxHQUFXLEVBQUUsRUFBRTtJQUM3QixJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2xCLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1gsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxrQkFBZSxNQUFNLENBQUMsY0FBYyxDQUNsQyxDQUFDLElBQWlCLEVBQXFCLEVBQUU7SUFDdkMsSUFDRSxJQUFJLFlBQVksZ0JBQU07UUFDdEIsSUFBSSxZQUFZLG9CQUFVO1FBQzFCLElBQUksWUFBWSx5QkFBUSxFQUN4QixDQUFDO1FBQ0QsTUFBTSxnQkFBZ0IsR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDdkUsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDdEIsT0FBTyw2QkFBaUIsQ0FBQyxjQUFjLENBQUM7UUFDMUMsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDcEMsT0FBTyw2QkFBaUIsQ0FBQyxTQUFTLENBQUM7UUFDckMsQ0FBQztRQUNELE9BQU8sNkJBQWlCLENBQUMsYUFBYSxDQUFDO0lBQ3pDLENBQUM7U0FBTSxJQUFJLElBQUksWUFBWSw4QkFBYSxFQUFFLENBQUM7UUFDekMsTUFBTSxnQkFBZ0IsR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDdkUsTUFBTSxnQkFBZ0IsR0FBRyxnQkFBZ0IsQ0FBQyxnQkFBZ0IsQ0FBQztRQUMzRCxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUN0QixPQUFPLDZCQUFpQixDQUFDLGNBQWMsQ0FBQztRQUMxQyxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUNwQyxPQUFPLDZCQUFpQixDQUFDLFNBQVMsQ0FBQztRQUNyQyxDQUFDO1FBQ0QsT0FBTyw2QkFBaUIsQ0FBQyxhQUFhLENBQUM7SUFDekMsQ0FBQztTQUFNLElBQUksSUFBSSxZQUFZLDJCQUFVLEVBQUUsQ0FBQztRQUN0QyxNQUFNLGdCQUFnQixHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN4RSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUN0QixPQUFPLDZCQUFpQixDQUFDLGNBQWMsQ0FBQztRQUMxQyxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUNwQyxPQUFPLDZCQUFpQixDQUFDLFNBQVMsQ0FBQztRQUNyQyxDQUFDO1FBQ0QsT0FBTyw2QkFBaUIsQ0FBQyxhQUFhLENBQUM7SUFDekMsQ0FBQztJQUNELE9BQU8sNkJBQWlCLENBQUMsY0FBYyxDQUFDO0FBQzFDLENBQUMsRUFDRCxNQUFNLEVBQ04sRUFBRSxLQUFLLEVBQUUsSUFBQSxZQUFLLEVBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQ2xDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKlxuQ29weXJpZ2h0IEFtYXpvbi5jb20sIEluYy4gb3IgaXRzIGFmZmlsaWF0ZXMuIEFsbCBSaWdodHMgUmVzZXJ2ZWQuXG5TUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuKi9cbmltcG9ydCB7IHBhcnNlIH0gZnJvbSAncGF0aCc7XG5pbXBvcnQgeyBDZm5SZXNvdXJjZSwgU3RhY2sgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBDZm5EZXBsb3ltZW50LCBDZm5TdGFnZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1hcGlnYXRld2F5JztcbmltcG9ydCB7IENmblN0YWdlIGFzIENmblN0YWdlVjIgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtYXBpZ2F0ZXdheXYyJztcbmltcG9ydCB7IENmbkFwaSwgQ2ZuSHR0cEFwaSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1zYW0nO1xuaW1wb3J0IHsgTmFnUnVsZUNvbXBsaWFuY2UgfSBmcm9tICcuLi8uLi9uYWctcnVsZXMnO1xuXG5jb25zdCBpc0pTT04gPSAoc3RyOiBzdHJpbmcpID0+IHtcbiAgdHJ5IHtcbiAgICBKU09OLnBhcnNlKHN0cik7XG4gIH0gY2F0Y2ggKGUpIHtcbiAgICByZXR1cm4gZmFsc2U7XG4gIH1cbiAgcmV0dXJuIHRydWU7XG59O1xuXG4vKipcbiAqIEFQSSBHYXRld2F5IGxvZ3MgYXJlIGNvbmZpZ3VyZWQgaW4gSlNPTiBmb3JtYXQuXG4gKiBAcGFyYW0gbm9kZSB0aGUgQ2ZuUmVzb3VyY2UgdG8gY2hlY2tcbiAqL1xuZXhwb3J0IGRlZmF1bHQgT2JqZWN0LmRlZmluZVByb3BlcnR5KFxuICAobm9kZTogQ2ZuUmVzb3VyY2UpOiBOYWdSdWxlQ29tcGxpYW5jZSA9PiB7XG4gICAgaWYgKFxuICAgICAgbm9kZSBpbnN0YW5jZW9mIENmbkFwaSB8fFxuICAgICAgbm9kZSBpbnN0YW5jZW9mIENmbkh0dHBBcGkgfHxcbiAgICAgIG5vZGUgaW5zdGFuY2VvZiBDZm5TdGFnZVxuICAgICkge1xuICAgICAgY29uc3QgYWNjZXNzTG9nU2V0dGluZyA9IFN0YWNrLm9mKG5vZGUpLnJlc29sdmUobm9kZS5hY2Nlc3NMb2dTZXR0aW5nKTtcbiAgICAgIGlmICghYWNjZXNzTG9nU2V0dGluZykge1xuICAgICAgICByZXR1cm4gTmFnUnVsZUNvbXBsaWFuY2UuTk9UX0FQUExJQ0FCTEU7XG4gICAgICB9XG4gICAgICBpZiAoaXNKU09OKGFjY2Vzc0xvZ1NldHRpbmcuZm9ybWF0KSkge1xuICAgICAgICByZXR1cm4gTmFnUnVsZUNvbXBsaWFuY2UuQ09NUExJQU5UO1xuICAgICAgfVxuICAgICAgcmV0dXJuIE5hZ1J1bGVDb21wbGlhbmNlLk5PTl9DT01QTElBTlQ7XG4gICAgfSBlbHNlIGlmIChub2RlIGluc3RhbmNlb2YgQ2ZuRGVwbG95bWVudCkge1xuICAgICAgY29uc3Qgc3RhZ2VEZXNjcmlwdGlvbiA9IFN0YWNrLm9mKG5vZGUpLnJlc29sdmUobm9kZS5zdGFnZURlc2NyaXB0aW9uKTtcbiAgICAgIGNvbnN0IGFjY2Vzc0xvZ1NldHRpbmcgPSBzdGFnZURlc2NyaXB0aW9uLmFjY2Vzc0xvZ1NldHRpbmc7XG4gICAgICBpZiAoIWFjY2Vzc0xvZ1NldHRpbmcpIHtcbiAgICAgICAgcmV0dXJuIE5hZ1J1bGVDb21wbGlhbmNlLk5PVF9BUFBMSUNBQkxFO1xuICAgICAgfVxuICAgICAgaWYgKGlzSlNPTihhY2Nlc3NMb2dTZXR0aW5nLmZvcm1hdCkpIHtcbiAgICAgICAgcmV0dXJuIE5hZ1J1bGVDb21wbGlhbmNlLkNPTVBMSUFOVDtcbiAgICAgIH1cbiAgICAgIHJldHVybiBOYWdSdWxlQ29tcGxpYW5jZS5OT05fQ09NUExJQU5UO1xuICAgIH0gZWxzZSBpZiAobm9kZSBpbnN0YW5jZW9mIENmblN0YWdlVjIpIHtcbiAgICAgIGNvbnN0IGFjY2Vzc0xvZ1NldHRpbmcgPSBTdGFjay5vZihub2RlKS5yZXNvbHZlKG5vZGUuYWNjZXNzTG9nU2V0dGluZ3MpO1xuICAgICAgaWYgKCFhY2Nlc3NMb2dTZXR0aW5nKSB7XG4gICAgICAgIHJldHVybiBOYWdSdWxlQ29tcGxpYW5jZS5OT1RfQVBQTElDQUJMRTtcbiAgICAgIH1cbiAgICAgIGlmIChpc0pTT04oYWNjZXNzTG9nU2V0dGluZy5mb3JtYXQpKSB7XG4gICAgICAgIHJldHVybiBOYWdSdWxlQ29tcGxpYW5jZS5DT01QTElBTlQ7XG4gICAgICB9XG4gICAgICByZXR1cm4gTmFnUnVsZUNvbXBsaWFuY2UuTk9OX0NPTVBMSUFOVDtcbiAgICB9XG4gICAgcmV0dXJuIE5hZ1J1bGVDb21wbGlhbmNlLk5PVF9BUFBMSUNBQkxFO1xuICB9LFxuICAnbmFtZScsXG4gIHsgdmFsdWU6IHBhcnNlKF9fZmlsZW5hbWUpLm5hbWUgfVxuKTtcbiJdfQ==