Skip to content

feat:Add a flag to support lambda output parsing#2

Open
shreyasdamle wants to merge 1 commit intodchakrav-github:parameterized-rulesfrom
shreyasdamle:lambda-parsed-output
Open

feat:Add a flag to support lambda output parsing#2
shreyasdamle wants to merge 1 commit intodchakrav-github:parameterized-rulesfrom
shreyasdamle:lambda-parsed-output

Conversation

@shreyasdamle
Copy link

@shreyasdamle shreyasdamle commented Oct 16, 2021

Description of changes:

  • Added a boolean flag parse_output to cfn_guard::run_checks. If true, it returns the parsed output. This is a breaking change for customers who are using cfn_guard as a library.
  • Removed unused function (validate_and_return_json) from validate.rs
  • Updated README for lambda.

Tests:
Payload (parse_output = true):

{"data": "{\"Resources\":{\"NewVolume\":{\"Type\":\"AWS::EC2::Volume\",\"Properties\":{\"Size\":500,\"Encrypted\":false,\"AvailabilityZone\":\"us-west-2b\"}},\"NewVolume2\":{\"Type\":\"AWS::EC2::Volume\",\"Properties\":{\"Size\":50,\"Encrypted\":false,\"AvailabilityZone\":\"us-west-2c\"}}}}", "rules" : [ "Resources.*[ Type == /EC2::Volume/ ].Properties.Encrypted == true" ], "parsed_output": true}

Output (parse_output = true):

{
  "message": [
    {
      "name": "",
      "metadata": {},
      "status": "FAIL",
      "not_compliant": [
        {
          "Rule": {
            "name": "default",
            "metadata": {},
            "messages": {
              "custom_message": null,
              "error_message": null
            },
            "checks": [
              {
                "Clause": {
                  "Binary": {
                    "context": " Resources.*. (filter-clauses).Properties.Encrypted EQUALS  Bool((Path(\"\"), true))",
                    "messages": {
                      "custom_message": "",
                      "error_message": "Check was not compliant as property value [Path=/Resources/NewVolume/Properties/Encrypted Value=false] not equal to value [Path= Value=true]."
                    },
                    "check": {
                      "Resolved": {
                        "from": {
                          "path": "/Resources/NewVolume/Properties/Encrypted",
                          "value": false
                        },
                        "to": {
                          "path": "",
                          "value": true
                        },
                        "comparison": [
                          "Eq",
                          false
                        ]
                      }
                    }
                  }
                }
              },
              {
                "Clause": {
                  "Binary": {
                    "context": " Resources.*. (filter-clauses).Properties.Encrypted EQUALS  Bool((Path(\"\"), true))",
                    "messages": {
                      "custom_message": "",
                      "error_message": "Check was not compliant as property value [Path=/Resources/NewVolume2/Properties/Encrypted Value=false] not equal to value [Path= Value=true]."
                    },
                    "check": {
                      "Resolved": {
                        "from": {
                          "path": "/Resources/NewVolume2/Properties/Encrypted",
                          "value": false
                        },
                        "to": {
                          "path": "",
                          "value": true
                        },
                        "comparison": [
                          "Eq",
                          false
                        ]
                      }
                    }
                  }
                }
              }
            ]
          }
        }
      ],
      "not_applicable": [],
      "compliant": []
    }
  ]
}

Payload (parse_output = false):

{"data": "{\"Resources\":{\"NewVolume\":{\"Type\":\"AWS::EC2::Volume\",\"Properties\":{\"Size\":500,\"Encrypted\":false,\"AvailabilityZone\":\"us-west-2b\"}},\"NewVolume2\":{\"Type\":\"AWS::EC2::Volume\",\"Properties\":{\"Size\":50,\"Encrypted\":false,\"AvailabilityZone\":\"us-west-2c\"}}}}", "rules" : [ "Resources.*[ Type == /EC2::Volume/ ].Properties.Encrypted == true" ], "parsed_output": false}

Output (parse_output = false)

{
  "message": [
    {
      "context": "File(rules=1)",
      "container": {
        "FileCheck": {
          "name": "",
          "status": "FAIL",
          "message": null
        }
      },
      "children": [
        {
          "context": "default",
          "container": {
            "RuleCheck": {
              "name": "default",
              "status": "FAIL",
              "message": null
            }
          },
          "children": [
            {
              "context": "GuardAccessClause#block Resources.*. (filter-clauses).Properties.Encrypted EQUALS  Bool((Path(\"\"), true))",
              "container": {
                "GuardClauseBlockCheck": {
                  "at_least_one_matches": false,
                  "status": "FAIL",
                  "message": null
                }
              },
              "children": [
                {
                  "context": "Filter/Map#1",
                  "container": {
                    "Filter": "PASS"
                  },
                  "children": [
                    {
                      "context": "GuardAccessClause#block Type EQUALS  Regex((Path(\"\"), \"EC2::Volume\"))",
                      "container": {
                        "GuardClauseBlockCheck": {
                          "at_least_one_matches": false,
                          "status": "PASS",
                          "message": null
                        }
                      },
                      "children": [
                        {
                          "context": " Type EQUALS  Regex((Path(\"\"), \"EC2::Volume\"))",
                          "container": {
                            "ClauseValueCheck": "Success"
                          },
                          "children": []
                        }
                      ]
                    }
                  ]
                },
                {
                  "context": "Filter/Map#1",
                  "container": {
                    "Filter": "PASS"
                  },
                  "children": [
                    {
                      "context": "GuardAccessClause#block Type EQUALS  Regex((Path(\"\"), \"EC2::Volume\"))",
                      "container": {
                        "GuardClauseBlockCheck": {
                          "at_least_one_matches": false,
                          "status": "PASS",
                          "message": null
                        }
                      },
                      "children": [
                        {
                          "context": " Type EQUALS  Regex((Path(\"\"), \"EC2::Volume\"))",
                          "container": {
                            "ClauseValueCheck": "Success"
                          },
                          "children": []
                        }
                      ]
                    }
                  ]
                },
                {
                  "context": " Resources.*. (filter-clauses).Properties.Encrypted EQUALS  Bool((Path(\"\"), true))",
                  "container": {
                    "ClauseValueCheck": {
                      "Comparison": {
                        "comparison": [
                          "Eq",
                          false
                        ],
                        "from": {
                          "Resolved": {
                            "path": "/Resources/NewVolume/Properties/Encrypted",
                            "value": false
                          }
                        },
                        "to": {
                          "Resolved": {
                            "path": "",
                            "value": true
                          }
                        },
                        "message": null,
                        "custom_message": null,
                        "status": "FAIL"
                      }
                    }
                  },
                  "children": []
                },
                {
                  "context": " Resources.*. (filter-clauses).Properties.Encrypted EQUALS  Bool((Path(\"\"), true))",
                  "container": {
                    "ClauseValueCheck": {
                      "Comparison": {
                        "comparison": [
                          "Eq",
                          false
                        ],
                        "from": {
                          "Resolved": {
                            "path": "/Resources/NewVolume2/Properties/Encrypted",
                            "value": false
                          }
                        },
                        "to": {
                          "Resolved": {
                            "path": "",
                            "value": true
                          }
                        },
                        "message": null,
                        "custom_message": null,
                        "status": "FAIL"
                      }
                    }
                  },
                  "children": []
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant