Class: IamRolePassRoleWildcardResourceRule
- Defined in:
- lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb
Constant Summary collapse
- IAM_ACTION_PATTERNS =
wildcard_patterns('PassRole').map! { |x| 'iam:' + x } + ['*']
Instance Method Summary collapse
Methods inherited from BaseRule
Instance Method Details
#audit_impl(cfn_model) ⇒ Object
22 23 24 25 26 27 28 29 30 31 32 33 |
# File 'lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb', line 22 def audit_impl(cfn_model) violating_roles = cfn_model.resources_by_type('AWS::IAM::Role').select do |role| violating_policies = role.policy_objects.select do |policy| violating_statements = policy.policy_document.statements.select do |statement| passrole_action?(statement) && wildcard_resource?(statement) end !violating_statements.empty? end !violating_policies.empty? end violating_roles.map(&:logical_resource_id) end |
#rule_id ⇒ Object
18 19 20 |
# File 'lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb', line 18 def rule_id 'F38' end |
#rule_text ⇒ Object
10 11 12 |
# File 'lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb', line 10 def rule_text 'IAM role should not allow * resource with PassRole action on its permissions policy' end |
#rule_type ⇒ Object
14 15 16 |
# File 'lib/cfn-nag/custom_rules/IamRolePassRoleWildcardResourceRule.rb', line 14 def rule_type Violation::FAILING_VIOLATION end |