cfn-guard 3.2.0

AWS CloudFormation Guard is an open-source general-purpose policy-as-code evaluation tool. It provides developers with a simple-to-use, yet powerful and expressive domain-specific language (DSL) to define policies and enables developers to validate JSON- or YAML- formatted structured data with those policies.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

[
  {
    "name": "Empty, SKIP",
    "input": {},
    "expectations": {
      "rules": {
        "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED": "SKIP"
      }
    }
  },
  {
    "name": "No resources, SKIP",
    "input": {
      "Resources": {}
    },
    "expectations": {
      "rules": {
        "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED": "SKIP"
      }
    }
  },
  {
    "name": "S3 Bucket Encryption set to SSE AES 256, PASS",
    "input": {
      "Resources": {
        "ExampleS3": {
          "Type": "AWS::S3::Bucket",
          "Properties": {
            "BucketName": "my-bucket",
            "BucketEncryption": {
              "ServerSideEncryptionConfiguration": [
                {
                  "ServerSideEncryptionByDefault": {
                    "SSEAlgorithm": "AES256"
                  }
                }
              ]
            }
          }
        }
      }
    },
    "expectations": {
      "rules": {
        "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED": "PASS"
      }
    }
  },
  {
    "name": "S3 Bucket Encryption set to SSE AWS KMS key, PASS",
    "input": {
      "Resources": {
        "ExampleS3": {
          "Type": "AWS::S3::Bucket",
          "Properties": {
            "BucketName": "my-bucket",
            "BucketEncryption": {
              "ServerSideEncryptionConfiguration": [
                {
                  "ServerSideEncryptionByDefault": {
                    "SSEAlgorithm": "aws:kms",
                    "KMSMasterKeyID": "ARN:AWS:12345678912"
                  }
                }
              ]
            }
          }
        }
      }
    },
    "expectations": {
      "rules": {
        "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED": "PASS"
      }
    }
  },
  {
    "name": "S3 Bucket Encryption not set, FAIL",
    "input": {
      "Resources": {
        "ExampleS3": {
          "Type": "AWS::S3::Bucket",
          "Properties": {
            "BucketName": "my-bucket"
          }
        }
      }
    },
    "expectations": {
      "rules": {
        "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED": "FAIL"
      }
    }
  },
  {
    "name": "S3 Bucket Encryption not set but rule is suppressed, SKIP",
    "input": {
      "Resources": {
        "ExampleS3": {
          "Type": "AWS::S3::Bucket",
          "Metadata": {
            "guard": {
              "SuppressedRules": [
                "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
              ]
            }
          },
          "Properties": {
            "BucketName": "my-bucket"
          }
        }
      }
    },
    "expectations": {
      "rules": {
        "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED": "SKIP"
      }
    }
  }
]