cfn-guard 3.2.0

AWS CloudFormation Guard is an open-source general-purpose policy-as-code evaluation tool. It provides developers with a simple-to-use, yet powerful and expressive domain-specific language (DSL) to define policies and enables developers to validate JSON- or YAML- formatted structured data with those policies.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#
# In this simple example, we will re-format an ARN by moving around some sections in it.
#
# We will start with a normal ARN that has the following pattern:
#    arn:<Partition>:<Service>:<Region>:<AccountID>:<ResourceType>/<ResourceID>
# and we will try to convert it to:
#    <Partition>/<AccountID>/<Region>/<Service>-<ResourceType>/<ResourceID>
#
# For example:
#    arn:aws:newservice:us-west-2:123456789012:Table/extracted
# becomes:
#    aws/123456789012/us-west-2/newservice-Table/extracted
#


let template = Resources.*[ Type == 'AWS::New::Service']

rule SOME_RULE when %template !empty {
    %template.Properties.Arn exists
    let arn = %template.Properties.Arn
    
    let arn_partition_regex = "^arn:(\w+):(\w+):([\w0-9-]+):(\d+):(.+)$"
    let capture_group_reordering = "${1}/${4}/${3}/${2}-${5}"
    let res = regex_replace(%arn, %arn_partition_regex, %capture_group_reordering)

    %res == "aws/123456789012/us-west-2/newservice-Table/extracted"
}