cfn-guard 3.2.0

AWS CloudFormation Guard is an open-source general-purpose policy-as-code evaluation tool. It provides developers with a simple-to-use, yet powerful and expressive domain-specific language (DSL) to define policies and enables developers to validate JSON- or YAML- formatted structured data with those policies.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

use super::*;

#[test]
fn append_cdk_metadata_test() -> Result<()> {
    let resources = r#"{
         "Resources": {
            "table1F1EAFA30": {
              "Type": "AWS::DynamoDB::Table",
              "Properties": {
                "KeySchema": [
                  {
                    "AttributeName": "table1",
                    "KeyType": "HASH"
                  }
                ],
                "AttributeDefinitions": [
                  {
                    "AttributeName": "table1",
                    "AttributeType": "S"
                  }
                ],
                "ProvisionedThroughput": {
                  "ReadCapacityUnits": 5,
                  "WriteCapacityUnits": 5
                }
              },
              "UpdateReplacePolicy": "Retain",
              "DeletionPolicy": "Retain",
              "Metadata": {
                "aws:cdk:path": "FtCdkDynamoDBStack/table1/Resource"
              }
            }
        }
    }"#;
    let root = PathAwareValue::try_from(resources)?;
    let query = AccessQuery::try_from(
        "Resources['table1F1EAFA30'].Properties.ProvisionedThroughput.ReadCapacityUnits",
    )?;
    struct Capture {}
    impl EvaluationContext for Capture {
        fn resolve_variable(&self, _: &str) -> Result<Vec<&PathAwareValue>> {
            unimplemented!()
        }

        fn rule_status(&self, _: &str) -> Result<Status> {
            unimplemented!()
        }

        fn end_evaluation(
            &self,
            _: EvaluationType,
            _: &str,
            msg: String,
            _: Option<PathAwareValue>,
            _: Option<PathAwareValue>,
            _: Option<Status>,
            _cmp: Option<(CmpOperator, bool)>,
        ) {
            assert_ne!(msg.as_str(), "");
            assert!(msg.starts_with("FIRST PART"));
            assert!(msg.len() > "FIRST PART".len());
            println!("{}", msg);
        }

        fn start_evaluation(&self, _: EvaluationType, _: &str) {
            unimplemented!()
        }
    }
    let capture = Capture {};
    let appender = MetadataAppender {
        root_context: &root,
        delegate: &capture,
    };
    let value = root.select(true, &query.query, &appender)?[0];
    println!("{:?}", value);
    appender.end_evaluation(
        EvaluationType::Clause,
        "Clause",
        "FIRST PART".to_string(),
        Some(value.clone()),
        None,
        Some(Status::FAIL),
        None,
    );
    Ok(())
}