cfn-guard 3.2.0

AWS CloudFormation Guard is an open-source general-purpose policy-as-code evaluation tool. It provides developers with a simple-to-use, yet powerful and expressive domain-specific language (DSL) to define policies and enables developers to validate JSON- or YAML- formatted structured data with those policies.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

use super::*;
use pretty_assertions::assert_eq;
use std::convert::TryFrom;

#[test]
fn test_absolute_pointer_traversal() -> crate::rules::Result<()> {
    let value = PathAwareValue::try_from(crate::rules::values::read_from(
        r#"
        Resources:
          Helper:
            Type: AWS::S3::Bucket
          s3:
            Type: AWS::S3::Bucket
            Properties:
              Name: MyBucket
              AnalyticsConfiguration:
                - Prefix: MyBucket/2021/10
                  StorageClassAnalysis:
                    DataExport:
                      Destination:
                        BucketAccountId: 123456789012
                        BucketArn: arn:aws:s3:us-west-2:123456789112:ThatBucket/2021
                        Format: Parquet
                  TagFilters:
                    - Key: ProdApp
                      Value: MyAppStuff
              InventoryConfigurations:
                - Id: InventoryConfigurationId
                  Destination:
                    BucketArn:
                      Fn::GetAtt:
                        - Helper
                        - Arn
                    Format: CSV
                    Prefix: InventoryDestinationPrefix
                  Enabled: true
                  IncludedObjectVersions: Current
                  Prefix: InventoryConfigurationPrefix
                  ScheduleFrequency: Weekly
        "#,
    )?)?;

    let traversal = Traversal::from(&value);
    let root = traversal.root().unwrap();
    let result = traversal.at("/", root)?;
    assert!(matches!(result, TraversalResult::Value(_)));
    if let TraversalResult::Value(curr) = result {
        assert!(std::ptr::eq(&value, curr.value));
    }
    let result = match result {
        TraversalResult::Value(val) => val,
        _ => unreachable!(),
    };

    let result = traversal.at("/Resources/s3/Properties/AnalyticsConfiguration", result)?;
    assert!(matches!(result, TraversalResult::Value(_)));
    let result = match result {
        TraversalResult::Value(val) => val,
        _ => unreachable!(),
    };
    assert!(matches!(result.value, PathAwareValue::List(_)));

    //
    // Testing relative
    //
    let upward = traversal.at("1/Name", result)?;
    assert!(matches!(upward, TraversalResult::Value(_)));
    let upward = match upward {
        TraversalResult::Value(up) => up,
        _ => unreachable!(),
    };
    match upward.value {
        PathAwareValue::String((path, value)) => {
            assert_eq!(path.0, "/Resources/s3/Properties/Name");
            assert_eq!(value, "MyBucket");
        }
        _ => unreachable!(),
    }

    Ok(())
}