cloudformation-guard icon indicating copy to clipboard operation
cloudformation-guard copied to clipboard

[BUG] Guard crashed when failing resources have a `/` in their name

Open benbridts opened this issue 2 years ago • 0 comments

Describe the bug When a resource in the template has a LogicalId like Name/With/Slash, guard panics if there is a failing rule for that resource.

I know that CloudFormation does not support LogicalIds like this, but I'm not setting the type to CFNTemplate, and I'm using a tool to autogenerate templates, so I can run guard on resources not deployed by CloudFormation.

To Reproduce Template that cause a crash:

# test.yaml
Resources:
  A/Resource/Name/With/Slash:
    Metadata:
      guard:
        SuppressedRules:
          - CW_LOGGROUP_RETENTION_PERIOD_CHECK]
    Type: AWS::Logs::LogGroup
    Properties:
     RetentionInDays: !Ref AWS::NoValue

Templates that don't cause a crash:

Resources:
  A/Resource/Name/With/Slash:
    Metadata:
      guard:
        SuppressedRules:
          - CW_LOGGROUP_RETENTION_PERIOD_CHECK
    Type: AWS::Logs::LogGroup
    Properties:
     RetentionInDays: !Ref AWS::NoValue
Resources:
  AResourceNameWithoutSlash:
    Type: AWS::Logs::LogGroup
    Properties:
     RetentionInDays: !Ref AWS::NoValue

Rules file:

# test.guard
let cloudwatch_logs_retention_period = Resources.*[ Type == 'AWS::Logs::LogGroup'
  Metadata.guard.SuppressedRules not exists or
  Metadata.guard.SuppressedRules.* != "CW_LOGGROUP_RETENTION_PERIOD_CHECK"
]

rule CW_LOGGROUP_RETENTION_PERIOD_CHECK when %cloudwatch_logs_retention_period !empty {
  %cloudwatch_logs_retention_period.Properties.RetentionInDays IN [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
  <<
    Guard Rule Set: wa-Security-Pillar
    Controls: SEC-4.2    
    Violation: CloudWatch Log LogsGroup does not have RetentionInDays set.
    Fix: Set the RetentionInDays parameter to a value of 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, or 3653.
  >>
}

Outputs:

~$ cfn-guard --version
cfn-guard 2.1.0

~$ RUST_BACKTRACE=full cfn-guard validate --rules test.guard --data test.yaml --verbose
test.yaml Status = FAIL
FAILED rules
test.guard/CW_LOGGROUP_RETENTION_PERIOD_CHECK    FAIL
---
thread 'main' panicked at 'internal error: entered unreachable code', guard/src/commands/validate/cfn.rs:181:22
stack backtrace:
   0:        0x1059f1022 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h16d1a5d48aeff79a
   1:        0x105a0725a - core::fmt::write::hd4894418914ead0b
   2:        0x1059ddf18 - std::io::Write::write_fmt::h64d317bb018e2b5c
   3:        0x1059e281d - std::panicking::default_hook::{{closure}}::h4fa7fb9660e915bb
   4:        0x1059e24d5 - std::panicking::default_hook::hfc7c802f5856fff7
   5:        0x1059e2e9f - std::panicking::rust_panic_with_hook::hac34d5423636aa62
   6:        0x1059f173a - std::panicking::begin_panic_handler::{{closure}}::h20649726a6fa6320
   7:        0x1059f1137 - std::sys_common::backtrace::__rust_end_short_backtrace::hc440a536609cc112
   8:        0x1059e2963 - _rust_begin_unwind
   9:        0x105a27123 - core::panicking::panic_fmt::h72d82fb70320b112
  10:        0x105a27007 - core::panicking::panic::h87a58e33b7ea1a3b
  11:        0x10584d60e - <cfn_guard::commands::validate::cfn::CfnAware as cfn_guard::commands::validate::Reporter>::report_eval::hc8d33ce1acba6d9d
  12:        0x1058b956b - <cfn_guard::commands::validate::summary_table::SummaryTable as cfn_guard::commands::validate::Reporter>::report_eval::h8d37524a59a27ed9
  13:        0x10583a46f - cfn_guard::commands::validate::evaluate_against_data_input::h1037e0c24b3f10a7
  14:        0x105838411 - <cfn_guard::commands::validate::Validate as cfn_guard::command::Command>::execute::h46260735b9a23b17
  15:        0x10586a8bc - cfn_guard::main::h8c97f5746ff0d553
  16:        0x10581baab - std::sys_common::backtrace::__rust_begin_short_backtrace::h7155b2c6000cfb03
  17:        0x105874788 - std::rt::lang_start::{{closure}}::hf4f32c13dc484b4b
  18:        0x1059d5b65 - std::rt::lang_start_internal::hd120a3e2e99da107
  19:        0x105870139 - _main

Operating System: MacOS OS Version Montery 12.4 (21F79)

benbridts avatar Jul 15 '22 10:07 benbridts