User description
This PR adds capability for cloudformation cloudsplaining to mark inspected_key_line for exposing of error lines.
Checklist:
- [x] I have performed a self-review of my own code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
- [x] I have added tests that prove my feature, policy, or fix is effective and works
- [x] New and existing tests pass locally with my changes
Generated description
Dear maintainer, below is a concise technical summary of the changes proposed in this PR:
Enhance the BaseCloudsplainingIAMCheck class to include functionality for marking inspected key lines in CloudFormation policies, aiding in error line exposure. Introduce the cloudsplaining_enrich_inspected_line method to identify and record the line number of violating actions within IAM policies. Update the Runner class to incorporate the inspected key line into the report. Modify test cases across various IAM checks to validate the new functionality, ensuring that the inspected key line is correctly identified and reported.
| Topic | Details |
|---|
| Workflow Adjustment
| Adjust GitHub workflow to include specific test files for CloudFormation checks.Modified files (1)- .github/workflows/pr-test.yml
Latest Contributors(2) |
| Cloudsplaining Enrichment
| Enhance the BaseCloudsplainingIAMCheck class to enrich inspected key lines for error exposure.Modified files (2)- checkov/cloudformation/checks/resource/base_resource_check.py
- checkov/cloudformation/checks/resource/BaseCloudsplainingIAMCheck.py
Latest Contributors(2) |
| Runner Update
| Update the Runner class to include inspected key lines in the report output.Modified files (2)- checkov/cloudformation/runner.py
- checkov/common/output/record.py
Latest Contributors(2) |
| Test Case Updates
| Modify test cases to validate the new inspected key line functionality in various IAM checks.Modified files (9)- tests/cloudformation/runner/resources/double_statement_cloudsplaining.yml
- tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMRole.py
- tests/cloudformation/runner/test_runner.py
- tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMCredentialsExposure.py
- tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMUser.py
- tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMGroup.py
- tests/cloudformation/checks/resource/aws/test_IAMWriteAccess.py
- tests/cloudformation/checks/resource/aws/test_CloudsplainingManagedPolicy.py
- tests/cloudformation/checks/resource/aws/test_IAMPermissionsManagement.py
Latest Contributors(2)| Email | Commit | Date |
|---|
| [email protected] | feat-cloudformation-En... | July 28, 2024 |
| 49649760+lirshindalman... | platform-general-remov... | January 28, 2024 |
|
This pull request is reviewed by Baz. Join @maxamel and the rest of your team on
(Baz).