Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Serverless Nag Pack #1793

Open
wants to merge 43 commits into
base: main
Choose a base branch
from

Conversation

Kevinwochan
Copy link

Fixes #

Kevinwochan and others added 30 commits April 29, 2024 12:20
Co-authored-by: Arun Donti <dontirun@gmail.com>
Co-authored-by: Arun Donti <dontirun@gmail.com>
Co-authored-by: Arun Donti <dontirun@gmail.com>
Co-authored-by: Arun Donti <dontirun@gmail.com>
@Kevinwochan
Copy link
Author

Test Suites: 50 passed, 50 total
Tests: 761 passed, 761 total
Snapshots: 0 total
Time: 10.992 s, estimated 11 s

@Kevinwochan
Copy link
Author

Service Level Name cfn-lint tflint CDK Nag
AWS Lambda Warning Lambda Tracing WS1000 aws_lambda_function_tracing_rule LambdaTracing (new)
AWS Lambda Error EventSourceMapping Failure Destination ES1001 aws_lambda_event_source_mapping_failure_destination LambdaEventSourceMappingDestination (new)
AWS Lambda Warning Lambda Permission Multiple Principals WS1002 aws_lambda_permission_multiple_principals N/A
AWS Lambda Warning Lambda Star Permissions WS1003 aws_iam_role_lambda_no_star IAMNoWildcardPermissions
AWS Lambda Warning Lambda Log Retention WS1004 aws_cloudwatch_log_group_lambda_retention CloudWatchLogGroupSpecifiedRetentionPeriod
AWS Lambda Error Lambda Default Memory Size ES1005 aws_lambda_function_default_memory LambdaDefaultMemorySize (new)
AWS Lambda Error Lambda Default Timeout ES1006 aws_lambda_function_default_timeout LambdaDefaultTimeout (new)
AWS Lambda Error Async Lambda Failure Destination ES1007 aws_lambda_event_invoke_config_async_on_failure LambdaAsyncFailureDestination (new)
AWS Lambda Error Lambda EOL Runtime E2531 aws_lambda_function_eol_runtime LambdaLatestVersion (new)
Amazon API Gateway REST APIs Error API Gateway Logging ES2000 aws_apigateway_stage_logging_rule APIGWAccessLogging (new)
Amazon API Gateway REST APIs Warning API Gateway Structured Logging WS2001 aws_api_gateway_stage_structured_logging APIGWStructuredLogging (new)
Amazon API Gateway REST APIs Warning API Gateway Tracing WS2002 aws_apigateway_stage_tracing_rule APIGWXrayEnabled
Amazon API Gateway REST APIs Warning API Gateway Default Throttling ES2003 aws_apigateway_stage_throttling_rule APIGWDefaultThrottling (new)
Amazon API Gateway HTTP APIs Error API Gateway Logging ES2000 aws_apigatewayv2_stage_logging_rule APIGWAccessLogging
Amazon API Gateway HTTP APIs Warning API Gateway Structured Logging WS2001 aws_apigatewayv2_stage_structured_logging APIGWStructuredLogging (new)
Amazon API Gateway HTTP APIs Warning API Gateway Default Throttling ES2003 aws_apigatewayv2_stage_throttling_rule APIGWDefaultThrottling (new)
AWS AppSync Error AppSync Tracing WS3000 aws_appsync_graphql_api_tracing_rule AppSyncTracing (new)
Amazon EventBridge Error EventBridge Rule Without DLQ ES4000 aws_cloudwatch_event_target_no_dlq EventBusDLQ (new)
Amazon SNS Error SNS Redrive Policy ES7000 aws_sns_topic_subscription_redrive_policy SNSRedrivePolicy (new)
Amazon SQS Error SQS Redrive Policy ES6000 aws_sqs_queue_redrive_policy SQSRedrivePolicy (new)
Amazon Step Functions Warning Step Functions Tracing WS5000 aws_sfn_state_machine_tracing StepFunctionStateMachineXray

@Kevinwochan Kevinwochan changed the title Serverless nag pack complete feat:Serverless nag pack complete Sep 2, 2024
@Kevinwochan
Copy link
Author

100% code coverage on all the rules, all the rules have been unit tested on L1 and L2 constructs

@Kevinwochan Kevinwochan changed the title feat:Serverless nag pack complete feat: Serverless Nag Pack Sep 2, 2024
Copy link
Collaborator

@dontirun dontirun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a large change thus I will go through multiple iterations of reviews.

In addition to the proposed changes to descriptions, please link this PR to the issue you created

};

/**
* Ensure that API Gateway REST and HTTP APIs are using JSON structured logs
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The explanations on all the rules need to be written in a declarative manner.

Suggested change
* Ensure that API Gateway REST and HTTP APIs are using JSON structured logs
* API Gateway REST and HTTP APIs use JSON structured logs

*/
private checkLambda(node: CfnResource) {
this.applyRule({
info: 'The Lambda function should have tracing set to Tracing.ACTIVE',
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These all need to be re-written to be both declarative and resource specific.

Example

Suggested change
info: 'The Lambda function should have tracing set to Tracing.ACTIVE',
info: 'The Lambda function does not have tracing set to Tracing.ACTIVE',

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants