Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix the example for resources that do not support the Tags property #285

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Fix the example for resources that do not support the Tags property #285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
6d10a8b
Add some more resources without Tags property
scottschreckengaust Oct 3, 2022
99d0c84
Remove "common" tag guard
scottschreckengaust Oct 3, 2022
6c6a1a5
Add resources without Tags property.
scottschreckengaust Oct 3, 2022
f899034
Added two resources without Tags outside us-east-1
scottschreckengaust Oct 3, 2022
dbcfb6e
Merge branch 'aws-cloudformation:main' into resources-without-tags-pr…
scottschreckengaust Oct 5, 2022
0bef3ec
Merge branch 'aws-cloudformation:main' into resources-without-tags-pr…
scottschreckengaust Oct 24, 2024
e5d3252
Merge branch 'aws-cloudformation:main' into resources-without-tags-pr…
scottschreckengaust Oct 24, 2024
01bdc2e
update check-tags-present.guard
scottschreckengaust Oct 24, 2024
c450b46
Update dynamodb-table-sse.guard
scottschreckengaust Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 12 additions & 9 deletions guard-examples/encryption/dynamodb-table-sse.guard
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,21 @@
#
# Common rule, all resources must have Tags present on them
#
rule assert_all_resources_have_non_empty_tags {
Resources.*.Properties.Tags !empty
}

#
# Select all DDB resources from the incoming template (payload)
#
let ddb = Resources.*[ Type == 'AWS::DynamoDB::Table' ]

#
# Common rule, DDB table resources must have Tags present on them
#
rule assert_ddb_resources_have_non_empty_tags
{
#
# Ensure ALL DynamoDB Tables have tags
#
%ddb.Properties.Tags !empty
}
#
# Run this DDB rule when there are DDB table present and
# we PASSED the check that all resources did have tags in them
# we PASSED the check that DDB table resources did have tags in them
#
# Rule Intent: ALL DDB Table must have encryption at rest turned
# on.
Expand All @@ -23,7 +26,7 @@ let ddb = Resources.*[ Type == 'AWS::DynamoDB::Table' ]
# c) FAIL if wasn't set for them
#
rule dynamo_db_sse_on when %ddb !empty
assert_all_resources_have_non_empty_tags
assert_ddb_resources_have_non_empty_tags
{
#
# Ensure ALL DynamoDB Tables have encryption at rest turned on
Expand Down
Loading
Loading