Merge pull request #145 from Skyscanner/issue-101

Handle empty file condition

CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## [0.23.1] - 2021-01-26
+### Improvements
+- Add more X-Ray permissions that accept wildcard resource only
+- CLI handles case of empty template by returning appropriate exception message
+- CLI now returns exit code 2 for scenarios where CFRipper finds a template violating any of the rules
+
 ## [0.23.0] - 2021-01-20
 ### Breaking changes
 - Rule config files using filters must now use `ingress_obj` and not `ingress`.

README.md

@@ -55,4 +55,16 @@ Result saved in /tmp/root.yaml.cfripper.results.json
 Analysing /tmp/root_bypass.json...
 Not adding CrossAccountTrustRule failure in rootRole because no AWS Account ID was found in the config.
 Result saved in /tmp/root_bypass.json.cfripper.results.json
-```
+```
+
+### Exit Codes
+```python
+"""
+Analyse AWS Cloudformation templates passed by parameter.
+Exit codes:
+  - 0 = all templates valid and scanned successfully
+  - 1 = error / issue in scanning at least one template
+  - 2 = at least one template is not valid according to CFRipper (template scanned successfully)
+  - 3 = unknown / unhandled exception in scanning the templates
+"""
+```

cfripper/__version__.py

@@ -1,3 +1,3 @@
-VERSION = (0, 23, 0)
+VERSION = (0, 23, 1)
 
 __version__ = ".".join(map(str, VERSION))

cfripper/cli.py

@@ -10,6 +10,7 @@
 
 from cfripper.__version__ import __version__
 from cfripper.config.config import Config
+from cfripper.exceptions import FileEmptyException
 from cfripper.model.result import Result
 from cfripper.model.utils import convert_json_or_yaml_to_dict
 from cfripper.rule_processor import RuleProcessor
@@ -36,8 +37,10 @@ def init_cfripper(rules_config_file: Optional[str]) -> Tuple[Config, RuleProcess
 
 
 def get_cfmodel(template: TextIOWrapper) -> CFModel:
-    template = convert_json_or_yaml_to_dict(template.read())
-    cfmodel = pycfmodel.parse(template)
+    template_file = convert_json_or_yaml_to_dict(template.read())
+    if not template_file:
+        raise FileEmptyException(f"{template.name} is empty and not a valid template.")
+    cfmodel = pycfmodel.parse(template_file)
     return cfmodel
 
 
@@ -170,7 +173,8 @@ def cli(templates, logging_level, resolve_parameters, **kwargs):
             for template in templates
         ]
         sys.exit(2 if False in results_of_templates else 0)
-
+    except FileEmptyException as file_empty:
+        sys.exit(file_empty)
     except Exception as e:
         logging.exception(
             "Unhandled exception raised, please create an issue with the error message at "

cfripper/exceptions.py

@@ -0,0 +1,2 @@
+class FileEmptyException(Exception):
+    """Raise when a template passed to CFRipper is empty and not valid."""