Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create remaining Password property rules #253

Closed
33 tasks done
phelewski opened this issue Jul 2, 2019 · 4 comments
Closed
33 tasks done

Create remaining Password property rules #253

phelewski opened this issue Jul 2, 2019 · 4 comments
Assignees
@tmcelhattan @phelewski
Labels
feature

Comments

@phelewski
Copy link
Contributor

phelewski commented Jul 2, 2019 •
edited

Add in the missing Resource/Property rules for passwords, tokens, and keys.

Current missing items:

  • AWS::Amplify::App.BasicAuthConfig
    • Password
  • AWS::DMS::Endpoint.MongoDbSettings
    • Password
  • AWS::AppStream::DirectoryConfig.ServiceAccountCredentials
    • AccountPassword
  • AWS::OpsWorks::Stack.RdsDbInstance
    • DbPassword
  • AWS::Amplify::Branch.BasicAuthConfig
    • Password
  • AWS::IAM::User.LoginProfile
    • Password
  • AWS::OpsWorks::App.SslConfiguration
    • PrivateKey
  • AWS::OpsWorks::Stack.Source
    • Password
  • AWS::EMR::Cluster.KerberosAttributes
    • ADDomainJoinPassword
    • CrossRealmTrustPrincipalPassword
    • KdcAdminPassword
  • AWS::AmazonMQ::Broker.User
    • Password
  • AWS::KinesisFirehose::DeliveryStream.RedshiftDestinationConfiguration
    • Password
  • AWS::OpsWorks::App.Source
    • Password
  • AWS::KinesisFirehose::DeliveryStream.SplunkDestinationConfiguration
    • HECToken
  • Alexa::ASK::Skill.AuthenticationConfiguration
    • [ ] ClientSecret Save this for another issue as it doesn't follow the AWS:: format
  • Alexa::ASK::Skill.AuthenticationConfiguration
    • [ ] RefreshToken Save this for another issue as it doesn't follow the AWS:: format
  • AWS::CodePipeline::Webhook.WebhookAuthConfiguration
    • SecretToken
  • AWS::Amplify::App
    • OauthToken
    • AccessToken
  • AWS::CloudFormation::CustomResource
    • [ ] ServiceToken Not a secured value
  • AWS::Pinpoint::APNSChannel
    • TokenKey
    • PrivateKey
  • AWS::Pinpoint::APNSSandboxChannel
    • TokenKey
    • PrivateKey
  • AWS::ElastiCache::ReplicationGroup
    • AuthToken
  • AWS::Pinpoint::APNSVoipSandboxChannel
    • TokenKey
    • PrivateKey
  • AWS::Pinpoint::APNSVoipChannel
    • TokenKey
    • PrivateKey
  • AWS::Lambda::Permission
    • EventSourceToken
  • AWS::OpsWorks::App.SslConfiguration
    • PrivateKey

Extras added from #253 (comment)

  • AWS::ManagedBlockchain::Member.MemberFabricConfiguration
    • AdminPassword
  • AWS::DocDB::DBCluster
    • MasterUserPassword
  • AWS::MediaLive::Channel.OutputDestinationSettings
    • PasswordParam
  • AWS::MediaLive::Input.InputSourceRequest
    • PasswordParam
phelewski pushed a commit that referenced this issue Jul 2, 2019
#253 adjusting variable positions
16fc725
phelewski pushed a commit that referenced this issue Jul 2, 2019
#253 adjusting variable positions
4af20f9
phelewski pushed a commit that referenced this issue Jul 2, 2019
#253 adding rule for Amplify App OauthToken
a62f054
phelewski pushed a commit that referenced this issue Jul 2, 2019
#253 adding rule for Amplify App AccessToken
b204628
phelewski pushed a commit that referenced this issue Jul 2, 2019
#253 adding rule for Pinpoint APNSChannel TokenKey
1475230
phelewski pushed a commit that referenced this issue Jul 2, 2019
#253 adding rule for Pinpoint APNSChannel PrivateKey
e074109
phelewski pushed a commit that referenced this issue Jul 2, 2019
#253 adding rule for Pinpoint APNSSandboxChannel PrivateKey & TokenKey
d8e988f
phelewski pushed a commit that referenced this issue Jul 3, 2019
#253 adding rule for Elasticache ReplicationGroup AuthToken
5dbc680
phelewski pushed a commit that referenced this issue Jul 3, 2019
#253 adding rule for Lambda Permission EventSourceToken
b47d891
phelewski pushed a commit that referenced this issue Jul 3, 2019
#253 adding rule for Pinpoint APNSVoipSandboxChannel PrivateKey & Tok…
bdc9971 
…enKey
phelewski pushed a commit that referenced this issue Jul 3, 2019
#253 adding rule for Pinpoint APNSVoipChannel PrivateKey & TokenKey
f8d5940
@phelewski phelewski mentioned this issue Jul 5, 2019
Merged
@phelewski phelewski self-assigned this Jul 5, 2019
phelewski pushed a commit that referenced this issue Jul 5, 2019
#253 merge master
2c0b9d1
phelewski pushed a commit that referenced this issue Jul 5, 2019
#253 update existing password specs to include new sub_property_name …
6ecf49a 
…variable
phelewski pushed a commit that referenced this issue Jul 5, 2019
#253 adding rule for DMS Endpoint MongoDbSettings Password
dc5b063
phelewski pushed a commit that referenced this issue Jul 5, 2019
#253 adding rule for AppStream DirectoryConfig ServiceAccountCredenti…
1e9a31a 
…als AccountPassword
tmcelhattan pushed a commit that referenced this issue Oct 24, 2019
Adding custom rules and tests for issue #253 - AWS::IAM::User.LoginPr…
73ea6a8 
…ofile password property rules
@tmcelhattan tmcelhattan mentioned this issue Oct 24, 2019
Merged
@tmcelhattan tmcelhattan self-assigned this Oct 25, 2019
tmcelhattan pushed a commit that referenced this issue Oct 25, 2019
Adding custom rules and tests for issue #253 - AWS::OpsWorks::Stack.R…
d8908cd 
…dsDbInstance password property rules
tmcelhattan pushed a commit that referenced this issue Oct 29, 2019
Adding custom rules and tests for issue #253 - AWS::AmazonMQ::Broker …
bc334d1 
…User Password property rules
This was referenced Oct 30, 2019
Merged
Merged
@ghost
Copy link

ghost commented Oct 31, 2019

don't add a rule for AWS::CloudFormation::CustomResource/ServiceToken. that "token" is just a phone number for the lambda to invoke, not a credential

@PatMyron
Copy link

PatMyron commented Nov 8, 2019 •
edited

aws-cloudformation/cfn-lint#1181

AdminPassword:

AWS::ManagedBlockchain::Member.MemberFabricConfiguration

MasterUserPassword:

AWS::DocDB::DBCluster

PasswordParam:

AWS::MediaLive::Channel.OutputDestinationSettings

AWS::MediaLive::Input.InputSourceRequest

ghost pushed a commit that referenced this issue Nov 16, 2019
Feature/issue 253 amazonmq broker user password (#301)
317ea44 
* Adding custom rules and tests for issue #253 - AWS::AmazonMQ::Broker User Password property rules

* cleaning up

* refactors to handle when 'Users' property and/or 'Password' key is not defined in AWS::AmazonMQ::Broker resource

* additional refactors
ghost pushed a commit that referenced this issue Nov 16, 2019
Feature/issue 253 ops works stack rds db password (#302)
65c5679 
* Adding custom rules and tests for issue #253 - AWS::OpsWorks::Stack.RdsDbInstance password property rules

* refactoring to test for multiple resources in test_templates yaml cfn files

* Refactoring to check to see if RdsDbInstances property exists and/or the DbPassword key is defined

* additional refactors
ghost pushed a commit that referenced this issue Nov 16, 2019
Adding custom rules and tests for issue #253 - AWS::IAM::User.LoginPr… (
140d062 
#298)

* Adding custom rules and tests for issue #253 - AWS::IAM::User.LoginProfile password property rules

* little bit of cleaning up

* one more clean up

* slight change to rule text

* reformatting

* refactoring to check to see if LoginProfile exists, and if so then check for violating resources

* cleaning up

* additional refactors
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding CrossRealmTrustPrincipalPassword rule for EMR Cluster Ker…
a916b86 
…berosAttributes
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding KdcAdminPassword rule for EMR Cluster KerberosAttributes
42c7a6e
@phelewski phelewski mentioned this issue Jan 15, 2020
Merged
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding PasswordParam rule for MediaLive Channel OutputDestinatio…
ac77604 
…nSettings
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding PasswordParam rule for MediaLive Input InputSourceRequest
cdfcb0a
@phelewski phelewski mentioned this issue Jan 15, 2020
Closed
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding SecretToken rule for CodePipeline Webhook AuthenticationC…
ccf595a 
…onfiguration
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding AuthToken rule for ElastiCache ReplicationGroup
c1f258b
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding EventSourceToken rule for Lambda Permission
6a3d75b
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding AdminPassword rule for ManagedBlockChain Member MemberFab…
eb49d15 
…ricationConfiguration
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding MasterUserPassword rule for DocDB DBCluster
da37381
@phelewski phelewski mentioned this issue Jan 15, 2020
Merged
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 updating AmazonMQ Broker Users Password rule to use password hel…
5bf49b9 
…per and to correct custom rule name to match property name
@phelewski phelewski mentioned this issue Jan 15, 2020
Merged
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 removing existing IAM User LoginProfile Password rule files to p…
82ef4fd 
…repare for new files with uppercase naming
phelewski pushed a commit that referenced this issue Jan 15, 2020
#253 adding IAM User LoginProfile Password rule back in with upper ca…
cb75a40 
…se IAM in rule and spec name
@phelewski phelewski mentioned this issue Jan 15, 2020
Merged
ghost pushed a commit that referenced this issue Jan 16, 2020
Feature/253 aws opsworks password rules (#340)
6088972 
* #253 adding Password rule for OpsWorks Stack CustomCookbookSource

* #253 adding PrivateKey rule for OpsWorks App SslConfiguration

* #253 adding Password rule for OpsWorks App AppSource
ghost pushed a commit that referenced this issue Jan 16, 2020
Feature/253 kinesis firehose delivery stream password rules (#342)
07b7b29 
* #253 adding Password rule for KinesisFirehose DeliveryStream RedshiftDestinationConfiguration

* #253 adding HECToken rule for KinesisFirehose DeliveryStream SplunkDestinationConfiguration
ghost pushed a commit that referenced this issue Jan 16, 2020
Feature/253 aws pinpoint password rules (#341)
1051d64 
* #253 adding TokenKey rule for Pinpoint APNSSandboxChannel

* #253 adding PrivateKey rule for Pinpoint APNSSandboxChannel

* #253 adding TokenKey rule for Pinpoint APNSChannel

* #253 adding PrivateKey rule for Pinpoint APNSChannel

* #253 adding TokenKey rule for Pinpoint APNSVoipSandboxChannel

* #253 adding PrivateKey rule for Pinpoint APNSVoipSandboxChannel

* #253 adding TokenKey rule for Pinpoint APNSVoipChannel

* #253 adding PrivateKey rule for Pinpoint APNSVoipChannel
ghost pushed a commit that referenced this issue Jan 16, 2020
Feature/253 emr cluster kerberos attributes password rules (#343)
5babc15 
* #253 adding ADDomainJoinPassword rule for EMR Cluster KerberosAttributes

* #253 adding CrossRealmTrustPrincipalPassword rule for EMR Cluster KerberosAttributes

* #253 adding KdcAdminPassword rule for EMR Cluster KerberosAttributes

* Update EMRClusterKerberosAttributesADDomainJoinPasswordRule.rb

* Update EMRClusterKerberosAttributesCrossRealmTrustPrincipalPasswordRule.rb

* Update EMRClusterKerberosAttributesKdcAdminPasswordRule.rb

Co-authored-by: Eric Kascic <eric.kascic@stelligent.com>
ghost pushed a commit that referenced this issue Jan 16, 2020
Feature/253 update iam user login profile password rule (#347)
d6b3c7f 
* #253 removing existing IAM User LoginProfile Password rule files to prepare for new files with uppercase naming

* #253 adding IAM User LoginProfile Password rule back in with upper case IAM in rule and spec name

* Update IAMUserLoginProfilePasswordRule.rb

Co-authored-by: Eric Kascic <eric.kascic@stelligent.com>
ghost pushed a commit that referenced this issue Jan 16, 2020
#253 updating AmazonMQ Broker Users Password rule to use password hel…
76801cc 
…per and to correct custom rule name to match property name (#346)

* #253 updating AmazonMQ Broker Users Password rule to use password helper and to correct custom rule name to match property name

* Update AmazonMQBrokerUsersPasswordRule.rb

Co-authored-by: Eric Kascic <eric.kascic@stelligent.com>
phelewski pushed a commit that referenced this issue Jan 16, 2020
#253 adding check to ensure the optional property exists in template …
37a53d6 
…before running secure check against value
ghost pushed a commit that referenced this issue Jan 16, 2020
Feature/253 remaining password property rules (#345)
c1868bd 
* #253 adding SecretToken rule for CodePipeline Webhook AuthenticationConfiguration

* #253 adding AuthToken rule for ElastiCache ReplicationGroup

* #253 adding EventSourceToken rule for Lambda Permission

* #253 adding AdminPassword rule for ManagedBlockChain Member MemberFabricationConfiguration

* #253 adding MasterUserPassword rule for DocDB DBCluster

* Update CodePipelineWebhookAuthenticationConfigurationSecretTokenRule.rb

* #253 adding check to ensure the optional property exists in template before running secure check against value

Co-authored-by: Eric Kascic <eric.kascic@stelligent.com>
@ghost
Copy link

ghost commented Jan 16, 2020

aws-cloudformation/cfn-python-lint#1181

AdminPassword:

AWS::ManagedBlockchain::Member.MemberFabricConfiguration

MasterUserPassword:

AWS::DocDB::DBCluster

PasswordParam:

AWS::MediaLive::Channel.OutputDestinationSettings

AWS::MediaLive::Input.InputSourceRequest

it's my belief that the media live PasswordParams are actually SSM key names - so not sensitive

@ghost ghost closed this as completed Jan 16, 2020
@ghost
Copy link

ghost commented Jan 16, 2020

pieces of this were released over time, but 0.4.72 includes all of them

@PatMyron PatMyron mentioned this issue Jun 30, 2020
Merged
@PatMyron PatMyron mentioned this issue Feb 2, 2022
Merged
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tmcelhattan tmcelhattan

@phelewski phelewski

Labels
feature
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@PatMyron @twellspring @tmcelhattan @phelewski