forked from cdklabs/cdk-nag
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: LexBotAliasEncryptedConversationLogs rule (AwsSolutions-LEX4) (c…
…dklabs#929) * feat: LexBotAliasEncryptedConversationLogs rule * chore: upgrade deps * chore: self mutation Signed-off-by: github-actions <github-actions@github.com> * docs: removing duplicate sentence in RULES.md Co-authored-by: github-actions <github-actions@github.com>
- Loading branch information
Showing
11 changed files
with
409 additions
and
46 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| /* | ||
| Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| import { parse } from 'path'; | ||
| import { CfnResource, Stack } from 'aws-cdk-lib'; | ||
| import { CfnBot, CfnBotAlias } from 'aws-cdk-lib/aws-lex'; | ||
| import { CfnLogGroup } from 'aws-cdk-lib/aws-logs'; | ||
| import { NagRuleCompliance, NagRules } from '../../nag-rules'; | ||
|
|
||
| /** | ||
| * Lex Bot conversation logs are encrypted with KMS keys | ||
| * @param node the CfnResource to check | ||
| */ | ||
| export default Object.defineProperty( | ||
| (node: CfnResource): NagRuleCompliance => { | ||
| if (node instanceof CfnBotAlias || node instanceof CfnBot) { | ||
| const settingLocation = | ||
| node instanceof CfnBotAlias | ||
| ? node | ||
| : Stack.of(node).resolve(node.testBotAliasSettings); | ||
| const conversationLogSettings = Stack.of(node).resolve( | ||
| settingLocation?.conversationLogSettings | ||
| ); | ||
| if (conversationLogSettings !== undefined) { | ||
| const audioLogSettings = | ||
| Stack.of(node).resolve(conversationLogSettings.audioLogSettings) ?? | ||
| []; | ||
| for (const log of audioLogSettings) { | ||
| const resolvedLog = Stack.of(node).resolve(log); | ||
| if (Stack.of(node).resolve(resolvedLog.enabled) === true) { | ||
| const resolvedDestination = Stack.of(node).resolve( | ||
| resolvedLog.destination | ||
| ); | ||
| const s3Bucket = Stack.of(node).resolve( | ||
| resolvedDestination.s3Bucket | ||
| ); | ||
| const kmsKeyArn = Stack.of(node).resolve(s3Bucket.kmsKeyArn); | ||
| if (kmsKeyArn === undefined) { | ||
| return NagRuleCompliance.NON_COMPLIANT; | ||
| } | ||
| } | ||
| } | ||
| const textLogSettings = | ||
| Stack.of(node).resolve(conversationLogSettings.textLogSettings) ?? []; | ||
| for (const log of textLogSettings) { | ||
| const resolvedLog = Stack.of(node).resolve(log); | ||
| if (Stack.of(node).resolve(resolvedLog.enabled) === true) { | ||
| const resolvedDestination = Stack.of(node).resolve( | ||
| resolvedLog.destination | ||
| ); | ||
| const cloudwatch = Stack.of(node).resolve( | ||
| resolvedDestination.cloudWatch | ||
| ); | ||
| const logGroupLogicalId = NagRules.resolveResourceFromInstrinsic( | ||
| node, | ||
| cloudwatch.cloudWatchLogGroupArn | ||
| ); | ||
| let found = false; | ||
| for (const child of Stack.of(node).node.findAll()) { | ||
| if (child instanceof CfnLogGroup) { | ||
| if ( | ||
| logGroupLogicalId === | ||
| NagRules.resolveResourceFromInstrinsic(child, child.logicalId) | ||
| ) { | ||
| found = true; | ||
| if (child.kmsKeyId === undefined) { | ||
| return NagRuleCompliance.NON_COMPLIANT; | ||
| } | ||
| break; | ||
| } | ||
| } | ||
| } | ||
| if (!found) { | ||
| throw Error( | ||
| `Unable to find the CloudWatch Log group "${JSON.stringify( | ||
| logGroupLogicalId | ||
| )}" used in one of Text Log Destinations in the CDK Application. Therefore the rule could not be validated.` | ||
| ); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| return NagRuleCompliance.COMPLIANT; | ||
| } else { | ||
| return NagRuleCompliance.NOT_APPLICABLE; | ||
| } | ||
| }, | ||
| 'name', | ||
| { value: parse(__filename).name } | ||
| ); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| /* | ||
| Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| export { default as LexBotAliasEncryptedConversationLogs } from './LexBotAliasEncryptedConversationLogs'; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.