Giter VIP home page Giter VIP logo

Comments (2)

connelldave avatar connelldave commented on July 21, 2024 1

Bumping as this caught me out today expecting valid JSON on stdout with -o.

I've raised a PR with the simplest fix I could see :)

from cfn_nag.

isuftin avatar isuftin commented on July 21, 2024

The problem was found in the template and corrected which fixed the error in the output. Original template:

Wrong:

---
AWSTemplateFormatVersion: "2010-09-09"
Description: My IAM role
Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      Description: My Description
      PermissionsBoundary: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/my-policy-boundary
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/ReadOnlyAccess
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AliasBasedKMSAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - kms:List*
                  - kms:Describe*
                  - kms:Decrypt
                  - kms:Encrypt
                Resource: !Sub arn:${AWS::Partition}:kms:*:${AWS::AccountId}:key/*
                Condition:
                  ForAnyValue:StringEquals:
                    kms:ResourceAliases:
                      - !Ref RDSKMSKeyAlias

Right:

---
AWSTemplateFormatVersion: "2010-09-09"
Description: My IAM role
Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      Description: My Description
      PermissionsBoundary: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/my-policy-boundary
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/ReadOnlyAccess
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: AliasBasedKMSAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - kms:List*
                  - kms:Describe*
                  - kms:Decrypt
                  - kms:Encrypt
                Resource: !Sub arn:${AWS::Partition}:kms:*:${AWS::AccountId}:key/*
                Condition:
                  ForAnyValue:StringEquals:
                    kms:ResourceAliases: !Ref RDSKMSKeyAlias

Specifically, cfn-nag was puking on this having a list instead of a string:

Condition:
  ForAnyValue:StringEquals:
    kms:ResourceAliases: ...

from cfn_nag.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.