def test_rule_ignores_where_auth_not_mentioned(neutral_template):
rule = CloudFormationAuthenticationRule(None)
result = rule.invoke(neutral_template)
assert result.valid
assert len(result.failed_rules) == 0
assert len(result.failed_monitored_rules) == 0
def test_no_failures_are_raised(good_template):
rule = CloudFormationAuthenticationRule(None)
result = rule.invoke(good_template)
assert result.valid
assert len(result.failed_rules) == 0
assert len(result.failed_monitored_rules) == 0
def test_failures_are_raised(bad_template):
result = Result()
rule = CloudFormationAuthenticationRule(None, result)
rule.invoke(bad_template)
assert result.valid
assert len(result.failed_rules) == 0
assert len(result.failed_monitored_rules) == 1
assert result.failed_monitored_rules[0].rule == "CloudFormationAuthenticationRule"
assert result.failed_monitored_rules[0].reason == "Hardcoded credentials in EC2I4LBA1"
def test_failures_are_raised(bad_template):
rule = CloudFormationAuthenticationRule(None)
result = rule.invoke(bad_template)
assert not result.valid
assert compare_lists_of_failures(
result.failures,
[
Failure(
granularity=RuleGranularity.RESOURCE,
reason="Hardcoded credentials in EC2I4LBA1",
risk_value=RuleRisk.MEDIUM,
rule="CloudFormationAuthenticationRule",
rule_mode=RuleMode.BLOCKING,
actions=None,
resource_ids={"EC2I4LBA1"},
)
],
)
def test_rule_supports_filter_config(bad_template, default_allow_all_config):
rule = CloudFormationAuthenticationRule(default_allow_all_config)
result = rule.invoke(bad_template)
assert result.valid
assert compare_lists_of_failures(result.failures, [])
def test_rule_ignores_where_auth_not_mentioned(neutral_template):
rule = CloudFormationAuthenticationRule(None)
result = rule.invoke(neutral_template)
assert result.valid
assert compare_lists_of_failures(result.failures, [])
def test_no_failures_are_raised(good_template):
rule = CloudFormationAuthenticationRule(None)
result = rule.invoke(good_template)
assert result.valid
assert compare_lists_of_failures(result.failures, [])