def test_run_secure_template(caplog):
"""
GIVEN a valid template is passed in
WHEN the template has no security issues
THEN exit with a code of 0
"""
caplog.set_level(logging.DEBUG)
c = CcValidator()
with pytest.raises(SystemExit):
c.run()
assert "No offending entries found" in caplog.text
def test_run_insecure_template(caplog, monkeypatch, template_dir):
"""
GIVEN a valid template is passed in
WHEN the template has security issues
THEN exit with an error code of 1 and the failing rules
"""
insecure_file_path = f"{template_dir}/insecure-s3-bucket.json"
monkeypatch.setenv("CFN_TEMPLATE_FILE_LOCATION", insecure_file_path)
c = CcValidator()
with pytest.raises(SystemExit):
c.run()
assert "offending entries found" in caplog.text
def test_run_insecure_template_fail_pipeline_enabled_cfn_disabled(
caplog, monkeypatch, template_dir):
"""
GIVEN a valid template is passed in
WHEN the template has security issues and the `FAIL_PIPELINE_CFN` env var is `enabled` but the `FailConformityPipeline` CFN param is `disabled`
THEN exit with an error of 1 and the failing rules
"""
caplog.set_level(logging.INFO)
insecure_file_path = f"{template_dir}/insecure-s3-bucket-disable-failure.json"
monkeypatch.setenv("FAIL_PIPELINE_CFN", "disabled")
monkeypatch.setenv("CFN_TEMPLATE_FILE_LOCATION", insecure_file_path)
print(insecure_file_path)
c = CcValidator()
with pytest.raises(SystemExit):
c.run()
assert "offending entries found" in caplog.text
def test_run_insecure_template_fail_pipeline_disabled(caplog, monkeypatch,
template_dir):
"""
GIVEN a valid template is passed in
WHEN the template has security issues but the `FAIL_PIPELINE` environment variable is set to "disabled"
THEN exit with a code of 0 and the failing rules
"""
caplog.set_level(logging.INFO)
insecure_file_path = f"{template_dir}/insecure-s3-bucket.json"
monkeypatch.setenv("FAIL_PIPELINE", "disabled")
monkeypatch.setenv("CFN_TEMPLATE_FILE_LOCATION", insecure_file_path)
print(insecure_file_path)
c = CcValidator()
with pytest.raises(SystemExit):
c.run()
assert "Pipeline failure has been disabled" in caplog.text
