Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
({"Type": "String", "NoEcho": True}, None, Parameter.NO_ECHO_NO_DEFAULT),
({"Type": "String", "NoEcho": False, "Default": "A"}, None, "A"),
({"Type": "String", "NoEcho": False}, None, None),
({"Type": "String", "Default": "abc"}, None, "abc"),
({"Type": "String", "Default": None}, None, None),
({"Type": "Number", "Default": 1}, None, "1"),
({"Type": "List", "Default": "1,2,3"}, None, ["1", "2", "3"]),
({"Type": "CommaDelimitedList", "Default": "a,b,c"}, None, ["a", "b", "c"]),
# Tests with provided value
({"Type": "String", "NoEcho": True, "Default": "A"}, "SuperSecret", Parameter.NO_ECHO_WITH_VALUE),
({"Type": "String", "NoEcho": True}, "SuperSecret", Parameter.NO_ECHO_WITH_VALUE),
({"Type": "String", "NoEcho": False, "Default": "A"}, "B", "B"),
({"Type": "String", "NoEcho": False}, "B", "B"),
({"Type": "String", "Default": "abc"}, "B", "B"),
({"Type": "String", "Default": None}, None, None),
({"Type": "Number", "Default": 1}, None, "1"),
({"Type": "List", "Default": "1,2,3"}, "4,5,6", ["4", "5", "6"]),
def has_hardcoded_credentials(self) -> bool:
if not self.Metadata or not self.Metadata.get("AWS::CloudFormation::Authentication"):
return False
for auth in self.Metadata["AWS::CloudFormation::Authentication"].values():
if not all(
[
auth.get("accessKeyId", Parameter.NO_ECHO_NO_DEFAULT) == Parameter.NO_ECHO_NO_DEFAULT,
auth.get("password", Parameter.NO_ECHO_NO_DEFAULT) == Parameter.NO_ECHO_NO_DEFAULT,
auth.get("secretKey", Parameter.NO_ECHO_NO_DEFAULT) == Parameter.NO_ECHO_NO_DEFAULT,
]
):
return True
return False
def _failure_added(self, result: Result, logical_id: str, resource: GenericResource) -> bool:
master_user_password = resource.Properties.get("MasterUserPassword", Parameter.NO_ECHO_NO_DEFAULT)
resource_type = resource.Type.replace("AWS::RDS::DB", "")
if master_user_password == Parameter.NO_ECHO_WITH_DEFAULT:
self.add_failure_to_result(
result, self.REASON_DEFAULT.format(resource_type, logical_id), resource_ids={logical_id}
)
return True
elif master_user_password not in (Parameter.NO_ECHO_NO_DEFAULT, Parameter.NO_ECHO_WITH_VALUE):
self.add_failure_to_result(
result, self.REASON_MISSING_NOECHO.format(resource_type, logical_id), resource_ids={logical_id},
)
return True
return False
def has_hardcoded_credentials(self) -> bool:
""" Returns True if login profile password contains a hardcoded string, otherwise False. """
if self.Properties:
login_profile = self.Properties.LoginProfile
if login_profile and login_profile.get("Password"):
if login_profile["Password"] != Parameter.NO_ECHO_NO_DEFAULT:
return True
return super().has_hardcoded_credentials()
def _failure_added(self, result: Result, logical_id: str, resource: GenericResource) -> bool:
master_user_password = resource.Properties.get("MasterUserPassword", Parameter.NO_ECHO_NO_DEFAULT)
resource_type = resource.Type.replace("AWS::RDS::DB", "")
if master_user_password == Parameter.NO_ECHO_WITH_DEFAULT:
self.add_failure_to_result(
result, self.REASON_DEFAULT.format(resource_type, logical_id), resource_ids={logical_id}
)
return True
elif master_user_password not in (Parameter.NO_ECHO_NO_DEFAULT, Parameter.NO_ECHO_WITH_VALUE):
self.add_failure_to_result(
result, self.REASON_MISSING_NOECHO.format(resource_type, logical_id), resource_ids={logical_id},
)
return True
return False
def has_hardcoded_credentials(self) -> bool:
if not self.Metadata or not self.Metadata.get("AWS::CloudFormation::Authentication"):
return False
for auth in self.Metadata["AWS::CloudFormation::Authentication"].values():
if not all(
[
auth.get("accessKeyId", Parameter.NO_ECHO_NO_DEFAULT) == Parameter.NO_ECHO_NO_DEFAULT,
auth.get("password", Parameter.NO_ECHO_NO_DEFAULT) == Parameter.NO_ECHO_NO_DEFAULT,
auth.get("secretKey", Parameter.NO_ECHO_NO_DEFAULT) == Parameter.NO_ECHO_NO_DEFAULT,
]
):
return True
return False