class RuboCop::Cop::Chef::Security::SshPrivateKey

Do not include plain text SSH private keys in your cookbook code. This sensitive data should be fetched from secrets management systems so that secrets are not uploaded in plain text to the Chef Infra Server or committed to source control systems.

@example

#### incorrect
file '/Users/bob_bobberson/.ssh/id_rsa' do
  content '-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----'
  mode '600'
end

Constants

MSG

Public Instance Methods

on_send(node) click to toggle source
# File lib/rubocop/cop/chef/security/ssh_private_key.rb, line 35
def on_send(node)
  return unless node.arguments?
  node.arguments.each do |arg|
    next unless arg.str_type? || arg.dstr_type?

    if arg.value.start_with?('-----BEGIN RSA PRIVATE', '-----BEGIN EC PRIVATE') # cookstyle: disable Chef/Security/SshPrivateKey
      add_offense(node, severity: :warning)
    end
  end
end