class StatementMetric
Public Instance Methods
metric(statement)
click to toggle source
rubocop:disable Metrics/AbcSize
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 11 def metric(statement) aggregate = weights[:Base_Statement] aggregate += effect_metrics(statement) aggregate += inversion_metrics(statement) aggregate += extra_service_count(statement) * weights[:Extra_Service] aggregate += misaligned_resource_action_count(statement) * weights[:Resource_Action_NotAligned] aggregate += mixed_wildcard(statement) * weights[:Mixed_Wildcard] aggregate += ConditionMetric.new.metric(statement) unless statement.condition.nil? aggregate end
Private Instance Methods
action(statement)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 93 def action(statement) return statement.actions unless statement.actions.empty? statement.not_actions end
action_service_name(action)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 77 def action_service_name(action) return '*' if action == '*' return action unless action.is_a?(String) action.split(':')[0] end
action_service_names(statement)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 69 def action_service_names(statement) action(statement).map { |action| action_service_name(action) } end
effect_metrics(statement)
click to toggle source
rubocop:enable Metrics/AbcSize
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 28 def effect_metrics(statement) aggregate = 0 aggregate += weights[:Deny] if statement.effect == 'Deny' aggregate += weights[:Allow] if statement.effect == 'Allow' aggregate end
extra_service_count(statement)
click to toggle source
rubocop:enable Naming/AccessorMethodName
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 64 def extra_service_count(statement) service_names = Set.new(action_service_names(statement) + resource_service_names(statement)).delete('*') [service_names.size - 1, 0].max end
inversion_metrics(statement)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 35 def inversion_metrics(statement) aggregate = 0 aggregate += weights[:NotAction] unless statement.not_actions.empty? aggregate += weights[:NotResource] unless statement.not_resources.empty? aggregate end
misaligned_resource_action_count(statement)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 49 def misaligned_resource_action_count(statement) return 0 if resource(statement) == ['*'] || action(statement) == ['*'] resource_service_names = resource(statement).map { |resource_arn| resource_service_name(resource_arn) } action_service_names = action(statement).map { |action| action_service_name(action) } (set_without_wildcard(resource_service_names) - set_without_wildcard(action_service_names)).size end
mixed_wildcard(statement)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 42 def mixed_wildcard(statement) count = 0 count += 1 if action_service_names(statement).include?('*') && action_service_names(statement).size > 1 count += 1 if resource_service_names(statement).include?('*') && resource_service_names(statement).size > 1 count end
resource(statement)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 99 def resource(statement) return statement.resources unless statement.resources.empty? statement.not_resources end
resource_service_name(resource_arn)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 85 def resource_service_name(resource_arn) return '*' if resource_arn == '*' return resource_arn unless resource_arn.is_a?(String) resource_arn.split(':')[2] end
resource_service_names(statement)
click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 73 def resource_service_names(statement) resource(statement).map { |resource_arn| resource_service_name(resource_arn) } end
set_without_wildcard(array)
click to toggle source
rubocop:disable Naming/AccessorMethodName
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 59 def set_without_wildcard(array) Set.new(array).delete('*') end