class ConditionMetric

Public Instance Methods

metric(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 9
def metric(statement)
  return 0 if statement.condition.nil?

  aggregate = 0
  aggregate += statement.condition.size * weights[:Condition]
  aggregate += confusing_value_operators(statement.condition)
  aggregate += if_exists_operators(statement.condition)
  aggregate += weights[:Null] if null_operator?(statement.condition)
  aggregate += values_with_policy_tags(statement.condition)
  aggregate
end

Private Instance Methods

all_values(conditions) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 40
def all_values(conditions)
  result = []
  conditions.each do |_, expression|
    expression.each do |_, value|
      case value
      when String
        result << value
      when Array
        result += value
      end
    end
  end
  result
end
confusing_value_operator?(operator) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 81
def confusing_value_operator?(operator)
  %w[ForAllValues ForAnyValues].find { |prefix| operator.start_with? prefix }
end
confusing_value_operators(conditions) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 74
def confusing_value_operators(conditions)
  conditions.reduce(0) do |aggregate, condition|
    operator = condition[0]
    aggregate + (confusing_value_operator?(operator) ? weights[:Condition] : 0)
  end
end
contains_policy_tag?(value) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 29
def contains_policy_tag?(value)
  strip_special_characters(value).match(/.*\$\{.+\}.*/)
end
if_exists_operator?(operator) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 70
def if_exists_operator?(operator)
  operator.end_with? 'IfExists'
end
if_exists_operators(conditions) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 63
def if_exists_operators(conditions)
  conditions.reduce(0) do |aggregate, condition|
    operator = condition[0]
    aggregate + (if_exists_operator?(operator) ? weights[:IfExists] : 0)
  end
end
null_operator?(conditions) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 59
def null_operator?(conditions)
  conditions.find { |operator, _| operator == 'Null' }
end
special_characters() click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 55
def special_characters
  %w[$ * ?]
end
strip_special_characters(value) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 33
def strip_special_characters(value)
  special_characters.each do |special_character|
    value = value.gsub("${#{special_character}}", '')
  end
  value
end
values_with_policy_tags(conditions) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/condition_metric.rb, line 23
def values_with_policy_tags(conditions)
  all_values(conditions).reduce(0) do |aggregate, value|
    aggregate + (contains_policy_tag?(value) ? weights[:PolicyVariables] : 0)
  end
end