class StatementMetric

Public Instance Methods

metric(statement) click to toggle source

rubocop:disable Metrics/AbcSize

# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 11
def metric(statement)
  aggregate = weights[:Base_Statement]

  aggregate += effect_metrics(statement)
  aggregate += inversion_metrics(statement)
  aggregate += extra_service_count(statement) * weights[:Extra_Service]
  aggregate += misaligned_resource_action_count(statement) * weights[:Resource_Action_NotAligned]
  aggregate += mixed_wildcard(statement) * weights[:Mixed_Wildcard]

  aggregate += ConditionMetric.new.metric(statement) unless statement.condition.nil?

  aggregate
end

Private Instance Methods

action(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 93
def action(statement)
  return statement.actions unless statement.actions.empty?

  statement.not_actions
end
action_service_name(action) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 77
def action_service_name(action)
  return '*' if action == '*'

  return action unless action.is_a?(String)

  action.split(':')[0]
end
action_service_names(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 69
def action_service_names(statement)
  action(statement).map { |action| action_service_name(action) }
end
effect_metrics(statement) click to toggle source

rubocop:enable Metrics/AbcSize

# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 28
def effect_metrics(statement)
  aggregate = 0
  aggregate += weights[:Deny] if statement.effect == 'Deny'
  aggregate += weights[:Allow] if statement.effect == 'Allow'
  aggregate
end
extra_service_count(statement) click to toggle source

rubocop:enable Naming/AccessorMethodName

# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 64
def extra_service_count(statement)
  service_names = Set.new(action_service_names(statement) + resource_service_names(statement)).delete('*')
  [service_names.size - 1, 0].max
end
inversion_metrics(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 35
def inversion_metrics(statement)
  aggregate = 0
  aggregate += weights[:NotAction] unless statement.not_actions.empty?
  aggregate += weights[:NotResource] unless statement.not_resources.empty?
  aggregate
end
misaligned_resource_action_count(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 49
def misaligned_resource_action_count(statement)
  return 0 if resource(statement) == ['*'] || action(statement) == ['*']

  resource_service_names = resource(statement).map { |resource_arn| resource_service_name(resource_arn) }
  action_service_names = action(statement).map { |action| action_service_name(action) }

  (set_without_wildcard(resource_service_names) - set_without_wildcard(action_service_names)).size
end
mixed_wildcard(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 42
def mixed_wildcard(statement)
  count = 0
  count += 1 if action_service_names(statement).include?('*') && action_service_names(statement).size > 1
  count += 1 if resource_service_names(statement).include?('*') && resource_service_names(statement).size > 1
  count
end
resource(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 99
def resource(statement)
  return statement.resources unless statement.resources.empty?

  statement.not_resources
end
resource_service_name(resource_arn) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 85
def resource_service_name(resource_arn)
  return '*' if resource_arn == '*'

  return resource_arn unless resource_arn.is_a?(String)

  resource_arn.split(':')[2]
end
resource_service_names(statement) click to toggle source
# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 73
def resource_service_names(statement)
  resource(statement).map { |resource_arn| resource_service_name(resource_arn) }
end
set_without_wildcard(array) click to toggle source

rubocop:disable Naming/AccessorMethodName

# File lib/cfn-nag/iam_complexity_metric/statement_metric.rb, line 59
def set_without_wildcard(array)
  Set.new(array).delete('*')
end