A simple GitHub Action for AWS CloudFormation static code analysis to improve infrastructure-as-code security using AWS cfn-guard.

The Action does not require AWS credentials!

It gets better: Guard Rules in this github action can be suppressed at the resource-level! See Guard Rule Suppression to learn how to leverage in your code.

The directory of the repo to scan the cloudformation templates.

The AWS Guard rule set used to run security test. Options are:

To get started simply add a workflow .yml file (name it whatever you would like) to your .github/workflows folder. Refer to the documentation on workflow YAML syntax here..

The following example tests CloudFormation with the FedRAMP-Moderate example rule set:

name: sast

on: [push]

jobs:
  ## Guard rule set FedRAMP-Moderate
  sast-guard:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: grolston/guard-action@main
      with:
        data_directory: './cloudformation/' ## change to your template directory
        rule_set: "FedRAMP-Moderate"

The following example tests CloudFormation with the cis-aws-benchmark-level-1 example rule set:

name: sast

on: [push]

jobs:
  ## Guard rule set cis-aws-benchmark-level-1
  sast-guard:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: grolston/guard-action@main
      with:
        data_directory: './cloudformation/' ## change to your template directory
        rule_set: "cis-aws-benchmark-level-1"

The rules build in guard-action support resource-level rule suppression. Suppressed Rules are marked as SKIP in the validation process. To suppress a rule add in to the resource metadata the following Metadata:

YAML: Suppressing rule EC2_INSTANCE_PROFILE_ATTACHED

Resources:
  ExampleEC2:
    Type: AWS::EC2::Instance
    Metadata:
      guard:
        SuppressedRules:
        - EC2_INSTANCE_PROFILE_ATTACHED

JSON: Suppressing rule ELASTICSEARCH_ENCRYPTED_AT_REST

"Resources": {
  "ElasticsearchDomain": {
    "Type": "AWS::Elasticsearch::Domain",
    "Metadata": {
      "guard": {
        "SuppressedRules": ["ELASTICSEARCH_ENCRYPTED_AT_REST"]
      }
    },
    "Properties": {
      "DomainName": "test"
    }
  }
}

This project is distributed under the Apache 2.0.