aws-cf-checker

AWS CloudFormation Checker

Checks can guarantee high security, reliability and conformity of your CloudFormation templates. We provide a set of default checks that you can use to validate your templates.

CLI usage

install the module globally

npm install aws-cf-checker -g

reading template from file

cf-checker --templateFile ./path/to/template.json

cf-checker --templateFile ./path/to/template.json --checksFile ./path/to/checks.json

reading template from stdin

cat ./path/to/template.json | cf-checker

cat ./path/to/template.json | cf-checker --checksFile ./path/to/checks.json

as long as the exit code is 0 your template is fine

Programatic usage

install the module locally

npm install aws-cf-checker

reading template from file

var checker = require("aws-cf-checker")

checker.checkFile("./path/to/template.json", {"logicalID": {"case": "pascal"}}, function(err, findings) {
  if (err) {
    throw err;
  } else {
    if (findings.length > 0) {
      console.error("findings", findings);
    } else {
      console.log("no findings");
    }
  }
});

using a template object

var checker = require("aws-cf-checker")

var template = {
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "minimal template"
};
checker.checkFile(template, {"logicalID": {"case": "pascal"}}, function(err, findings) {
  if (err) {
    throw err;
  } else {
    if (findings.length > 0) {
      console.error("findings", findings);
    } else {
      console.log("no findings");
    }
  }
});

as long as the findings array is empty your template is fine

Checks

Checks are configured with a JSON file. Have a look at our default checks.

logicalID

Checks logical ids of your template.

Options:

• case: Enum["pascal", "camel"] (default: "pascal")

resourceType

Checks if the resource types are allowed in the template. If you deny resource types everything that is not denied is allowed. If you allow resource types everything that is not allowed is denied.

Options:

• deny: Array[String]
• allow: Array[String]

securityGroupInbound

Checks that only security groups attached to external load balancers allow traffic from public ip addresses. Security groups attached to internal load balancers, auto scaling groups (launch configuration), rds instances should only allow inbound traffic from other security groups or private ip addresses.

Options:

• none