Skip to content

Releases

v3.2.1

v3.2.1 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 15:33
3.2.1
e531ef5

What's Changed

  • Use remote check for tag and force-with-lease for branch to allow rel… by @Zee2413 in #675
  • Fetch before pushing release branch by @Zee2413 in #676
  • Remove homebrew step and skip scratch compilation during cargo publish by @Zee2413 in #678
  • Prevent cargo publish errors from being swallowed as already published by @Zee2413 in #680
  • fix: exclude bot authors from release notes and prevent duplication o… by @Zee2413 in #682
  • fix: bump form-data to 4.0.5 to resolve CVE-2025-7783 (Dependabot #46) by @Zee2413 in #685
  • fix: resolve npm audit vulnerabilities in action/ and replace dead gitpkg dependency by @Zee2413 in #691
  • fix: resolve 9 npm audit vulnerabilities in guard/ dev dependencies by @Zee2413 in #690
  • fix: add explicit permissions to all GitHub Actions workflows by @Zee2413 in #693
  • fix: upgrade @actions/github to 8.0.1 and @actions/core to 2.0.3 to resolve undici CVEs by @Zee2413 in #695
  • fix: bump bytes crate to 1.11.1 to resolve CVE-2026-25541 by @Zee2413 in #694
  • chore: automate ATTRIBUTION generation with cargo-about by @Zee2413 in #697
  • chore(deps): Fix high severity npm audit findings in /action and /guard by @Zee2413 in #711
  • Fix evaluator and reporter defects where a rule reported compliance, or nothing at all, for input it should have rejected by @awsmadi in #717
  • fix(deps): Patch high-severity advisories by @Zee2413 in #724
  • fix(deps): Update undici to 6.28.0 by @Zee2413 in #726

New Contributors

  • @github-actions[bot] made their first contribution in #681
  • @awsmadi made their first contribution in #717

Full Changelog: 3.2.0...3.2.1

Contributors

Zee2413 and awsmadi
Assets 15

v3.2.0

v3.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Mar 17:47
3.2.0
ae35f4e

What's Changed

  • chore(deps-dev): Bump eslint from 8.57.0 to 8.57.1 in /action by @dependabot[bot] in #569
  • chore: override cross-spawn version by @dannyvassallo in #592
  • [fix] explicity set resolver=2 on root virtual workspace. by @lizhunt-aws in #593
  • Update Terraform plan cfn-guard examples by @awsree in #587
  • fix: failing cargo audit ci job by @joshfried-aws in #606
  • fix: adding a step to install rustc 1.81 to audit ci job by @joshfried-aws in #607
  • chore: adding check for cargo-audit job to skip forked repositories by @joshfried-aws in #609
  • chore: updating rstest version due to flagged dependency by @joshfried-aws in #610
  • chore: updating colored and simple_logger to address flagged dependency by @joshfried-aws in #611
  • chore: bumping up nom and nom_locate by @joshfried-aws in #612
  • chore(deps-dev): Bump the npm-development group across 1 directory with 11 updates by @dependabot[bot] in #613
  • chore(deps): Bump @actions/core from 1.10.1 to 1.11.1 in /action by @dependabot[bot] in #572
  • chore(deps): Bump undici from 5.28.4 to 5.28.5 in /action by @dependabot[bot] in #602
  • chore(deps): Bump @octokit/request-error from 5.1.0 to 5.1.1 in /action by @dependabot[bot] in #615
  • chore(deps-dev): Bump the npm-development group in /action with 4 updates by @dependabot[bot] in #616
  • chore(deps-dev): Bump @stylistic/eslint-plugin from 2.8.0 to 3.1.0 in /action by @dependabot[bot] in #618
  • chore(deps-dev): Bump eslint from 8.57.1 to 9.20.1 in /action by @dependabot[bot] in #617
  • chore(deps-dev): Bump @stylistic/eslint-plugin from 3.1.0 to 4.0.0 in /action by @dependabot[bot] in #620
  • chore(deps): Bump @octokit/endpoint from 9.0.5 to 9.0.6 in /action by @dependabot[bot] in #619
  • chore(deps): Bump @octokit/request from 8.4.0 to 8.4.1 in /action by @dependabot[bot] in #621
  • chore(deps): Bump @octokit/plugin-paginate-rest from 9.2.1 to 9.2.2 in /action by @dependabot[bot] in #622
  • feat: skip diff check on dependabot by @dannyvassallo in #623
  • chore(deps-dev): Bump the npm-development group in /action with 10 updates by @dependabot[bot] in #624
  • chore(deps-dev): Bump globals from 15.15.0 to 16.0.0 in /action by @dependabot[bot] in #625
  • fix(loader): update parse boolean to work with all accepted yaml values by @joshfried-aws in #633
  • chore(deps): Bump tokio from 1.43.0 to 1.43.1 by @dependabot[bot] in #631
  • chore(deps-dev): Bump the npm-development group across 1 directory with 11 updates by @dependabot[bot] in #632
  • feat: add linux-named release assets for compatibility by @deepfuriya in #664
  • fix: resolve dangerous implicit autoref in YAML parser by @chenrui333 in #650
  • fix(guard-lambda): upgrade lambda_runtime to 0.13.0 to resolve RUSTSE… by @Zee2413 in #667
  • Omit ource from typos check by @Zee2413 in #669
  • Remove macos-13-xlarge from os matrix to prevent CI failures by @Zee2413 in #670
  • Replace archived actions-rs/clippy-check with direct cargo clippy by @Zee2413 in #671
  • feat: add unified release workflow with crates.io, Homebrew, and Dock… by @Zee2413 in #673
  • Bump version using release branch instead of directly on main by @Zee2413 in #674

New Contributors

Full Changelog: 3.1.2...3.2.0

Contributors

chenrui333, dannyvassallo, and 6 other contributors
Loading

v3.1.2

v3.1.2

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 25 Nov 17:23
3.1.2
de26750
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

New Contributors

NOTE

Please note the new time api introduced in this release is considered experimental. Please report any bugs to our GitHub repository, we intend to stabilize it in an upcoming 3.2.0 release.

Full Changelog: 3.1.1...3.1.12

Contributors

jbleduigou, dannyvassallo, and 4 other contributors
Loading

v3.1.1

v3.1.1

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 12 Apr 17:30
3.1.1
b120e1e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • [BugFix]: fix for regression regarding delimiters for show summary by @joshfried-aws in #494

Full Changelog: 3.1.0...3.1.1

Contributors

joshfried-aws
Loading

v3.1.0

v3.1.0

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 27 Mar 15:27
3.1.0
e44fc14
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

New Contributors

Full Changelog: 3.0.3...3.1.0

Table of Contents

  1. New Validate reporters
  2. New Test Flag to Specify an Output
  3. Cfn-Guard as a Library
  4. Stabilized Converter Functions

New Validate Reporters

  1. JUnit - users can now use the -o or --output-format flag to request a JUnit report -o junit
  2. Sarif - users can now use the -o or --output-format flag to request a Sarif report -o sarif

NOTE: If either junit, or sarif output-format is set, this requires the user to also pass --structured, and -S none otherwise cfn-guard will return an error

New Test Flag to Specify an Output

  1. The output format flag has been added to the test command. This means users can now take advantage of 4 different reporting mechanisms; single-line-summary, json, yaml, or junit

Cfn-Guard as a Library

  1. Users can now leverage cfn-guard as a library. We now have added builders for users to construct commands, and call them as needed. This will allow users to more easily build solutions with cfn-guard for specific needs

Stabilized Converter Functions

NOTE: This feature was previously introduced in version 3.0.1, it is now stabilized as of version 3.1.0
To improve the user experience for validating templates when schemas use types that might be easier evaluated as a different type (i.e. a string thats actually a number) the 3.0.1 release adds support to convert between specific types.

The conversions allowed are the following
strings/floats-> ints
strings/ints -> floats
strings -> bools
bools/floats/ints -> strings

The following is an example of parsing a string into an int.

Given the following template:

Resources:
  asg:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: "1"

We can write the following rule

let asg = Resources.*[ Type == 'AWS::AutoScaling::AutoScalingGroup' ]

rule test_parse_int when %asg !empty {
   let min = parse_int(%asg.Properties.MinSize)

   %min == 1
}

Contributors

dannyvassallo, sejimhp, and 2 other contributors
Loading
0 Join discussion

3.1.0-beta

3.1.0-beta Pre-release
Pre-release

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 01 Mar 19:13
3.1.0-beta
a2f441f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

New Contributors

Full Changelog: 3.0.3...3.1.0-beta

Table of Contents

  1. New Validate reporters
  2. New Test Flag to Specify an Output
  3. Cfn-Guard as a Library

New Validate Reporters

  1. JUnit - users can now use the -o or --output-format flag to request a JUnit report -o junit
  2. Sarif - users can now use the -o or --output-format flag to request a Sarif report -o sarif

NOTE: If either junit, or sarif output-format is set, this requires the user to also pass --structured, and -S none otherwise cfn-guard will return an error

New Test Flag to Specify an Output

  1. The output format flag has been added to the test command. This means users can now take advantage of 4 different reporting mechanisms; single-line-summary, json, yaml, or junit

Cfn-Guard as a Library

  1. Users can now leverage cfn-guard as a library. We now have added builders for users to construct commands, and call them as needed. This will allow users to more easily build solutions with cfn-guard for specific needs

Contributors

dannyvassallo, sejimhp, and joshfried-aws
Loading
0 Join discussion

v3.0.3

v3.0.3

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 11 Jan 19:37
3.0.3
d397d8d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

What's Changed

New Contributors

Full Changelog: 3.0.2...3.0.3

Contributors

sepehrdaddev, dependabot, and joshfried-aws
Loading

v3.0.2

v3.0.2

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 17 Nov 15:51
3.0.2
88faf08
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

What's Changed

Full Changelog: 3.0.1...3.0.2

Contributors

joshfried-aws
Loading

v3.0.1

v3.0.1

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 08 Sep 15:00
3.0.1
e0a6602
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

What's Changed

Details

Added support for conversion functions

To improve the user experience for validating templates when schemas use types that might be easier evaluated as a different type (i.e. a string thats actually a number) the 3.0.1 release adds support to convert between specific types.

The conversions allowed are the following
strings/floats-> ints
strings/ints -> floats
strings -> bools
bools/floats/ints -> strings

The following is an example of parsing a string into an int.

Given the following template:

Resources:
  asg:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: "1"

We can write the following rule

let asg = Resources.*[ Type == 'AWS::AutoScaling::AutoScalingGroup' ]

rule test_parse_int when %asg !empty {
   let min = parse_int(%asg.Properties.MinSize)

   %min == 1
}

Full Changelog: 3.0.0...3.0.1

Contributors

joshfried-aws
Loading

v3.0.0

v3.0.0

Choose a tag to compare

View all tags
@joshfried-aws joshfried-aws released this 29 Jun 19:32
3.0.0
c7bcce2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

What's Changed

  • Populated filename in the output by @akshayrane in #358
  • Support for some function expressions / stateful rules by @joshfried-aws in #361
  • Combined structured output and updated default rule clause name to include file name by @akshayrane in #360
  • Clap Autocompletions by @joshfried-aws in #340
  • Adding documentation for functions by @joshfried-aws in #362
  • Deprecated migrate and previous engine by @akshayrane in #364
  • Removing unnecessary print statement for failure in parse-tree command by @joshfried-aws in #368
  • Improve error message for templates that cause an error by @joshfried-aws in #370
  • Clippy lints + ci by @joshfried-aws in #371
  • [Bugfix]: Fixed bug where cfn template fails validate rule check and when failing node isnt a child of resources by @joshfried-aws in #372
  • Updating reporters to all use serde for both json and yaml + misc improvements by @joshfried-aws in #373
  • [Bugfix] Fixing improper console output when using single line summary by @joshfried-aws in #378
  • [Enhancement] Creating a new error code for rule failures by @joshfried-aws in #379
  • Refined documentation for functions, join path bugfix & version bump by @akshayrane in #381
  • Changes to CI actions by @akshayrane & @joshfried-aws in #366 & #383
    • Updates to README.md for 3.0.0
    • Added latest configuration for aws-guard-rules-registry integration tests
    • Added new deployment method for cfn-guard-lambda through AWS SAM-CLI
    • Deprecated -j as short flag for print-json
    • Updated names for artifacts to have v3 in them
    • Added rogue_one branch to docker workflow, this will publish an ECR image for all updates to this remote branch as well
  • Added OS-specific cargo targets to release workflow by @akshayrane in #310
  • [Code Quality]: Rust-fmt action + formatting project by @joshfried-aws in #315
  • [Code Quality]: Implementing custom writer, bug fixes, new integration test framework, and adding initial tests for all commands by @joshfried-aws in #325
  • Bump tokio from 1.21.2 to 1.24.2 by @dependabot in #327
  • Improved documentation for new Guard version and keeping version up to date for GitHub runner OS by @razcloud in #365
  • +[fancy-regex] Added support for advanced regular expressions by @akshayrane in #326
  • improved safety of serde_yaml::Value -> value conversion by @joshfried-aws in #328
  • Improve handling of function references for test command by @joshfried-aws in #331
  • PR to add Thiserror to cfn-guard by @joshfried-aws in #329
  • Redirected verbose output from stdout to custom writer and added unit… by @akshayrane in #332
  • Addit cargo-audit to CI + bump up clap to 3.0 by @joshfried-aws in #330
  • Implemented custom reader, increasing test coverage for validate command. by @joshfried-aws in #334
  • Update CONTRIBUTING.md by @swiercek in #335
  • Clap4 by @joshfried-aws in #336
  • Added integration tests against aws-guard-rules-registry on Ubuntu by @akshayrane in #337
  • Update check-tags-present.guard by @Aishwarya4400 in #313
  • Adding structured evaluator by @joshfried-aws in #339

Breaking changes in 3.0.0

  1. Error codes - We emit a different exit code (19) now for validation failure if the data template(s) passed are non-compliant against the rules. This will make it easy to distinguish between the two. Previously, we emitted the same code as for parse errors (5). (PR #379)
  2. Intrinsic function resolution with test command. We now handle the intrinsic functions like Fn::ImportValue, Fn::Sub, etc in unit tests in an improved way. Read more about this change here.
  3. Standardized the output format for generic JSON/YAML templates to be inline with CFN-specific one. (PR #373)

Table of Contents

  1. Built-in Functions and Stateful Rules
  2. Added alternative deployment method using SAM-CLI for cfn-guard-lambda
  3. Updated the output to contain filename
  4. Updated combined structured output & default anonymous rule name
  5. Command auto-completions
  6. Added support for advanced regular expressions
  7. Improved handling for intrinsic functions in test command
  8. Added --structured flag to validate command to emit JSON/YAML parseable output

Details

1. Built-in Functions and Stateful Rules

As of version 3.0.0 guard now supplies some builtin functions, allowing for stateful rules.

Built-in functions are supported only through assignment to a variable at the moment, and not inline.

NOTE: all examples are operating off the following YAML template

Data

(click to expand) 
Resources:
  newServer:
    Type: AWS::New::Service
    Properties:
      Policy: |
        {
           "Principal": "*",
           "Actions": ["s3*", "ec2*"]
        }
      Arn: arn:aws:newservice:us-west-2:123456789012:Table/extracted
      Encoded: This%20string%20will%20be%20URL%20encoded
    Collection:
      - a
      - b
      - c
    BucketPolicy:
      PolicyText: '{"Version":"2012-10-17","Statement":[{"Sid":"DenyReducedReliabilityStorage","Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::s3-test-123/*","Condition":{"StringEquals":{"s3:x-amz-storage-class-123":["ONEZONE_IA","REDUCED_REDUNDANCY"]}}}]}'

  s3:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  bucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

String Manipulation Functions

The following functions all operate on queries that resolve to string values

1. json_parse()

The json_parse function adds support for parsing inline JSON strings from a given template. After parsing the string into an object,
you can now evaluate certain properties of this struct just like with a normal JSON/YAML object

Rule

(click to expand) 
let template = Resources.*[ Type == 'AWS::New::Service']
let expected = {
        "Principal": "*",
        "Actions": ["s3*", "ec2*"]
    }
rule TEST_JSON_PARSE when %template !empty {
    let policy = %template.Properties.Policy

    let res = json_parse(%policy)

    %res !empty
    %res == %expected
    <<
        Violation: the IAM policy does not match with the recommended policy
    >>
}

2. regex_replace()

The regex_replace function adds support for replacing one regular expression with another

In this simple example, we will re-format an ARN by moving around some sections in it.
We will start with a normal ARN that has the following pattern: arn:<Partition>:<Service>:<Region>:<AccountID>:<ResourceType>/<ResourceID>
and we will try to convert it to: <Partition>/<AccountID>/<Region>/<Service>-<ResourceType>/<ResourceID>

Rule

(click to expand) 
let template = Resources.*[ Type == 'AWS::New::Service']

rule TEST_REGEX_REPLACE when %template !empty {
    %template.Properties.Arn exists
    let arn = %template.Properties.Arn

    let arn_partition_regex = "^arn:(\w+):(\w+):([\w0-9-]+):(\d+):(.+)$"
    let capture_group_reordering = "${1}/${4}/${3}/${2}-${5}"
    let res = regex_replace(%arn, %arn_partition_regex, %capture_group_reordering)

    %res == "aws/123456789012/us-west-2/newservice-Table/extracted"
    << Violation: Resulting reformatted ARN does not match the expected format >>
}

3. join()

The join function adds support to collect a query, and the...

Read more

Contributors

akshayrane, dependabot, and 4 other contributors
Loading