Custom rules about sonar-cloudformation-plugin

[issue-label-bot]

Issue-Label Bot is automatically applying the label question to this issue, with a confidence of 0.71. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[pethers]

To be honest I haven't really thought about custom rules, managed to create PR to cfn-nag that got merged for all rules I required.

Not sure I can support this. Also a bit of problem to support https://github.com/aws-cloudformation/cloudformation-guard, lack well defined rules id:s as well.

[tzvetkov75]

Yes, IMHO custom rules means sonar server needs dynamically to load them from scan report. May be like OWASP dependency check plugin.

[pethers]

The owasp dependency check use 1 rule for all, but change severity/text based to include cve. Would be happy to include rule id:s that can be installed by released gem:s .

https://github.com/bridgecrewio/checkov might be possible to add support for.

[tzvetkov75]

I think easy win to add rule:id as place holder, like W1000, or/and F1000. If CFN_NAG provides report with unknown ids , then they are mapped to the place holder id (many-to-one). The Plugin currently would display the msg finding properly, aka msg "My custom finding..." . Similar to owasp. (not perfect but better then nothing)

[pethers]

Will try to fix this later this week, will create a custom warning and on error so depending on if ID starts with F or W they will get different severity.

[pethers]

Now included in https://github.com/Hack23/sonar-cloudformation-plugin/releases/tag/sonar-cloudformation-plugin-2.0.8

[pethers]

Updated https://github.com/Hack23/sonar-cloudformation-plugin with below
Custom cfn-nag rules or rules not yet defined
Will be mapped to "Custom cfn-nag failure rule or rule missing integration in this plugin." alt Custom cfn-nag warning rule or rule missing integration in this plugin. Assumes all failures start with uppercase F and all warnings with uppercase W.

Updated