Skip to content

Commit 5546916

Browse files
ViktorLindstrmViktorLindstrm
committed
Tests for CloudFormation lib
1 parent f1e727b commit 5546916

7 files changed

Lines changed: 226 additions & 0 deletions

File tree

‎ql/test/library-tests/aws/cloudformation/AST.expected‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,61 @@
11
cloudformation
2+
| IAMRole.yml:1:1:18:74 | CloudFormation Document |
3+
| IngressEgressResources.yml:1:1:19:21 | CloudFormation Document |
4+
| ecs.yml:1:1:92:40 | CloudFormation Document |
5+
| lambda.yml:1:1:21:18 | CloudFormation Document |
26
| s3.json:1:1:77:1 | CloudFormation Document |
37
| s3.yml:1:1:42:59 | CloudFormation Document |
8+
| securitygroup.yml:1:1:16:24 | CloudFormation Document |
49
resources
10+
| IAMRole.yml:5:5:18:74 | CloudFormation IAM Role |
11+
| IngressEgressResources.yml:7:5:13:2 | CloudFormation EC2 Security Group Ingress |
12+
| IngressEgressResources.yml:14:5:19:21 | CloudFormation EC2 Security Group Egress |
13+
| ecs.yml:6:5:38:2 | CloudFormation ECS Task Set |
14+
| ecs.yml:39:5:66:2 | CloudFormation ECS Task Definition |
15+
| ecs.yml:67:5:92:40 | CloudFormation Resource |
16+
| lambda.yml:5:5:21:18 | CloudFormation Lambda Function |
517
| s3.json:4:21:15:9 | CloudFormation S3 Bucket |
618
| s3.json:16:25:47:9 | CloudFormation S3 Bucket Policy |
719
| s3.yml:4:5:12:2 | CloudFormation S3 Bucket |
820
| s3.yml:13:5:28:28 | CloudFormation S3 Bucket Policy |
21+
| securitygroup.yml:7:5:16:24 | CloudFormation EC2 Security Group |
922
resourceProperties
23+
| IAMRole.yml:7:7:18:74 | CloudFormation Resource Properties |
24+
| IngressEgressResources.yml:9:7:13:2 | CloudFormation Resource Properties |
25+
| IngressEgressResources.yml:16:7:19:21 | CloudFormation Resource Properties |
26+
| ecs.yml:8:7:38:2 | CloudFormation Resource Properties |
27+
| ecs.yml:41:7:66:2 | CloudFormation Resource Properties |
28+
| ecs.yml:70:7:92:40 | CloudFormation Resource Properties |
29+
| lambda.yml:7:7:21:18 | CloudFormation Resource Properties |
1030
| s3.json:6:27:12:13 | CloudFormation Resource Properties |
1131
| s3.json:18:27:46:13 | CloudFormation Resource Properties |
1232
| s3.yml:6:7:10:4 | CloudFormation Resource Properties |
1333
| s3.yml:15:7:28:28 | CloudFormation Resource Properties |
34+
| securitygroup.yml:9:7:16:24 | CloudFormation Resource Properties |
1435
s3
1536
| s3.json:4:21:15:9 | CloudFormation S3 Bucket |
1637
| s3.yml:4:5:12:2 | CloudFormation S3 Bucket |
1738
s3Policy
1839
| s3.yml:4:5:12:2 | CloudFormation S3 Bucket | s3.yml:13:5:28:28 | CloudFormation S3 Bucket Policy |
40+
lambda
41+
| lambda.yml:5:5:21:18 | CloudFormation Lambda Function |
42+
ec2SecurityGroup
43+
| securitygroup.yml:7:5:16:24 | CloudFormation EC2 Security Group |
44+
ec2SecurityGroupIngress
45+
| IngressEgressResources.yml:7:5:13:2 | CloudFormation EC2 Security Group Ingress |
46+
ec2SecurityGroupEgress
47+
| IngressEgressResources.yml:14:5:19:21 | CloudFormation EC2 Security Group Egress |
48+
iamRole
49+
| IAMRole.yml:5:5:18:74 | CloudFormation IAM Role |
50+
iamStatement
51+
| IAMRole.yml:9:9:16:6 | Version ... -10-17' |
52+
| s3.yml:16:9:28:6 | Id: MyPolicy |
53+
ecsService
54+
| ecs.yml:67:5:92:40 | CloudFormation Resource |
55+
ecsCluster
56+
ecsTaskSet
57+
| ecs.yml:6:5:38:2 | CloudFormation ECS Task Set |
58+
taskDefinition
59+
| ecs.yml:39:5:66:2 | CloudFormation ECS Task Definition |
60+
containerDefinition
61+
| ecs.yml:41:7:66:2 | CloudFormation Resource Properties |

‎ql/test/library-tests/aws/cloudformation/AST.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,17 @@ query predicate s3(CloudFormation::S3Bucket n) { any() }
1111
query predicate s3Policy(CloudFormation::S3Bucket n, CloudFormation::S3BucketPolicy p) {
1212
p = n.getBucketPolicy()
1313
}
14+
15+
query predicate lambda(CloudFormation::LambdaFunction n) { any() }
16+
17+
query predicate ec2SecurityGroup(CloudFormation::EC2SecurityGroup n) { any() }
18+
query predicate ec2SecurityGroupIngress(CloudFormation::EC2SecurityGroupIngress n) { any() }
19+
query predicate ec2SecurityGroupEgress(CloudFormation::EC2SecurityGroupEgress n) { any() }
20+
query predicate iamRole(CloudFormation::IAMRole n) { any() }
21+
query predicate iamStatement(CloudFormation::IAMStatement p){ any() }
22+
23+
query predicate ecsService(CloudFormation::ECSService p){ any() }
24+
query predicate ecsCluster(CloudFormation::ECSCluster p){ any() }
25+
query predicate ecsTaskSet(CloudFormation::ECSTaskSet p){ any() }
26+
query predicate taskDefinition(CloudFormation::TaskDefinition p){ any() }
27+
query predicate containerDefinition(CloudFormation::ContainerDefinition p){ any() }

‎ql/test/library-tests/aws/cloudformation/IAMRole.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'Security: Account Enable Guardduty'
3+
Resources:
4+
LambdaRole:
5+
Type: 'AWS::IAM::Role'
6+
Properties:
7+
RoleName: SecurityGuardDutyLambdaRole
8+
AssumeRolePolicyDocument:
9+
Version: '2012-10-17'
10+
Statement:
11+
- Effect: Allow
12+
Principal:
13+
Service: 'lambda.amazonaws.com'
14+
Action:
15+
- 'sts:AssumeRole'
16+
Path: '/'
17+
ManagedPolicyArns:
18+
- 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

‎ql/test/library-tests/aws/cloudformation/IngressEgressResources.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Transform: AWS::Serverless-2016-10-31
3+
Description: PositionAndJourney Statistics Service
4+
5+
Resources:
6+
IngressInbound:
7+
Type: 'AWS::EC2::SecurityGroupIngress'
8+
Properties:
9+
IpProtocol: tcp
10+
CidrIp: 0.0.0.0/0
11+
FromPort: '6370'
12+
ToPort: '6379'
13+
EgressOutbound:
14+
Type: 'AWS::EC2::SecurityGroupEgress'
15+
Properties:
16+
IpProtocol: tcp
17+
CidrIp: 0.0.0.0/0
18+
FromPort: '6370'
19+
ToPort: '6379'
20+
21+
22+

‎ql/test/library-tests/aws/cloudformation/ecs.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'Infrastructure for the ECS Fargate deployment pattern workshop service.'
3+
Parameters:
4+
Resources:
5+
TaskSet:
6+
Type: 'AWS::ECS::TaskSet'
7+
Properties:
8+
Cluster: !Ref 'Cluster'
9+
Service: !Ref 'Service'
10+
TaskDefinition: !Ref 'TaskDefinition'
11+
LaunchType: 'FARGATE'
12+
NetworkConfiguration:
13+
AwsVpcConfiguration:
14+
AssignPublicIp: 'ENABLED'
15+
SecurityGroups:
16+
- !Ref 'SecurityGroup'
17+
Subnets:
18+
- !Ref 'SubnetA'
19+
- !Ref 'SubnetB'
20+
- !Ref 'SubnetC'
21+
LoadBalancers:
22+
- ContainerName: !Ref 'ContainerName'
23+
ContainerPort: !Ref 'ContainerPort'
24+
TargetGroupArn: !Ref 'TargetGroup'
25+
PlatformVersion: 'LATEST'
26+
Scale: !Ref 'Scale'
27+
ServiceRegistries:
28+
- ContainerName: !Ref 'ContainerName'
29+
ContainerPort: !Ref 'ContainerPort'
30+
RegistryArn: !Ref 'ServiceDiscoveryRegistry'
31+
HealthCheckGracePeriodSeconds: 90
32+
SchedulingStrategy: 'REPLICA'
33+
ServiceDiscovery: !Ref 'ServiceDiscovery'
34+
35+
#------------------------------------------------
36+
# ECS task definition
37+
#------------------------------------------------
38+
ComponentTaskDefinition:
39+
Type: 'AWS::ECS::TaskDefinition'
40+
Properties:
41+
ContainerDefinitions:
42+
- Image: !Ref Container
43+
Name: !Ref Component
44+
PortMappings:
45+
- ContainerPort: !Ref ContainerPort
46+
LogConfiguration:
47+
LogDriver: 'awslogs'
48+
Options:
49+
awslogs-create-group: true
50+
awslogs-region: !Ref AWS::Region
51+
awslogs-group: !Sub '/fargate/logs'
52+
awslogs-stream-prefix: !Ref Component
53+
Environment:
54+
# Normally mandatory (but e.g. SHORTNAME and FLAVOUR may not always be applicable)
55+
Cpu: 512
56+
ExecutionRoleArn: !GetAtt ComponentTaskDefinitionExecutionRole.Arn
57+
TaskRoleArn: !GetAtt ComponentTaskDefinitionRole.Arn
58+
Family: !Ref Component
59+
Memory: 1024
60+
RequiresCompatibilities:
61+
- 'FARGATE'
62+
63+
#------------------------------------------------
64+
# ECS Service
65+
#------------------------------------------------
66+
ComponentEcsService:
67+
Type: 'AWS::ECS::Service'
68+
DependsOn: DummyListenerRule
69+
Properties:
70+
Cluster:
71+
Fn::ImportValue: 'ecs-fargate-ws-cluster-arn'
72+
DesiredCount: 1
73+
LaunchType: 'FARGATE'
74+
LoadBalancers:
75+
- ContainerName: !Ref Component
76+
ContainerPort: !Ref ContainerPort
77+
TargetGroupArn: !Ref ComponentTargetGroup
78+
NetworkConfiguration:
79+
AwsvpcConfiguration:
80+
AssignPublicIp: 'ENABLED'
81+
SecurityGroups:
82+
- !Ref ComponentEcsServiceSecurityGroup
83+
- !Ref CiSecurityGroupId
84+
Subnets:
85+
- !Ref PrivateA
86+
- !Ref PrivateB
87+
- !Ref PrivateC
88+
ServiceName: !Ref Service
89+
TaskDefinition: !Ref ComponentTaskDefinition
90+
PropagateTags: 'TASK_DEFINITION'
91+
# Note: The value has been lowered from the recommended 180, for production use please choose this value wisely.
92+
HealthCheckGracePeriodSeconds: 90

‎ql/test/library-tests/aws/cloudformation/lambda.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: 'Security: Account Enable Guardduty'
3+
Resources:
4+
LambdaFunctionEnableGuardDuty:
5+
Type: 'AWS::Lambda::Function'
6+
Properties:
7+
Code:
8+
ZipFile: |
9+
'use strict';
10+
const AWS = require('aws-sdk');
11+
const response = require('cfn-response');
12+
Handler: 'index.handler'
13+
MemorySize: 128
14+
Role: !GetAtt 'LambdaRole.Arn'
15+
Runtime: 'nodejs16.x'
16+
Tags:
17+
- Key: 'wcar-service'
18+
Value: 'provisioning-security-guardduty'
19+
- Key: 'team'
20+
Value: 'sec-ops'
21+
Timeout: 120

‎ql/test/library-tests/aws/cloudformation/securitygroup.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Metadata:
3+
Description: 'AWS CloudFormation Template To fs2 messaging test'
4+
5+
Resources:
6+
SecurityGroup:
7+
Type: AWS::EC2::SecurityGroup
8+
Properties:
9+
GroupDescription: "Vpc Security Group"
10+
SecurityGroupEgress:
11+
- IpProtocol: "tcp"
12+
CidrIp: "0.0.0.0/0"
13+
FromPort: 1337
14+
ToPort: 1337
15+
Description: "For RDS"
16+
VpcId: !Ref VpcId

0 commit comments

Comments
 (0)