Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Investigate whether MfaConfiguration=ON for AWS::Cognito::UserPool is a sane check #67

Closed
ghost opened this issue Oct 18, 2017 · 1 comment
Closed

Investigate whether MfaConfiguration=ON for AWS::Cognito::UserPool is a sane check #67

ghost opened this issue Oct 18, 2017 · 1 comment
Assignees
@tmcelhattan
Labels
feature

Comments

@ghost
Copy link

ghost commented Oct 18, 2017

Will require understanding if there are any use cases where we really want it OFF or OPTIONAL..... might be a warning if we usually want ON, but can have a reason for other
@ghost ghost changed the title Investigate where MfaConfiguration=ON for AWS::Cognito::UserPool is a sane check Investigate whether MfaConfiguration=ON for AWS::Cognito::UserPool is a sane check Oct 18, 2017
@ghost
Copy link
Author

ghost commented May 8, 2019

https://www.pivotaltracker.com/story/show/164842080

@ghost ghost closed this as completed May 8, 2019
@ghost ghost reopened this May 30, 2019
@ghost ghost assigned tmcelhattan Feb 3, 2020
tmcelhattan pushed a commit that referenced this issue Feb 7, 2020
Initial commit for Issue #67 - Adding rule to check for Cognito UserP…
84efe74 
…ool MfaConfiguration set to 'ON' or 'OPTIONAL'
@tmcelhattan tmcelhattan mentioned this issue Feb 7, 2020
Merged
ghost pushed a commit that referenced this issue Feb 17, 2020
Initial commit for Issue #67 - Adding rule to check for Cognito UserP… (
4540357 
#366)

#67 - Adding rule to check for Cognito UserPool MfaConfiguration set to 'ON' or 'OPTIONAL'

* cleaning up

* change rule to failing violation

* refactors

* Refactoring rule. Added util script and methods for checking if property is referencing a parameter and for getting that parameter's Default value

* #369 PRESUMING that unwrapped on/off will cause cloudformation to fail.... this hopefully simplifies the search for OFF

1. ignore a boolean parse of on/off given cfn will just blow
2. don't sweat trying to resolve parameter values from the rule - that's a job for the model.  when the cognito_user_pool_mfa_configuration_violations_all_variations_with_param_refs.yaml is parsed with parameter_value subsitution enabled... the default values of the parameter are applied.

* cleaning up

* rubocop

Co-authored-by: Eric Kascic <eric.kascic@stelligent.com>
@pshelby pshelby closed this as completed Feb 28, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tmcelhattan tmcelhattan

Labels
feature
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@pshelby @twellspring @tmcelhattan