{"id":5329,"date":"2022-01-24T01:15:41","date_gmt":"2022-01-23T17:15:41","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5329"},"modified":"2022-01-24T01:16:02","modified_gmt":"2022-01-23T17:16:02","slug":"cfripper-cloudformation-security-scanning-audit-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2022\/01\/cfripper-cloudformation-security-scanning-audit-tool\/","title":{"rendered":"CFRipper &#8211; CloudFormation Security Scanning &#038; Audit Tool"},"content":{"rendered":"<p>CFRipper is a Python-based Library and CLI security analyzer that functions as an AWS CloudFormation security scanning and audit tool, it aims to prevent vulnerabilities from getting to production infrastructure through vulnerable CloudFormation scripts.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CFRipper-CloudFormation-Security-Scanning-Audit-Tool-640x314.png\" alt=\"CFRipper - CloudFormation Security Scanning &amp; Audit Tool\" width=\"640\" height=\"314\" class=\"alignnone size-medium wp-image-5588\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CFRipper-CloudFormation-Security-Scanning-Audit-Tool-640x314.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CFRipper-CloudFormation-Security-Scanning-Audit-Tool.png 1024w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>You can use CFRipper to prevent deploying insecure AWS resources into your Cloud environment. You can write your own compliance checks by adding new custom plugins.<\/p>\n<p>CFRipper should be part of your CI\/CD pipeline. It runs just before a CloudFormation stack is deployed or updated and if the CloudFormation script fails to pass the security check it fails the deployment and notifies the team that owns the stack. Rules are the heart of CFRipper. When running CFRipper the CloudFormation stack will be checked against each rule and the results combined.<\/p>\n<h2>Usage of CFRipper for CloudFormation Security Scanning<\/h2>\n<pre>\r\nUsage:  [OPTIONS] [TEMPLATES]...\r\n\r\n  Analyse AWS Cloudformation templates passed by parameter. Exit codes:   -\r\n  0 = all templates valid and scanned successfully   - 1 = error \/ issue in\r\n  scanning at least one template   - 2 = at least one template is not valid\r\n  according to CFRipper (template scanned successfully)   - 3 = unknown \/\r\n  unhandled exception in scanning the templates\r\n\r\nOptions:\r\n  --version                       Show the version and exit.\r\n  --resolve \/ --no-resolve        Resolves cloudformation variables and\r\n                                  intrinsic functions  [default: False]\r\n\r\n  --resolve-parameters FILENAME   JSON\/YML file containing key-value pairs\r\n                                  used for resolving CloudFormation files with\r\n                                  templated parameters. For example, {\"abc\":\r\n                                  \"ABC\"} will change all occurrences of\r\n                                  {\"Ref\": \"abc\"} in the CloudFormation file to\r\n                                  \"ABC\".\r\n\r\n  --format [json|txt]             Output format  [default: txt]\r\n  --output-folder DIRECTORY       If not present, result will be sent to\r\n                                  stdout\r\n\r\n  --logging [ERROR|WARNING|INFO|DEBUG]\r\n                                  Logging level  [default: INFO]\r\n  --rules-config-file FILENAME    Loads rules configuration file (type: [.py,\r\n                                  .pyc])\r\n\r\n  --rules-filters-folder DIRECTORY\r\n                                  All files in the folder must be of type:\r\n                                  [.py, .pyc]\r\n\r\n  --aws-account-id TEXT           A 12-digit AWS account number eg.\r\n                                  123456789012\r\n\r\n  --aws-principals TEXT           A comma-separated list of AWS principals eg.\r\n                                  arn:aws:iam::123456789012:root,234567890123,\r\n                                  arn:aws:iam::111222333444:user\/user-name\r\n\r\n  --help                          Show this message and exit.\r\n<\/pre>\n<p>You can download CFRipper here:<\/p>\n<p><a href=\"https:\/\/github.com\/Skyscanner\/cfripper\/archive\/refs\/tags\/1.3.1.zip\">cfripper-1.3.1.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/Skyscanner\/cfripper\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CFRipper is a Python-based Library and CLI security analyzer that functions as an AWS CloudFormation security scanning and audit tool, it aims to prevent vulnerabilities from getting to production infrastructure through vulnerable CloudFormation scripts. You can use CFRipper to prevent deploying insecure AWS resources into your Cloud environment. You can write your own compliance checks [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":5588,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"CFRipper - CloudFormation Security Scanning &amp; Audit Tool","_seopress_titles_desc":"CFRipper is a Python-based Library and CLI security analyzer that functions as an AWS CloudFormation security scanning and audit tool","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[11],"tags":[],"featured_image_src":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CFRipper-CloudFormation-Security-Scanning-Audit-Tool.png","featured_image_src_square":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CFRipper-CloudFormation-Security-Scanning-Audit-Tool.png","author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5329"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5329"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5329\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media\/5588"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}