aws-cloudformation-templates | A collection of useful CloudFormation templates

CFN-Nag looks for patterns in AWS CloudFormation templates that may indicate insecure infrastructure,

Ex:

IAM rules that are too permissive (wildcards), Security group rules that are too permissive (wildcards), Access logs that aren’t enabled, Encryption that isn’t enabled,

CFN-Lint scans the AWS CloudFormation template by processing a collection of Rules, where every rule handles a specific function check or validation of the template. It validates against AWS CloudFormation Resource specification.

This collection of rules can be extended with custom rules using the --append-rules argument.

Ex: Whitespaces, alignment(YAML), type checks, valid values for resource properties, and other best practices.

Those two links you previded above have all the information needed, just not directly for a Nodejs developer using a Windows machine.

Step1: Pull the docket image stelligent/cfn-nag

Step2: Add the script to your package.json for cfn-nag

Ex:

You have a !Sub on the string already, so instead of ${!Ref EFSFileSystem} you just need to do ${EFSFileSystem}. That will be replaced with the default output of the resource, in this case, the Id.

Important point to note to get the syntax right is to use Json with Yaml when using multiple Intrinsic functions. Updated syntax below. For Environment value DEV, this creates a bucket of name content-input-dev

This is a syntax error. One example how it should be for the Replace operation is given in the repository. Here is a template that I was able to deploy, it uses Transform inside FindInMap and creates an S3 bucket with a test-key:test-value tag:

I guess you are referring this sudo java -jar /tmp/app.jar &? I think you should kill it in your Init after your test finishes.

One way to do this could be as follows:

Not really sure what the difference between !Sub 'LoadBalancerRule${!Explode Prefix}' & - LoadBalancerRule!Explode Prefix is, but this worked out

Because Count is a macro, not a custom resource. A macro is a preprocessor for the Cloudformation template. It takes the template, changes it and outputs a new template. Cloudformation then carries on creating the stack using the updated template.

When you delete the stack, it deletes all resources defined in the stack so there is no need to call the macro again.

In contrast a custom resource is executed at deployment and is used to control resources that Cloudformation doesn't support or to implement other custom logic. The custom resource will be invoked when the stack is deleted to give it a chance to clear up the resources it created.