Template scanner

This endpoint returns the list of available rules that are executed when scanning a template.

Example Request (CloudFormation):

curl -H "Content-Type: application/vnd.api+json" \
https://us-west-2-api.cloudconformity.com/v1/template-scanner/rules?type=cloudformation-template

Example Request (Terraform):

curl -H "Content-Type: application/vnd.api+json" \
https://us-west-2-api.cloudconformity.com/v1/template-scanner/rules?type=terraform-template

Example Response:

{
  "data": [
    {
      "type": "rules",
      "id": "EC2-001",
      "attributes": {
        "title": "Security Group Port Range",
        "description": "Ensure no security group opens range of ports",
        "compliances": [
          "NIST4",
          "NIST5",
          "SOC2",
          "NIST-CSF",
          "NIST-CSF-2_0",
          "AGISM",
          "HITRUST",
          "ASAE-3150",
          "PCI",
          "PCI-V4",
          "FEDRAMP",
          "CSA"
        ],
        "provider": "aws",
        "service": "EC2"
      }
    },
    {
      "type": "rules",
      "id": "EC2-014",
      "attributes": {
        "title": "Security Group Rules Counts",
        "description": "Determine if there is a large number of rules in a security group",
        "compliances": [
          "AWAF",
          "AGISM",
          "ASAE-3150",
          "PCI",
          "PCI-V4",
          "CSA"
        ],
        "provider": "aws",
        "service": "EC2"
      }
    }, ...more rules
  ]
}

Template scanner accepts CloudFormation templates, in either YAML or JSON format, and Terraform plan templates only in JSON format. For assistance in how to generate Terraform plan templates from HCL to JSON format, please refer to the section Scanning a Terraform Template in the Help pages.

• Child modules are also supported for Terraform

Supported rules:

All resource level rules are supported. For CloudFormation template rules supported, please refer to the CloudFormation rules endpoint for a list. For Terraform JSON plan rules supported, please refer to the Terraform rules endpoint for a list.

Examples:

Scan a template using Bash:

#!/usr/bin/env bash
# Scans a template file
# Requires "jq" (https://stedolan.github.io/jq/) to be installed

# Cloud Conformity API Key
api_key="Your Cloud Conformity API Key"
# Path to template file
file_path="Path to template"
# Region in which Cloud Conformity serves your organisation
region="us-west-2"

contents=$(cat ${file_path} | jq '.' -MRs)
payload="{\"data\":{\"attributes\":{\"type\":\"cloudformation-template\",\"contents\":${contents}}}}"

echo Request:
echo ${payload} | jq '.' -M

echo Response:
curl -s -X POST \
     -H "Authorization: ApiKey ${api_key}" \
     -H "Content-Type: application/vnd.api+json" \
     https://${region}-api.cloudconformity.com/v1/template-scanner/scan \
     --data-binary "${payload}" | jq '.' -M

Scan a template using Python:

#!/usr/bin/env python
# Scans a template file
# Requires "requests" to be installed

import requests
import json

# Please substitute filePath, apiKey, and region
# Cloud Conformity API Key
apiKey="Your Cloud Conformity API Key"
# Path to CloudFormation template file Yaml or JSON file
filePath="Path to CloudFormation template"
# Region in which Cloud Conformity serves your organisation
region="us-west-2"

endpoint = 'https://' + region + '-api.cloudconformity.com'
url = endpoint + '/v1/template-scanner/scan'

headers = {
    'Content-Type': 'application/vnd.api+json',
    'Authorization': 'ApiKey ' + apiKey
}

contents = open(filePath, 'r').read()

payload =  {
    'data': {
        'attributes': {
            'type': 'cloudformation-template',
            'contents': contents
        }
    }
}
print 'Request:\n' + json.dumps(payload, indent=2)

resp = requests.post(url, headers=headers, data=json.dumps(payload))
print 'Response:\n' + json.dumps(resp.json(), indent=2, sort_keys=True)