Sorry about the very long delay. Iâve finally had a chance to test this. You did send me links to a demo instance - and thanks for that! - but as part of my initial testing I always want to start up an instance with the plugin and run an analysis just to make sure the basics are covered. They are.
Iâve requested some changes to your PR. Once theyâre handled, Iâll pull the trigger on this.
AND, I do have some non-blocker feedback for you.
You seem to raise all issues on the Type element. When youâre raising an issue about a missing property, I guess thatâs as good a place as any. However, when youâre raising an issue about a property that is there, it seems like the issue should be raised on that property. E.G.
Taking the user directly to the exact line and symbol that needs work helps her understand what needs to be done.
Iâm hoping that youâll eventually flesh out your rule descriptions to explain why the issues you raise represent problems that need to be addressed. Right now, each description is a re-statement of the rule name. If you know what youâre doing, then this âreminderâ format is okay. But keep in mind that SonarQube is a teaching/learning tool for many, many developers. If they already understood what the good practices are, they wouldnât need us.
Long term, Iâm hoping that your plan is to embed the underlying tool and run it as part of analysis if a report isnât fed in manually. What youâre doing is perfectly acceptable, but it would ease adoption/use to make things as simple as possible to use.
CWE-732 - Incorrect Permission Assignment for Critical Resource
CWE-272 - Least Privilege Violation
CWE-257 - Storing Passwords in a Recoverable Format
CWE-311 - Missing Encryption of Sensitive Data
CWE-326 - Inadequate Encryption Strength
CWE-286 - Incorrect User Management
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-778 - Insufficient Logging
" You seem to raise all issues on the Type element.", a limitation of the cfn-nag tool. It only reports a line number at the moment. But once the parser https://github.com/stelligent/cfn-model improves and support more specific issues and will try to support it.
P.S. I just saw how this shows up in the Marketplace / Plugin Version Matrix:
If I can add an item to my wish list, it would be that you update the name (not the key! just the name) to something like Cloudformation or Cfn-nag or Cloudformation/Cfn-nag, orâŠ
Why? Well⊠itâs obvious in context that itâs a plugin, and âweâ (for some definition of âweâ) get a little twitchy about that âSonarâ sometimes.
