Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
function _diffProperty(oldV: any, newV: any, key: string, resourceSpec?: cfnspec.schema.ResourceType) {
let changeImpact = types.ResourceImpact.NO_CHANGE;
const spec = resourceSpec && resourceSpec.Properties && resourceSpec.Properties[key];
if (spec && !deepEqual(oldV, newV)) {
switch (spec.UpdateType) {
case cfnspec.schema.UpdateType.Immutable:
changeImpact = types.ResourceImpact.WILL_REPLACE;
break;
case cfnspec.schema.UpdateType.Conditional:
changeImpact = types.ResourceImpact.MAY_REPLACE;
break;
default:
// In those cases, whatever is the current value is what we should keep
changeImpact = types.ResourceImpact.WILL_UPDATE;
}
}
return new types.PropertyDifference(oldV, newV, { changeImpact });
}
private readResourceChange(resourceChange: ResourceChange) {
switch (resourceChange.scrutinyType) {
case cfnspec.schema.ResourceScrutinyType.IdentityPolicyResource:
// AWS::IAM::Policy
this.statements.addOld(...this.readIdentityPolicyResource(resourceChange.oldProperties));
this.statements.addNew(...this.readIdentityPolicyResource(resourceChange.newProperties));
break;
case cfnspec.schema.ResourceScrutinyType.ResourcePolicyResource:
// AWS::*::{Bucket,Queue,Topic}Policy
this.statements.addOld(...this.readResourcePolicyResource(resourceChange.oldProperties));
this.statements.addNew(...this.readResourcePolicyResource(resourceChange.newProperties));
break;
case cfnspec.schema.ResourceScrutinyType.LambdaPermission:
this.statements.addOld(...this.readLambdaStatements(resourceChange.oldProperties));
this.statements.addNew(...this.readLambdaStatements(resourceChange.newProperties));
break;
}
}
}
/**
* Changes to IAM statements
*/
export class IamChanges {
public static IamPropertyScrutinies = [
cfnspec.schema.PropertyScrutinyType.InlineIdentityPolicies,
cfnspec.schema.PropertyScrutinyType.InlineResourcePolicy,
cfnspec.schema.PropertyScrutinyType.ManagedPolicies,
];
public static IamResourceScrutinies = [
cfnspec.schema.ResourceScrutinyType.ResourcePolicyResource,
cfnspec.schema.ResourceScrutinyType.IdentityPolicyResource,
cfnspec.schema.ResourceScrutinyType.LambdaPermission,
];
public readonly statements = new DiffableCollection();
public readonly managedPolicies = new DiffableCollection();
constructor(props: IamChangesProps) {
for (const propertyChange of props.propertyChanges) {
this.readPropertyChange(propertyChange);
}
for (const resourceChange of props.resourceChanges) {
this.readResourceChange(resourceChange);
}
this.statements.calculateDiff();
this.managedPolicies.calculateDiff();
}
this.metadata = args.metadata || new DifferenceCollection({});
this.outputs = args.outputs || new DifferenceCollection({});
this.parameters = args.parameters || new DifferenceCollection({});
this.resources = args.resources || new DifferenceCollection({});
this.unknown = args.unknown || new DifferenceCollection({});
this.iamChanges = new IamChanges({
propertyChanges: this.scrutinizablePropertyChanges(IamChanges.IamPropertyScrutinies),
resourceChanges: this.scrutinizableResourceChanges(IamChanges.IamResourceScrutinies),
});
this.securityGroupChanges = new SecurityGroupChanges({
egressRulePropertyChanges: this.scrutinizablePropertyChanges([cfnspec.schema.PropertyScrutinyType.EgressRules]),
ingressRulePropertyChanges: this.scrutinizablePropertyChanges([cfnspec.schema.PropertyScrutinyType.IngressRules]),
egressRuleResourceChanges: this.scrutinizableResourceChanges([cfnspec.schema.ResourceScrutinyType.EgressRuleResource]),
ingressRuleResourceChanges: this.scrutinizableResourceChanges([cfnspec.schema.ResourceScrutinyType.IngressRuleResource]),
});
}
this.conditions = args.conditions || new DifferenceCollection({});
this.mappings = args.mappings || new DifferenceCollection({});
this.metadata = args.metadata || new DifferenceCollection({});
this.outputs = args.outputs || new DifferenceCollection({});
this.parameters = args.parameters || new DifferenceCollection({});
this.resources = args.resources || new DifferenceCollection({});
this.unknown = args.unknown || new DifferenceCollection({});
this.iamChanges = new IamChanges({
propertyChanges: this.scrutinizablePropertyChanges(IamChanges.IamPropertyScrutinies),
resourceChanges: this.scrutinizableResourceChanges(IamChanges.IamResourceScrutinies),
});
this.securityGroupChanges = new SecurityGroupChanges({
egressRulePropertyChanges: this.scrutinizablePropertyChanges([cfnspec.schema.PropertyScrutinyType.EgressRules]),
ingressRulePropertyChanges: this.scrutinizablePropertyChanges([cfnspec.schema.PropertyScrutinyType.IngressRules]),
egressRuleResourceChanges: this.scrutinizableResourceChanges([cfnspec.schema.ResourceScrutinyType.EgressRuleResource]),
ingressRuleResourceChanges: this.scrutinizableResourceChanges([cfnspec.schema.ResourceScrutinyType.IngressRuleResource]),
});
}