fix: Enhance API Gateway structured logging and Lambda permission rule for improved validation (#231)

* fix: Enhance ApiGatewayStructuredLoggingRule and LambdaStarPermissionRule for improved validation

- Added stripping of leading/trailing quotes and whitespace in log format for ApiGatewayStructuredLoggingRule.
- Improved validation in LambdaStarPermissionRule by ensuring that statements and principals are dictionaries before accessing their properties.

* fix: Removed unnecessary conditional check for "Service" key in principal dictionary, directly accessing it to streamline the code.

* chore: update project version and dependencies

- Bumped version from 0.3.3 to 0.3.4 in pyproject.toml.
- Updated cfn-lint dependency from version 1.33.0 to 1.36.0 for improved functionality and compatibility.
- Incremented revision in uv.lock to reflect changes in dependency management.

* chore: update aws-serverless plugin version to 0.3.4

- Bumped version from 0.3.3 to 0.3.4 in README.md, tflint.md, and example configuration.
- Updated version in main.go to reflect the new plugin version.

Author: sliedig

README.md

@@ -41,7 +41,7 @@ You can enable the Serverless Rules plugin by adding a plugin section in the `.t
 ```terraform
 plugin "aws-serverless" {
   enabled = true
-  version = "0.3.3"
+  version = "0.3.4"
   source = "github.com/awslabs/serverless-rules"
 }
 ```

cfn-lint-serverless/cfn_lint_serverless/rules/api_gateway.py

@@ -74,6 +74,12 @@ def _check_log_format(self, log_format: str) -> bool:
         JSON first.
         """
 
+        # Strip any leading/trailing quotes and whitespace that might be in the string
+        log_format = log_format.strip()
+        if (log_format.startswith("'") and log_format.endswith("'")) or (log_format.startswith('"') and log_format.endswith('"')):
+            log_format = log_format[1:-1]
+
+        # Replace context variables with a simple value
         log_format = self._log_format_pattern.sub("0", log_format)
 
         try:

cfn-lint-serverless/cfn_lint_serverless/rules/lambda_.py

@@ -133,10 +133,17 @@ def _get_principals(self, properties) -> List[str]:
         principals = []
 
         for statement in properties.get("AssumeRolePolicyDocument", {}).get("Statement", []):
-            if "Service" not in statement.get("Principal", {}):
+            if not isinstance(statement, dict):
+                continue
+                
+            principal = statement.get("Principal", {})
+            if not isinstance(principal, dict):
+                continue
+                
+            if "Service" not in principal:
                 continue
 
-            services = statement.get("Principal", {}).get("Service")
+            services = principal["Service"]
 
             if isinstance(services, str):
                 principals.append(services)
@@ -154,7 +161,13 @@ def _get_actions(self, properties) -> List[str]:
         actions = []
 
         for policy in properties.get("Policies", []):
+            if not isinstance(policy, dict):
+                continue
+                
             for statement in policy.get("PolicyDocument", {}).get("Statement", []):
+                if not isinstance(statement, dict):
+                    continue
+                    
                 action = statement.get("Action")
 
                 if isinstance(action, str):

cfn-lint-serverless/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "cfn_lint_serverless"
-version = "0.3.3"
+version = "0.3.4"
 description = "Serverless rules for cfn-lint"
 authors = [{name = "Amazon Web Service"}]
 readme = "README.md"
 license = "MIT-0"
 requires-python = ">=3.9.1,<4"
 dependencies = [
-    "cfn-lint>=1.33.0"
+    "cfn-lint>=1.36.0"
 ]
 
 [dependency-groups]

cfn-lint-serverless/uv.lock

@@ -10,7 +10,7 @@ You can enable the Serverless Rules plugin by adding a plugin section in the `.t
 ```terraform
 plugin "aws-serverless" {
   enabled = true
-  version = "0.3.3"
+  version = "0.3.4"
   source = "github.com/awslabs/serverless-rules"
 }
 ```
@@ -76,7 +76,7 @@ Rules in `tflint` can be disabled either through the `--disable-rule` command-li
     ```terraform
     plugin "aws-serverless" {
       enabled = true
-      version = "0.3.3"
+      version = "0.3.4"
       source = "github.com/awslabs/serverless-rules"
     }
 

docs/tflint.md

@@ -6,5 +6,5 @@ plugin "aws-serverless" {
   enabled = true
   # Uncomment those lines if you are using tflint 0.29 or later
   # source = "github.com/awslabs/serverless-rules"
-  # version = "0.3.3"
+  # version = "0.3.4"
 }

examples/tflint/.tflint.hcl

@@ -10,7 +10,7 @@ func main() {
 	plugin.Serve(&plugin.ServeOpts{
 		RuleSet: &tflint.BuiltinRuleSet{
 			Name:    "aws-serverless",
-			Version: "0.3.3",
+			Version: "0.3.4",
 			Rules:   rules.Rules,
 		},
 	})