bump trivy to v0.57.1 #263
Conversation
nikpivkin
force-pushed
the
bump-trivy
branch
from
4fd0d72 to
936dc4a
Compare
Signed-off-by: Nikita Pivkin <[email protected]>
nikpivkin
force-pushed
the
bump-trivy
branch
from
936dc4a to
96170d0
Compare
| { | ||
| "Type": "AWS", | ||
| "ID": "AVD-AWS-0092", | ||
| "AVDID": "AVD-AWS-0092", | ||
| "Title": "S3 Buckets not publicly accessible through ACL.", | ||
| "Description": "Buckets should not have ACLs that allow public access", | ||
| "Resolution": "Don't use canned ACLs or switch to private acl", | ||
| "Severity": "HIGH", | ||
| "PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0092", | ||
| "References": [ | ||
| "https://avd.aquasec.com/misconfig/avd-aws-0092" | ||
| ], | ||
| "Status": "PASS", | ||
| "Layer": {}, | ||
| "CauseMetadata": { | ||
| "Resource": "arn:aws:s3:::examplebucket", | ||
| "Provider": "aws", | ||
| "Service": "s3", |
There was a problem hiding this comment.
This check is still considered passed, but due to the specificity of Rego checks, all passed checks will have an empty target.
| { | ||
| "Type": "AWS", | ||
| "ID": "AVD-AWS-0089", | ||
| "AVDID": "AVD-AWS-0089", | ||
| "Title": "S3 Bucket Logging", | ||
| "Description": "Ensures S3 bucket logging is enabled for S3 buckets", | ||
| "Message": "Bucket has logging disabled", | ||
| "Namespace": "builtin.aws.s3.aws0089", | ||
| "Query": "deny", | ||
| "Resolution": "Add a logging block to the resource to enable access logging", | ||
| "Severity": "LOW", | ||
| "PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0089", | ||
| "References": [ | ||
| "https://avd.aquasec.com/misconfig/avd-aws-0089" | ||
| ], | ||
| "Status": "FAIL", | ||
| "Layer": {}, | ||
| "CauseMetadata": { | ||
| "Resource": "arn:aws:s3:::examplebucket", | ||
| "Provider": "aws", | ||
| "Service": "s3", | ||
| "Code": { | ||
| "Lines": null | ||
| } | ||
| } | ||
| }, |
There was a problem hiding this comment.
Strange that this check didn't work before, but according to the s3onlycache.json cache file the bucket has no logging.
|
@simar7 What do you think about if we move the JSON content of reports from go to separate golden files to make them easier to maintain? I think we can also make the tests in run_test.go integration and set options via flags, as is done in Trivy. I can do this in a separate PR. |
Sure, sounds good to me. |
| // combine results without a target for consistency of the result | ||
| filtered = combineResults(filtered) |
There was a problem hiding this comment.
What's this for? Should we do it as a separate feature PR?
There was a problem hiding this comment.
Results can have multiple records without a target in different order which sometimes causes tests to fail. This function simply merges the results without a target and sorts the misconfigs by AVDID.
In this PR:
--no-progressflag to suppress progressbar