-
Notifications
You must be signed in to change notification settings - Fork 31
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #39 from aquasecurity/replace-trivy-iac-with-defsec
refactor(deps): Replace `trivy-iac/pkg` with `defsec/pkg`
- Loading branch information
Showing
17 changed files
with
422 additions
and
94 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,15 +1,17 @@ | ||
|
|
||
| When enabling Performance Insights on an RDS cluster or RDS DB Instance, and encryption key should be provided. | ||
| Amazon RDS uses the AWS managed key for your new DB instance. For complete control over KMS keys, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, and rotating their cryptographic material, use a customer managed keys. | ||
|
|
||
| The encryption key specified in `performance_insights_kms_key_id` references a KMS ARN | ||
|
|
||
| ### Impact | ||
| Data can be read from the RDS Performance Insights if it is compromised | ||
| Using AWS managed keys does not allow for fine grained control | ||
|
|
||
| <!-- DO NOT CHANGE --> | ||
| {{ remediationActions }} | ||
|
|
||
| ### Links | ||
| - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.htm | ||
| - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.access-control.html#USER_PerfInsights.access-control.cmk-policy | ||
|
|
||
| - https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,194 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| goast "go/ast" | ||
| "go/parser" | ||
| "go/token" | ||
| "io" | ||
| "os" | ||
| "path/filepath" | ||
| "strings" | ||
| "text/template" | ||
|
|
||
| "github.com/aquasecurity/defsec/pkg/framework" | ||
| "github.com/aquasecurity/trivy-policies/rules" | ||
|
|
||
| _ "github.com/aquasecurity/defsec/pkg/rego" | ||
| registered "github.com/aquasecurity/defsec/pkg/rules" | ||
| drules "github.com/aquasecurity/defsec/pkg/types/rules" | ||
| ) | ||
|
|
||
| func main() { | ||
| var generateCount int | ||
|
|
||
| for _, metadata := range registered.GetRegistered(framework.ALL) { | ||
| writeDocsFile(metadata, "avd_docs") | ||
| generateCount++ | ||
| } | ||
|
|
||
| fmt.Printf("\nGenerated %d files in avd_docs\n", generateCount) | ||
| } | ||
|
|
||
| // nolint: cyclop | ||
| func writeDocsFile(meta drules.RegisteredRule, path string) { | ||
|
|
||
| tmpl, err := template.New("defsec").Parse(docsMarkdownTemplate) | ||
| if err != nil { | ||
| fail("error occurred creating the template %v\n", err) | ||
| } | ||
|
|
||
| docpath := filepath.Join(path, | ||
| strings.ToLower(meta.GetRule().Provider.ConstName()), | ||
| strings.ToLower(strings.ReplaceAll(meta.GetRule().Service, "-", "")), | ||
| meta.GetRule().AVDID, | ||
| ) | ||
|
|
||
| if err := os.MkdirAll(docpath, os.ModePerm); err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| file, err := os.Create(filepath.Join(docpath, "docs.md")) | ||
| if err != nil { | ||
| fail("error occurred creating the docs file for %s", docpath) | ||
| } | ||
|
|
||
| if err := tmpl.Execute(file, meta.GetRule()); err != nil { | ||
| fail("error occurred generating the document %v", err) | ||
| } | ||
| fmt.Printf("Generating docs file for policy %s\n", meta.GetRule().AVDID) | ||
|
|
||
| if meta.GetRule().Terraform != nil { | ||
| if len(meta.GetRule().Terraform.GoodExamples) > 0 || len(meta.GetRule().Terraform.Links) > 0 { | ||
| if meta.GetRule().RegoPackage != "" { // get examples from file as rego rules don't have embedded | ||
| value, err := GetExampleValueFromFile(meta.GetRule().Terraform.GoodExamples[0], "GoodExamples") | ||
| if err != nil { | ||
| fail("error retrieving examples from metadata: %v\n", err) | ||
| } | ||
| meta.GetRule().Terraform.GoodExamples = []string{value} | ||
| } | ||
|
|
||
| tmpl, err := template.New("terraform").Parse(terraformMarkdownTemplate) | ||
| if err != nil { | ||
| fail("error occurred creating the template %v\n", err) | ||
| } | ||
| file, err := os.Create(filepath.Join(docpath, "Terraform.md")) | ||
| if err != nil { | ||
| fail("error occurred creating the Terraform file for %s", docpath) | ||
| } | ||
| defer func() { _ = file.Close() }() | ||
|
|
||
| if err := tmpl.Execute(file, meta.GetRule()); err != nil { | ||
| fail("error occurred generating the document %v", err) | ||
| } | ||
| fmt.Printf("Generating Terraform file for policy %s\n", meta.GetRule().AVDID) | ||
| } | ||
| } | ||
|
|
||
| if meta.GetRule().CloudFormation != nil { | ||
| if len(meta.GetRule().CloudFormation.GoodExamples) > 0 || len(meta.GetRule().CloudFormation.Links) > 0 { | ||
| if meta.GetRule().RegoPackage != "" { // get examples from file as rego rules don't have embedded | ||
| value, err := GetExampleValueFromFile(meta.GetRule().CloudFormation.GoodExamples[0], "GoodExamples") | ||
| if err != nil { | ||
| fail("error retrieving examples from metadata: %v\n", err) | ||
| } | ||
| meta.GetRule().CloudFormation.GoodExamples = []string{value} | ||
| } | ||
|
|
||
| tmpl, err := template.New("cloudformation").Parse(cloudformationMarkdownTemplate) | ||
| if err != nil { | ||
| fail("error occurred creating the template %v\n", err) | ||
| } | ||
| file, err := os.Create(filepath.Join(docpath, "CloudFormation.md")) | ||
| if err != nil { | ||
| fail("error occurred creating the CloudFormation file for %s", docpath) | ||
| } | ||
| defer func() { _ = file.Close() }() | ||
|
|
||
| if err := tmpl.Execute(file, meta.GetRule()); err != nil { | ||
| fail("error occurred generating the document %v", err) | ||
| } | ||
| fmt.Printf("Generating CloudFormation file for policy %s\n", meta.GetRule().AVDID) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func fail(msg string, args ...interface{}) { | ||
| fmt.Printf(msg, args...) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| func readFileFromPolicyFS(path string) (io.Reader, error) { | ||
| path = strings.TrimPrefix(path, "rules/") | ||
| return rules.EmbeddedPolicyFileSystem.Open(path) | ||
|
|
||
| } | ||
|
|
||
| func GetExampleValueFromFile(filename string, exampleType string) (string, error) { | ||
| r, err := readFileFromPolicyFS(filename) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| f, err := parser.ParseFile(token.NewFileSet(), filename, r, parser.AllErrors) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| for _, d := range f.Decls { | ||
| switch decl := d.(type) { | ||
| case *goast.GenDecl: | ||
| for _, spec := range decl.Specs { | ||
| switch spec := spec.(type) { | ||
| case *goast.ValueSpec: | ||
| for _, id := range spec.Names { | ||
| switch v := id.Obj.Decl.(*goast.ValueSpec).Values[0].(type) { | ||
| case *goast.CompositeLit: | ||
| value := v.Elts[0].(*goast.BasicLit).Value | ||
| if strings.Contains(id.Name, exampleType) { | ||
| return strings.ReplaceAll(value, "`", ""), nil | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| return "", fmt.Errorf("exampleType %s not found in file: %s", exampleType, filename) | ||
| } | ||
|
|
||
| var docsMarkdownTemplate = ` | ||
| {{ .Explanation }} | ||
| ### Impact | ||
| {{ if .Impact }}{{ .Impact }}{{ else }}<!-- Add Impact here -->{{ end }} | ||
| <!-- DO NOT CHANGE --> | ||
| {{ ` + "`{{ " + `remediationActions ` + "`}}" + `}} | ||
| {{ if .Links }}### Links{{ range .Links }} | ||
| - {{ . }} | ||
| {{ end}} | ||
| {{ end }} | ||
| ` | ||
|
|
||
| var terraformMarkdownTemplate = ` | ||
| {{ .Resolution }} | ||
| {{ if .Terraform.GoodExamples }}{{ range .Terraform.GoodExamples }}` + "```hcl" + `{{ . }} | ||
| ` + "```" + ` | ||
| {{ end}}{{ end }} | ||
| {{ if .Terraform.Links }}#### Remediation Links{{ range .Terraform.Links }} | ||
| - {{ . }} | ||
| {{ end}}{{ end }} | ||
| ` | ||
|
|
||
| var cloudformationMarkdownTemplate = ` | ||
| {{ .Resolution }} | ||
| {{ if .CloudFormation.GoodExamples }}{{ range .CloudFormation.GoodExamples }}` + "```yaml" + `{{ . }} | ||
| ` + "```" + ` | ||
| {{ end}}{{ end }} | ||
| {{ if .CloudFormation.Links }}#### Remediation Links{{ range .CloudFormation.Links }} | ||
| - {{ . }} | ||
| {{ end}}{{ end }} | ||
| ` |
Oops, something went wrong.