feat(misconf): ignore duplicate checks

Signed-off-by: nikpivkin <[email protected]>
aquasecurity · Aug 7, 2024 · d8c3416 · d8c3416
1 parent 7278abd
commit d8c3416
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/pkg/iac/rego/embed.go b/pkg/iac/rego/embed.go
@@ -47,6 +47,9 @@ func RegisterRegoRules(modules map[string]*ast.Module) {
 	}
 
 	retriever := NewMetadataRetriever(compiler)
+
+	regoCheckIDs := make(map[string]struct{})
+
 	for _, module := range modules {
 		metadata, err := retriever.RetrieveMetadata(ctx, module)
 		if err != nil {
@@ -55,10 +58,23 @@ func RegisterRegoRules(modules map[string]*ast.Module) {
 		if metadata.AVDID == "" {
 			continue
 		}
+
+		if !metadata.Deprecated {
+			regoCheckIDs[metadata.AVDID] = struct{}{}
+		}
+
 		rules.Register(
 			metadata.ToRule(),
 		)
 	}
+
+	for _, check := range rules.GetRegistered() {
+		if !check.Deprecated && check.CanCheck() {
+			if _, exists := regoCheckIDs[check.AVDID]; exists {
+				rules.Deregister(check)
+			}
+		}
+	}
 }
 
 func LoadEmbeddedPolicies() (map[string]*ast.Module, error) {