rego

Documentation

Index

• Variables
• func BuildSchemaSetFromPolicies(policies map[string]*ast.Module, paths []string, srcFS fs.FS) (*ast.SchemaSet, bool, error)
• func RecurseEmbeddedModules(fs embed.FS, dir string) (map[string]*ast.Module, error)
• func RegisterRegoRules(modules map[string]*ast.Module)
• type DynamicMetadata
• type Input
• type InputOptions
• type MetadataRetriever
  • func NewMetadataRetriever(compiler *ast.Compiler) *MetadataRetriever
  • func (m *MetadataRetriever) RetrieveMetadata(ctx context.Context, module *ast.Module, inputs ...Input) (*StaticMetadata, error)
• type Scanner
  • func NewScanner(source types.Source, options ...options.ScannerOption) *Scanner
  • func (s *Scanner) LoadEmbeddedLibraries() error
  • func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies bool, srcFS fs.FS, ...) error
  • func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results, error)
  • func (s *Scanner) SetDataDirs(dirs ...string)
  • func (s *Scanner) SetDataFilesystem(fs fs.FS)
  • func (s *Scanner) SetDebugWriter(writer io.Writer)
  • func (s *Scanner) SetFrameworks(frameworks []framework.Framework)
  • func (s *Scanner) SetParentDebugLogger(l debug.Logger)
  • func (s *Scanner) SetPerResultTracingEnabled(b bool)
  • func (s *Scanner) SetPolicyDirs(_ ...string)
  • func (s *Scanner) SetPolicyFilesystem(fs fs.FS)
  • func (s *Scanner) SetPolicyNamespaces(namespaces ...string)
  • func (s *Scanner) SetPolicyReaders(_ []io.Reader)
  • func (s *Scanner) SetRegoErrorLimit(limit int)
  • func (s *Scanner) SetRegoOnly(bool)
  • func (s *Scanner) SetSkipRequiredCheck(_ bool)
  • func (s *Scanner) SetSpec(spec string)
  • func (s *Scanner) SetTraceWriter(writer io.Writer)
  • func (s *Scanner) SetUseEmbeddedLibraries(b bool)
  • func (s *Scanner) SetUseEmbeddedPolicies(b bool)
• type Selector
• type StaticMetadata
  • func (m StaticMetadata) ToRule() scan.Rule
• type SubType

Variables

var SchemaMap = map[types.Source]schemas.Schema{
	types.SourceDefsec:     schemas.Cloud,
	types.SourceCloud:      schemas.Cloud,
	types.SourceKubernetes: schemas.Kubernetes,
	types.SourceRbac:       schemas.Kubernetes,
	types.SourceDockerfile: schemas.Dockerfile,
	types.SourceTOML:       schemas.Anything,
	types.SourceYAML:       schemas.Anything,
	types.SourceJSON:       schemas.Anything,
}

Functions

func BuildSchemaSetFromPolicies

func BuildSchemaSetFromPolicies(policies map[string]*ast.Module, paths []string, srcFS fs.FS) (*ast.SchemaSet, bool, error)

func RecurseEmbeddedModules

func RecurseEmbeddedModules(fs embed.FS, dir string) (map[string]*ast.Module, error)

func RegisterRegoRules

func RegisterRegoRules(modules map[string]*ast.Module)

Types

type DynamicMetadata

type DynamicMetadata struct {
	Warning   bool
	Filepath  string
	Message   string
	StartLine int
	EndLine   int
}

type Input

type Input struct {
	Path     string      `json:"path"`
	FS       fs.FS       `json:"-"`
	Contents interface{} `json:"contents"`
}

type InputOptions

type InputOptions struct {
	Combined  bool
	Selectors []Selector
}

type MetadataRetriever

type MetadataRetriever struct {
	// contains filtered or unexported fields
}

func NewMetadataRetriever

func NewMetadataRetriever(compiler *ast.Compiler) *MetadataRetriever

func (*MetadataRetriever) RetrieveMetadata

func (m *MetadataRetriever) RetrieveMetadata(ctx context.Context, module *ast.Module, inputs ...Input) (*StaticMetadata, error)

type Scanner

type Scanner struct {
	// contains filtered or unexported fields
}

func NewScanner

func NewScanner(source types.Source, options ...options.ScannerOption) *Scanner

func (*Scanner) LoadEmbeddedLibraries

func (s *Scanner) LoadEmbeddedLibraries() error

func (*Scanner) LoadPolicies

func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies bool, srcFS fs.FS, paths []string, readers []io.Reader) error

func (*Scanner) ScanInput

func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results, error)

func (*Scanner) SetDataDirs

func (s *Scanner) SetDataDirs(dirs ...string)

func (*Scanner) SetDataFilesystem

func (s *Scanner) SetDataFilesystem(fs fs.FS)

func (*Scanner) SetDebugWriter

func (s *Scanner) SetDebugWriter(writer io.Writer)

func (*Scanner) SetFrameworks

func (s *Scanner) SetFrameworks(frameworks []framework.Framework)

func (*Scanner) SetParentDebugLogger

func (s *Scanner) SetParentDebugLogger(l debug.Logger)

func (*Scanner) SetPerResultTracingEnabled

func (s *Scanner) SetPerResultTracingEnabled(b bool)

func (*Scanner) SetPolicyDirs

func (s *Scanner) SetPolicyDirs(_ ...string)

func (*Scanner) SetPolicyFilesystem

func (s *Scanner) SetPolicyFilesystem(fs fs.FS)

func (*Scanner) SetPolicyNamespaces

func (s *Scanner) SetPolicyNamespaces(namespaces ...string)

func (*Scanner) SetPolicyReaders

func (s *Scanner) SetPolicyReaders(_ []io.Reader)

func (*Scanner) SetRegoErrorLimit

func (s *Scanner) SetRegoErrorLimit(limit int)

func (*Scanner) SetRegoOnly

func (s *Scanner) SetRegoOnly(bool)

func (*Scanner) SetSkipRequiredCheck

func (s *Scanner) SetSkipRequiredCheck(_ bool)

func (*Scanner) SetSpec

func (s *Scanner) SetSpec(spec string)

func (*Scanner) SetTraceWriter

func (s *Scanner) SetTraceWriter(writer io.Writer)

func (*Scanner) SetUseEmbeddedLibraries

func (s *Scanner) SetUseEmbeddedLibraries(b bool)

func (*Scanner) SetUseEmbeddedPolicies

func (s *Scanner) SetUseEmbeddedPolicies(b bool)

type Selector

type Selector struct {
	Type     string
	Subtypes []SubType
}

type StaticMetadata

type StaticMetadata struct {
	ID                 string
	AVDID              string
	Title              string
	ShortCode          string
	Description        string
	Severity           string
	RecommendedActions string
	PrimaryURL         string
	References         []string
	InputOptions       InputOptions
	Package            string
	Frameworks         map[framework.Framework][]string
	Provider           string
	Service            string
	Library            bool
	CloudFormation     *scan.EngineMetadata
	Terraform          *scan.EngineMetadata
}

func (StaticMetadata) ToRule

func (m StaticMetadata) ToRule() scan.Rule

type SubType

type SubType struct {
	Group     string
	Version   string
	Kind      string
	Namespace string
	Service   string // only for cloud
	Provider  string // only for cloud
}