rego

Documentation

Index

• Variables
• func BuildSchemaSetFromPolicies(policies map[string]*ast.Module, paths []string, fsys fs.FS, ...) (*ast.SchemaSet, bool, error)
• func BuiltinNamespaces() []string
• func GetInputsContents(inputs []Input) []any
• func IsBuiltinNamespace(namespace string) bool
• func IsDotFile(name string) bool
• func IsJSONFile(name string) bool
• func IsRegoFile(name string) bool
• func LoadEmbeddedLibraries() (map[string]*ast.Module, error)
• func LoadEmbeddedPolicies() (map[string]*ast.Module, error)
• func LoadPoliciesFromDirs(target fs.FS, paths ...string) (map[string]*ast.Module, error)
• func NewEngineMetadata(schema string, meta map[string]any) (*scan.EngineMetadata, error)
• func RegisterRegoRules(modules map[string]*ast.Module)
• func WithCustomSchemas(schemas map[string][]byte) options.ScannerOption
• func WithDataDirs(paths ...string) options.ScannerOption
• func WithDataFilesystem(fsys fs.FS) options.ScannerOption
• func WithDisabledCheckIDs(ids ...string) options.ScannerOption
• func WithEmbeddedLibraries(include bool) options.ScannerOption
• func WithEmbeddedPolicies(include bool) options.ScannerOption
• func WithFrameworks(frameworks ...framework.Framework) options.ScannerOption
• func WithIncludeDeprecatedChecks(enabled bool) options.ScannerOption
• func WithPerResultTracing(enabled bool) options.ScannerOption
• func WithPolicyDirs(paths ...string) options.ScannerOption
• func WithPolicyFilesystem(fsys fs.FS) options.ScannerOption
• func WithPolicyNamespaces(namespaces ...string) options.ScannerOption
• func WithPolicyReader(readers ...io.Reader) options.ScannerOption
• func WithRegoErrorLimits(limit int) options.ScannerOption
• func WithTrace(w io.Writer) options.ScannerOption
• type DynamicMetadata
• type Input
• type InputOptions
• type MetadataRetriever
  • func NewMetadataRetriever(compiler *ast.Compiler) *MetadataRetriever
  • func (m *MetadataRetriever) RetrieveMetadata(ctx context.Context, module *ast.Module, contents ...any) (*StaticMetadata, error)
• type Scanner
  • func NewScanner(source types.Source, opts ...options.ScannerOption) *Scanner
  • func (s *Scanner) LoadPolicies(srcFS fs.FS) error
  • func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results, error)
• type Selector
• type StaticMetadata
  • func NewStaticMetadata(pkgPath string, inputOpt InputOptions) *StaticMetadata
  • func (sm *StaticMetadata) FromAnnotations(annotations *ast.Annotations) error
  • func (m StaticMetadata) ToRule() scan.Rule
• type SubType

Variables

var LoadAndRegister = sync.OnceFunc(func() {
	modules, err := LoadEmbeddedPolicies()
	if err != nil {

		panic(err)
	}
	loadedLibs, err := LoadEmbeddedLibraries()
	if err != nil {
		panic(err)
	}
	for name, policy := range loadedLibs {
		modules[name] = policy
	}

	RegisterRegoRules(modules)
})

Functions

func BuildSchemaSetFromPolicies

func BuildSchemaSetFromPolicies(policies map[string]*ast.Module, paths []string, fsys fs.FS, customSchemas map[string][]byte) (*ast.SchemaSet, bool, error)

func BuiltinNamespaces

func BuiltinNamespaces() []string

func GetInputsContents

func GetInputsContents(inputs []Input) []any

func IsBuiltinNamespace

func IsBuiltinNamespace(namespace string) bool

func IsDotFile

func IsDotFile(name string) bool

func IsJSONFile

func IsJSONFile(name string) bool

func IsRegoFile

func IsRegoFile(name string) bool

func LoadEmbeddedLibraries

func LoadEmbeddedLibraries() (map[string]*ast.Module, error)

func LoadEmbeddedPolicies

func LoadEmbeddedPolicies() (map[string]*ast.Module, error)

func LoadPoliciesFromDirs

func LoadPoliciesFromDirs(target fs.FS, paths ...string) (map[string]*ast.Module, error)

func NewEngineMetadata

func NewEngineMetadata(schema string, meta map[string]any) (*scan.EngineMetadata, error)

func RegisterRegoRules

func RegisterRegoRules(modules map[string]*ast.Module)

func WithCustomSchemas

func WithCustomSchemas(schemas map[string][]byte) options.ScannerOption

func WithDataDirs

func WithDataDirs(paths ...string) options.ScannerOption

func WithDataFilesystem

func WithDataFilesystem(fsys fs.FS) options.ScannerOption

func WithDisabledCheckIDs

func WithDisabledCheckIDs(ids ...string) options.ScannerOption

WithDisabledCheckIDs disables checks by their ID (ID field in metadata)

func WithEmbeddedLibraries

func WithEmbeddedLibraries(include bool) options.ScannerOption

func WithEmbeddedPolicies

func WithEmbeddedPolicies(include bool) options.ScannerOption

func WithFrameworks

func WithFrameworks(frameworks ...framework.Framework) options.ScannerOption

func WithIncludeDeprecatedChecks

func WithIncludeDeprecatedChecks(enabled bool) options.ScannerOption

func WithPerResultTracing

func WithPerResultTracing(enabled bool) options.ScannerOption

func WithPolicyDirs

func WithPolicyDirs(paths ...string) options.ScannerOption

func WithPolicyFilesystem

func WithPolicyFilesystem(fsys fs.FS) options.ScannerOption

func WithPolicyNamespaces

func WithPolicyNamespaces(namespaces ...string) options.ScannerOption

WithPolicyNamespaces - namespaces which indicate rego policies containing enforced rules

func WithPolicyReader

func WithPolicyReader(readers ...io.Reader) options.ScannerOption

func WithRegoErrorLimits

func WithRegoErrorLimits(limit int) options.ScannerOption

func WithTrace

func WithTrace(w io.Writer) options.ScannerOption

WithTrace specifies an io.Writer for trace logs (mainly rego tracing) - if not set, they are discarded

Types

type DynamicMetadata

type DynamicMetadata struct {
	Warning   bool
	Filepath  string
	Message   string
	StartLine int
	EndLine   int
}

type Input

type Input struct {
	Path     string `json:"path"`
	FS       fs.FS  `json:"-"`
	Contents any    `json:"contents"`
}

type InputOptions

type InputOptions struct {
	Selectors []Selector
}

type MetadataRetriever

type MetadataRetriever struct {
	// contains filtered or unexported fields
}

func NewMetadataRetriever

func NewMetadataRetriever(compiler *ast.Compiler) *MetadataRetriever

func (*MetadataRetriever) RetrieveMetadata

func (m *MetadataRetriever) RetrieveMetadata(ctx context.Context, module *ast.Module, contents ...any) (*StaticMetadata, error)

type Scanner

type Scanner struct {
	// contains filtered or unexported fields
}

func NewScanner

func NewScanner(source types.Source, opts ...options.ScannerOption) *Scanner

func (*Scanner) LoadPolicies

func (s *Scanner) LoadPolicies(srcFS fs.FS) error

func (*Scanner) ScanInput

func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results, error)

type Selector

type Selector struct {
	Type     string
	Subtypes []SubType
}

type StaticMetadata

type StaticMetadata struct {
	Deprecated         bool
	ID                 string
	AVDID              string
	Title              string
	ShortCode          string
	Aliases            []string
	Description        string
	Severity           string
	RecommendedActions string
	PrimaryURL         string
	References         []string
	InputOptions       InputOptions
	Package            string
	Frameworks         map[framework.Framework][]string
	Provider           string
	Service            string
	Library            bool
	CloudFormation     *scan.EngineMetadata
	Terraform          *scan.EngineMetadata
}

func NewStaticMetadata

func NewStaticMetadata(pkgPath string, inputOpt InputOptions) *StaticMetadata

func (*StaticMetadata) FromAnnotations

func (sm *StaticMetadata) FromAnnotations(annotations *ast.Annotations) error

func (StaticMetadata) ToRule

func (m StaticMetadata) ToRule() scan.Rule

type SubType

type SubType struct {
	Group     string
	Version   string
	Kind      string
	Namespace string
	Service   string // only for cloud
	Provider  string // only for cloud
}