| from __future__ import annotations |
|
|
| from .schemas import EnrichedFinding, EnrichedFindings, ScanBundle |
|
|
|
|
| POLICY_DESCRIPTIONS: dict[str, str] = { |
| "CKV_AWS_18": "S3 buckets should have access logging enabled.", |
| "CKV_AWS_20": "S3 buckets should not allow public ACLs.", |
| "CKV_AWS_21": "S3 buckets should have versioning enabled.", |
| "CKV_AWS_23": "Security group ingress rules should not allow unrestricted access.", |
| "CKV_AWS_24": "Security group ingress rules should not allow unrestricted SSH.", |
| "CKV_AWS_79": "EC2 instances should require IMDSv2.", |
| "CKV_AWS_144": "S3 buckets should have cross-region replication enabled when required.", |
| "CKV_AWS_145": "S3 buckets should use KMS encryption.", |
| "CKV2_AWS_6": "S3 public access block should block public ACLs and policies.", |
| "CKV2_AWS_61": "S3 buckets should have lifecycle configuration.", |
| "CKV2_AWS_62": "S3 buckets should have event notifications configured when required.", |
| "CKV2_AWS_64": "KMS keys should have key rotation enabled.", |
| "CKV_K8S_8": "Kubernetes containers should not run as root.", |
| "CKV_K8S_9": "Kubernetes containers should not run with privileged escalation.", |
| "CKV_K8S_10": "Kubernetes containers should set CPU requests.", |
| "CKV_K8S_11": "Kubernetes containers should set CPU limits.", |
| "CKV_K8S_12": "Kubernetes containers should set memory requests.", |
| "CKV_K8S_13": "Kubernetes containers should set memory limits.", |
| "CKV_K8S_14": "Kubernetes images should use immutable tags.", |
| "CKV_K8S_20": "Kubernetes containers should not run privileged.", |
| "CKV_K8S_21": "Kubernetes default namespace should not be used.", |
| "CKV_K8S_22": "Kubernetes containers should use read-only root filesystems where possible.", |
| "CKV_K8S_23": "Kubernetes containers should drop dangerous capabilities.", |
| "CKV_K8S_28": "Kubernetes containers should minimize Linux capabilities.", |
| "CKV_K8S_29": "Kubernetes containers should not allow privilege escalation.", |
| "CKV_K8S_31": "Kubernetes seccomp profile should be configured.", |
| "CKV_K8S_37": "Kubernetes containers should minimize capabilities.", |
| "CKV_K8S_38": "Kubernetes containers should run as non-root.", |
| "CKV_K8S_40": "Kubernetes containers should not run as UID 0.", |
| "CKV_K8S_43": "Kubernetes images should use digest or immutable tags.", |
| "CKV_TF_1": "Terraform should pin module sources to immutable versions.", |
| "CKV_TF_2": "Terraform providers should be version constrained.", |
| } |
|
|
|
|
| REMEDIATION_HINTS: dict[str, str] = { |
| "CKV_AWS_20": "For aws_s3_bucket_acl, avoid public-read/public-read-write. Prefer private ACLs and ownership controls.", |
| "CKV_AWS_21": "Add aws_s3_bucket_versioning with versioning_configuration { status = \"Enabled\" } for the target bucket.", |
| "CKV_AWS_23": "Restrict ingress CIDR blocks from 0.0.0.0/0 to a known trusted CIDR. If unknown, require human approval.", |
| "CKV_AWS_24": "Do not expose port 22 to 0.0.0.0/0. Narrow CIDR or remove the SSH ingress rule if not required.", |
| "CKV_AWS_79": "Add metadata_options { http_tokens = \"required\" } to aws_instance resources.", |
| "CKV_AWS_145": "Configure aws_s3_bucket_server_side_encryption_configuration with aws:kms only when a real KMS key exists; otherwise require approval.", |
| "CKV2_AWS_6": "Add aws_s3_bucket_public_access_block with all four block/restrict flags set to true.", |
| "CKV2_AWS_61": "Add aws_s3_bucket_lifecycle_configuration only when a retention policy is known; otherwise require approval.", |
| "CKV2_AWS_64": "Set enable_key_rotation = true on aws_kms_key resources.", |
| "CKV_K8S_8": "Add securityContext.runAsNonRoot: true and avoid UID 0.", |
| "CKV_K8S_9": "Set securityContext.allowPrivilegeEscalation: false on every container.", |
| "CKV_K8S_10": "Add resources.requests.cpu to each container.", |
| "CKV_K8S_11": "Add resources.limits.cpu to each container.", |
| "CKV_K8S_12": "Add resources.requests.memory to each container.", |
| "CKV_K8S_13": "Add resources.limits.memory to each container.", |
| "CKV_K8S_14": "Replace latest or mutable image tags with immutable versions if a real version is known.", |
| "CKV_K8S_20": "Set privileged: false in each container securityContext.", |
| "CKV_K8S_22": "Set readOnlyRootFilesystem: true only when the workload does not require writes, otherwise require approval.", |
| "CKV_K8S_29": "Set allowPrivilegeEscalation: false on each container securityContext.", |
| "CKV_K8S_31": "Set seccompProfile.type: RuntimeDefault at pod or container securityContext.", |
| "CKV_K8S_38": "Set runAsNonRoot: true at pod or container securityContext.", |
| "CKV_K8S_40": "Set runAsUser to a non-zero UID only when compatible with the image; otherwise require approval.", |
| "CKV_TF_1": "Pin module source references to tags or commits. Do not invent a version if none is known.", |
| "CKV_TF_2": "Add required_providers version constraints compatible with the configuration.", |
| } |
|
|
|
|
| def enrich_findings(bundle: ScanBundle) -> EnrichedFindings: |
| findings = [] |
| for finding in bundle.findings: |
| findings.append( |
| EnrichedFinding( |
| **finding.model_dump(), |
| policy_description=POLICY_DESCRIPTIONS.get(finding.rule_id, finding.message), |
| remediation_hint=REMEDIATION_HINTS.get(finding.rule_id), |
| cis_controls=[], |
| doc_snippets=[], |
| ) |
| ) |
| return EnrichedFindings(file=bundle.file, findings=findings) |
|
|
|
|
| def build_rule_hints_md(rule_ids: list[str]) -> str: |
| lines: list[str] = [] |
| for rule_id in sorted(set(rule_ids)): |
| description = POLICY_DESCRIPTIONS.get(rule_id, "Scanner policy finding.") |
| hint = REMEDIATION_HINTS.get(rule_id, "Use the scanner message and make the smallest safe in-file remediation.") |
| lines.append(f"- {rule_id}: {description} Fix: {hint}") |
| return "\n".join(lines) |
|
|
