feat(compliance): Loader and Execute (#1465)

This commit is contained in:
Pepe Fagoaga
2022-11-23 15:53:53 +01:00
committed by GitHub
parent 1a70a45805
commit b3e57ca3e5
515 changed files with 6018 additions and 5614 deletions

View File

@@ -1,35 +1,37 @@
{
"Provider": "aws",
"CheckID": "codebuild_project_older_90_days",
"CheckTitle": "Ensure CodeBuild Project has been invoked in the last 90 days",
"CheckType": ["Software and Configuration Checks", "Industry and Regulatory Standards"],
"ServiceName": "codebuild",
"SubServiceName": "",
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
"Severity": "medium",
"ResourceType": "AwsCodeBuildProject",
"Description": "Ensure CodeBuild Project has been invoked in the last 90 days",
"Risk": "Older CodeBuild projects can be checked to see if they are currently in use.",
"RelatedUrl": "",
"Remediation": {
"Code": {
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
},
"Recommendation": {
"Text": "Check if CodeBuild project are really in use and remove the stale ones",
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/delete-project.html"
}
"Provider": "aws",
"CheckID": "codebuild_project_older_90_days",
"CheckTitle": "Ensure CodeBuild Project has been invoked in the last 90 days",
"CheckType": [
"Software and Configuration Checks",
"Industry and Regulatory Standards"
],
"ServiceName": "codebuild",
"SubServiceName": "",
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
"Severity": "medium",
"ResourceType": "AwsCodeBuildProject",
"Description": "Ensure CodeBuild Project has been invoked in the last 90 days",
"Risk": "Older CodeBuild projects can be checked to see if they are currently in use.",
"RelatedUrl": "",
"Remediation": {
"Code": {
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
},
"Categories": [],
"Tags": {
"Tag1Key": "value",
"Tag2Key": "value"
},
"DependsOn": [],
"RelatedTo": [],
"Notes": "",
"Compliance": []
}
"Recommendation": {
"Text": "Check if CodeBuild project are really in use and remove the stale ones",
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/delete-project.html"
}
},
"Categories": [],
"Tags": {
"Tag1Key": "value",
"Tag2Key": "value"
},
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
}

View File

@@ -8,7 +8,7 @@ class codebuild_project_older_90_days(Check):
def execute(self):
findings = []
for project in codebuild_client.projects:
report = Check_Report(self.metadata)
report = Check_Report(self.metadata())
report.region = project.region
report.resource_id = project.name
report.resource_arn = ""

View File

@@ -1,35 +1,37 @@
{
"Provider": "aws",
"CheckID": "codebuild_project_user_controlled_buildspec",
"CheckTitle": "Ensure CodeBuild Project uses a controlled buildspec",
"CheckType": ["Software and Configuration Checks", "Industry and Regulatory Standards"],
"ServiceName": "codebuild",
"SubServiceName": "",
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
"Severity": "medium",
"ResourceType": "AwsCodeBuildProject",
"Description": "Ensure CodeBuild Project uses a controlled buildspec",
"Risk": "The CodeBuild projects with user controlled buildspec",
"RelatedUrl": "",
"Remediation": {
"Code": {
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
},
"Recommendation": {
"Text": "Use buildspec.yml from a trusted source which user cant interfere with",
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/security.html"
}
"Provider": "aws",
"CheckID": "codebuild_project_user_controlled_buildspec",
"CheckTitle": "Ensure CodeBuild Project uses a controlled buildspec",
"CheckType": [
"Software and Configuration Checks",
"Industry and Regulatory Standards"
],
"ServiceName": "codebuild",
"SubServiceName": "",
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
"Severity": "medium",
"ResourceType": "AwsCodeBuildProject",
"Description": "Ensure CodeBuild Project uses a controlled buildspec",
"Risk": "The CodeBuild projects with user controlled buildspec",
"RelatedUrl": "",
"Remediation": {
"Code": {
"CLI": "",
"NativeIaC": "",
"Other": "",
"Terraform": ""
},
"Categories": [],
"Tags": {
"Tag1Key": "value",
"Tag2Key": "value"
},
"DependsOn": [],
"RelatedTo": [],
"Notes": "",
"Compliance": []
}
"Recommendation": {
"Text": "Use buildspec.yml from a trusted source which user cant interfere with",
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/security.html"
}
},
"Categories": [],
"Tags": {
"Tag1Key": "value",
"Tag2Key": "value"
},
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
}

View File

@@ -8,7 +8,7 @@ class codebuild_project_user_controlled_buildspec(Check):
def execute(self):
findings = []
for project in codebuild_client.projects:
report = Check_Report(self.metadata)
report = Check_Report(self.metadata())
report.region = project.region
report.resource_id = project.name
report.resource_arn = ""