Repository navigation
feat(catalog)!: embed the CIS AWS Benchmark v6.0 controls only - #28
Merged
Merged
Conversation
…exiting 2 A served manifest newer than the embedded catalog can delegate a control id the catalog does not hold. delegation_unresolved put that id in ctf.controlIds, the runner's emit check refused it, and report exited 2. The finding now names the id in its message, carries no control id, and the report completes.
A raw-resource finding carried every control the catalog places on the resource type, alongside a remediation naming one module. ModuleRef.Controls documents that the remediation holds every id the finding carries; the finding now carries the intersection, so it never says the module closes a control it does not enforce.
The catalog embedded in ctfkit now holds the CIS v6.0 controls, each with its CIS v6.0 clauses, and the module entries. It includes vpc_security_group_remote_administration_ipv4 and _ipv6. A full catalog is read with --catalog FILE or from ~/.ctf/control-requirements.yaml; ctfkit catalog pull is planned. TestEmbeddedCatalogIsTheCISSubset fails if the embedded catalog holds more. ctf.policy.disabled_control_unknown is now an error: a ?disable= of a real control outside the loaded catalog lands there, and a warning would let it pass CI. BREAKING CHANGE: with the embedded catalog, findings carry control ids and frameworks for CIS v6.0 controls only. A control-keyed exception for a control outside CIS v6.0 no longer matches; use a rule entry or load the full catalog. ctf.policy.disabled_control_unknown is reported at error level instead of warning.
The unknown-control messages of delegation_unresolved and disabled_control_unknown said the embedded catalog holds CIS v6.0 only and suggested --catalog even when a full catalog was loaded. The hint now appears only when the loaded catalog has the embedded catalog's version. The end-to-end report test also asserts the delegation finding for an unknown id carries no control id.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
ctfkit reportexited 2 when a served module manifest named a control id the embedded catalog does not hold:delegation_unresolvedcopied the manifest's control id intoctf.controlIds.ValidateForrefuses an id the catalog lacks, so one unknown id failed the whole run.Changes
ctf.controlIds, and the report completes.ValidateForstays strict for analyzer bugs.--catalog FILEor from~/.ctf/control-requirements.yaml;ctfkit catalog pullis planned.TestEmbeddedCatalogIsTheCISSubsetfails if the embedded catalog holds anything more.--fail-on error.ModuleRef.Controlsdocuments. The catalog can place controls on a covered type that the module does not enforce.rule: ctf.coverage.module_sourceentry, because that finding now carries no control id. Goldens are re-recorded, andtestdata/fixtures/README.mdrecords the decision.docs/configuration.md(catalog, exceptions),docs/analyzers.md, the GitHub adapter README, the sample repo, andDEVELOPING.md.Breaking changes
ctf.risk.sensitive_change_*and delegation findings for other controls still fire, with no control id.ruleentry, or load the full catalog.ctf.policy.disabled_control_unknownis reported at error level, not warning.--catalog embeddedby default. To use a full catalog there, pass its file.Tests
TestReportToleratesAControlTheCatalogLacks(end to end) andTestDelegationUnresolvedToleratesAControlTheCatalogLacks: both fail with the exit-2 error before the fix.TestRawResourceCarriesOnlyTheModulesControls,TestEmbeddedCatalogIsTheCISSubset, andTestFixture03ControlIDsupdated for the unknown-disable error.go test -race ./..., golangci-lint v2.15.0 (0 issues),make conformance schemacheck hygiene vulncheckandprek run --all-filespass.