Documentation
¶
Overview ¶
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License. *
This product includes software developed at Datadog (https://www.datadoghq.com) Copyright 2024 Datadog, Inc.
Package platform provides a central registry of IaC scan platform definitions. Shared Rego libraries (common, datadog) and the cross-platform rule platform live in libraries.go — they are not scan targets.
Index ¶
- Constants
- func CompareKey(name string) string
- func IsCrossPlatformRule(name string) bool
- func IsRequested(id ID, requested []string) bool
- func IsSharedLibrary(name string) bool
- func LibraryIdentity(name string) (string, bool)
- func LibraryIdentityOrUnknown(name string) string
- func LibraryName(name string) string
- func Matches(a, b string) bool
- func RuleIdentity(name string) (string, bool)
- func StructuralClassificationRequiresContent(extension string) bool
- func StructuralExtensions() []string
- func SupportsResourceIndex(name string) bool
- type Definition
- type ID
- func CanonicalID(name string) (ID, bool)
- func ClassifyDocument(document map[string]interface{}) (ID, bool)
- func ClassifyStructuredContent(extension string, content []byte) (ID, bool)
- func ClassifyStructuredDocument(extension string, document map[string]interface{}) (ID, bool)
- func PayloadTargets(name string) []ID
- type IndexCapability
Constants ¶
const ( // LibraryCommon is generic.common — cross-platform Rego utilities. LibraryCommon = "common" // LibraryDatadog is package datadog — scanner contract helpers (finding, scopes). LibraryDatadog = "datadog" )
Shared Rego libraries bundled with rules. These are not IaC scan targets.
const RulePlatformCommon = "common"
RulePlatformCommon is the metadata.json platform for rules that evaluate all payloads.
Variables ¶
This section is empty.
Functions ¶
func CompareKey ¶
CompareKey returns a stable lowercase key for comparing scan-platform names across aliases.
func IsCrossPlatformRule ¶
IsCrossPlatformRule reports whether name is the cross-platform rule metadata platform.
func IsRequested ¶
IsRequested reports whether a platform is allowed by a requested platform filter.
func IsSharedLibrary ¶
IsSharedLibrary reports whether name identifies a bundled shared Rego library.
func LibraryIdentity ¶
LibraryIdentity returns the library file key for any accepted scan-platform or shared-library name.
func LibraryIdentityOrUnknown ¶
LibraryIdentityOrUnknown returns the library identity or "unknown" when the name is not recognized.
func LibraryName ¶
LibraryName maps a user-facing platform name to the embedded library file name. Unrecognized names fall back to the lower-cased input.
func RuleIdentity ¶
RuleIdentity returns the rule/query identity string for any accepted scan-platform or cross-platform name.
func StructuralClassificationRequiresContent ¶
StructuralClassificationRequiresContent reports whether an extension needs content for classification.
func StructuralExtensions ¶
func StructuralExtensions() []string
StructuralExtensions returns extensions admitted by structural classifiers.
func SupportsResourceIndex ¶
SupportsResourceIndex reports whether the named platform has a migrated adapter.
Types ¶
type Definition ¶
type Definition struct {
// Canonical is the all-lowercase identity stored in FileMetadata.Platform after lowercasing.
Canonical ID
// Aliases are all names accepted case-insensitively (includes the canonical value).
Aliases []string
// RuleIdentity is the platform string used in QueryMetadata.Platform (may differ in casing).
RuleIdentity string
// LibraryIdentity is the key passed to GetQueryLibrary (may differ in casing, e.g. "k8s", "cloudFormation").
LibraryIdentity string
// PayloadTargets lists the canonical payloads that receive documents classified as this platform.
// Usually just {Canonical}; Knative documents also enter the Kubernetes payload.
PayloadTargets []ID
// IndexCapability reports whether this platform has a migrated resource-index adapter.
IndexCapability IndexCapability
}
Definition holds all metadata for a registered platform.
func All ¶
func All() []Definition
All returns a copy of all registered scan-platform definitions in registration order.
func Lookup ¶
func Lookup(name string) (Definition, bool)
Lookup returns the Definition for any accepted name (case-insensitive).
type ID ¶
type ID string
ID is the canonical all-lowercase identifier for an IaC scan platform.
const ( Terraform ID = "terraform" CloudFormation ID = "cloudformation" Kubernetes ID = "kubernetes" Ansible ID = "ansible" CICD ID = "cicd" Dockerfile ID = "dockerfile" Knative ID = "knative" Crossplane ID = "crossplane" ServerlessFW ID = "serverlessfw" AzureResourceManager ID = "azureresourcemanager" OpenAPI ID = "openapi" GoogleDeploymentManager ID = "googledeploymentmanager" DockerCompose ID = "dockercompose" Pulumi ID = "pulumi" GRPC ID = "grpc" Buildah ID = "buildah" )
Canonical scan-platform IDs.
func CanonicalID ¶
CanonicalID returns the canonical ID for any accepted name (case-insensitive).
func ClassifyDocument ¶
ClassifyDocument classifies an already parsed document.
func ClassifyStructuredContent ¶
ClassifyStructuredContent classifies a supported structured file.
func ClassifyStructuredDocument ¶
ClassifyStructuredDocument classifies an already parsed analyzer document.
func PayloadTargets ¶
PayloadTargets returns the canonical payload IDs for any accepted name. Returns nil if the name is not recognized.
type IndexCapability ¶
type IndexCapability uint8
IndexCapability describes whether a platform has a migrated resource-index adapter.
const ( // IndexUnsupported means the platform does not yet have a resourceindex adapter. IndexUnsupported IndexCapability = iota // IndexMigrated means the platform has a fully migrated adapter in pkg/engine/resourceindex. IndexMigrated )
Source Files