inspector2

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 22 Imported by: 0

README

Inspector

Parity grade: A · SDK aws-sdk-go-v2/service/inspector2@v1.48.2 · last audited 2026-07-12 (1e21a848)

Coverage

Metric Value
Operations audited 13 (13 ok)
Feature families 22 (13 ok, 2 partial, 7 gap)
Known gaps 4
Deferred items 1
Resource leaks clean
Known gaps
  • CodeSecurityScanConfiguration Get/List responses use a simplified, internally-consistent shape that diverges structurally from the real API (missing nested 'configuration'/ruleSetCategories/level/continuousIntegrationScanConfiguration; List summary shape has no relation to Get's shape at all in real AWS). Full reshape is a substantial, separate effort — file a bd issue before attempting (gopherstack: file follow-up).
  • ListCoverage/ListCoverageStatistics, ListUsageTotals, ListAccountPermissions, SearchVulnerabilities, BatchGetCodeSnippet, BatchGetFindingDetails, GetClustersForImage are all disguised no-ops (hardwired empty/stub responses) predating this audit pass. Lower priority than the wire-shape bugs fixed here since they don't crash real clients, but each is a genuine parity gap — Finding already has a SeedFinding precedent these could follow.
  • CreateFindingsReport/CreateSbomExport results (GetFindingsReportStatus/GetSbomExport) omit createdAt/destination/filterCriteria/errorMessage fields present in the real API. Not wire-breaking (real client just sees them as unset) but incomplete.
  • CreateFilter/CreateCisScanConfiguration/CreateCodeSecurityIntegration/CreateCodeSecurityScanConfiguration 'name' fields are not validated against AWS's length/charset constraints (e.g. filter name: 3-64 chars, alnum/dot/underscore/dash). Real AWS returns ValidationException for violations; this backend accepts anything non-empty.
Deferred
  • Full CIS session lifecycle semantics (health/telemetry payload validation, session expiry) — accepted as no-ops, not audited for correctness beyond routing/basic state.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrFilterNotFound is returned when a filter does not exist.
	ErrFilterNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrFilterAlreadyExists is returned when a filter already exists.
	ErrFilterAlreadyExists = awserr.New(errConflict, awserr.ErrConflict)
	// ErrTagsResourceNotFound is returned when the tagged resource does not exist.
	ErrTagsResourceNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New(errValidation, awserr.ErrInvalidParameter)

	// ErrMemberNotFound is returned when a member account is not found.
	ErrMemberNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrMemberAlreadyExists is returned when a member already exists.
	ErrMemberAlreadyExists = awserr.New(errConflict, awserr.ErrConflict)
	// ErrDelegatedAdminNotFound is returned when a delegated admin is not found.
	ErrDelegatedAdminNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrDelegatedAdminAlreadyExists is returned on duplicate enable.
	ErrDelegatedAdminAlreadyExists = awserr.New(errConflict, awserr.ErrConflict)
	// ErrCisScanConfigNotFound is returned when a CIS scan config is missing.
	ErrCisScanConfigNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrCodeSecurityIntegrationNotFound is returned when a code security integration is missing.
	ErrCodeSecurityIntegrationNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrCodeSecurityScanConfigNotFound is returned when a code security scan config is missing.
	ErrCodeSecurityScanConfigNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrReportNotFound is returned when a findings report is missing.
	ErrReportNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrSbomExportNotFound is returned when an SBOM export is missing.
	ErrSbomExportNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrCisSessionNotFound is returned when a CIS session is missing.
	ErrCisSessionNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
)
View Source 
var ErrNilAppContext = errors.New("inspector2: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type AccountPermission 

type AccountPermission struct {
	Operation string `json:"operation"`
	Status    string `json:"status"`
}

AccountPermission represents an Inspector2 account-level permission.

type AccountStatusResponse 

type AccountStatusResponse struct {
	AccountID    string `json:"accountId"`
	Status       string `json:"status"`
	Ec2Status    string `json:"ec2Status"`
	EcrStatus    string `json:"ecrStatus"`
	LambdaStatus string `json:"lambdaStatus"`
}

AccountStatusResponse holds Enable/Disable/BatchGetAccountStatus output.

type CisCheckResult 

type CisCheckResult struct {
	CheckID      string `json:"checkId"`
	CheckDescr   string `json:"checkDescription"`
	Level        string `json:"level"`
	Platform     string `json:"platform"`
	Status       string `json:"status"`
	TargetID     string `json:"targetResourceId"`
	AccountID    string `json:"accountId"`
	StatusReason string `json:"statusReason,omitempty"`
}

CisCheckResult is a single CIS benchmark check outcome for one target resource.

type CisScan 

type CisScan struct {
	ScheduledAt          time.Time         `json:"scheduledBy"`
	FinishedAt           time.Time         `json:"finishedAt"`
	ScanArn              string            `json:"scanArn"`
	ScanConfigurationArn string            `json:"scanConfigurationArn"`
	ScanName             string            `json:"scanName"`
	Status               string            `json:"status"`
	SecurityLevel        string            `json:"securityLevel"`
	TargetAccountID      string            `json:"targetAccountId"`
	Results              []*CisCheckResult `json:"results"`
	TotalChecks          int               `json:"totalChecks"`
	FailedChecks         int               `json:"failedChecks"`
}

CisScan is a completed CIS scan run produced from a scan configuration. It carries the per-check results so the report, result-detail and aggregation operations all derive from the same stored state rather than canned data.

type CisScanConfiguration 

type CisScanConfiguration struct {
	Tags       map[string]string `json:"tags,omitempty"`
	ScheduleV2 map[string]any    `json:"schedule,omitempty"`
	Targets    map[string]any    `json:"targets,omitempty"`
	Arn        string            `json:"scanConfigurationArn"`
	Name       string            `json:"scanName"`
	OwnedBy    string            `json:"ownedBy"`
}

CisScanConfiguration represents a CIS scan configuration.

type CisSession 

type CisSession struct {
	StartedAt    time.Time `json:"startedAt"`
	ScanJobID    string    `json:"scanJobId"`
	SessionToken string    `json:"sessionToken"`
	Status       string    `json:"status"`
}

CisSession represents an active CIS scan session.

type CodeSecurityIntegration 

type CodeSecurityIntegration struct {
	CreatedAt      time.Time         `json:"createdAt"`
	UpdatedAt      time.Time         `json:"updatedAt"`
	Tags           map[string]string `json:"tags,omitempty"`
	IntegrationArn string            `json:"integrationArn"`
	Name           string            `json:"name"`
	Type           string            `json:"type"`
	Status         string            `json:"status"`
}

CodeSecurityIntegration represents a code security integration.

type CodeSecurityScanConfiguration 

type CodeSecurityScanConfiguration struct {
	CreatedAt          time.Time         `json:"createdAt"`
	UpdatedAt          time.Time         `json:"updatedAt"`
	ScopeSettings      map[string]any    `json:"scopeSettings,omitempty"`
	PeriodicScanConfig map[string]any    `json:"periodicScanConfiguration,omitempty"`
	Tags               map[string]string `json:"tags,omitempty"`
	Arn                string            `json:"scanConfigurationArn"`
	Name               string            `json:"name"`
	IntegrationArn     string            `json:"integrationArn,omitempty"`
	Status             string            `json:"status"`
}

CodeSecurityScanConfiguration represents a code security scan configuration.

type CodeSecurityScanConfigurationAssociation 

type CodeSecurityScanConfigurationAssociation struct {
	ScanConfigurationArn string `json:"scanConfigurationArn"`
	Resource             string `json:"resource"`
	Status               string `json:"status"`
}

CodeSecurityScanConfigurationAssociation links a scan config to a repository.

type Configuration 

type Configuration struct {
	Ec2ScanMode       string `json:"ec2ScanMode"`
	EcrRescanDuration string `json:"ecrRescanDuration"`
}

Configuration holds Inspector2 scan configuration.

type CoverageEntry 

type CoverageEntry struct {
	ScanStatus   map[string]any `json:"scanStatus"`
	AccountID    string         `json:"accountId"`
	ResourceID   string         `json:"resourceId"`
	ResourceType string         `json:"resourceType"`
	ScanType     string         `json:"scanType"`
}

CoverageEntry represents a resource covered by Inspector2.

type DelegatedAdminAccount 

type DelegatedAdminAccount struct {
	AccountID string `json:"accountId"`
	Status    string `json:"status"`
}

DelegatedAdminAccount represents a delegated admin account.

type Ec2DeepInspectionConfig 

type Ec2DeepInspectionConfig struct {
	Status       string   `json:"status"`
	ErrorMessage string   `json:"errorMessage,omitempty"`
	PackagePaths []string `json:"packagePaths"`
}

Ec2DeepInspectionConfig holds EC2 deep inspection configuration.

type EncryptionKey 

type EncryptionKey struct {
	KmsKeyID     string `json:"kmsKeyId"`
	ResourceType string `json:"resourceType"`
	ScanType     string `json:"scanType"`
}

EncryptionKey holds an encryption key for a resource type.

type Filter 

type Filter struct {
	CreatedAt   time.Time         `json:"createdAt"`
	UpdatedAt   time.Time         `json:"updatedAt"`
	Criteria    map[string]any    `json:"filterCriteria,omitempty"`
	Tags        map[string]string `json:"tags,omitempty"`
	Arn         string            `json:"arn"`
	Name        string            `json:"name"`
	Action      string            `json:"action"`
	Description string            `json:"description,omitempty"`
	Reason      string            `json:"reason,omitempty"`
	OwnerID     string            `json:"ownerId"`
}

Filter represents an Inspector2 findings filter.

type Finding 

type Finding struct {
	FirstObservedAt time.Time         `json:"firstObservedAt"`
	LastObservedAt  time.Time         `json:"lastObservedAt"`
	UpdatedAt       time.Time         `json:"updatedAt"`
	Description     string            `json:"description"`
	AccountID       string            `json:"awsAccountId"`
	Type            string            `json:"type"`
	Status          string            `json:"status"`
	Title           string            `json:"title,omitempty"`
	FindingArn      string            `json:"findingArn"`
	FixAvailable    string            `json:"fixAvailable,omitempty"`
	ResourceType    string            `json:"-"`
	ResourceID      string            `json:"-"`
	Severity        FindingSeverity   `json:"severity"`
	Resources       []FindingResource `json:"resources,omitempty"`
}

Finding represents an Inspector2 finding. The store is seedable so callers (tests, fixtures, the dashboard) can inject realistic findings that ListFindings will then return and filter — behavior that exceeds LocalStack, which always returns an empty list.

type FindingResource 

type FindingResource struct {
	Type string `json:"type"`
	ID   string `json:"id"`
}

FindingResource describes a resource associated with a finding.

type FindingSeverity 

type FindingSeverity struct {
	Label string  `json:"label"`
	Score float64 `json:"score,omitempty"`
}

FindingSeverity holds severity details for a finding.

type FindingsReport 

type FindingsReport struct {
	CreatedAt    time.Time      `json:"createdAt"`
	Destination  map[string]any `json:"destination,omitempty"`
	ReportID     string         `json:"reportId"`
	Status       string         `json:"status"`
	ErrorCode    string         `json:"errorCode,omitempty"`
	ErrorMessage string         `json:"errorMessage,omitempty"`
}

FindingsReport represents an async findings report job.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler handles Inspector2 HTTP requests.

func NewHandler 

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a matcher that accepts Inspector2 REST paths.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend. Without this, cli.go's generic setupPersistence (which type-asserts the registered service.Registerable, i.e. *Handler, for Snapshot/Restore) never finds a persistable Inspector2 service even though InMemoryBackend itself has always implemented Snapshot/Restore -- the backend methods were dead wiring until Handler delegated to them.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory implementation of Inspector2.

Every map[string]*T resource collection is a *store.Table[T] registered on registry (see store_setup.go); tags, enabledTypes, and codeSecurityScans remain plain maps because their values are not *T (see store_setup.go's file doc comment for the full persistence audit).

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new backend for the given account and region.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the backend account ID.

func (*InMemoryBackend) AddFinding 

func (b *InMemoryBackend) AddFinding(
	findingType, severityLabel, status, title, description string,
	resources []FindingResource,
) string

AddFinding stores a finding and returns its ARN. Used to seed test state.

func (*InMemoryBackend) AssociateMember 

func (b *InMemoryBackend) AssociateMember(accountID string) error

AssociateMember adds a member account.

func (*InMemoryBackend) BatchAssociateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) BatchAssociateCodeSecurityScanConfiguration(
	scanConfigARN string,
	resources []string,
) ([]map[string]any, error)

BatchAssociateCodeSecurityScanConfiguration associates scan configs with resources.

func (*InMemoryBackend) BatchDisassociateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) BatchDisassociateCodeSecurityScanConfiguration(
	scanConfigARN string,
	resources []string,
) ([]map[string]any, error)

BatchDisassociateCodeSecurityScanConfiguration removes scan config associations.

func (*InMemoryBackend) BatchGetCodeSnippet 

func (b *InMemoryBackend) BatchGetCodeSnippet(_ []string) (map[string]any, error)

BatchGetCodeSnippet returns code snippets for findings (stub).

func (*InMemoryBackend) BatchGetFindingDetails 

func (b *InMemoryBackend) BatchGetFindingDetails(_ []map[string]any) (map[string]any, error)

BatchGetFindingDetails returns finding details (stub).

func (*InMemoryBackend) BatchGetFreeTrialInfo 

func (b *InMemoryBackend) BatchGetFreeTrialInfo(accountIDs []string) (map[string]any, error)

BatchGetFreeTrialInfo returns free trial information for accounts.

func (*InMemoryBackend) BatchGetMemberEc2DeepInspectionStatus 

func (b *InMemoryBackend) BatchGetMemberEc2DeepInspectionStatus(accountIDs []string) []*MemberEc2DeepInspectionStatus

BatchGetMemberEc2DeepInspectionStatus returns EC2 deep inspection status for member accounts.

func (*InMemoryBackend) BatchUpdateMemberEc2DeepInspectionStatus 

func (b *InMemoryBackend) BatchUpdateMemberEc2DeepInspectionStatus(
	updates []*MemberEc2DeepInspectionStatus,
) []*MemberEc2DeepInspectionStatus

BatchUpdateMemberEc2DeepInspectionStatus updates EC2 deep inspection status for member accounts.

func (*InMemoryBackend) CancelFindingsReport 

func (b *InMemoryBackend) CancelFindingsReport(reportID string) error

CancelFindingsReport cancels a findings report.

func (*InMemoryBackend) CancelSbomExport 

func (b *InMemoryBackend) CancelSbomExport(reportID string) error

CancelSbomExport cancels an SBOM export.

func (*InMemoryBackend) CreateCisScanConfiguration 

func (b *InMemoryBackend) CreateCisScanConfiguration(
	name string,
	schedule map[string]any,
	targets map[string]any,
	tags map[string]string,
) (*CisScanConfiguration, error)

CreateCisScanConfiguration creates a new CIS scan configuration.

func (*InMemoryBackend) CreateCodeSecurityIntegration 

func (b *InMemoryBackend) CreateCodeSecurityIntegration(
	name, integType string,
	tags map[string]string,
	details map[string]any,
) (*CodeSecurityIntegration, error)

CreateCodeSecurityIntegration creates a new code security integration.

func (*InMemoryBackend) CreateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) CreateCodeSecurityScanConfiguration(
	name string,
	scopeSettings map[string]any,
	periodicConfig map[string]any,
	tags map[string]string,
) (*CodeSecurityScanConfiguration, error)

CreateCodeSecurityScanConfiguration creates a code security scan configuration.

func (*InMemoryBackend) CreateFilter 

func (b *InMemoryBackend) CreateFilter(
	name, action, description, reason string,
	criteria map[string]any,
	tags map[string]string,
) (*Filter, error)

CreateFilter creates a new findings filter.

func (*InMemoryBackend) CreateFindingsReport 

func (b *InMemoryBackend) CreateFindingsReport(destination map[string]any) (*FindingsReport, error)

CreateFindingsReport creates an async findings report.

func (*InMemoryBackend) CreateSbomExport 

func (b *InMemoryBackend) CreateSbomExport(destination map[string]any) (*SbomExport, error)

CreateSbomExport creates an async SBOM export.

func (*InMemoryBackend) DeleteCisScanConfiguration 

func (b *InMemoryBackend) DeleteCisScanConfiguration(configARN string) error

DeleteCisScanConfiguration deletes a CIS scan configuration.

func (*InMemoryBackend) DeleteCodeSecurityIntegration 

func (b *InMemoryBackend) DeleteCodeSecurityIntegration(integrationARN string) error

DeleteCodeSecurityIntegration deletes a code security integration.

func (*InMemoryBackend) DeleteCodeSecurityScanConfiguration 

func (b *InMemoryBackend) DeleteCodeSecurityScanConfiguration(scanConfigARN string) error

DeleteCodeSecurityScanConfiguration deletes a code security scan configuration.

func (*InMemoryBackend) DeleteFilter 

func (b *InMemoryBackend) DeleteFilter(filterARN string) error

DeleteFilter deletes a filter by ARN.

func (*InMemoryBackend) DescribeOrganizationConfiguration 

func (b *InMemoryBackend) DescribeOrganizationConfiguration() OrgConfiguration

DescribeOrganizationConfiguration returns org-level Inspector2 configuration.

func (*InMemoryBackend) Disable 

func (b *InMemoryBackend) Disable(resourceTypes []string) error

Disable disables Inspector2 scanning for the given resource types. If resourceTypes is empty, all known resource types are disabled.

func (*InMemoryBackend) DisableDelegatedAdminAccount 

func (b *InMemoryBackend) DisableDelegatedAdminAccount(accountID string) error

DisableDelegatedAdminAccount disables a delegated admin account.

func (*InMemoryBackend) DisassociateMember 

func (b *InMemoryBackend) DisassociateMember(accountID string) error

DisassociateMember removes a member account.

func (*InMemoryBackend) Enable 

func (b *InMemoryBackend) Enable(resourceTypes []string) error

Enable enables Inspector2 scanning for the given resource types. If resourceTypes is empty, all known resource types are enabled.

func (*InMemoryBackend) EnableDelegatedAdminAccount 

func (b *InMemoryBackend) EnableDelegatedAdminAccount(accountID string) error

EnableDelegatedAdminAccount enables a delegated admin account.

func (*InMemoryBackend) FindingSeverityCounts 

func (b *InMemoryBackend) FindingSeverityCounts() map[string]int64

FindingSeverityCounts returns the number of seeded findings grouped by severity, used by ListFindingAggregations.

func (*InMemoryBackend) GetCisScanReport 

func (b *InMemoryBackend) GetCisScanReport(scanArn string) (map[string]any, error)

GetCisScanReport returns the report for a completed CIS scan. The status and counts are drawn from the stored scan produced by its configuration. For an unrecognized scan ARN it returns a benign SUCCEEDED report with no findings, matching AWS, which does not error on missing report targets.

func (*InMemoryBackend) GetCisScanResultDetails 

func (b *InMemoryBackend) GetCisScanResultDetails(scanArn string) (map[string]any, error)

GetCisScanResultDetails returns the per-check results for a CIS scan. Results reflect the scan generated for the configuration; an unknown scan ARN yields an empty result set rather than an error (AWS behavior for absent scans).

func (*InMemoryBackend) GetClustersForImage 

func (b *InMemoryBackend) GetClustersForImage(_ map[string]any) (map[string]any, error)

GetClustersForImage returns clusters associated with a container image (stub).

func (*InMemoryBackend) GetCodeSecurityIntegration 

func (b *InMemoryBackend) GetCodeSecurityIntegration(integrationARN string) (*CodeSecurityIntegration, error)

GetCodeSecurityIntegration returns a code security integration.

func (*InMemoryBackend) GetCodeSecurityScan 

func (b *InMemoryBackend) GetCodeSecurityScan(scanID string) (map[string]any, error)

GetCodeSecurityScan returns status of a code security scan.

func (*InMemoryBackend) GetCodeSecurityScanConfiguration 

func (b *InMemoryBackend) GetCodeSecurityScanConfiguration(
	scanConfigARN string,
) (*CodeSecurityScanConfiguration, error)

GetCodeSecurityScanConfiguration returns a code security scan configuration.

func (*InMemoryBackend) GetConfiguration 

func (b *InMemoryBackend) GetConfiguration() *Configuration

GetConfiguration returns the current configuration.

func (*InMemoryBackend) GetDelegatedAdminAccount 

func (b *InMemoryBackend) GetDelegatedAdminAccount() (*DelegatedAdminAccount, error)

GetDelegatedAdminAccount returns the delegated admin account.

func (*InMemoryBackend) GetEc2DeepInspectionConfiguration 

func (b *InMemoryBackend) GetEc2DeepInspectionConfiguration() Ec2DeepInspectionConfig

GetEc2DeepInspectionConfiguration returns EC2 deep inspection config.

func (*InMemoryBackend) GetEncryptionKey 

func (b *InMemoryBackend) GetEncryptionKey(resourceType, scanType string) (*EncryptionKey, error)

GetEncryptionKey returns encryption key info for the given resource type and scan type.

func (*InMemoryBackend) GetFindingsReportStatus 

func (b *InMemoryBackend) GetFindingsReportStatus(reportID string) (*FindingsReport, error)

GetFindingsReportStatus returns the status of a findings report.

func (*InMemoryBackend) GetMember 

func (b *InMemoryBackend) GetMember(accountID string) (*Member, error)

GetMember returns a member account.

func (*InMemoryBackend) GetSbomExport 

func (b *InMemoryBackend) GetSbomExport(reportID string) (*SbomExport, error)

GetSbomExport returns the status of an SBOM export.

func (*InMemoryBackend) GetStatus 

func (b *InMemoryBackend) GetStatus() *AccountStatusResponse

GetStatus returns account status information with per-resource-type detail.

func (*InMemoryBackend) IsEnabled 

func (b *InMemoryBackend) IsEnabled() bool

IsEnabled returns whether Inspector2 is enabled for any resource type.

func (*InMemoryBackend) ListAccountPermissions 

func (b *InMemoryBackend) ListAccountPermissions(_ string) ([]*AccountPermission, error)

ListAccountPermissions returns account-level Inspector2 permissions (stub).

func (*InMemoryBackend) ListCisScanConfigurations 

func (b *InMemoryBackend) ListCisScanConfigurations() ([]*CisScanConfiguration, error)

ListCisScanConfigurations returns CIS scan configurations.

func (*InMemoryBackend) ListCisScanResultsAggregatedByChecks 

func (b *InMemoryBackend) ListCisScanResultsAggregatedByChecks(scanArn string) ([]map[string]any, error)

ListCisScanResultsAggregatedByChecks groups a scan's results by check ID, reporting passed/failed/skipped counts per check. An unknown scan ARN yields an empty aggregation list.

func (*InMemoryBackend) ListCisScanResultsAggregatedByTargetResource 

func (b *InMemoryBackend) ListCisScanResultsAggregatedByTargetResource(
	scanArn string,
) ([]map[string]any, error)

ListCisScanResultsAggregatedByTargetResource groups a scan's results by target resource, reporting passed/failed/skipped counts per resource. An unknown scan ARN yields an empty aggregation list.

func (*InMemoryBackend) ListCisScans 

func (b *InMemoryBackend) ListCisScans() ([]map[string]any, error)

ListCisScans returns all completed CIS scans, sorted by scan ARN for stable pagination-free ordering. Each entry summarizes the scan produced from a configuration.

func (*InMemoryBackend) ListCodeSecurityIntegrations 

func (b *InMemoryBackend) ListCodeSecurityIntegrations() ([]*CodeSecurityIntegration, error)

ListCodeSecurityIntegrations returns all code security integrations.

func (*InMemoryBackend) ListCodeSecurityScanConfigurationAssociations 

func (b *InMemoryBackend) ListCodeSecurityScanConfigurationAssociations(
	scanConfigARN string,
) ([]*CodeSecurityScanConfigurationAssociation, error)

ListCodeSecurityScanConfigurationAssociations returns associations for a scan config.

func (*InMemoryBackend) ListCodeSecurityScanConfigurations 

func (b *InMemoryBackend) ListCodeSecurityScanConfigurations() ([]*CodeSecurityScanConfiguration, error)

ListCodeSecurityScanConfigurations returns all code security scan configurations.

func (*InMemoryBackend) ListCoverage 

func (b *InMemoryBackend) ListCoverage(_ map[string]any, _ int32, _ string) ([]*CoverageEntry, string, error)

ListCoverage returns a list of covered resources (stub — always empty).

func (*InMemoryBackend) ListCoverageStatistics 

func (b *InMemoryBackend) ListCoverageStatistics(_ map[string]any) (map[string]any, error)

ListCoverageStatistics returns coverage statistics (stub).

func (*InMemoryBackend) ListDelegatedAdminAccounts 

func (b *InMemoryBackend) ListDelegatedAdminAccounts() ([]*DelegatedAdminAccount, error)

ListDelegatedAdminAccounts returns all delegated admin accounts.

func (*InMemoryBackend) ListFilters 

func (b *InMemoryBackend) ListFilters(arns []string, action string) ([]*Filter, error)

ListFilters returns all filters, optionally filtered by ARNs and action.

func (*InMemoryBackend) ListFindingAggregations 

func (b *InMemoryBackend) ListFindingAggregations(aggregationType string, _ map[string]any) (map[string]any, error)

ListFindingAggregations returns aggregated finding counts. When findings have been seeded it reports the real per-account severity breakdown; otherwise it returns an empty responses list (matching the prior empty-stub contract).

func (*InMemoryBackend) ListFindings 

func (b *InMemoryBackend) ListFindings(
	maxResults int32, nextToken string, criteria map[string]any,
) ([]*Finding, string, error)

ListFindings returns a page of seeded findings filtered by the supplied filterCriteria. With no seeded findings it returns an empty page (preserving the prior always-empty contract for callers that never seed). Pagination uses the finding ARN as a stable cursor over the sorted result set.

func (*InMemoryBackend) ListMembers 

func (b *InMemoryBackend) ListMembers(onlyAssociated bool) ([]*Member, error)

ListMembers returns all member accounts, optionally only associated ones.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns all tags for a resource.

func (*InMemoryBackend) ListUsageTotals 

func (b *InMemoryBackend) ListUsageTotals(_ []string) ([]map[string]any, error)

ListUsageTotals returns usage totals (stub).

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the backend region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) ResetEncryptionKey 

func (b *InMemoryBackend) ResetEncryptionKey(resourceType, scanType string) error

ResetEncryptionKey resets the encryption key to the AWS-managed default.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes the backend state.

func (*InMemoryBackend) SearchVulnerabilities 

func (b *InMemoryBackend) SearchVulnerabilities(_ map[string]any, _ string) ([]map[string]any, string, error)

SearchVulnerabilities returns matching vulnerabilities (stub).

func (*InMemoryBackend) SeedFinding 

func (b *InMemoryBackend) SeedFinding(f Finding) (*Finding, error)

SeedFinding injects a finding into the backend so ListFindings/aggregations return realistic data. Unset fields are defaulted to AWS-plausible values. It returns the stored finding (with a generated ARN when none was supplied).

This is the additive capability that lets gopherstack exceed LocalStack, whose Inspector2 ListFindings is hardwired to return an empty set.

func (*InMemoryBackend) SendCisSessionHealth 

func (b *InMemoryBackend) SendCisSessionHealth(_ string) error

SendCisSessionHealth acknowledges CIS session health.

func (*InMemoryBackend) SendCisSessionTelemetry 

func (b *InMemoryBackend) SendCisSessionTelemetry(_ string, _ map[string]any) error

SendCisSessionTelemetry records CIS session telemetry (no-op in memory).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes the backend state. It implements persistence.Persistable via Handler.Snapshot (see below).

func (*InMemoryBackend) StartCisSession 

func (b *InMemoryBackend) StartCisSession(scanJobID, sessionToken string) (*CisSession, error)

StartCisSession starts a new CIS scan session.

func (*InMemoryBackend) StartCodeSecurityScan 

func (b *InMemoryBackend) StartCodeSecurityScan(resourceID string) (map[string]any, error)

StartCodeSecurityScan starts a code security scan.

func (*InMemoryBackend) StopCisSession 

func (b *InMemoryBackend) StopCisSession(scanJobID string) error

StopCisSession stops a CIS scan session.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource adds or replaces tags on a resource.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource.

func (*InMemoryBackend) UpdateCisScanConfiguration 

func (b *InMemoryBackend) UpdateCisScanConfiguration(
	configARN string,
	name string,
	schedule map[string]any,
	targets map[string]any,
) (*CisScanConfiguration, error)

UpdateCisScanConfiguration updates a CIS scan configuration.

func (*InMemoryBackend) UpdateCodeSecurityIntegration 

func (b *InMemoryBackend) UpdateCodeSecurityIntegration(
	integrationARN string,
	details map[string]any,
) (*CodeSecurityIntegration, error)

UpdateCodeSecurityIntegration updates a code security integration.

func (*InMemoryBackend) UpdateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) UpdateCodeSecurityScanConfiguration(
	scanConfigARN string,
	scopeSettings map[string]any,
	periodicConfig map[string]any,
) (*CodeSecurityScanConfiguration, error)

UpdateCodeSecurityScanConfiguration updates a code security scan configuration.

func (*InMemoryBackend) UpdateConfiguration 

func (b *InMemoryBackend) UpdateConfiguration(ec2ScanMode, ecrRescanDuration string) error

UpdateConfiguration updates the scan configuration.

func (*InMemoryBackend) UpdateEc2DeepInspectionConfiguration 

func (b *InMemoryBackend) UpdateEc2DeepInspectionConfiguration(paths []string) error

UpdateEc2DeepInspectionConfiguration updates EC2 deep inspection config.

func (*InMemoryBackend) UpdateEncryptionKey 

func (b *InMemoryBackend) UpdateEncryptionKey(kmsKeyID, resourceType, scanType string) error

UpdateEncryptionKey sets a customer-managed KMS key for the given resource and scan type.

func (*InMemoryBackend) UpdateFilter 

func (b *InMemoryBackend) UpdateFilter(
	filterARN, action, description, reason string,
	criteria map[string]any,
) (*Filter, error)

UpdateFilter updates an existing filter.

func (*InMemoryBackend) UpdateOrgEc2DeepInspectionConfiguration 

func (b *InMemoryBackend) UpdateOrgEc2DeepInspectionConfiguration(paths []string) error

UpdateOrgEc2DeepInspectionConfiguration updates org-level EC2 deep inspection config.

func (*InMemoryBackend) UpdateOrganizationConfiguration 

func (b *InMemoryBackend) UpdateOrganizationConfiguration(cfg OrgConfiguration) error

UpdateOrganizationConfiguration updates org-level Inspector2 configuration.

type Member 

type Member struct {
	UpdatedAt               time.Time `json:"updatedAt"`
	AccountID               string    `json:"accountId"`
	DelegatedAdminAccountID string    `json:"delegatedAdminAccountId"`
	Email                   string    `json:"email"`
	RelationshipStatus      string    `json:"relationshipStatus"`
}

Member represents an Inspector2 member account.

type MemberEc2DeepInspectionStatus 

type MemberEc2DeepInspectionStatus struct {
	AccountID    string   `json:"accountId"`
	Status       string   `json:"status"`
	ErrorMessage string   `json:"errorMessage,omitempty"`
	PackagePaths []string `json:"packagePaths"`
}

MemberEc2DeepInspectionStatus holds EC2 deep inspection status for a member.

type OrgConfiguration 

type OrgConfiguration struct {
	AutoEnable             bool `json:"autoEnable"`
	MaxAccountLimitReached bool `json:"maxAccountLimitReached"`
}

OrgConfiguration holds organization-level Inspector2 settings.

type OrgEc2DeepInspectionConfig 

type OrgEc2DeepInspectionConfig struct {
	CustomPaths []string `json:"orgPackagePaths"`
}

OrgEc2DeepInspectionConfig holds org-level EC2 deep inspection settings.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon Inspector2.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Inspector2 service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type SbomExport 

type SbomExport struct {
	CreatedAt    time.Time      `json:"createdAt"`
	Destination  map[string]any `json:"destination,omitempty"`
	ReportID     string         `json:"reportId"`
	Status       string         `json:"status"`
	ErrorCode    string         `json:"errorCode,omitempty"`
	ErrorMessage string         `json:"errorMessage,omitempty"`
}

SbomExport represents an async SBOM export job.

type StorageBackend 

type StorageBackend interface {
	Enable(resourceTypes []string) error
	Disable(resourceTypes []string) error
	IsEnabled() bool
	GetStatus() *AccountStatusResponse

	CreateFilter(
		name, action, description, reason string,
		criteria map[string]any,
		tags map[string]string,
	) (*Filter, error)
	UpdateFilter(arn, action, description, reason string, criteria map[string]any) (*Filter, error)
	DeleteFilter(arn string) error
	ListFilters(arns []string, action string) ([]*Filter, error)

	ListFindings(maxResults int32, nextToken string, filterCriteria map[string]any) ([]*Finding, string, error)
	SeedFinding(f Finding) (*Finding, error)
	FindingSeverityCounts() map[string]int64
	AddFinding(findingType, severityLabel, status, title, description string, resources []FindingResource) string

	GetConfiguration() *Configuration
	UpdateConfiguration(ec2ScanMode, ecrRescanDuration string) error

	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)

	// Member operations
	AssociateMember(accountID string) error
	DisassociateMember(accountID string) error
	GetMember(accountID string) (*Member, error)
	ListMembers(onlyAssociated bool) ([]*Member, error)

	// Delegated admin operations
	EnableDelegatedAdminAccount(accountID string) error
	DisableDelegatedAdminAccount(accountID string) error
	GetDelegatedAdminAccount() (*DelegatedAdminAccount, error)
	ListDelegatedAdminAccounts() ([]*DelegatedAdminAccount, error)

	// Organization configuration
	DescribeOrganizationConfiguration() OrgConfiguration
	UpdateOrganizationConfiguration(cfg OrgConfiguration) error

	// EC2 deep inspection
	GetEc2DeepInspectionConfiguration() Ec2DeepInspectionConfig
	UpdateEc2DeepInspectionConfiguration(paths []string) error
	UpdateOrgEc2DeepInspectionConfiguration(paths []string) error
	BatchGetMemberEc2DeepInspectionStatus(accountIDs []string) []*MemberEc2DeepInspectionStatus
	BatchUpdateMemberEc2DeepInspectionStatus(updates []*MemberEc2DeepInspectionStatus) []*MemberEc2DeepInspectionStatus

	// Encryption key operations
	GetEncryptionKey(resourceType, scanType string) (*EncryptionKey, error)
	ResetEncryptionKey(resourceType, scanType string) error
	UpdateEncryptionKey(kmsKeyID, resourceType, scanType string) error

	// CIS scan configuration
	CreateCisScanConfiguration(
		name string,
		schedule map[string]any,
		targets map[string]any,
		tags map[string]string,
	) (*CisScanConfiguration, error)
	DeleteCisScanConfiguration(configARN string) error
	UpdateCisScanConfiguration(
		configARN string,
		name string,
		schedule map[string]any,
		targets map[string]any,
	) (*CisScanConfiguration, error)
	ListCisScanConfigurations() ([]*CisScanConfiguration, error)

	// CIS session operations
	StartCisSession(scanJobID, sessionToken string) (*CisSession, error)
	StopCisSession(scanJobID string) error
	SendCisSessionHealth(scanJobID string) error
	SendCisSessionTelemetry(scanJobID string, messages map[string]any) error
	GetCisScanReport(scanJobID string) (map[string]any, error)
	GetCisScanResultDetails(scanJobID string) (map[string]any, error)
	ListCisScans() ([]map[string]any, error)
	ListCisScanResultsAggregatedByChecks(scanJobID string) ([]map[string]any, error)
	ListCisScanResultsAggregatedByTargetResource(scanJobID string) ([]map[string]any, error)

	// Code security integration
	CreateCodeSecurityIntegration(
		name, integType string,
		tags map[string]string,
		details map[string]any,
	) (*CodeSecurityIntegration, error)
	DeleteCodeSecurityIntegration(integrationARN string) error
	GetCodeSecurityIntegration(integrationARN string) (*CodeSecurityIntegration, error)
	UpdateCodeSecurityIntegration(integrationARN string, details map[string]any) (*CodeSecurityIntegration, error)
	ListCodeSecurityIntegrations() ([]*CodeSecurityIntegration, error)

	// Code security scan configuration
	CreateCodeSecurityScanConfiguration(
		name string,
		scopeSettings map[string]any,
		periodicConfig map[string]any,
		tags map[string]string,
	) (*CodeSecurityScanConfiguration, error)
	DeleteCodeSecurityScanConfiguration(scanConfigARN string) error
	GetCodeSecurityScanConfiguration(scanConfigARN string) (*CodeSecurityScanConfiguration, error)
	UpdateCodeSecurityScanConfiguration(
		scanConfigARN string,
		scopeSettings map[string]any,
		periodicConfig map[string]any,
	) (*CodeSecurityScanConfiguration, error)
	ListCodeSecurityScanConfigurations() ([]*CodeSecurityScanConfiguration, error)
	BatchAssociateCodeSecurityScanConfiguration(scanConfigARN string, resources []string) ([]map[string]any, error)
	BatchDisassociateCodeSecurityScanConfiguration(scanConfigARN string, resources []string) ([]map[string]any, error)
	ListCodeSecurityScanConfigurationAssociations(
		scanConfigARN string,
	) ([]*CodeSecurityScanConfigurationAssociation, error)
	StartCodeSecurityScan(resourceID string) (map[string]any, error)
	GetCodeSecurityScan(scanID string) (map[string]any, error)

	// Findings report
	CreateFindingsReport(destination map[string]any) (*FindingsReport, error)
	CancelFindingsReport(reportID string) error
	GetFindingsReportStatus(reportID string) (*FindingsReport, error)

	// SBOM export
	CreateSbomExport(destination map[string]any) (*SbomExport, error)
	CancelSbomExport(reportID string) error
	GetSbomExport(reportID string) (*SbomExport, error)

	// Coverage
	ListCoverage(filters map[string]any, maxResults int32, nextToken string) ([]*CoverageEntry, string, error)
	ListCoverageStatistics(filters map[string]any) (map[string]any, error)

	// Finding aggregations / usage
	ListFindingAggregations(aggregationType string, filters map[string]any) (map[string]any, error)
	ListUsageTotals(accountIDs []string) ([]map[string]any, error)
	ListAccountPermissions(service string) ([]*AccountPermission, error)
	SearchVulnerabilities(filterCriteria map[string]any, nextToken string) ([]map[string]any, string, error)

	// Batch / misc
	BatchGetCodeSnippet(findingARNs []string) (map[string]any, error)
	BatchGetFindingDetails(findingARNs []map[string]any) (map[string]any, error)
	BatchGetFreeTrialInfo(accountIDs []string) (map[string]any, error)
	GetClustersForImage(filters map[string]any) (map[string]any, error)

	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for Inspector2 storage operations.

type Vulnerability 

type Vulnerability struct {
	VulnerabilityID string `json:"vulnerabilityId"`
	Description     string `json:"description"`
	Severity        string `json:"severity"`
}

Vulnerability represents a known vulnerability.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.