inspector2

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 23 Imported by: 0

README

Inspector

Parity grade: A · SDK aws-sdk-go-v2/service/inspector2@v1.53.0 · last audited 2026-07-25 (9e3baacb5)

Coverage

Metric Value
Operations audited 13 (13 ok)
Feature families 24 (22 ok, 2 partial)
Known gaps 8
Deferred items 1
Resource leaks clean
Known gaps
  • ListConnectors' ConnectorFilterCriteria.accounts/connectorType facets are not modeled (accounts is meaningless in this single-account emulator; connectorType — CUSTOMER_MANAGED/SERVICE_LINKED — has no corresponding field on the real Connector response type to filter against at all, confirmed via types/types.go). Only provider/connectorArns/awsConfigConnectorArns are supported.
  • Connector's real PENDING_DELETION EnablementStatus value and ScopeConfiguration's real ACTIVE/ERROR/DISABLED State values are never reached: this backend's connectors never leave PENDING_AUTHORIZATION (no out-of-band Azure OAuth step exists in the SDK to drive them further), so DeleteConnector completes synchronously and every submitted scope setting is always reported PENDING. Both are deliberate, documented simplifications of an inherently external-system-dependent async lifecycle — see the connectors family note above.
  • CodeSecurityScanConfiguration Get/List responses use a simplified, internally-consistent shape that diverges structurally from the real API (missing nested 'configuration'/ruleSetCategories/level/continuousIntegrationScanConfiguration; List summary shape has no relation to Get's shape at all in real AWS). Full reshape is a substantial, separate effort — file a bd issue before attempting (gopherstack: file follow-up). Not attempted this pass (out of scope per prior audit's own note; re-verified the scope estimate still holds).
  • CreateCodeSecurityIntegrationOutput's optional 'authorizationUrl' member (real API: OAuth callback URL for GitHub/GitLab-type integrations) is never returned. gopherstack has no OAuth flow to derive a real URL from; omitting it is unset-on-the-wire, not wire-breaking.
  • GetClustersForImage always returns an empty (but now correctly-keyed, request-validated) cluster list: gopherstack has no ECS/EKS cluster-membership tracking to join an ECR image resourceId against. Would need a SeedClustersForImage capability plus real ECS/EKS service cross-references to close for real; lower priority than the wire-shape bugs fixed this pass since GetClustersForImage is a low-traffic informational op.
  • CreateCisScanConfiguration/CreateCodeSecurityIntegration/CreateCodeSecurityScanConfiguration 'name' fields are still not validated against AWS's exact length/charset constraints (unlike CreateFilter, fixed this pass) — the real per-op constraints were not confirmed against SDK validation-trait metadata this pass. Real AWS returns ValidationException for violations; this backend accepts anything non-empty. Low severity (a client sending an invalid name simply gets a permissive accept instead of a client-side-preventable error).
  • CoverageFilterCriteria's tag/date/number-range filter facets (ec2InstanceTags, ecrImageLastInUseAt, lastScannedAt date ranges, etc.) and CoveredResource.resourceMetadata (nested per-resource-type metadata union) are real but not modeled by SeedCoverage/ListCoverage — only the string-comparison facets (accountId/resourceId/resourceType/scanType) are supported.
  • Vulnerability's nested AtigData/CisaData/Cvss2/Cvss3/Cvss4/Epss/ExploitObserved objects and FindingDetail's CisaData/Evidences/ExploitObserved/Ttps objects are real but not modeled — only scalar/list fields are seedable via SeedVulnerability/SeedFinding.
Deferred
  • Full CIS session lifecycle semantics (health/telemetry payload validation, session expiry) — accepted as no-ops, not audited for correctness beyond routing/basic state.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrFilterNotFound is returned when a filter does not exist.
	ErrFilterNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrFilterAlreadyExists is returned when a filter already exists.
	ErrFilterAlreadyExists = awserr.New(errConflict, awserr.ErrConflict)
	// ErrTagsResourceNotFound is returned when the tagged resource does not exist.
	ErrTagsResourceNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New(errValidation, awserr.ErrInvalidParameter)

	// ErrMemberNotFound is returned when a member account is not found.
	ErrMemberNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrMemberAlreadyExists is returned when a member already exists.
	ErrMemberAlreadyExists = awserr.New(errConflict, awserr.ErrConflict)
	// ErrDelegatedAdminNotFound is returned when a delegated admin is not found.
	ErrDelegatedAdminNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrDelegatedAdminAlreadyExists is returned on duplicate enable.
	ErrDelegatedAdminAlreadyExists = awserr.New(errConflict, awserr.ErrConflict)
	// ErrCisScanConfigNotFound is returned when a CIS scan config is missing.
	ErrCisScanConfigNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrCodeSecurityIntegrationNotFound is returned when a code security integration is missing.
	ErrCodeSecurityIntegrationNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrCodeSecurityScanConfigNotFound is returned when a code security scan config is missing.
	ErrCodeSecurityScanConfigNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrReportNotFound is returned when a findings report is missing.
	ErrReportNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrSbomExportNotFound is returned when an SBOM export is missing.
	ErrSbomExportNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrCisSessionNotFound is returned when a CIS session is missing.
	ErrCisSessionNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrConnectorNotFound is returned when a connector does not exist.
	ErrConnectorNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrConnectorScanConfigNotFound is returned when UpdateConnectorScanConfiguration
	// targets an AWS Config connector ARN with no associated connector.
	ErrConnectorScanConfigNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
)
View Source 
var ErrNilAppContext = errors.New("inspector2: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type AccountPermission 

type AccountPermission struct {
	Operation string `json:"operation"`
	Service   string `json:"service"`
}

AccountPermission represents an Inspector2 account-level permission, matching the real Permission shape (operation/service). The prior "status" field was a gopherstack-invented member with no counterpart in the real API -- deleted in favor of the real "service" field.

type AccountStatusResponse 

type AccountStatusResponse struct {
	AccountID    string `json:"accountId"`
	Status       string `json:"status"`
	Ec2Status    string `json:"ec2Status"`
	EcrStatus    string `json:"ecrStatus"`
	LambdaStatus string `json:"lambdaStatus"`
}

AccountStatusResponse holds Enable/Disable/BatchGetAccountStatus output.

type CisCheckResult 

type CisCheckResult struct {
	CheckID      string `json:"checkId"`
	CheckDescr   string `json:"checkDescription"`
	Level        string `json:"level"`
	Platform     string `json:"platform"`
	Status       string `json:"status"`
	TargetID     string `json:"targetResourceId"`
	AccountID    string `json:"accountId"`
	StatusReason string `json:"statusReason,omitempty"`
}

CisCheckResult is a single CIS benchmark check outcome for one target resource.

type CisScan 

type CisScan struct {
	ScheduledAt          time.Time         `json:"scheduledBy"`
	FinishedAt           time.Time         `json:"finishedAt"`
	ScanArn              string            `json:"scanArn"`
	ScanConfigurationArn string            `json:"scanConfigurationArn"`
	ScanName             string            `json:"scanName"`
	Status               string            `json:"status"`
	SecurityLevel        string            `json:"securityLevel"`
	TargetAccountID      string            `json:"targetAccountId"`
	Results              []*CisCheckResult `json:"results"`
	TotalChecks          int               `json:"totalChecks"`
	FailedChecks         int               `json:"failedChecks"`
}

CisScan is a completed CIS scan run produced from a scan configuration. It carries the per-check results so the report, result-detail and aggregation operations all derive from the same stored state rather than canned data.

type CisScanConfiguration 

type CisScanConfiguration struct {
	Tags       map[string]string `json:"tags,omitempty"`
	ScheduleV2 map[string]any    `json:"schedule,omitempty"`
	Targets    map[string]any    `json:"targets,omitempty"`
	Arn        string            `json:"scanConfigurationArn"`
	Name       string            `json:"scanName"`
	OwnedBy    string            `json:"ownedBy"`
}

CisScanConfiguration represents a CIS scan configuration.

type CisSession 

type CisSession struct {
	StartedAt    time.Time `json:"startedAt"`
	ScanJobID    string    `json:"scanJobId"`
	SessionToken string    `json:"sessionToken"`
	Status       string    `json:"status"`
}

CisSession represents an active CIS scan session.

type CodeLine added in v1.2.0 

type CodeLine struct {
	Content    string `json:"content"`
	LineNumber int32  `json:"lineNumber"`
}

CodeLine is a single line of a retrieved code snippet (real CodeLine shape).

type CodeSecurityIntegration 

type CodeSecurityIntegration struct {
	CreatedAt      time.Time         `json:"createdAt"`
	UpdatedAt      time.Time         `json:"updatedAt"`
	Tags           map[string]string `json:"tags,omitempty"`
	IntegrationArn string            `json:"integrationArn"`
	Name           string            `json:"name"`
	Type           string            `json:"type"`
	Status         string            `json:"status"`
}

CodeSecurityIntegration represents a code security integration.

type CodeSecurityScanConfiguration 

type CodeSecurityScanConfiguration struct {
	CreatedAt                       time.Time
	UpdatedAt                       time.Time
	ScopeSettings                   map[string]any
	PeriodicScanConfig              map[string]any
	ContinuousIntegrationScanConfig map[string]any
	Tags                            map[string]string
	Arn                             string
	Name                            string
	Level                           string
	RuleSetCategories               []string
}

CodeSecurityScanConfiguration represents a code security scan configuration.

Level and RuleSetCategories mirror CreateCodeSecurityScanConfigurationInput's required members: level sits alongside the nested "configuration" object on the wire, while RuleSetCategories/PeriodicScanConfig/ ContinuousIntegrationScanConfig all nest *under* "configuration" (confirmed via serializers.go's awsRestjson1_serializeDocumentCodeSecurityScanConfiguration) -- see codeSecurityScanConfigToWire for the reshape. UpdateCodeSecurityScanConfiguration only ever replaces that nested configuration object: UpdateCodeSecurityScanConfigurationInput has just "configuration" and "scanConfigurationArn" members, so level/scopeSettings/name are immutable after creation on the real API. There is no "status" member anywhere on the real CodeSecurityScanConfiguration/GetCodeSecurityScanConfigurationOutput shape -- an earlier revision fabricated one; do not reintroduce it.

type CodeSecurityScanConfigurationAssociation 

type CodeSecurityScanConfigurationAssociation struct {
	ScanConfigurationArn string `json:"scanConfigurationArn"`
	Resource             string `json:"resource"`
	Status               string `json:"status"`
}

CodeSecurityScanConfigurationAssociation links a scan config to a repository.

type Configuration 

type Configuration struct {
	Ec2ScanMode       string `json:"ec2ScanMode"`
	EcrRescanDuration string `json:"ecrRescanDuration"`
}

Configuration holds Inspector2 scan configuration.

type Connector added in v1.2.0 

type Connector struct {
	CreatedAt              time.Time                    `json:"createdAt"`
	UpdatedAt              time.Time                    `json:"updatedAt"`
	Health                 *ConnectorHealth             `json:"health,omitempty"`
	ScopeConfiguration     *ConnectorScopeConfiguration `json:"scopeConfiguration,omitempty"`
	Tags                   map[string]string            `json:"tags,omitempty"`
	ConnectorArn           string                       `json:"connectorArn"`
	Name                   string                       `json:"name"`
	Description            string                       `json:"description,omitempty"`
	Provider               string                       `json:"provider"`
	AwsConfigConnectorArn  string                       `json:"awsConfigConnectorArn,omitempty"`
	EnablementStatus       string                       `json:"enablementStatus"`
	EnablementStatusReason string                       `json:"enablementStatusReason,omitempty"`
	AzureRegions           []string                     `json:"azureRegions,omitempty"`
	AutoInstallVMScanner   bool                         `json:"autoInstallVMScanner"`
}

Connector represents an Amazon Inspector connector linking an external cloud provider (currently only Azure, per the real ConnectorCloudProvider enum's single AZURE value) to Inspector for vulnerability scanning, matching the real Connector shape (types.Connector, field-diffed against aws-sdk-go-v2/service/inspector2/types@v1.53.0's deserializers.go).

type ConnectorContainerImageScanConfig added in v1.2.0 

type ConnectorContainerImageScanConfig struct {
	PullDuration string `json:"pullDuration,omitempty"`
	PushDuration string `json:"pushDuration,omitempty"`
}

ConnectorContainerImageScanConfig mirrors the real ConnectorContainerImageScanConfiguration shape: the rescan-duration settings applied to container images pulled/pushed through a connector's connected registries.

type ConnectorHealth added in v1.2.0 

type ConnectorHealth struct {
	LastCheckedAt   time.Time `json:"lastCheckedAt"`
	ConnectorStatus string    `json:"connectorStatus"`
	Message         string    `json:"message,omitempty"`
}

ConnectorHealth reports the connectivity/authorization health of a Connector, matching the real ConnectorHealth shape. Real ConnectorHealthStatus includes PENDING_AUTHORIZATION: an Azure connector requires completing an external Azure AD app-consent (OAuth) flow in the Azure portal before Amazon Inspector can reach the tenant, and none of CreateConnector/UpdateConnector/DeleteConnector/ListConnectors/ ListConnectorScanConfigurations/UpdateConnectorScanConfiguration (the entire connector SDK surface) drives or observes that step. See connectors.go's CreateConnector doc comment for why this backend leaves Health permanently at PENDING_AUTHORIZATION rather than faking a transition to CONNECTED.

type ConnectorScanConfiguration added in v1.2.0 

type ConnectorScanConfiguration struct {
	ContainerImageScanning *ConnectorContainerImageScanConfig `json:"containerImageScanning,omitempty"`
	AwsConfigConnectorArn  string                             `json:"awsConfigConnectorArn"`
}

ConnectorScanConfiguration represents the scan settings applied to resources discovered through every connector sharing one AWS Config connector ARN, matching the real ConnectorScanConfiguration shape. Stored keyed by AwsConfigConnectorArn -- there is no CreateConnectorScanConfiguration operation in the real API, so UpdateConnectorScanConfiguration is the only write path (see connectors.go).

type ConnectorScanConfigurationItem added in v1.2.0 

type ConnectorScanConfigurationItem struct {
	ScanConfiguration     *ConnectorScanConfiguration `json:"scanConfiguration"`
	AwsConfigConnectorArn string                      `json:"awsConfigConnectorArn"`
	ConnectorArns         []string                    `json:"connectorArns"`
}

ConnectorScanConfigurationItem represents one entry of ListConnectorScanConfigurations' result, matching the real ConnectorScanConfigurationItem shape: the AWS Config connector ARN, the (dynamically derived) list of connector ARNs currently sharing it, and its scan configuration.

type ConnectorScopeConfiguration added in v1.2.0 

type ConnectorScopeConfiguration struct {
	ContainerImageScanning *ConnectorScopeSetting `json:"containerImageScanning,omitempty"`
	ServerlessScanning     *ConnectorScopeSetting `json:"serverlessScanning,omitempty"`
	VMScanning             *ConnectorScopeSetting `json:"vmScanning,omitempty"`
}

ConnectorScopeConfiguration mirrors the real AzureScopeConfiguration shape: the scope of Azure resources scanned, defined separately per scanning type.

type ConnectorScopeSetting added in v1.2.0 

type ConnectorScopeSetting struct {
	ScopeType   string   `json:"scopeType"`
	State       string   `json:"state,omitempty"`
	StateReason string   `json:"stateReason,omitempty"`
	ScopeValues []string `json:"scopeValues,omitempty"`
}

ConnectorScopeSetting represents one scanning type's Azure resource scope (VM, container image, or serverless), matching the real ScopeConfiguration shape. State reflects that this backend can never validate a submitted scope against a live Azure tenant (the connector itself never leaves PENDING_AUTHORIZATION), so State is always PENDING here, never ACTIVE/ ERROR/DISABLED.

type CoverageEntry 

type CoverageEntry struct {
	LastScannedAt time.Time           `json:"lastScannedAt"`
	ScanStatus    *CoverageScanStatus `json:"scanStatus,omitempty"`
	AccountID     string              `json:"accountId"`
	ResourceID    string              `json:"resourceId"`
	ResourceType  string              `json:"resourceType"`
	ScanType      string              `json:"scanType"`
	ScanMode      string              `json:"scanMode,omitempty"`
}

CoverageEntry represents a resource covered by Inspector2, matching the real CoveredResource shape (accountId/resourceId/resourceType/scanType are required; lastScannedAt/scanMode/scanStatus are optional). Seeded via SeedCoverage -- ListCoverage/ListCoverageStatistics were previously hardwired-empty stubs with no way to populate real data, unlike Finding's SeedFinding.

type CoverageScanStatus added in v1.2.0 

type CoverageScanStatus struct {
	StatusCode string `json:"statusCode"`
	Reason     string `json:"reason,omitempty"`
}

CoverageScanStatus mirrors the real ScanStatus shape (statusCode/reason).

type DelegatedAdminAccount 

type DelegatedAdminAccount struct {
	AccountID string `json:"accountId"`
	Status    string `json:"status"`
}

DelegatedAdminAccount represents a delegated admin account.

type Ec2DeepInspectionConfig 

type Ec2DeepInspectionConfig struct {
	Status       string   `json:"status"`
	ErrorMessage string   `json:"errorMessage,omitempty"`
	PackagePaths []string `json:"packagePaths"`
}

Ec2DeepInspectionConfig holds EC2 deep inspection configuration.

type EncryptionKey 

type EncryptionKey struct {
	KmsKeyID     string `json:"kmsKeyId"`
	ResourceType string `json:"resourceType"`
	ScanType     string `json:"scanType"`
}

EncryptionKey holds an encryption key for a resource type.

type Filter 

type Filter struct {
	CreatedAt   time.Time         `json:"createdAt"`
	UpdatedAt   time.Time         `json:"updatedAt"`
	Criteria    map[string]any    `json:"filterCriteria,omitempty"`
	Tags        map[string]string `json:"tags,omitempty"`
	Arn         string            `json:"arn"`
	Name        string            `json:"name"`
	Action      string            `json:"action"`
	Description string            `json:"description,omitempty"`
	Reason      string            `json:"reason,omitempty"`
	OwnerID     string            `json:"ownerId"`
}

Filter represents an Inspector2 findings filter.

type Finding 

type Finding struct {
	FirstObservedAt time.Time         `json:"firstObservedAt"`
	LastObservedAt  time.Time         `json:"lastObservedAt"`
	UpdatedAt       time.Time         `json:"updatedAt"`
	Title           string            `json:"title,omitempty"`
	FindingArn      string            `json:"findingArn"`
	ResourceID      string            `json:"-"`
	ResourceType    string            `json:"-"`
	FixAvailable    string            `json:"fixAvailable,omitempty"`
	Description     string            `json:"description"`
	AccountID       string            `json:"awsAccountId"`
	Type            string            `json:"type"`
	Status          string            `json:"status"`
	Resources       []FindingResource `json:"resources,omitempty"`
	Cwes            []string          `json:"cwes,omitempty"`
	Severity        FindingSeverity   `json:"severity"`
	Tools           []string          `json:"tools,omitempty"`
	ReferenceUrls   []string          `json:"referenceUrls,omitempty"`
	// Ttps holds FindingDetail.Ttps (MITRE adversary tactics/techniques/
	// procedures) -- a plain string list, identical in shape to Tools/Cwes/
	// ReferenceUrls above, added alongside them this pass (field-diffed
	// against types.FindingDetail; previously omitted despite being no more
	// complex than the fields already modeled).
	Ttps      []string `json:"ttps,omitempty"`
	EpssScore float64  `json:"epssScore,omitempty"`
	RiskScore int32    `json:"riskScore,omitempty"`
}

Finding represents an Inspector2 finding. The store is seedable so callers (tests, fixtures, the dashboard) can inject realistic findings that ListFindings will then return and filter — behavior that exceeds LocalStack, which always returns an empty list.

EpssScore/RiskScore/Cwes/ReferenceUrls/Tools/Ttps back BatchGetFindingDetails only (real FindingDetail shape) -- findingToWire (ListFindings' wire shape) never renders them, matching the real API where these live on a separate FindingDetail resource, not on Finding itself. (Field order below is fieldalignment-optimized, not declaration/doc order.)

type FindingResource 

type FindingResource struct {
	Type string `json:"type"`
	ID   string `json:"id"`
}

FindingResource describes a resource associated with a finding.

type FindingSeverity 

type FindingSeverity struct {
	Label string  `json:"label"`
	Score float64 `json:"score,omitempty"`
}

FindingSeverity holds severity details for a finding.

type FindingsReport 

type FindingsReport struct {
	CreatedAt      time.Time      `json:"createdAt"`
	Destination    map[string]any `json:"destination,omitempty"`
	FilterCriteria map[string]any `json:"filterCriteria,omitempty"`
	ReportID       string         `json:"reportId"`
	ReportFormat   string         `json:"reportFormat,omitempty"`
	Status         string         `json:"status"`
	ErrorCode      string         `json:"errorCode,omitempty"`
	ErrorMessage   string         `json:"errorMessage,omitempty"`
}

FindingsReport represents an async findings report job. FilterCriteria and ReportFormat are captured from CreateFindingsReport's request and echoed back by GetFindingsReportStatus (real GetFindingsReportStatusOutput wire keys: destination/errorCode/errorMessage/filterCriteria/reportId/status -- note the real shape has no createdAt member at all, so CreatedAt below is backend bookkeeping only and must never reach the wire).

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler handles Inspector2 HTTP requests.

func NewHandler 

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a matcher that accepts Inspector2 REST paths.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend. Without this, cli.go's generic setupPersistence (which type-asserts the registered service.Registerable, i.e. *Handler, for Snapshot/Restore) never finds a persistable Inspector2 service even though InMemoryBackend itself has always implemented Snapshot/Restore -- the backend methods were dead wiring until Handler delegated to them.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory implementation of Inspector2.

Every map[string]*T resource collection is a *store.Table[T] registered on registry (see store_setup.go); tags, enabledTypes, and codeSecurityScans remain plain maps because their values are not *T (see store_setup.go's file doc comment for the full persistence audit).

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new backend for the given account and region.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the backend account ID.

func (*InMemoryBackend) AddFinding 

func (b *InMemoryBackend) AddFinding(
	findingType, severityLabel, status, title, description string,
	resources []FindingResource,
) string

AddFinding stores a finding and returns its ARN. Used to seed test state.

func (*InMemoryBackend) AssociateMember 

func (b *InMemoryBackend) AssociateMember(accountID string) error

AssociateMember adds a member account.

func (*InMemoryBackend) BatchAssociateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) BatchAssociateCodeSecurityScanConfiguration(
	scanConfigARN string,
	resources []string,
) ([]map[string]any, error)

BatchAssociateCodeSecurityScanConfiguration associates scan configs with resources.

func (*InMemoryBackend) BatchDisassociateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) BatchDisassociateCodeSecurityScanConfiguration(
	scanConfigARN string,
	resources []string,
) ([]map[string]any, error)

BatchDisassociateCodeSecurityScanConfiguration removes scan config associations.

func (*InMemoryBackend) BatchGetCodeSnippet 

func (b *InMemoryBackend) BatchGetCodeSnippet(findingARNs []string) (map[string]any, error)

BatchGetCodeSnippet returns seeded code snippet content for each requested finding ARN, or a CODE_SNIPPET_NOT_FOUND error entry (the only error code meaningful here -- see types.CodeSnippetErrorCode) for any ARN with none seeded. This replaces the prior stub, which silently ignored its input entirely and always returned two empty lists regardless of what was asked for.

func (*InMemoryBackend) BatchGetFindingDetails 

func (b *InMemoryBackend) BatchGetFindingDetails(findingARNs []string) (map[string]any, error)

BatchGetFindingDetails returns extended vulnerability details for each requested finding ARN that exists in the backend, or a FINDING_DETAILS_NOT_FOUND error entry for any ARN that does not. This replaces the prior stub (which additionally decoded its request body into the wrong shape entirely -- real BatchGetFindingDetailsInput.findingArns is a plain string array, not an array of objects).

func (*InMemoryBackend) BatchGetFreeTrialInfo 

func (b *InMemoryBackend) BatchGetFreeTrialInfo(accountIDs []string) (map[string]any, error)

BatchGetFreeTrialInfo returns free trial information for accounts.

func (*InMemoryBackend) BatchGetMemberEc2DeepInspectionStatus 

func (b *InMemoryBackend) BatchGetMemberEc2DeepInspectionStatus(accountIDs []string) []*MemberEc2DeepInspectionStatus

BatchGetMemberEc2DeepInspectionStatus returns EC2 deep inspection status for member accounts.

func (*InMemoryBackend) BatchUpdateMemberEc2DeepInspectionStatus 

func (b *InMemoryBackend) BatchUpdateMemberEc2DeepInspectionStatus(
	updates []*MemberEc2DeepInspectionStatus,
) []*MemberEc2DeepInspectionStatus

BatchUpdateMemberEc2DeepInspectionStatus updates EC2 deep inspection status for member accounts.

func (*InMemoryBackend) CancelFindingsReport 

func (b *InMemoryBackend) CancelFindingsReport(reportID string) error

CancelFindingsReport cancels a findings report.

func (*InMemoryBackend) CancelSbomExport 

func (b *InMemoryBackend) CancelSbomExport(reportID string) error

CancelSbomExport cancels an SBOM export.

func (*InMemoryBackend) CreateCisScanConfiguration 

func (b *InMemoryBackend) CreateCisScanConfiguration(
	name string,
	schedule map[string]any,
	targets map[string]any,
	tags map[string]string,
) (*CisScanConfiguration, error)

CreateCisScanConfiguration creates a new CIS scan configuration.

func (*InMemoryBackend) CreateCodeSecurityIntegration 

func (b *InMemoryBackend) CreateCodeSecurityIntegration(
	name, integType string,
	tags map[string]string,
	details map[string]any,
) (*CodeSecurityIntegration, error)

CreateCodeSecurityIntegration creates a new code security integration.

func (*InMemoryBackend) CreateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) CreateCodeSecurityScanConfiguration(
	name, level string,
	ruleSetCategories []string,
	continuousIntegrationScanConfig map[string]any,
	periodicConfig map[string]any,
	scopeSettings map[string]any,
	tags map[string]string,
) (*CodeSecurityScanConfiguration, error)

CreateCodeSecurityScanConfiguration creates a code security scan configuration.

func (*InMemoryBackend) CreateConnector added in v1.2.0 

func (b *InMemoryBackend) CreateConnector(
	name, description, provider string,
	tags map[string]string,
	awsConfigConnectorArn string,
	azureRegions []string,
	autoInstallVMScanner *bool,
	scopeConfig *ConnectorScopeConfiguration,
) (*Connector, error)

CreateConnector creates a new Azure connector.

Real CreateConnector is asynchronous: Amazon Inspector begins provisioning the connector and its Azure AD app-consent (OAuth) authorization flow in the background, and CreateConnectorOutput returns only the new connector's ARN (confirmed via api_op_CreateConnector.go -- ConnectorArn is the output's only member). The connector only becomes healthy (Health.ConnectorStatus == CONNECTED) once an operator completes that external OAuth consent in the Azure portal; there is no Amazon Inspector API operation in the SDK that drives or observes that step (CreateConnector/UpdateConnector/DeleteConnector/ListConnectors/ ListConnectorScanConfigurations/UpdateConnectorScanConfiguration are the entire connector-related SDK surface -- confirmed via `go doc .../inspector2 | grep -i connector`). This backend therefore creates the connector with EnablementStatus=PENDING_ENABLEMENT and Health.ConnectorStatus=PENDING_AUTHORIZATION and never auto-advances either: faking a transition to ENABLED/CONNECTED would silently claim to have completed an OAuth flow gopherstack has no way to perform, the same bug class the securityhub connector work in this campaign flagged.

func (*InMemoryBackend) CreateFilter 

func (b *InMemoryBackend) CreateFilter(
	name, action, description, reason string,
	criteria map[string]any,
	tags map[string]string,
) (*Filter, error)

CreateFilter creates a new findings filter.

func (*InMemoryBackend) CreateFindingsReport 

func (b *InMemoryBackend) CreateFindingsReport(
	destination, filterCriteria map[string]any, reportFormat string,
) (*FindingsReport, error)

CreateFindingsReport creates an async findings report.

func (*InMemoryBackend) CreateSbomExport 

func (b *InMemoryBackend) CreateSbomExport(
	destination, filterCriteria map[string]any, format string,
) (*SbomExport, error)

CreateSbomExport creates an async SBOM export.

func (*InMemoryBackend) DeleteCisScanConfiguration 

func (b *InMemoryBackend) DeleteCisScanConfiguration(configARN string) error

DeleteCisScanConfiguration deletes a CIS scan configuration.

func (*InMemoryBackend) DeleteCodeSecurityIntegration 

func (b *InMemoryBackend) DeleteCodeSecurityIntegration(integrationARN string) error

DeleteCodeSecurityIntegration deletes a code security integration.

func (*InMemoryBackend) DeleteCodeSecurityScanConfiguration 

func (b *InMemoryBackend) DeleteCodeSecurityScanConfiguration(scanConfigARN string) error

DeleteCodeSecurityScanConfiguration deletes a code security scan configuration.

func (*InMemoryBackend) DeleteConnector added in v1.2.0 

func (b *InMemoryBackend) DeleteConnector(connectorArn string) error

DeleteConnector deletes a connector.

Real DeleteConnector is also asynchronous in principle (EnablementStatus has a PENDING_DELETION value), but the SDK exposes no follow-up read operation for a single connector (no GetConnector) through which a caller could ever observe an in-between state -- only ListConnectors, which would have to keep listing a deleted connector forever for "pending deletion" to be observable at all, since nothing in the connector SDK surface ever advances that state. Leaving it listed forever would misrepresent deletion as never completing, a worse dishonesty than treating the delete as complete once requested. This backend therefore removes the connector synchronously. Any ConnectorScanConfiguration keyed by the connector's AwsConfigConnectorArn is left untouched: it is real backend state (there is no evidence in the SDK that deleting one connector cascades to a scan configuration potentially still shared by other connectors on the same AWS Config connector ARN), not invented cleanup.

func (*InMemoryBackend) DeleteFilter 

func (b *InMemoryBackend) DeleteFilter(filterARN string) error

DeleteFilter deletes a filter by ARN.

func (*InMemoryBackend) DescribeOrganizationConfiguration 

func (b *InMemoryBackend) DescribeOrganizationConfiguration() OrgConfiguration

DescribeOrganizationConfiguration returns org-level Inspector2 configuration.

func (*InMemoryBackend) Disable 

func (b *InMemoryBackend) Disable(resourceTypes []string) error

Disable disables Inspector2 scanning for the given resource types. If resourceTypes is empty, all known resource types are disabled.

func (*InMemoryBackend) DisableDelegatedAdminAccount 

func (b *InMemoryBackend) DisableDelegatedAdminAccount(accountID string) error

DisableDelegatedAdminAccount disables a delegated admin account.

func (*InMemoryBackend) DisassociateMember 

func (b *InMemoryBackend) DisassociateMember(accountID string) error

DisassociateMember removes a member account.

func (*InMemoryBackend) Enable 

func (b *InMemoryBackend) Enable(resourceTypes []string) error

Enable enables Inspector2 scanning for the given resource types. If resourceTypes is empty, all known resource types are enabled.

func (*InMemoryBackend) EnableDelegatedAdminAccount 

func (b *InMemoryBackend) EnableDelegatedAdminAccount(accountID string) error

EnableDelegatedAdminAccount enables a delegated admin account.

func (*InMemoryBackend) FindingSeverityCounts 

func (b *InMemoryBackend) FindingSeverityCounts() map[string]int64

FindingSeverityCounts returns the number of seeded findings grouped by severity, used by ListFindingAggregations.

func (*InMemoryBackend) GetCisScanReport 

func (b *InMemoryBackend) GetCisScanReport(scanArn string) (map[string]any, error)

GetCisScanReport returns the report for a completed CIS scan. The status and counts are drawn from the stored scan produced by its configuration. For an unrecognized scan ARN it returns a benign SUCCEEDED report with no findings, matching AWS, which does not error on missing report targets.

func (*InMemoryBackend) GetCisScanResultDetails 

func (b *InMemoryBackend) GetCisScanResultDetails(scanArn string) (map[string]any, error)

GetCisScanResultDetails returns the per-check results for a CIS scan. Results reflect the scan generated for the configuration; an unknown scan ARN yields an empty result set rather than an error (AWS behavior for absent scans).

func (*InMemoryBackend) GetClustersForImage 

func (b *InMemoryBackend) GetClustersForImage(resourceID string) (map[string]any, error)

GetClustersForImage returns the ECS/EKS clusters running the given ECR image resource. Real GetClustersForImageInput's "filter.resourceId" member is required (ValidationException if empty); gopherstack has no ECS/EKS cluster-membership tracking to join against, so a validated request always returns an empty (but correctly-shaped) cluster list rather than fabricating cluster ARNs.

func (*InMemoryBackend) GetCodeSecurityIntegration 

func (b *InMemoryBackend) GetCodeSecurityIntegration(integrationARN string) (*CodeSecurityIntegration, error)

GetCodeSecurityIntegration returns a code security integration.

func (*InMemoryBackend) GetCodeSecurityScan 

func (b *InMemoryBackend) GetCodeSecurityScan(scanID string) (map[string]any, error)

GetCodeSecurityScan returns status of a code security scan.

func (*InMemoryBackend) GetCodeSecurityScanConfiguration 

func (b *InMemoryBackend) GetCodeSecurityScanConfiguration(
	scanConfigARN string,
) (*CodeSecurityScanConfiguration, error)

GetCodeSecurityScanConfiguration returns a code security scan configuration.

func (*InMemoryBackend) GetConfiguration 

func (b *InMemoryBackend) GetConfiguration() *Configuration

GetConfiguration returns the current configuration.

func (*InMemoryBackend) GetDelegatedAdminAccount 

func (b *InMemoryBackend) GetDelegatedAdminAccount() (*DelegatedAdminAccount, error)

GetDelegatedAdminAccount returns the delegated admin account.

func (*InMemoryBackend) GetEc2DeepInspectionConfiguration 

func (b *InMemoryBackend) GetEc2DeepInspectionConfiguration() Ec2DeepInspectionConfig

GetEc2DeepInspectionConfiguration returns EC2 deep inspection config.

func (*InMemoryBackend) GetEncryptionKey 

func (b *InMemoryBackend) GetEncryptionKey(resourceType, scanType string) (*EncryptionKey, error)

GetEncryptionKey returns encryption key info for the given resource type and scan type.

func (*InMemoryBackend) GetFindingsReportStatus 

func (b *InMemoryBackend) GetFindingsReportStatus(reportID string) (*FindingsReport, error)

GetFindingsReportStatus returns the status of a findings report.

func (*InMemoryBackend) GetMember 

func (b *InMemoryBackend) GetMember(accountID string) (*Member, error)

GetMember returns a member account.

func (*InMemoryBackend) GetSbomExport 

func (b *InMemoryBackend) GetSbomExport(reportID string) (*SbomExport, error)

GetSbomExport returns the status of an SBOM export.

func (*InMemoryBackend) GetStatus 

func (b *InMemoryBackend) GetStatus() *AccountStatusResponse

GetStatus returns account status information with per-resource-type detail.

func (*InMemoryBackend) IsEnabled 

func (b *InMemoryBackend) IsEnabled() bool

IsEnabled returns whether Inspector2 is enabled for any resource type.

func (*InMemoryBackend) ListAccountPermissions 

func (b *InMemoryBackend) ListAccountPermissions(service string) ([]*AccountPermission, error)

ListAccountPermissions returns the account's Inspector2 configuration permissions. gopherstack's mock account has no IAM engine to evaluate against, so -- rather than the prior hardwired-empty stub, which silently dropped every request -- it reports the full real Operation x Service permission matrix (the account can perform every configuration operation), narrowed by the optional service filter, matching real AccountPermission wire shape (operation/service).

func (*InMemoryBackend) ListCisScanConfigurations 

func (b *InMemoryBackend) ListCisScanConfigurations() ([]*CisScanConfiguration, error)

ListCisScanConfigurations returns CIS scan configurations.

func (*InMemoryBackend) ListCisScanResultsAggregatedByChecks 

func (b *InMemoryBackend) ListCisScanResultsAggregatedByChecks(scanArn string) ([]map[string]any, error)

ListCisScanResultsAggregatedByChecks groups a scan's results by check ID, reporting passed/failed/skipped counts per check. An unknown scan ARN yields an empty aggregation list.

func (*InMemoryBackend) ListCisScanResultsAggregatedByTargetResource 

func (b *InMemoryBackend) ListCisScanResultsAggregatedByTargetResource(
	scanArn string,
) ([]map[string]any, error)

ListCisScanResultsAggregatedByTargetResource groups a scan's results by target resource, reporting passed/failed/skipped counts per resource. An unknown scan ARN yields an empty aggregation list.

func (*InMemoryBackend) ListCisScans 

func (b *InMemoryBackend) ListCisScans() ([]map[string]any, error)

ListCisScans returns all completed CIS scans, sorted by scan ARN for stable pagination-free ordering. Each entry summarizes the scan produced from a configuration.

func (*InMemoryBackend) ListCodeSecurityIntegrations 

func (b *InMemoryBackend) ListCodeSecurityIntegrations() ([]*CodeSecurityIntegration, error)

ListCodeSecurityIntegrations returns all code security integrations.

func (*InMemoryBackend) ListCodeSecurityScanConfigurationAssociations 

func (b *InMemoryBackend) ListCodeSecurityScanConfigurationAssociations(
	scanConfigARN string,
) ([]*CodeSecurityScanConfigurationAssociation, error)

ListCodeSecurityScanConfigurationAssociations returns associations for a scan config.

func (*InMemoryBackend) ListCodeSecurityScanConfigurations 

func (b *InMemoryBackend) ListCodeSecurityScanConfigurations() ([]*CodeSecurityScanConfiguration, error)

ListCodeSecurityScanConfigurations returns all code security scan configurations.

func (*InMemoryBackend) ListConnectorScanConfigurations added in v1.2.0 

func (b *InMemoryBackend) ListConnectorScanConfigurations(
	awsConfigConnectorArns []string, maxResults int32, nextToken string,
) ([]*ConnectorScanConfigurationItem, string, error)

ListConnectorScanConfigurations lists scan configurations that have been explicitly set via UpdateConnectorScanConfiguration, optionally narrowed to specific AWS Config connector ARNs. There is no CreateConnectorScanConfiguration operation in the real API, so a connector with no prior Update call simply has no entry here (not a zero-value one). Pagination follows ListConnectors' precedent, cursored on AwsConfigConnectorArn; real ListConnectorScanConfigurationsInput documents maxResults' valid range as 1-50, matching defaultConnectorScanConfigsPageSize.

func (*InMemoryBackend) ListConnectors added in v1.2.0 

func (b *InMemoryBackend) ListConnectors(
	providers, connectorArns, awsConfigConnectorArns []string,
	maxResults int32, nextToken string,
) ([]*Connector, string, error)

ListConnectors lists connectors, optionally narrowed by provider, connector ARN, and/or AWS Config connector ARN -- the three ConnectorFilterCriteria facets this backend supports (see this file's package-level gaps note in PARITY.md for the ones it doesn't: accounts, meaningless in this single-account emulator, and connectorType, which has no corresponding field on the real Connector response shape to filter against at all). Matches are OR'd within a facet and AND'd across facets; every filter's real Comparison enum has exactly one value (EQUALS), so there is no other comparison semantic to emulate. Pagination uses the connector ARN as a stable cursor over the sorted result set, following ListFindings' precedent.

func (*InMemoryBackend) ListCoverage 

func (b *InMemoryBackend) ListCoverage(
	criteria map[string]any, maxResults int32, nextToken string,
) ([]*CoverageEntry, string, error)

ListCoverage returns a page of seeded coverage entries filtered by the supplied filterCriteria (accountId/resourceId/resourceType/scanType). Pagination uses the composite resourceId/scanType key as a stable cursor, mirroring ListFindings.

func (*InMemoryBackend) ListCoverageStatistics 

func (b *InMemoryBackend) ListCoverageStatistics(criteria map[string]any, groupBy string) (map[string]any, error)

ListCoverageStatistics returns real aggregate counts over seeded coverage entries. When groupBy is empty (as real AWS allows), it returns only the overall totalCounts with no per-group breakdown; otherwise countsByGroup buckets by the requested GroupKey.

func (*InMemoryBackend) ListDelegatedAdminAccounts 

func (b *InMemoryBackend) ListDelegatedAdminAccounts() ([]*DelegatedAdminAccount, error)

ListDelegatedAdminAccounts returns all delegated admin accounts.

func (*InMemoryBackend) ListFilters 

func (b *InMemoryBackend) ListFilters(arns []string, action string) ([]*Filter, error)

ListFilters returns all filters, optionally filtered by ARNs and action.

func (*InMemoryBackend) ListFindingAggregations 

func (b *InMemoryBackend) ListFindingAggregations(aggregationType string, _ map[string]any) (map[string]any, error)

ListFindingAggregations returns aggregated finding counts. When findings have been seeded it reports the real per-account severity breakdown; otherwise it returns an empty responses list (matching the prior empty-stub contract).

func (*InMemoryBackend) ListFindings 

func (b *InMemoryBackend) ListFindings(
	maxResults int32, nextToken string, criteria map[string]any,
) ([]*Finding, string, error)

ListFindings returns a page of seeded findings filtered by the supplied filterCriteria. With no seeded findings it returns an empty page (preserving the prior always-empty contract for callers that never seed). Pagination uses the finding ARN as a stable cursor over the sorted result set.

func (*InMemoryBackend) ListMembers 

func (b *InMemoryBackend) ListMembers(onlyAssociated bool) ([]*Member, error)

ListMembers returns all member accounts, optionally only associated ones.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns all tags for a resource.

func (*InMemoryBackend) ListUsageTotals 

func (b *InMemoryBackend) ListUsageTotals(accountIDs []string) ([]map[string]any, error)

ListUsageTotals returns real per-account usage, derived from which resource types are enabled and how many covered resources of each scan type have been seeded (see SeedCoverage) -- replacing the prior hardwired-empty-usage stub. accountIDs defaults to the backend's own account when empty, matching real AWS (an empty request means "my account").

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the backend region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) ResetEncryptionKey 

func (b *InMemoryBackend) ResetEncryptionKey(resourceType, scanType string) error

ResetEncryptionKey resets the encryption key to the AWS-managed default.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes the backend state.

func (*InMemoryBackend) SearchVulnerabilities 

func (b *InMemoryBackend) SearchVulnerabilities(
	filterCriteria map[string]any, nextToken string,
) ([]*Vulnerability, string, error)

SearchVulnerabilities looks up seeded vulnerabilities by ID. Real SearchVulnerabilitiesFilterCriteria.VulnerabilityIds is a required exact-ID lookup list (not a free-text query), so this returns exactly the seeded vulnerabilities whose ID was requested, in requested order, silently omitting any ID with no seeded match (matching real AWS's behavior for an unknown vulnerability ID: it is simply absent from the response, not an error).

func (*InMemoryBackend) SeedCodeSnippet added in v1.2.0 

func (b *InMemoryBackend) SeedCodeSnippet(findingARN string, lines []CodeLine, fixes []SuggestedFix) error

SeedCodeSnippet attaches code snippet content to a finding ARN so BatchGetCodeSnippet can return it, mirroring the SeedFinding/SeedCoverage/ SeedVulnerability additive-capability precedent: gopherstack has no static analysis engine to derive real snippet content.

func (*InMemoryBackend) SeedCoverage added in v1.2.0 

func (b *InMemoryBackend) SeedCoverage(e CoverageEntry) (*CoverageEntry, error)

SeedCoverage injects a coverage entry into the backend so ListCoverage/ ListCoverageStatistics return realistic data, mirroring the SeedFinding precedent: real AWS populates coverage automatically as resources are scanned, which gopherstack has no scanning engine to emulate, so this is the additive capability that lets tests/fixtures/the dashboard populate it directly instead of ListCoverage being permanently hardwired empty.

func (*InMemoryBackend) SeedFinding 

func (b *InMemoryBackend) SeedFinding(f Finding) (*Finding, error)

SeedFinding injects a finding into the backend so ListFindings/aggregations return realistic data. Unset fields are defaulted to AWS-plausible values. It returns the stored finding (with a generated ARN when none was supplied).

This is the additive capability that lets gopherstack exceed LocalStack, whose Inspector2 ListFindings is hardwired to return an empty set.

func (*InMemoryBackend) SeedVulnerability added in v1.2.0 

func (b *InMemoryBackend) SeedVulnerability(v Vulnerability) (*Vulnerability, error)

SeedVulnerability injects a vulnerability into the backend so SearchVulnerabilities can look it up by ID, mirroring SeedFinding: real SearchVulnerabilities queries AWS's own global vulnerability intelligence database (CVE/NVD-derived), which gopherstack has no equivalent data source for, so this is the additive capability that lets tests/fixtures populate specific vulnerability IDs instead of the op being permanently hardwired empty.

func (*InMemoryBackend) SendCisSessionHealth 

func (b *InMemoryBackend) SendCisSessionHealth(_ string) error

SendCisSessionHealth acknowledges CIS session health.

func (*InMemoryBackend) SendCisSessionTelemetry 

func (b *InMemoryBackend) SendCisSessionTelemetry(_ string, _ map[string]any) error

SendCisSessionTelemetry records CIS session telemetry (no-op in memory).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes the backend state. It implements persistence.Persistable via Handler.Snapshot (see below).

func (*InMemoryBackend) StartCisSession 

func (b *InMemoryBackend) StartCisSession(scanJobID, sessionToken string) (*CisSession, error)

StartCisSession starts a new CIS scan session.

func (*InMemoryBackend) StartCodeSecurityScan 

func (b *InMemoryBackend) StartCodeSecurityScan(resourceID string) (map[string]any, error)

StartCodeSecurityScan starts a code security scan.

func (*InMemoryBackend) StopCisSession 

func (b *InMemoryBackend) StopCisSession(scanJobID string) error

StopCisSession stops a CIS scan session.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource adds or replaces tags on a resource.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource.

func (*InMemoryBackend) UpdateCisScanConfiguration 

func (b *InMemoryBackend) UpdateCisScanConfiguration(
	configARN string,
	name string,
	schedule map[string]any,
	targets map[string]any,
) (*CisScanConfiguration, error)

UpdateCisScanConfiguration updates a CIS scan configuration.

func (*InMemoryBackend) UpdateCodeSecurityIntegration 

func (b *InMemoryBackend) UpdateCodeSecurityIntegration(
	integrationARN string,
	details map[string]any,
) (*CodeSecurityIntegration, error)

UpdateCodeSecurityIntegration updates a code security integration.

func (*InMemoryBackend) UpdateCodeSecurityScanConfiguration 

func (b *InMemoryBackend) UpdateCodeSecurityScanConfiguration(
	scanConfigARN string,
	ruleSetCategories []string,
	continuousIntegrationScanConfig map[string]any,
	periodicConfig map[string]any,
) (*CodeSecurityScanConfiguration, error)

UpdateCodeSecurityScanConfiguration updates a code security scan configuration. Real UpdateCodeSecurityScanConfigurationInput only carries "configuration" (ruleSetCategories/periodicScanConfiguration/ continuousIntegrationScanConfiguration) and "scanConfigurationArn" -- level, scopeSettings, and name are set at creation and are not update targets.

func (*InMemoryBackend) UpdateConfiguration 

func (b *InMemoryBackend) UpdateConfiguration(ec2ScanMode, ecrRescanDuration string) error

UpdateConfiguration updates the scan configuration.

func (*InMemoryBackend) UpdateConnector added in v1.2.0 

func (b *InMemoryBackend) UpdateConnector(
	connectorArn string,
	description *string,
	azureRegions []string,
	autoInstallVMScanner *bool,
	scopeConfig *ConnectorScopeConfiguration,
) (*Connector, error)

UpdateConnector updates an existing connector's description and/or Azure provider detail. Real UpdateConnectorOutput echoes only the connector's ARN (confirmed via api_op_UpdateConnector.go). description is nil when the caller omitted the field (real UpdateConnectorInput.Description is *string); a non-nil empty string is a valid explicit clear, matching the pointer-optionality of the real request shape. azureRegions/ autoInstallVMScanner/scopeConfig replace the corresponding stored value only when the caller supplies them, matching AzureProviderDetailUpdate's all-optional members. EnablementStatus moves to PENDING_UPDATE, mirroring that a real update triggers Amazon Inspector to revalidate the new configuration -- and, like Create, this backend never auto-advances it back to ENABLED (see CreateConnector's doc comment for why).

func (*InMemoryBackend) UpdateConnectorScanConfiguration added in v1.2.0 

func (b *InMemoryBackend) UpdateConnectorScanConfiguration(
	awsConfigConnectorArn string, containerImageScanning *ConnectorContainerImageScanConfig,
) error

UpdateConnectorScanConfiguration sets the scan configuration applied to resources discovered through every connector sharing awsConfigConnectorArn. There is no standalone "AWS Config connector" resource in Inspector2 to validate an unrecognized awsConfigConnectorArn against, so this backend requires at least one existing Connector carrying that AwsConfigConnectorArn, returning ErrConnectorScanConfigNotFound (ResourceNotFoundException) otherwise -- an arbitrary/unknown ARN is rejected rather than silently accepted, per this campaign's requirement that scan-config updates validate the connector actually exists.

func (*InMemoryBackend) UpdateEc2DeepInspectionConfiguration 

func (b *InMemoryBackend) UpdateEc2DeepInspectionConfiguration(paths []string) error

UpdateEc2DeepInspectionConfiguration updates EC2 deep inspection config.

func (*InMemoryBackend) UpdateEncryptionKey 

func (b *InMemoryBackend) UpdateEncryptionKey(kmsKeyID, resourceType, scanType string) error

UpdateEncryptionKey sets a customer-managed KMS key for the given resource and scan type.

func (*InMemoryBackend) UpdateFilter 

func (b *InMemoryBackend) UpdateFilter(
	filterARN, action, description, reason string,
	criteria map[string]any,
) (*Filter, error)

UpdateFilter updates an existing filter.

func (*InMemoryBackend) UpdateOrgEc2DeepInspectionConfiguration 

func (b *InMemoryBackend) UpdateOrgEc2DeepInspectionConfiguration(paths []string) error

UpdateOrgEc2DeepInspectionConfiguration updates org-level EC2 deep inspection config.

func (*InMemoryBackend) UpdateOrganizationConfiguration 

func (b *InMemoryBackend) UpdateOrganizationConfiguration(cfg OrgConfiguration) error

UpdateOrganizationConfiguration updates org-level Inspector2 configuration.

type Member 

type Member struct {
	UpdatedAt               time.Time `json:"updatedAt"`
	AccountID               string    `json:"accountId"`
	DelegatedAdminAccountID string    `json:"delegatedAdminAccountId"`
	Email                   string    `json:"email"`
	RelationshipStatus      string    `json:"relationshipStatus"`
}

Member represents an Inspector2 member account.

type MemberEc2DeepInspectionStatus 

type MemberEc2DeepInspectionStatus struct {
	AccountID    string   `json:"accountId"`
	Status       string   `json:"status"`
	ErrorMessage string   `json:"errorMessage,omitempty"`
	PackagePaths []string `json:"packagePaths"`
}

MemberEc2DeepInspectionStatus holds EC2 deep inspection status for a member.

type OrgConfiguration 

type OrgConfiguration struct {
	AutoEnable             bool `json:"autoEnable"`
	MaxAccountLimitReached bool `json:"maxAccountLimitReached"`
}

OrgConfiguration holds organization-level Inspector2 settings.

type OrgEc2DeepInspectionConfig 

type OrgEc2DeepInspectionConfig struct {
	CustomPaths []string `json:"orgPackagePaths"`
}

OrgEc2DeepInspectionConfig holds org-level EC2 deep inspection settings.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon Inspector2.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Inspector2 service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type SbomExport 

type SbomExport struct {
	CreatedAt      time.Time      `json:"createdAt"`
	Destination    map[string]any `json:"s3Destination,omitempty"`
	FilterCriteria map[string]any `json:"filterCriteria,omitempty"`
	ReportID       string         `json:"reportId"`
	Format         string         `json:"format,omitempty"`
	Status         string         `json:"status"`
	ErrorCode      string         `json:"errorCode,omitempty"`
	ErrorMessage   string         `json:"errorMessage,omitempty"`
}

SbomExport represents an async SBOM export job. Real GetSbomExportOutput wire keys: errorCode/errorMessage/filterCriteria/format/reportId/ s3Destination/status (no createdAt member; see FindingsReport's doc comment).

type StorageBackend 

type StorageBackend interface {
	Enable(resourceTypes []string) error
	Disable(resourceTypes []string) error
	IsEnabled() bool
	GetStatus() *AccountStatusResponse

	CreateFilter(
		name, action, description, reason string,
		criteria map[string]any,
		tags map[string]string,
	) (*Filter, error)
	UpdateFilter(arn, action, description, reason string, criteria map[string]any) (*Filter, error)
	DeleteFilter(arn string) error
	ListFilters(arns []string, action string) ([]*Filter, error)

	ListFindings(maxResults int32, nextToken string, filterCriteria map[string]any) ([]*Finding, string, error)
	SeedFinding(f Finding) (*Finding, error)
	FindingSeverityCounts() map[string]int64
	AddFinding(findingType, severityLabel, status, title, description string, resources []FindingResource) string

	GetConfiguration() *Configuration
	UpdateConfiguration(ec2ScanMode, ecrRescanDuration string) error

	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)

	// Member operations
	AssociateMember(accountID string) error
	DisassociateMember(accountID string) error
	GetMember(accountID string) (*Member, error)
	ListMembers(onlyAssociated bool) ([]*Member, error)

	// Delegated admin operations
	EnableDelegatedAdminAccount(accountID string) error
	DisableDelegatedAdminAccount(accountID string) error
	GetDelegatedAdminAccount() (*DelegatedAdminAccount, error)
	ListDelegatedAdminAccounts() ([]*DelegatedAdminAccount, error)

	// Organization configuration
	DescribeOrganizationConfiguration() OrgConfiguration
	UpdateOrganizationConfiguration(cfg OrgConfiguration) error

	// EC2 deep inspection
	GetEc2DeepInspectionConfiguration() Ec2DeepInspectionConfig
	UpdateEc2DeepInspectionConfiguration(paths []string) error
	UpdateOrgEc2DeepInspectionConfiguration(paths []string) error
	BatchGetMemberEc2DeepInspectionStatus(accountIDs []string) []*MemberEc2DeepInspectionStatus
	BatchUpdateMemberEc2DeepInspectionStatus(updates []*MemberEc2DeepInspectionStatus) []*MemberEc2DeepInspectionStatus

	// Encryption key operations
	GetEncryptionKey(resourceType, scanType string) (*EncryptionKey, error)
	ResetEncryptionKey(resourceType, scanType string) error
	UpdateEncryptionKey(kmsKeyID, resourceType, scanType string) error

	// CIS scan configuration
	CreateCisScanConfiguration(
		name string,
		schedule map[string]any,
		targets map[string]any,
		tags map[string]string,
	) (*CisScanConfiguration, error)
	DeleteCisScanConfiguration(configARN string) error
	UpdateCisScanConfiguration(
		configARN string,
		name string,
		schedule map[string]any,
		targets map[string]any,
	) (*CisScanConfiguration, error)
	ListCisScanConfigurations() ([]*CisScanConfiguration, error)

	// CIS session operations
	StartCisSession(scanJobID, sessionToken string) (*CisSession, error)
	StopCisSession(scanJobID string) error
	SendCisSessionHealth(scanJobID string) error
	SendCisSessionTelemetry(scanJobID string, messages map[string]any) error
	GetCisScanReport(scanJobID string) (map[string]any, error)
	GetCisScanResultDetails(scanJobID string) (map[string]any, error)
	ListCisScans() ([]map[string]any, error)
	ListCisScanResultsAggregatedByChecks(scanJobID string) ([]map[string]any, error)
	ListCisScanResultsAggregatedByTargetResource(scanJobID string) ([]map[string]any, error)

	// Code security integration
	CreateCodeSecurityIntegration(
		name, integType string,
		tags map[string]string,
		details map[string]any,
	) (*CodeSecurityIntegration, error)
	DeleteCodeSecurityIntegration(integrationARN string) error
	GetCodeSecurityIntegration(integrationARN string) (*CodeSecurityIntegration, error)
	UpdateCodeSecurityIntegration(integrationARN string, details map[string]any) (*CodeSecurityIntegration, error)
	ListCodeSecurityIntegrations() ([]*CodeSecurityIntegration, error)

	// Code security scan configuration
	CreateCodeSecurityScanConfiguration(
		name, level string,
		ruleSetCategories []string,
		continuousIntegrationScanConfig map[string]any,
		periodicConfig map[string]any,
		scopeSettings map[string]any,
		tags map[string]string,
	) (*CodeSecurityScanConfiguration, error)
	DeleteCodeSecurityScanConfiguration(scanConfigARN string) error
	GetCodeSecurityScanConfiguration(scanConfigARN string) (*CodeSecurityScanConfiguration, error)
	UpdateCodeSecurityScanConfiguration(
		scanConfigARN string,
		ruleSetCategories []string,
		continuousIntegrationScanConfig map[string]any,
		periodicConfig map[string]any,
	) (*CodeSecurityScanConfiguration, error)
	ListCodeSecurityScanConfigurations() ([]*CodeSecurityScanConfiguration, error)
	BatchAssociateCodeSecurityScanConfiguration(scanConfigARN string, resources []string) ([]map[string]any, error)
	BatchDisassociateCodeSecurityScanConfiguration(scanConfigARN string, resources []string) ([]map[string]any, error)
	ListCodeSecurityScanConfigurationAssociations(
		scanConfigARN string,
	) ([]*CodeSecurityScanConfigurationAssociation, error)
	StartCodeSecurityScan(resourceID string) (map[string]any, error)
	GetCodeSecurityScan(scanID string) (map[string]any, error)

	// Findings report
	CreateFindingsReport(destination, filterCriteria map[string]any, reportFormat string) (*FindingsReport, error)
	CancelFindingsReport(reportID string) error
	GetFindingsReportStatus(reportID string) (*FindingsReport, error)

	// SBOM export
	CreateSbomExport(destination, filterCriteria map[string]any, format string) (*SbomExport, error)
	CancelSbomExport(reportID string) error
	GetSbomExport(reportID string) (*SbomExport, error)

	// Coverage
	ListCoverage(filters map[string]any, maxResults int32, nextToken string) ([]*CoverageEntry, string, error)
	ListCoverageStatistics(filters map[string]any, groupBy string) (map[string]any, error)
	SeedCoverage(e CoverageEntry) (*CoverageEntry, error)

	// Finding aggregations / usage
	ListFindingAggregations(aggregationType string, filters map[string]any) (map[string]any, error)
	ListUsageTotals(accountIDs []string) ([]map[string]any, error)
	ListAccountPermissions(service string) ([]*AccountPermission, error)
	SearchVulnerabilities(filterCriteria map[string]any, nextToken string) ([]*Vulnerability, string, error)
	SeedVulnerability(v Vulnerability) (*Vulnerability, error)

	// Connectors
	CreateConnector(
		name, description, provider string,
		tags map[string]string,
		awsConfigConnectorArn string,
		azureRegions []string,
		autoInstallVMScanner *bool,
		scopeConfig *ConnectorScopeConfiguration,
	) (*Connector, error)
	UpdateConnector(
		connectorArn string,
		description *string,
		azureRegions []string,
		autoInstallVMScanner *bool,
		scopeConfig *ConnectorScopeConfiguration,
	) (*Connector, error)
	DeleteConnector(connectorArn string) error
	ListConnectors(
		providers, connectorArns, awsConfigConnectorArns []string,
		maxResults int32,
		nextToken string,
	) ([]*Connector, string, error)
	ListConnectorScanConfigurations(
		awsConfigConnectorArns []string,
		maxResults int32,
		nextToken string,
	) ([]*ConnectorScanConfigurationItem, string, error)
	UpdateConnectorScanConfiguration(
		awsConfigConnectorArn string,
		containerImageScanning *ConnectorContainerImageScanConfig,
	) error

	// Batch / misc
	BatchGetCodeSnippet(findingARNs []string) (map[string]any, error)
	BatchGetFindingDetails(findingARNs []string) (map[string]any, error)
	BatchGetFreeTrialInfo(accountIDs []string) (map[string]any, error)
	GetClustersForImage(resourceID string) (map[string]any, error)
	SeedCodeSnippet(findingARN string, lines []CodeLine, fixes []SuggestedFix) error

	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for Inspector2 storage operations.

type SuggestedFix added in v1.2.0 

type SuggestedFix struct {
	Code        string `json:"code,omitempty"`
	Description string `json:"description,omitempty"`
}

SuggestedFix is a suggested remediation for a code vulnerability finding (real SuggestedFix shape).

type Vulnerability 

type Vulnerability struct {
	VendorCreatedAt        time.Time `json:"vendorCreatedAt"`
	VendorUpdatedAt        time.Time `json:"vendorUpdatedAt"`
	ID                     string    `json:"id"`
	Description            string    `json:"description,omitempty"`
	Source                 string    `json:"source,omitempty"`
	SourceURL              string    `json:"sourceUrl,omitempty"`
	VendorSeverity         string    `json:"vendorSeverity,omitempty"`
	Cwes                   []string  `json:"cwes,omitempty"`
	ReferenceUrls          []string  `json:"referenceUrls,omitempty"`
	RelatedVulnerabilities []string  `json:"relatedVulnerabilities,omitempty"`
}

Vulnerability represents a known vulnerability, matching the real Vulnerability shape's field names (wire key "id", not "vulnerabilityId"; "vendorSeverity", not the gopherstack-invented "severity"). Only the scalar/list fields are modeled -- the nested AtigData/CisaData/Cvss*/Epss/ ExploitObserved objects are real but omitted here (an omitted optional field is unset on the wire, not wire-breaking, unlike a wrong key name). Seeded via SeedVulnerability, following the same additive-capability precedent as Finding's SeedFinding: SearchVulnerabilities queries AWS's own global vulnerability intelligence database in real Inspector2, which gopherstack has no equivalent data source for.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.