Help us shape the future of Go! Take the 2026 Go Developer Survey

security

package
v1.233.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: Apache-2.0 Imports: 38 Imported by: 0

Documentation

Overview

Package security is a generated GoMock package.

Index

Constants

View Source 
const MaxFindingsForLookup = 500

MaxFindingsForLookup is the default max findings when looking up a specific finding by ID.

Variables

This section is empty.

Functions

func NewFindingsCache 

func NewFindingsCache(opts ...FindingsCacheOption) *findingsCache

NewFindingsCache creates a new findings cache with the given options.

Types

type AWSSecurityTagMapping 

type AWSSecurityTagMapping = schema.AWSSecurityTagMapping

AWSSecurityTagMapping is re-exported from schema for use in reports.

type ArtifactLocation added in v1.220.0 

type ArtifactLocation struct {
	URI       string `json:"uri,omitempty"`
	URIBaseID string `json:"uriBaseId,omitempty"`
}

ArtifactLocation is a URI reference for a file in the repository.

type CVSSScore added in v1.220.0 

type CVSSScore struct {
	BaseScore float64 `json:"base_score,omitempty" yaml:"base_score,omitempty"`
	Vector    string  `json:"vector,omitempty" yaml:"vector,omitempty"`
	Source    string  `json:"source,omitempty" yaml:"source,omitempty"`
	Version   string  `json:"version,omitempty" yaml:"version,omitempty"`
}

CVSSScore captures source CVSS score details.

type CodeChange 

type CodeChange struct {
	FilePath string `json:"file_path" yaml:"file_path"`
	Line     int    `json:"line,omitempty" yaml:"line,omitempty"`
	Before   string `json:"before" yaml:"before"`
	After    string `json:"after" yaml:"after"`
}

CodeChange represents a specific code change in a Terraform file.

type ComplianceControl 

type ComplianceControl struct {
	ControlID   string       `json:"control_id" yaml:"control_id"`
	Title       string       `json:"title" yaml:"title"`
	Severity    Severity     `json:"severity" yaml:"severity"`
	Component   string       `json:"component,omitempty" yaml:"component,omitempty"`
	Stack       string       `json:"stack,omitempty" yaml:"stack,omitempty"`
	Remediation *Remediation `json:"remediation,omitempty" yaml:"remediation,omitempty"`
}

ComplianceControl represents a single compliance control and its status.

type ComplianceReport 

type ComplianceReport struct {
	GeneratedAt     time.Time           `json:"generated_at" yaml:"generated_at"`
	Stack           string              `json:"stack,omitempty" yaml:"stack,omitempty"`
	Framework       string              `json:"framework" yaml:"framework"`
	FrameworkTitle  string              `json:"framework_title" yaml:"framework_title"`
	TotalControls   int                 `json:"total_controls" yaml:"total_controls"`
	PassingControls int                 `json:"passing_controls" yaml:"passing_controls"`
	FailingControls int                 `json:"failing_controls" yaml:"failing_controls"`
	ScorePercent    float64             `json:"score_percent" yaml:"score_percent"`
	FailingDetails  []ComplianceControl `json:"failing_details" yaml:"failing_details"`
}

ComplianceReport represents a compliance posture report for a specific framework.

type ComplianceStandard added in v1.220.0 

type ComplianceStandard struct {
	ID      string `json:"id,omitempty" yaml:"id,omitempty"`
	Name    string `json:"name,omitempty" yaml:"name,omitempty"`
	Version string `json:"version,omitempty" yaml:"version,omitempty"`
}

ComplianceStandard captures a source framework/control reference.

type ComponentMapper 

type ComponentMapper interface {
	// MapFinding attempts to map a finding's resource to an Atmos component/stack.
	// It tries Path A (tag-based) first, then falls back to Path B (heuristic pipeline).
	MapFinding(ctx context.Context, finding *Finding) (*ComponentMapping, error)

	// MapFindings maps multiple findings in batch, optimizing for shared lookups.
	MapFindings(ctx context.Context, findings []Finding) ([]Finding, error)
}

ComponentMapper maps AWS resources from security findings to Atmos components and stacks.

func NewComponentMapper 

func NewComponentMapper(atmosConfig *schema.AtmosConfiguration, authCtx *schema.AWSAuthContext) ComponentMapper

NewComponentMapper creates a ComponentMapper that uses both tag-based and heuristic strategies. If authCtx is non-nil, AWS clients will use Atmos Auth credentials.

type ComponentMapping 

type ComponentMapping struct {
	Stack         string            `json:"stack" yaml:"stack"`
	Component     string            `json:"component" yaml:"component"`
	ComponentPath string            `json:"component_path" yaml:"component_path"`
	Workspace     string            `json:"workspace,omitempty" yaml:"workspace,omitempty"`
	Mapped        bool              `json:"mapped" yaml:"mapped"`
	Confidence    MappingConfidence `json:"confidence" yaml:"confidence"`
	Method        string            `json:"method" yaml:"method"` // How the mapping was determined (e.g., "tag", "state", "naming", "ai").
}

ComponentMapping represents the resolved mapping from a finding to an Atmos component/stack.

type Driver added in v1.220.0 

type Driver struct {
	Name            string `json:"name"`
	Version         string `json:"version,omitempty"`
	SemanticVersion string `json:"semanticVersion,omitempty"`
	InformationURI  string `json:"informationUri,omitempty"`
	Rules           []Rule `json:"rules,omitempty"`
}

Driver is the primary analysis tool.

type Finding 

type Finding struct {
	ID                  string                `json:"id" yaml:"id"`
	Title               string                `json:"title" yaml:"title"`
	Description         string                `json:"description" yaml:"description"`
	Severity            Severity              `json:"severity" yaml:"severity"`
	Source              Source                `json:"source" yaml:"source"`
	SourceSeverity      *SourceSeverity       `json:"source_severity,omitempty" yaml:"source_severity,omitempty"`
	SourceLifecycle     *SourceLifecycle      `json:"source_lifecycle,omitempty" yaml:"source_lifecycle,omitempty"`
	SourceTimestamps    *SourceTimestamps     `json:"source_timestamps,omitempty" yaml:"source_timestamps,omitempty"`
	SourceRemediation   *SourceRemediation    `json:"source_remediation,omitempty" yaml:"source_remediation,omitempty"`
	SourceURL           string                `json:"source_url,omitempty" yaml:"source_url,omitempty"`
	ComplianceStandard  string                `json:"compliance_standard,omitempty" yaml:"compliance_standard,omitempty"`
	ComplianceStandards []ComplianceStandard  `json:"compliance_standards,omitempty" yaml:"compliance_standards,omitempty"`
	SecurityControlID   string                `json:"security_control_id,omitempty" yaml:"security_control_id,omitempty"` // Per-control ID (e.g., "EC2.18") for compliance deduplication.
	ResourceARN         string                `json:"resource_arn" yaml:"resource_arn"`
	ResourceType        string                `json:"resource_type" yaml:"resource_type"`
	ResourceTags        map[string]string     `json:"resource_tags,omitempty" yaml:"resource_tags,omitempty"` // Tags from the Security Hub finding (no extra API call needed).
	AccountID           string                `json:"account_id" yaml:"account_id"`
	Region              string                `json:"region" yaml:"region"`
	CreatedAt           time.Time             `json:"created_at" yaml:"created_at"`
	UpdatedAt           time.Time             `json:"updated_at" yaml:"updated_at"`
	Vulnerability       *VulnerabilityDetails `json:"vulnerability,omitempty" yaml:"vulnerability,omitempty"`
	Mapping             *ComponentMapping     `json:"mapping,omitempty" yaml:"mapping,omitempty"`
	Remediation         *Remediation          `json:"remediation,omitempty" yaml:"remediation,omitempty"`
}

Finding represents a normalized security finding from any AWS security service.

type FindingAnalyzer 

type FindingAnalyzer interface {
	// AnalyzeFinding analyzes a single finding with component context.
	AnalyzeFinding(ctx context.Context, finding *Finding, componentSource string, stackConfig string) (*Remediation, error)

	// AnalyzeFindings analyzes multiple findings in batch, grouping by component.
	AnalyzeFindings(ctx context.Context, findings []Finding) ([]Finding, error)
}

FindingAnalyzer provides AI-powered analysis of security findings.

func NewFindingAnalyzer 

func NewFindingAnalyzer(ctx context.Context, atmosConfig *schema.AtmosConfiguration, toolRegistry *tools.Registry, toolExecutor *tools.Executor) (FindingAnalyzer, error)

NewFindingAnalyzer creates a FindingAnalyzer backed by the configured AI provider. If toolRegistry and toolExecutor are provided, API providers use multi-turn tool analysis. CLI providers always fall back to single-prompt mode with pre-fetched context.

type FindingFetcher 

type FindingFetcher interface {
	// FetchFindings retrieves findings matching the given options.
	FetchFindings(ctx context.Context, opts *QueryOptions) ([]Finding, error)

	// FetchComplianceStatus retrieves compliance status for a specific framework.
	FetchComplianceStatus(ctx context.Context, framework string, stack string) (*ComplianceReport, error)
}

FindingFetcher retrieves security findings from AWS security services.

func NewFindingFetcher 

func NewFindingFetcher(atmosConfig *schema.AtmosConfiguration, authCtx *schema.AWSAuthContext) FindingFetcher

NewFindingFetcher creates a FindingFetcher based on the configured security sources. If authCtx is non-nil, AWS clients will use Atmos Auth credentials.

type FindingsCacheOption 

type FindingsCacheOption func(*findingsCache)

FindingsCacheOption is a functional option for configuring the findings cache.

func WithCacheTTL 

func WithCacheTTL(ttl time.Duration) FindingsCacheOption

WithCacheTTL sets a custom TTL for cache entries.

type Inspector2API added in v1.220.0 

type Inspector2API interface {
	ListFindings(ctx context.Context, params *inspector2.ListFindingsInput, optFns ...func(*inspector2.Options)) (*inspector2.ListFindingsOutput, error)
}

Inspector2API defines the subset of Amazon Inspector2 API used by this package.

type Invocation added in v1.220.0 

type Invocation struct {
	CommandLine         string            `json:"commandLine,omitempty"`
	Arguments           []string          `json:"arguments,omitempty"`
	StartTimeUTC        string            `json:"startTimeUtc,omitempty"`
	EndTimeUTC          string            `json:"endTimeUtc,omitempty"`
	ExitCode            int               `json:"exitCode"`
	ExitCodeDescription string            `json:"exitCodeDescription,omitempty"`
	WorkingDirectory    *ArtifactLocation `json:"workingDirectory,omitempty"`
	ExecutionSuccessful bool              `json:"executionSuccessful"`
	Properties          map[string]any    `json:"properties,omitempty"`
}

Invocation records how the CLI was executed for audit evidence.

type Location added in v1.220.0 

type Location struct {
	PhysicalLocation *PhysicalLocation `json:"physicalLocation,omitempty"`
	LogicalLocations []LogicalLocation `json:"logicalLocations,omitempty"`
	Message          *MultiformatText  `json:"message,omitempty"`
}

Location identifies where a result occurred.

type LogicalLocation added in v1.220.0 

type LogicalLocation struct {
	Name               string `json:"name,omitempty"`
	FullyQualifiedName string `json:"fullyQualifiedName,omitempty"`
	Kind               string `json:"kind,omitempty"`
}

LogicalLocation references a non-file entity (e.g., an AWS resource ARN).

type MappingConfidence 

type MappingConfidence string

MappingConfidence represents how confident the finding-to-code mapping is. 

const (
	ConfidenceExact  MappingConfidence = "exact"  // Tag-based (Path A).
	ConfidenceHigh   MappingConfidence = "high"   // Terraform state match.
	ConfidenceMedium MappingConfidence = "medium" // Naming convention match.
	ConfidenceLow    MappingConfidence = "low"    // Resource type + AI inference.
	ConfidenceNone   MappingConfidence = "none"   // No match found.
)

type MockInspector2API added in v1.220.0 

type MockInspector2API struct {
	// contains filtered or unexported fields
}

MockInspector2API is a mock of Inspector2API interface.

func NewMockInspector2API added in v1.220.0 

func NewMockInspector2API(ctrl *gomock.Controller) *MockInspector2API

NewMockInspector2API creates a new mock instance.

func (*MockInspector2API) EXPECT added in v1.220.0 

func (m *MockInspector2API) EXPECT() *MockInspector2APIMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockInspector2API) ListFindings added in v1.220.0 

func (m *MockInspector2API) ListFindings(ctx context.Context, params *inspector2.ListFindingsInput, optFns ...func(*inspector2.Options)) (*inspector2.ListFindingsOutput, error)

ListFindings mocks base method.

type MockInspector2APIMockRecorder added in v1.220.0 

type MockInspector2APIMockRecorder struct {
	// contains filtered or unexported fields
}

MockInspector2APIMockRecorder is the mock recorder for MockInspector2API.

func (*MockInspector2APIMockRecorder) ListFindings added in v1.220.0 

func (mr *MockInspector2APIMockRecorder) ListFindings(ctx, params any, optFns ...any) *gomock.Call

ListFindings indicates an expected call of ListFindings.

type MockOrganizationsAPI added in v1.220.0 

type MockOrganizationsAPI struct {
	// contains filtered or unexported fields
}

MockOrganizationsAPI is a mock of OrganizationsAPI interface.

func NewMockOrganizationsAPI added in v1.220.0 

func NewMockOrganizationsAPI(ctrl *gomock.Controller) *MockOrganizationsAPI

NewMockOrganizationsAPI creates a new mock instance.

func (*MockOrganizationsAPI) DescribeAccount added in v1.220.0 

func (m *MockOrganizationsAPI) DescribeAccount(ctx context.Context, params *organizations.DescribeAccountInput, optFns ...func(*organizations.Options)) (*organizations.DescribeAccountOutput, error)

DescribeAccount mocks base method.

func (*MockOrganizationsAPI) EXPECT added in v1.220.0 

func (m *MockOrganizationsAPI) EXPECT() *MockOrganizationsAPIMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

type MockOrganizationsAPIMockRecorder added in v1.220.0 

type MockOrganizationsAPIMockRecorder struct {
	// contains filtered or unexported fields
}

MockOrganizationsAPIMockRecorder is the mock recorder for MockOrganizationsAPI.

func (*MockOrganizationsAPIMockRecorder) DescribeAccount added in v1.220.0 

func (mr *MockOrganizationsAPIMockRecorder) DescribeAccount(ctx, params any, optFns ...any) *gomock.Call

DescribeAccount indicates an expected call of DescribeAccount.

type MockSecurityHubAPI added in v1.220.0 

type MockSecurityHubAPI struct {
	// contains filtered or unexported fields
}

MockSecurityHubAPI is a mock of SecurityHubAPI interface.

func NewMockSecurityHubAPI added in v1.220.0 

func NewMockSecurityHubAPI(ctrl *gomock.Controller) *MockSecurityHubAPI

NewMockSecurityHubAPI creates a new mock instance.

func (*MockSecurityHubAPI) EXPECT added in v1.220.0 

func (m *MockSecurityHubAPI) EXPECT() *MockSecurityHubAPIMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockSecurityHubAPI) GetEnabledStandards added in v1.220.0 

func (m *MockSecurityHubAPI) GetEnabledStandards(ctx context.Context, params *securityhub.GetEnabledStandardsInput, optFns ...func(*securityhub.Options)) (*securityhub.GetEnabledStandardsOutput, error)

GetEnabledStandards mocks base method.

func (*MockSecurityHubAPI) GetFindings added in v1.220.0 

func (m *MockSecurityHubAPI) GetFindings(ctx context.Context, params *securityhub.GetFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.GetFindingsOutput, error)

GetFindings mocks base method.

func (*MockSecurityHubAPI) ListSecurityControlDefinitions added in v1.220.0 

func (m *MockSecurityHubAPI) ListSecurityControlDefinitions(ctx context.Context, params *securityhub.ListSecurityControlDefinitionsInput, optFns ...func(*securityhub.Options)) (*securityhub.ListSecurityControlDefinitionsOutput, error)

ListSecurityControlDefinitions mocks base method.

type MockSecurityHubAPIMockRecorder added in v1.220.0 

type MockSecurityHubAPIMockRecorder struct {
	// contains filtered or unexported fields
}

MockSecurityHubAPIMockRecorder is the mock recorder for MockSecurityHubAPI.

func (*MockSecurityHubAPIMockRecorder) GetEnabledStandards added in v1.220.0 

func (mr *MockSecurityHubAPIMockRecorder) GetEnabledStandards(ctx, params any, optFns ...any) *gomock.Call

GetEnabledStandards indicates an expected call of GetEnabledStandards.

func (*MockSecurityHubAPIMockRecorder) GetFindings added in v1.220.0 

func (mr *MockSecurityHubAPIMockRecorder) GetFindings(ctx, params any, optFns ...any) *gomock.Call

GetFindings indicates an expected call of GetFindings.

func (*MockSecurityHubAPIMockRecorder) ListSecurityControlDefinitions added in v1.220.0 

func (mr *MockSecurityHubAPIMockRecorder) ListSecurityControlDefinitions(ctx, params any, optFns ...any) *gomock.Call

ListSecurityControlDefinitions indicates an expected call of ListSecurityControlDefinitions.

type MockTaggingAPI added in v1.220.0 

type MockTaggingAPI struct {
	// contains filtered or unexported fields
}

MockTaggingAPI is a mock of TaggingAPI interface.

func NewMockTaggingAPI added in v1.220.0 

func NewMockTaggingAPI(ctrl *gomock.Controller) *MockTaggingAPI

NewMockTaggingAPI creates a new mock instance.

func (*MockTaggingAPI) EXPECT added in v1.220.0 

func (m *MockTaggingAPI) EXPECT() *MockTaggingAPIMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockTaggingAPI) GetResources added in v1.220.0 

func (m *MockTaggingAPI) GetResources(ctx context.Context, params *resourcegroupstaggingapi.GetResourcesInput, optFns ...func(*resourcegroupstaggingapi.Options)) (*resourcegroupstaggingapi.GetResourcesOutput, error)

GetResources mocks base method.

type MockTaggingAPIMockRecorder added in v1.220.0 

type MockTaggingAPIMockRecorder struct {
	// contains filtered or unexported fields
}

MockTaggingAPIMockRecorder is the mock recorder for MockTaggingAPI.

func (*MockTaggingAPIMockRecorder) GetResources added in v1.220.0 

func (mr *MockTaggingAPIMockRecorder) GetResources(ctx, params any, optFns ...any) *gomock.Call

GetResources indicates an expected call of GetResources.

type MultiformatText added in v1.220.0 

type MultiformatText struct {
	Text     string `json:"text,omitempty"`
	Markdown string `json:"markdown,omitempty"`
}

MultiformatText is a SARIF message/description container.

type OCSFAccount added in v1.220.0 

type OCSFAccount struct {
	UID  string `json:"uid,omitempty"`
	Name string `json:"name,omitempty"`
}

OCSFAccount identifies a cloud account.

type OCSFAffectedPackage added in v1.220.0 

type OCSFAffectedPackage struct {
	Name           string `json:"name"`
	Version        string `json:"version"`
	FixedInVersion string `json:"fixed_in_version,omitempty"`
	PackageManager string `json:"package_manager,omitempty"`
	Path           string `json:"path,omitempty"`
	Remediation    string `json:"remediation,omitempty"`
}

OCSFAffectedPackage describes a vulnerable software package.

type OCSFCVE added in v1.220.0 

type OCSFCVE struct {
	UID        string     `json:"uid"`
	Desc       string     `json:"desc,omitempty"`
	Title      string     `json:"title,omitempty"`
	CWEUID     string     `json:"cwe_uid,omitempty"`
	CVSS       []OCSFCVSS `json:"cvss,omitempty"`
	EPSS       *OCSFEPSS  `json:"epss,omitempty"`
	References []string   `json:"references,omitempty"`
}

OCSFCVE captures CVE detail including CVSS scores and EPSS probability.

type OCSFCVSS added in v1.220.0 

type OCSFCVSS struct {
	BaseScore    float64 `json:"base_score"`
	Version      string  `json:"version"`
	VectorString string  `json:"vector_string,omitempty"`
}

OCSFCVSS is a single CVSS score.

type OCSFCWE added in v1.220.0 

type OCSFCWE struct {
	UID     string `json:"uid"`
	Caption string `json:"caption,omitempty"`
	SrcURL  string `json:"src_url,omitempty"`
}

OCSFCWE captures a CWE classification.

type OCSFCloud added in v1.220.0 

type OCSFCloud struct {
	Provider string       `json:"provider"`
	Region   string       `json:"region,omitempty"`
	Account  *OCSFAccount `json:"account,omitempty"`
}

OCSFCloud describes the cloud environment the finding originated in.

type OCSFEPSS added in v1.220.0 

type OCSFEPSS struct {
	Score string `json:"score"`
}

OCSFEPSS is the EPSS probability for a CVE. OCSF 1.4.0 schemas the score as a string (https://schema.ocsf.io/1.4.0/objects/epss); we honor the spec even though the value is a float, so we format on the way out.

type OCSFEnrichment added in v1.220.0 

type OCSFEnrichment struct {
	Name     string `json:"name"`
	Value    string `json:"value"`
	Data     any    `json:"data"`
	Type     string `json:"type,omitempty"`
	Provider string `json:"provider,omitempty"`
}

OCSFEnrichment is an Atmos extension carried under the OCSF enrichments[] array. The schema requires name, value, and data — we set data to the same (string-coerced) value, which keeps consumers that ignore data correct and gives structured consumers a useful payload.

type OCSFEvent added in v1.220.0 

type OCSFEvent struct {
	ActivityID      int              `json:"activity_id"`
	ActivityName    string           `json:"activity_name,omitempty"`
	CategoryUID     int              `json:"category_uid"`
	CategoryName    string           `json:"category_name,omitempty"`
	ClassUID        int              `json:"class_uid"`
	ClassName       string           `json:"class_name,omitempty"`
	TypeUID         int              `json:"type_uid"`
	TypeName        string           `json:"type_name,omitempty"`
	Severity        string           `json:"severity,omitempty"`
	SeverityID      int              `json:"severity_id"`
	Status          string           `json:"status,omitempty"`
	StatusID        int              `json:"status_id,omitempty"`
	StatusCode      string           `json:"status_code,omitempty"`
	StatusDetail    string           `json:"status_detail,omitempty"`
	Time            int64            `json:"time"`
	StartTime       int64            `json:"start_time,omitempty"`
	EndTime         int64            `json:"end_time,omitempty"`
	ModifiedTime    int64            `json:"modified_time,omitempty"`
	Metadata        OCSFMetadata     `json:"metadata"`
	FindingInfo     OCSFFindingInfo  `json:"finding_info"`
	Cloud           OCSFCloud        `json:"cloud"`
	Resources       []OCSFResource   `json:"resources,omitempty"`
	Vulnerabilities []OCSFVuln       `json:"vulnerabilities,omitempty"`
	Remediation     *OCSFRemediation `json:"remediation,omitempty"`
	Enrichments     []OCSFEnrichment `json:"enrichments,omitempty"`
	Unmapped        map[string]any   `json:"unmapped,omitempty"`
}

OCSFEvent is one top-level OCSF Detection Finding event.

func BuildOCSFEvents added in v1.220.0 

func BuildOCSFEvents(report *Report) []OCSFEvent

BuildOCSFEvents converts a security Report into OCSF 1.4.0 Detection Finding events. Findings are sorted with the same deterministic ordering SARIF uses so output is byte-stable for the same input report.

type OCSFFindingInfo added in v1.220.0 

type OCSFFindingInfo struct {
	UID        string         `json:"uid"`
	Title      string         `json:"title,omitempty"`
	Desc       string         `json:"desc,omitempty"`
	SrcURL     string         `json:"src_url,omitempty"`
	ProductUID string         `json:"product_uid,omitempty"`
	Types      []string       `json:"types,omitempty"`
	Tags       []OCSFKeyValue `json:"tags,omitempty"`
}

OCSFFindingInfo describes the finding itself. ProductUID identifies the upstream AWS service that detected the finding (security-hub, config, inspector, guardduty, macie, access-analyzer) — orthogonal to metadata.product which identifies atmos as the event producer.

type OCSFKeyValue added in v1.220.0 

type OCSFKeyValue struct {
	Name  string `json:"name"`
	Value string `json:"value,omitempty"`
}

OCSFKeyValue mirrors the OCSF key_value_object pattern used by tags.

type OCSFMetadata added in v1.220.0 

type OCSFMetadata struct {
	Version        string      `json:"version"`
	Product        OCSFProduct `json:"product"`
	CorrelationUID string      `json:"correlation_uid,omitempty"`
	Profiles       []string    `json:"profiles,omitempty"`
}

OCSFMetadata identifies the producer and the batch.

type OCSFProduct added in v1.220.0 

type OCSFProduct struct {
	Name       string `json:"name,omitempty"`
	VendorName string `json:"vendor_name,omitempty"`
	Version    string `json:"version,omitempty"`
	URLString  string `json:"url_string,omitempty"`
}

OCSFProduct identifies the tool that produced the finding.

type OCSFRemediation added in v1.220.0 

type OCSFRemediation struct {
	Desc       string   `json:"desc"`
	References []string `json:"references,omitempty"`
}

OCSFRemediation carries native remediation guidance.

type OCSFResource added in v1.220.0 

type OCSFResource struct {
	UID    string         `json:"uid,omitempty"`
	Type   string         `json:"type,omitempty"`
	Region string         `json:"region,omitempty"`
	Tags   []OCSFKeyValue `json:"tags,omitempty"`
	Labels []string       `json:"labels,omitempty"`
}

OCSFResource describes an affected resource.

type OCSFVuln added in v1.220.0 

type OCSFVuln struct {
	Desc             string                `json:"desc,omitempty"`
	Title            string                `json:"title,omitempty"`
	Severity         string                `json:"severity,omitempty"`
	IsFixAvailable   *bool                 `json:"is_fix_available,omitempty"`
	FixAvailable     *bool                 `json:"fix_available,omitempty"`
	CVE              *OCSFCVE              `json:"cve,omitempty"`
	CWE              *OCSFCWE              `json:"cwe,omitempty"`
	AffectedPackages []OCSFAffectedPackage `json:"affected_packages,omitempty"`
	References       []string              `json:"references,omitempty"`
}

OCSFVuln models the OCSF Vulnerability object. The OCSF schema requires exactly one of cve/cwe/advisory — we prefer cve when available, otherwise cwe, otherwise we omit the whole vulnerabilities[] entry.

type OrganizationsAPI 

type OrganizationsAPI interface {
	DescribeAccount(ctx context.Context, params *organizations.DescribeAccountInput, optFns ...func(*organizations.Options)) (*organizations.DescribeAccountOutput, error)
}

OrganizationsAPI defines the subset of AWS Organizations API used for account name lookup.

type OutputFormat 

type OutputFormat string

OutputFormat represents the desired output format. 

const (
	FormatMarkdown OutputFormat = "markdown"
	FormatJSON     OutputFormat = "json"
	FormatYAML     OutputFormat = "yaml"
	FormatCSV      OutputFormat = "csv"
	FormatSARIF    OutputFormat = "sarif"
	FormatOCSF     OutputFormat = "ocsf"
)

func ParseOutputFormat 

func ParseOutputFormat(format string) (OutputFormat, error)

ParseOutputFormat validates a format string and returns the corresponding OutputFormat.

type PhysicalLocation added in v1.220.0 

type PhysicalLocation struct {
	ArtifactLocation *ArtifactLocation `json:"artifactLocation,omitempty"`
	Region           *Region           `json:"region,omitempty"`
}

PhysicalLocation points at a file (and optional region).

type QueryOptions 

type QueryOptions struct {
	Stack       string
	Component   string
	Severity    []Severity
	Source      Source
	Framework   string
	MaxFindings int
	Region      string
	NoAI        bool
}

QueryOptions contains the filter options for fetching security findings.

type Region added in v1.220.0 

type Region struct {
	StartLine int `json:"startLine,omitempty"`
}

Region is a sub-range within an artifact.

type Relationship added in v1.220.0 

type Relationship struct {
	Target ReportingDescriptorReference `json:"target"`
	Kinds  []string                     `json:"kinds,omitempty"`
}

Relationship links a rule to a taxonomy item.

type Remediation 

type Remediation struct {
	Description   string       `json:"description" yaml:"description"`                           // Brief summary of the remediation.
	RootCause     string       `json:"root_cause,omitempty" yaml:"root_cause,omitempty"`         // Why this finding exists in the infrastructure.
	Steps         []string     `json:"steps,omitempty" yaml:"steps,omitempty"`                   // Ordered remediation steps.
	CodeChanges   []CodeChange `json:"code_changes,omitempty" yaml:"code_changes,omitempty"`     // Specific Terraform/HCL changes.
	StackChanges  string       `json:"stack_changes,omitempty" yaml:"stack_changes,omitempty"`   // Specific stack YAML changes.
	DeployCommand string       `json:"deploy_command,omitempty" yaml:"deploy_command,omitempty"` // atmos terraform apply <component> -s <stack>.
	RiskLevel     string       `json:"risk_level,omitempty" yaml:"risk_level,omitempty"`         // low, medium, high.
	References    []string     `json:"references,omitempty" yaml:"references,omitempty"`         // AWS docs, CIS benchmarks, etc.
}

Remediation contains AI-generated remediation details for a finding. This is the output contract — every AI provider must populate these fields following the same structure, ensuring consistent and reproducible output.

type Report 

type Report struct {
	GeneratedAt    time.Time              `json:"generated_at" yaml:"generated_at"`
	Stack          string                 `json:"stack,omitempty" yaml:"stack,omitempty"`
	Component      string                 `json:"component,omitempty" yaml:"component,omitempty"`
	TotalFindings  int                    `json:"total_findings" yaml:"total_findings"`
	SeverityCounts map[Severity]int       `json:"severity_counts" yaml:"severity_counts"`
	Findings       []Finding              `json:"findings" yaml:"findings"`
	MappedCount    int                    `json:"mapped_count" yaml:"mapped_count"`
	UnmappedCount  int                    `json:"unmapped_count" yaml:"unmapped_count"`
	TagMapping     *AWSSecurityTagMapping `json:"-" yaml:"-"` // Display-only: configured tag keys for unmapped findings message.
	GroupFindings  bool                   `json:"-" yaml:"-"` // Display-only: group duplicate findings in Markdown output.
	Invocation     *ReportInvocation      `json:"-" yaml:"-"`
}

Report represents a complete security or compliance analysis report.

type ReportInvocation added in v1.220.0 

type ReportInvocation struct {
	CommandLine         string
	Arguments           []string
	StartTimeUTC        time.Time
	EndTimeUTC          time.Time
	ExitCode            int
	ExitCodeDescription string
	WorkingDirectory    string
	ExecutionSuccessful bool
	AccountsScanned     []string
	RegionsScanned      []string
	StacksScanned       []string
}

ReportInvocation captures audit details for a CLI run.

type ReportRenderer 

type ReportRenderer interface {
	// RenderSecurityReport renders a security findings report.
	RenderSecurityReport(w io.Writer, report *Report) error

	// RenderComplianceReport renders a compliance posture report.
	RenderComplianceReport(w io.Writer, report *ComplianceReport) error
}

ReportRenderer renders security and compliance reports in various formats.

func NewReportRenderer 

func NewReportRenderer(format OutputFormat) ReportRenderer

NewReportRenderer creates a renderer for the given output format.

type ReportingDescriptor added in v1.220.0 

type ReportingDescriptor struct {
	ID               string           `json:"id"`
	Name             string           `json:"name,omitempty"`
	ShortDescription *MultiformatText `json:"shortDescription,omitempty"`
	FullDescription  *MultiformatText `json:"fullDescription,omitempty"`
}

ReportingDescriptor describes a rule or taxonomy item.

type ReportingDescriptorReference added in v1.220.0 

type ReportingDescriptorReference struct {
	ID            string                  `json:"id,omitempty"`
	ToolComponent *ToolComponentReference `json:"toolComponent,omitempty"`
}

ReportingDescriptorReference references a rule or taxonomy descriptor.

type Result added in v1.220.0 

type Result struct {
	RuleID          string                         `json:"ruleId"`
	RuleIndex       *int                           `json:"ruleIndex,omitempty"`
	Level           string                         `json:"level,omitempty"`
	Kind            string                         `json:"kind,omitempty"`
	Message         MultiformatText                `json:"message"`
	Locations       []Location                     `json:"locations,omitempty"`
	Taxa            []ReportingDescriptorReference `json:"taxa,omitempty"`
	HostedViewerURI string                         `json:"hostedViewerUri,omitempty"`
	Fingerprints    map[string]string              `json:"fingerprints,omitempty"`
	Properties      map[string]any                 `json:"properties,omitempty"`
}

Result is a single finding occurrence.

type Rule added in v1.220.0 

type Rule struct {
	ID               string           `json:"id"`
	Name             string           `json:"name,omitempty"`
	ShortDescription *MultiformatText `json:"shortDescription,omitempty"`
	FullDescription  *MultiformatText `json:"fullDescription,omitempty"`
	Help             *MultiformatText `json:"help,omitempty"`
	HelpURI          string           `json:"helpUri,omitempty"`
	DefaultConfig    *RuleConfig      `json:"defaultConfiguration,omitempty"`
	Relationships    []Relationship   `json:"relationships,omitempty"`
	Properties       map[string]any   `json:"properties,omitempty"`
}

Rule describes a class of finding (one entry per unique finding title).

type RuleConfig added in v1.220.0 

type RuleConfig struct {
	Level string `json:"level,omitempty"`
}

RuleConfig sets per-rule defaults such as level.

type Run added in v1.220.0 

type Run struct {
	Tool               Tool                        `json:"tool"`
	Invocations        []Invocation                `json:"invocations,omitempty"`
	OriginalURIBaseIDs map[string]ArtifactLocation `json:"originalUriBaseIds,omitempty"`
	Taxonomies         []ToolComponent             `json:"taxonomies,omitempty"`
	Results            []Result                    `json:"results"`
}

Run captures the output of a single tool invocation.

type SARIFLog added in v1.220.0 

type SARIFLog struct {
	Schema  string `json:"$schema,omitempty"`
	Version string `json:"version"`
	Runs    []Run  `json:"runs"`
}

SARIFLog is the top-level SARIF document.

func BuildSARIFLog added in v1.220.0 

func BuildSARIFLog(report *Report) *SARIFLog

BuildSARIFLog converts a security Report into a SARIF 2.1.0 log. The mapping is stable: rules are derived from unique finding titles, results are emitted in a deterministic order so output is reproducible across runs.

type SecurityHubAPI 

type SecurityHubAPI interface {
	GetFindings(ctx context.Context, params *securityhub.GetFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.GetFindingsOutput, error)
	GetEnabledStandards(ctx context.Context, params *securityhub.GetEnabledStandardsInput, optFns ...func(*securityhub.Options)) (*securityhub.GetEnabledStandardsOutput, error)
	ListSecurityControlDefinitions(ctx context.Context, params *securityhub.ListSecurityControlDefinitionsInput, optFns ...func(*securityhub.Options)) (*securityhub.ListSecurityControlDefinitionsOutput, error)
}

SecurityHubAPI defines the subset of AWS Security Hub API used by this package.

type Severity 

type Severity string

Severity represents a security finding severity level. 

const (
	SeverityCritical      Severity = "CRITICAL"
	SeverityHigh          Severity = "HIGH"
	SeverityMedium        Severity = "MEDIUM"
	SeverityLow           Severity = "LOW"
	SeverityInformational Severity = "INFORMATIONAL"
)

type Source 

type Source string

Source represents the AWS security service that generated a finding. 

const (
	SourceSecurityHub    Source = "security-hub"
	SourceConfig         Source = "config"
	SourceInspector      Source = "inspector"
	SourceGuardDuty      Source = "guardduty"
	SourceMacie          Source = "macie"
	SourceAccessAnalyzer Source = "access-analyzer"
	SourceAll            Source = "all"
)

type SourceLifecycle added in v1.220.0 

type SourceLifecycle struct {
	WorkflowStatus   string `json:"workflow_status,omitempty" yaml:"workflow_status,omitempty"`
	RecordState      string `json:"record_state,omitempty" yaml:"record_state,omitempty"`
	ComplianceStatus string `json:"compliance_status,omitempty" yaml:"compliance_status,omitempty"`
	InspectorStatus  string `json:"inspector_status,omitempty" yaml:"inspector_status,omitempty"`
}

SourceLifecycle preserves raw lifecycle state from AWS source feeds.

type SourceRemediation added in v1.220.0 

type SourceRemediation struct {
	Text string `json:"text,omitempty" yaml:"text,omitempty"`
	URL  string `json:"url,omitempty" yaml:"url,omitempty"`
}

SourceRemediation preserves remediation guidance supplied by AWS.

type SourceSeverity added in v1.220.0 

type SourceSeverity struct {
	Score *float64 `json:"score,omitempty" yaml:"score,omitempty"`
	Label string   `json:"label,omitempty" yaml:"label,omitempty"`
}

SourceSeverity preserves raw severity values from AWS source feeds.

type SourceTimestamps added in v1.220.0 

type SourceTimestamps struct {
	FirstObservedAt *time.Time `json:"first_observed_at,omitempty" yaml:"first_observed_at,omitempty"`
	LastObservedAt  *time.Time `json:"last_observed_at,omitempty" yaml:"last_observed_at,omitempty"`
	UpdatedAt       *time.Time `json:"updated_at,omitempty" yaml:"updated_at,omitempty"`
	CreatedAt       *time.Time `json:"created_at,omitempty" yaml:"created_at,omitempty"`
}

SourceTimestamps preserves AWS source-feed timestamps separately from report upload time.

type TaggingAPI 

type TaggingAPI interface {
	GetResources(ctx context.Context, params *resourcegroupstaggingapi.GetResourcesInput, optFns ...func(*resourcegroupstaggingapi.Options)) (*resourcegroupstaggingapi.GetResourcesOutput, error)
}

TaggingAPI defines the subset of AWS Resource Groups Tagging API used by this package.

type Tool added in v1.220.0 

type Tool struct {
	Driver Driver `json:"driver"`
}

Tool describes the analysis tool that produced the run.

type ToolComponent added in v1.220.0 

type ToolComponent struct {
	Name           string                `json:"name"`
	Version        string                `json:"version,omitempty"`
	InformationURI string                `json:"informationUri,omitempty"`
	GUID           string                `json:"guid,omitempty"`
	Taxa           []ReportingDescriptor `json:"taxa,omitempty"`
}

ToolComponent describes a SARIF tool extension or taxonomy.

type ToolComponentReference added in v1.220.0 

type ToolComponentReference struct {
	Index int `json:"index"`
}

ToolComponentReference references a SARIF tool component by run-level index.

type VulnerabilityDetails added in v1.220.0 

type VulnerabilityDetails struct {
	ID             string              `json:"id,omitempty" yaml:"id,omitempty"`
	CVEID          string              `json:"cve_id,omitempty" yaml:"cve_id,omitempty"`
	CWEIDs         []string            `json:"cwe_ids,omitempty" yaml:"cwe_ids,omitempty"`
	EPSSScore      float64             `json:"epss_score,omitempty" yaml:"epss_score,omitempty"`
	PackageName    string              `json:"package_name,omitempty" yaml:"package_name,omitempty"`
	PackageVersion string              `json:"package_version,omitempty" yaml:"package_version,omitempty"`
	FixedInVersion string              `json:"fixed_in_version,omitempty" yaml:"fixed_in_version,omitempty"`
	Packages       []VulnerablePackage `json:"packages,omitempty" yaml:"packages,omitempty"`
	ReferenceURLs  []string            `json:"reference_urls,omitempty" yaml:"reference_urls,omitempty"`
	CVSS           []CVSSScore         `json:"cvss,omitempty" yaml:"cvss,omitempty"`
}

VulnerabilityDetails preserves structured package vulnerability data from AWS.

type VulnerablePackage added in v1.220.0 

type VulnerablePackage struct {
	Name           string `json:"name,omitempty" yaml:"name,omitempty"`
	Version        string `json:"version,omitempty" yaml:"version,omitempty"`
	FixedInVersion string `json:"fixed_in_version,omitempty" yaml:"fixed_in_version,omitempty"`
	PackageManager string `json:"package_manager,omitempty" yaml:"package_manager,omitempty"`
	Remediation    string `json:"remediation,omitempty" yaml:"remediation,omitempty"`
	FilePath       string `json:"file_path,omitempty" yaml:"file_path,omitempty"`
}

VulnerablePackage captures an affected package and available fix.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.