Documentation
¶
Overview ¶
Package securitygroups implements the aws.security_group source plugin: lists EC2 security groups in one AWS account and emits one firewall_rule evidence record per ingress/egress rule, carrying the cross-vendor direction / protocol / port-range / unrestricted-source attributes that network-exposure policies evaluate.
Per the KISS-no-DRY axiom (docs/architecture/04-source-plugins.md §The plugin contract) the plugin caches nothing across Collect calls. N policies bound to this plugin → N invocations of Collect.
Index ¶
Constants ¶
const EvidenceTypeID = "firewall_rule"
EvidenceTypeID is the evidence type this plugin emits.
const SourceID = "aws.security_group"
SourceID is the registered ID for the aws.security_group plugin instance.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API interface {
DescribeSecurityGroups(ctx context.Context, params *awsec2.DescribeSecurityGroupsInput, optFns ...func(*awsec2.Options)) (*awsec2.DescribeSecurityGroupsOutput, error)
}
API is the subset of the EC2 client this plugin uses.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the in-process aws.security_group source.
func NewFromAWS ¶
NewFromAWS constructs a Plugin backed by the real AWS SDK.
func (*Plugin) Collect ¶
func (p *Plugin) Collect(ctx context.Context, req core.SlotRequest) ([]core.EvidenceRecord, error)
Collect lists security groups and returns one firewall_rule record per ingress/egress rule (flattening every group's IpPermissions and IpPermissionsEgress into individual rule records).
Source Files