Nova Custom Checkov Rules

This directory holds Nova-authored Checkov custom rules, written in the Checkov Python custom-rule framework.

Files

nova_tagging.py — NOVA_TAG_NAMING (D-054, D-109 warn mode in P2): ensures every taggable AWS resource carries the four required Nova tags (nova:owner, nova:contract, nova:environment, nova:cost-center). This rule replaces the synthetic SKIPPED NOVA_TAG_NAMING record that the Checkov adapter previously emitted (D-043 closure). Renamed from acdl_tagging.py / ACDL_TAG_NAMING in P2 (REQ-158). The canonical tag set is declared in schemas/tagging-standard.json.

P2 warn mode (D-109): existing resources still carry acdl:* tag-key values (left for P3). When a resource has only acdl:*-style tags and no nova:* tags, the rule logs a WARNING instead of failing, so the regression gate stays green during the parallel-tag transition window. P3 flips to hard-fail once nova:* tags are emitted in parallel and the ABAC policy is swapped.

How Checkov loads them

Checkov custom rules are discovered via the --external-checks-dir flag. scripts/run_platform.sh invokes Checkov with:

checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
        --external-checks-dir adapters/terraform/policy/custom_rules/

Checkov imports each *.py file in the directory and instantiates the module-level check object (see the check = NovaTaggingStandard() line at the bottom of nova_tagging.py).

Severity / result mapping

The Checkov adapter (adapters/terraform/policy/checkov_adapter.py) maps NOVA_TAG_NAMING to (tagging-standard, medium) in RULE_MAP. The custom rule therefore produces real PASS/FAIL PolicyCheckResult records, feeding the confidence signal instead of the old SKIPPED placeholder.