Jon Chery
7f4b79593a
plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46), forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports CKV_AWS_7/33) over terraform show -json output. meta/ policies (2): block-on-any-critical (declarative source of truth for critical-block; confidence_signal hard-override stays as defense-in-depth, D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj KJ_REQUIRE_TAGGING_STANDARD, D-118). scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips gracefully when kj absent (D-120). tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj), test_run_platform_plan_json_policies.py (script-substring assertion, no skip). ---ci--- project: acdl phase: 3 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-300, REQ-301, REQ-302, REQ-303] partial: [] ---/ci---
32 lines
891 B
JSON
32 lines
891 B
JSON
{
|
|
"apiVersion": "json.kyverno.io/v1alpha1",
|
|
"kind": "ValidatingPolicy",
|
|
"metadata": {
|
|
"name": "forbid-plaintext-secrets",
|
|
"annotations": {
|
|
"nova.cloudinit.dev/severity": "high",
|
|
"title.policy.kyverno.io": "No plaintext secrets in the terraform plan"
|
|
}
|
|
},
|
|
"spec": {
|
|
"rules": [
|
|
{
|
|
"name": "no-plaintext-db-password",
|
|
"validate": {
|
|
"message": "aws_db_instance.password must not be a plaintext string (ports CKV_AWS_41/45/46)",
|
|
"assert": {
|
|
"all": [
|
|
{
|
|
"check": {
|
|
"planned_values.root_module.~.resources": {
|
|
"(type == 'aws_db_instance' && contains(keys(values), 'password') && !contains(['${...}', ''], values.password))": false
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |