Jon Chery
1fd37a2843
Phase 23 (v1.7) — tagging standards and security adapters.
* schemas/tagging-standard.json (D-054): canonical required-tags schema
(acdl:owner, acdl:contract, acdl:environment, acdl:cost-center).
* adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom
rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043
(synthetic SKIPPED record replaced by real PASS/FAIL records).
* checkov_adapter.py: removed _emit_tag_naming_skipped(), added
ACDL_TAG_NAMING to RULE_MAP, updated docstring.
* scripts/run_platform.sh: both Checkov invocations pass
--external-checks-dir adapters/terraform/policy/custom_rules/.
* adapters/wiz/ (D-052): Wiz adapter translating issue records to
PolicyCheckResult (engine: "wiz"); graceful degradation emits
WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate.
* adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport
results to PolicyCheckResult (engine: "kyverno"); ready but inactive
for Terraform-only stacks; 3 sample ClusterPolicies in policies/.
* schemas/policy_check_result.schema.json: engine enum += "wiz".
* tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py
(13 tests); updated test_checkov_adapter.py to not expect the removed
synthetic ACDL_TAG_NAMING SKIPPED record.
* scripts/run_ci.sh: lint stage compiles the new adapter modules.
202 tests pass; CI pipeline OK (lint + test + check-only).
Deviations:
- Wiz adapt() had an AttributeError on bare-list top-level input
(data.get() on a list); fixed to dispatch on isinstance(data, list)
before calling .get(). No spec change — bare-list handling is implied
by the original docstring's "data if isinstance(data, list)" branch.
- Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result",
"skip") -> "skip"), not "error"; test expectation corrected. Added an
explicit unknown-result-string test to cover the "error" fallback.
---ci---
project: acdl
phase: 23
milestone: v1.7
status: execute
---/ci---
55 lines
2.6 KiB
Markdown
55 lines
2.6 KiB
Markdown
# Wiz Adapter
|
|
|
|
The Wiz adapter translates Wiz API issue records to the normalized ACDL
|
|
[`PolicyCheckResult`](../../schemas/policy_check_result.schema.json) schema
|
|
(engine: `"wiz"`), mirroring the Checkov adapter pattern.
|
|
|
|
## What Wiz is
|
|
|
|
[Wiz](https://www.wiz.io/) is a cloud security SaaS platform that
|
|
continuously scans CSPM / CWPP / KSPM findings across AWS, Azure, GCP and
|
|
Kubernetes. It exposes a GraphQL/REST API for fetching issue records.
|
|
|
|
## Adapter behaviour
|
|
|
|
`wiz_adapter.py <wiz_issues.json> <contract-id>` reads a JSON file of Wiz
|
|
issue records (the shape returned by the Wiz `issues` GraphQL query /
|
|
list endpoint) and emits a list of `PolicyCheckResult` dicts:
|
|
|
|
| Wiz field | PolicyCheckResult field |
|
|
|------------------|------------------------------------------------------------|
|
|
| `id` / `control.id` | `ruleId` |
|
|
| `severity` | `severity` (mapped `CRITICAL/HIGH/MEDIUM/LOW/INFO`) |
|
|
| `status` | `result` (`OPEN→fail`, `RESOLVED→pass`, `IN_PROGRESS/DISMISSED→skipped`) |
|
|
| `title` / `control.name` | `message` |
|
|
| `entity.id` | `resourceRef` + `evidence.resource` |
|
|
| `entity.{name,cloudPlatform,subscriptionId}` | `evidence.*` |
|
|
|
|
The adapter is read-only against a local JSON fixture; the pipeline is
|
|
responsible for fetching from Wiz (when configured) and writing the file.
|
|
|
|
## Offline / degraded behaviour (D-052)
|
|
|
|
When Wiz is not configured the pipeline passes an empty issues payload (or
|
|
simply does not invoke the adapter). The adapter degrades gracefully:
|
|
|
|
- an empty `issues` list → the adapter emits a single `WIZ_NOT_CONFIGURED`
|
|
`PolicyCheckResult` with `result: "skipped"` so the confidence policy
|
|
input stays non-empty (and does not falsely inflate the score).
|
|
|
|
`is_configured()` returns `True` only when the `WIZ_API_TOKEN`
|
|
environment variable is set; the pipeline uses it to decide whether to
|
|
fetch and invoke the adapter at all.
|
|
|
|
## Configuration
|
|
|
|
| Env var | Required | Purpose |
|
|
|-----------------|----------|--------------------------------------------------|
|
|
| `WIZ_API_TOKEN` | yes | Bearer token for the Wiz REST API. When unset, `is_configured()` returns `False`. |
|
|
| `WIZ_ENDPOINT` | no | Wiz API endpoint (defaults to `https://api.wiz.io` when implemented). |
|
|
|
|
## Schema path
|
|
|
|
The output records validate against
|
|
[`schemas/policy_check_result.schema.json`](../../schemas/policy_check_result.schema.json)
|
|
(`engine: "wiz"` was added to the enum in Phase 23). |