Jon Chery
1fd37a2843
Phase 23 (v1.7) — tagging standards and security adapters.
* schemas/tagging-standard.json (D-054): canonical required-tags schema
(acdl:owner, acdl:contract, acdl:environment, acdl:cost-center).
* adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom
rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043
(synthetic SKIPPED record replaced by real PASS/FAIL records).
* checkov_adapter.py: removed _emit_tag_naming_skipped(), added
ACDL_TAG_NAMING to RULE_MAP, updated docstring.
* scripts/run_platform.sh: both Checkov invocations pass
--external-checks-dir adapters/terraform/policy/custom_rules/.
* adapters/wiz/ (D-052): Wiz adapter translating issue records to
PolicyCheckResult (engine: "wiz"); graceful degradation emits
WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate.
* adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport
results to PolicyCheckResult (engine: "kyverno"); ready but inactive
for Terraform-only stacks; 3 sample ClusterPolicies in policies/.
* schemas/policy_check_result.schema.json: engine enum += "wiz".
* tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py
(13 tests); updated test_checkov_adapter.py to not expect the removed
synthetic ACDL_TAG_NAMING SKIPPED record.
* scripts/run_ci.sh: lint stage compiles the new adapter modules.
202 tests pass; CI pipeline OK (lint + test + check-only).
Deviations:
- Wiz adapt() had an AttributeError on bare-list top-level input
(data.get() on a list); fixed to dispatch on isinstance(data, list)
before calling .get(). No spec change — bare-list handling is implied
by the original docstring's "data if isinstance(data, list)" branch.
- Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result",
"skip") -> "skip"), not "error"; test expectation corrected. Added an
explicit unknown-result-string test to cover the "error" fallback.
---ci---
project: acdl
phase: 23
milestone: v1.7
status: execute
---/ci---
34 lines
1.4 KiB
Markdown
34 lines
1.4 KiB
Markdown
# ACDL Custom Checkov Rules
|
|
|
|
This directory holds ACDL-authored Checkov custom rules, written in the
|
|
[Checkov Python custom-rule framework](https://www.checkov.io/4.Contributing/Custom%20Policies.html).
|
|
|
|
## Files
|
|
|
|
- `acdl_tagging.py` — `ACDL_TAG_NAMING` (D-054): ensures every taggable AWS
|
|
resource carries the four required ACDL tags
|
|
(`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`).
|
|
This rule replaces the synthetic SKIPPED `ACDL_TAG_NAMING` record that the
|
|
Checkov adapter previously emitted (D-043 closure). The canonical tag set
|
|
is declared in [`schemas/tagging-standard.json`](../../../schemas/tagging-standard.json).
|
|
|
|
## How Checkov loads them
|
|
|
|
Checkov custom rules are discovered via the `--external-checks-dir` flag.
|
|
`scripts/run_platform.sh` invokes Checkov with:
|
|
|
|
```
|
|
checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
|
|
--external-checks-dir adapters/terraform/policy/custom_rules/
|
|
```
|
|
|
|
Checkov imports each `*.py` file in the directory and instantiates the
|
|
module-level `check` object (see the `check = AcdlTaggingStandard()` line at
|
|
the bottom of `acdl_tagging.py`).
|
|
|
|
## Severity / result mapping
|
|
|
|
The Checkov adapter (`adapters/terraform/policy/checkov_adapter.py`)
|
|
maps `ACDL_TAG_NAMING` to `(tagging-standard, medium)` in `RULE_MAP`. The
|
|
custom rule therefore produces real `PASS`/`FAIL` PolicyCheckResult records,
|
|
feeding the confidence signal instead of the old SKIPPED placeholder. |