Merge pull request #109 from aquasecurity/check-bundle

chore(checks): Rename repo to trivy-checks

.github/workflows/release.yaml

@@ -22,7 +22,15 @@ jobs:
  registry: ghcr.io
  username: ${{ env.GH_USER }}
  password: ${{ secrets.GITHUB_TOKEN }}
- - name: Deploy to GitHub Packages Container registry
+ - name: Deploy policy bundle to ghcr.io (for backwards compatibility)
+ run: |
+ tags=(latest ${{ env.RELEASE_VERSION}} ${{env.MINOR_VERSION }} ${{ env.MAJOR_VERSION }})
+ for tag in ${tags[@]}; do
+ oras push ghcr.io/aquasecurity/trivy-policies:${tag} \
+ --config /dev/null:application/vnd.cncf.openpolicyagent.config.v1+json \
+ bundle.tar.gz:application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip
+ done
+ - name: Deploy checks bundle to ghcr.io
  run: |
  tags=(latest ${{ env.RELEASE_VERSION}} ${{env.MINOR_VERSION }} ${{ env.MAJOR_VERSION }})
  for tag in ${tags[@]}; do

CONTRIBUTING.md

@@ -1,10 +1,10 @@
 # Contributing
 
-Welcome, and thank you for considering contributing to trivy-policies!
+Welcome, and thank you for considering contributing to trivy-checks!
 
 The following guide gives an overview of the project and some directions on how to make common types of contribution. If something is missing, or you get stuck, please [start a discussion](https://github.com/aquasecurity/trivy/discussions/new) and we'll do our best to help.
 
-### Writing Rules
+### Writing Checks
 
 Writing a new rule can be relatively simple, but there are a few things to keep in mind. The following guide will help you get started.
 

checks/cloud/aws/accessanalyzer/enable_access_analyzer.go

@@ -1,7 +1,7 @@
 package accessanalyzer
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/apigateway/enable_access_logging.go

@@ -1,7 +1,7 @@
 package apigateway
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/apigateway/enable_cache.go

@@ -1,7 +1,7 @@
 package apigateway
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/apigateway/enable_cache_encryption.go

@@ -1,7 +1,7 @@
 package apigateway
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/apigateway/enable_tracing.go

@@ -1,7 +1,7 @@
 package apigateway
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/apigateway/no_public_access.go

@@ -1,7 +1,7 @@
 package apigateway
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  v1 "github.com/aquasecurity/trivy/pkg/iac/providers/aws/apigateway/v1"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/apigateway/use_secure_tls_policy.go

@@ -1,7 +1,7 @@
 package apigateway
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/athena/enable_at_rest_encryption.go

@@ -1,7 +1,7 @@
 package athena
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/athena"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/athena/no_encryption_override.go

@@ -1,7 +1,7 @@
 package athena
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/cloudfront/enable_logging.go

@@ -1,7 +1,7 @@
 package cloudfront
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/cloudfront/enable_waf.go

@@ -1,7 +1,7 @@
 package cloudfront
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/cloudfront/enforce_https.go

@@ -1,7 +1,7 @@
 package cloudfront
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudfront"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/cloudfront/use_secure_tls_policy.go

@@ -1,7 +1,7 @@
 package cloudfront
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudfront"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/cloudtrail/enable_all_regions.go

@@ -1,7 +1,7 @@
 package cloudtrail
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/cloudtrail/enable_log_validation.go

@@ -1,7 +1,7 @@
 package cloudtrail
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/cloudtrail/encryption_customer_key.go

@@ -1,7 +1,7 @@
 package cloudtrail
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/cloudtrail/ensure_cloudwatch_integration.go

@@ -1,7 +1,7 @@
 package cloudtrail
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/cloudtrail/no_public_log_access.go

@@ -1,7 +1,7 @@
 package cloudtrail
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/cloudtrail/require_bucket_access_logging.go

@@ -1,7 +1,7 @@
 package cloudtrail
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/cloudwatch/log_group_customer_key.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/cloudwatch/require_cloudtrail_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_cmk_disabled_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_config_configuration_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_console_login_failure_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_iam_policy_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_nacl_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_network_gateway_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_non_mfa_login_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_org_changes_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_root_user_usage_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_route_table_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_s3_bucket_policy_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_security_group_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_unauthorised_api_call_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/cloudwatch/require_vpc_change_alarm.go

@@ -1,7 +1,7 @@
 package cloudwatch
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudwatch"

checks/cloud/aws/codebuild/enable_encryption.go

@@ -1,7 +1,7 @@
 package codebuild
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/config/aggregate_all_regions.go

@@ -1,7 +1,7 @@
 package config
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/documentdb/enable_log_export.go

@@ -1,7 +1,7 @@
 package documentdb
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/providers/aws/documentdb"
  "github.com/aquasecurity/trivy/pkg/iac/scan"

checks/cloud/aws/documentdb/enable_storage_encryption.go

@@ -1,7 +1,7 @@
 package documentdb
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/documentdb/encryption_customer_key.go

@@ -1,7 +1,7 @@
 package documentdb
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"

checks/cloud/aws/dynamodb/enable_at_rest_encryption.go

@@ -1,7 +1,7 @@
 package dynamodb
 
 import (
- "github.com/aquasecurity/trivy-policies/pkg/rules"
+ "github.com/aquasecurity/trivy-checks/pkg/rules"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/severity"