You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For more advanced use cases, there is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`.
484
484
More info about the helper functions are in the library [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go).
485
485
486
-
You can find more example policies [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go)
486
+
You can find more example checks [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go)
487
487
488
488
### By Vulnerability Exploitability Exchange (VEX)
Copy file name to clipboardExpand all lines: docs/docs/coverage/iac/helm.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ The following scanners are supported.
11
11
Trivy recursively searches directories and scans all found Helm files.
12
12
13
13
It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks.
14
-
See [here](../../scanner/misconfiguration/check/builtin.md) for more details on the built-in policies.
14
+
See [here](../../scanner/misconfiguration/check/builtin.md) for more details on the built-in checks.
15
15
16
16
### Value overrides
17
17
There are a number of options for overriding values in Helm charts.
--include-deprecated-checks include deprecated checks
90
91
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
91
92
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
92
93
--max-cache-age duration The maximum age of the cloud cache. Cached data will be required from the cloud provider if it is older than this. (default 24h0m0s)
--include-deprecated-checks include deprecated checks
34
35
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
35
36
--k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0)
36
37
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
You can also bring a custom policy that defines one or more custom schema.
60
60
@@ -71,21 +71,21 @@ You can also bring a custom policy that defines one or more custom schema.
71
71
}
72
72
```
73
73
74
-
The policies can be placed in a structure as follows
74
+
The checks can be placed in a structure as follows
75
75
76
76
!!! example
77
77
```
78
-
/Users/user/my-custom-policies
78
+
/Users/user/my-custom-checks
79
79
├── my_policy.rego
80
80
└── schemas
81
81
└── fooschema.json
82
82
└── barschema.json
83
83
```
84
84
85
-
To use such a policy with Trivy, use the `--config-policy` flag that points to the policy file or to the directory where the schemas and policies are contained.
85
+
To use such a policy with Trivy, use the `--config-policy` flag that points to the policy file or to the directory where the schemas and checks are contained.
For more details on how to define schemas within Rego policies, please see the [OPA guide](https://www.openpolicyagent.org/docs/latest/policy-language/#schema-annotations) that describes it in more detail.
91
+
For more details on how to define schemas within Rego checks, please see the [OPA guide](https://www.openpolicyagent.org/docs/latest/policy-language/#schema-annotations) that describes it in more detail.
Copy file name to clipboardExpand all lines: docs/docs/scanner/misconfiguration/custom/testing.md
+6-6
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
# Testing
2
-
It is highly recommended to write tests for your custom policies.
2
+
It is highly recommended to write tests for your custom checks.
3
3
4
4
## Rego testing
5
-
To help you verify the correctness of your custom policies, OPA gives you a framework that you can use to write tests for your policies.
6
-
By writing tests for your custom policies you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve.
5
+
To help you verify the correctness of your custom checks, OPA gives you a framework that you can use to write tests for your checks.
6
+
By writing tests for your custom checks you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve.
7
7
8
8
For more details, see [Policy Testing][opa-testing].
9
9
@@ -22,12 +22,12 @@ For more details, see [Policy Testing][opa-testing].
22
22
}
23
23
```
24
24
25
-
To write tests for custom policies, you can refer to existing tests under [trivy-checks][trivy-checks].
25
+
To write tests for custom checks, you can refer to existing tests under [trivy-checks][trivy-checks].
26
26
27
27
## Go testing
28
28
[Fanal][fanal] which is a core library of Trivy can be imported as a Go library.
29
-
You can scan config files in Go and test your custom policies using Go's testing methods, such as [table-driven tests][table].
30
-
This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom policies work in practice.
29
+
You can scan config files in Go and test your custom checks using Go's testing methods, such as [table-driven tests][table].
30
+
This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom checks work in practice.
31
31
32
32
In particular, Dockerfile and HCL need to be converted to structural data as input, which may be different from the expected input format.
Copy file name to clipboardExpand all lines: docs/docs/scanner/misconfiguration/index.md
+8-8
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
# Misconfiguration Scanning
2
-
Trivy provides built-in policies to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more.
3
-
In addition to built-in policies, you can write your own custom policies, as you can see [here][custom].
2
+
Trivy provides built-in checks to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more.
3
+
In addition to built-in checks, you can write your own custom checks, as you can see [here][custom].
4
4
5
5
## Quick start
6
6
@@ -94,7 +94,7 @@ In the above example, Trivy detected vulnerabilities of Python dependencies and
94
94
95
95
## Type detection
96
96
The specified directory can contain mixed types of IaC files.
97
-
Trivy automatically detects config types and applies relevant policies.
97
+
Trivy automatically detects config types and applies relevant checks.
98
98
99
99
For example, the following example holds IaC files for Terraform, CloudFormation, Kubernetes, Helm Charts, and Dockerfile in the same directory.
0 commit comments