rules

package
v0.18.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 13, 2026 License: MIT Imports: 5 Imported by: 0

Documentation

Overview

EC2_OVERPROVISIONED_PLACEHOLDER has been replaced by EC2_LOW_CPU (ec2_low_cpu.go). This file is intentionally empty; it will be removed in a future cleanup.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AWSALBIdleRule 

type AWSALBIdleRule struct{}

AWSALBIdleRule flags Application Load Balancers that received zero requests over the evaluation period, indicating the LB is likely idle and incurring unnecessary hourly charges.

Only ALBs with state == "active" are evaluated. NLB and GWLB are excluded because they use different CloudWatch metrics. RequestCount == 0 means either no traffic reached the ALB or CloudWatch data was unavailable — both cases are flagged because an active ALB with no traffic is suspicious.

func (AWSALBIdleRule) Evaluate 

func (r AWSALBIdleRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per active ALB whose RequestCount is zero.

func (AWSALBIdleRule) ID 

func (r AWSALBIdleRule) ID() string

func (AWSALBIdleRule) Name 

func (r AWSALBIdleRule) Name() string

type AWSCloudTrailNotMultiRegionRule 

type AWSCloudTrailNotMultiRegionRule struct{}

AWSCloudTrailNotMultiRegionRule flags accounts that have no multi-region CloudTrail trail. A multi-region trail is required to capture API activity across all regions; single-region trails leave blind spots that attackers can exploit by operating in unmonitored regions.

func (AWSCloudTrailNotMultiRegionRule) Evaluate 

func (r AWSCloudTrailNotMultiRegionRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding when no multi-region trail exists.

func (AWSCloudTrailNotMultiRegionRule) ID 

func (r AWSCloudTrailNotMultiRegionRule) ID() string

func (AWSCloudTrailNotMultiRegionRule) Name 

func (r AWSCloudTrailNotMultiRegionRule) Name() string

type AWSConfigDisabledRule 

type AWSConfigDisabledRule struct{}

AWSConfigDisabledRule flags regions where AWS Config is not actively recording. AWS Config is required for compliance monitoring, resource inventory, and change tracking; disabled regions have no configuration history or compliance evaluation.

func (AWSConfigDisabledRule) Evaluate 

func (r AWSConfigDisabledRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per region where AWS Config is not recording.

func (AWSConfigDisabledRule) ID 

func (r AWSConfigDisabledRule) ID() string

func (AWSConfigDisabledRule) Name 

func (r AWSConfigDisabledRule) Name() string

type AWSEBSGP2LegacyRule 

type AWSEBSGP2LegacyRule struct{}

AWSEBSGP2LegacyRule flags EBS volumes still using the legacy gp2 volume type. gp2 volumes cost more per GB than gp3 and offer no performance advantage for most workloads; migrating is low-risk and requires no downtime.

func (AWSEBSGP2LegacyRule) Evaluate 

func (r AWSEBSGP2LegacyRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one Finding per gp2 volume found in ctx.RegionData.

func (AWSEBSGP2LegacyRule) ID 

func (r AWSEBSGP2LegacyRule) ID() string

func (AWSEBSGP2LegacyRule) Name 

func (r AWSEBSGP2LegacyRule) Name() string

type AWSEBSUnattachedRule 

type AWSEBSUnattachedRule struct{}

AWSEBSUnattachedRule flags EBS volumes that are not attached to any instance. An unattached volume in the "available" state incurs storage charges with no workload benefit.

func (AWSEBSUnattachedRule) Evaluate 

func (r AWSEBSUnattachedRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate iterates all EBS volumes in ctx.RegionData and returns one Finding per volume where Attached == false and State == "available".

func (AWSEBSUnattachedRule) ID 

func (r AWSEBSUnattachedRule) ID() string

func (AWSEBSUnattachedRule) Name 

func (r AWSEBSUnattachedRule) Name() string

type AWSEBSUnencryptedRule 

type AWSEBSUnencryptedRule struct{}

AWSEBSUnencryptedRule flags EBS volumes that do not have encryption enabled. Unencrypted volumes expose data at rest to anyone with physical or snapshot access, violating data-protection requirements.

func (AWSEBSUnencryptedRule) Evaluate 

func (r AWSEBSUnencryptedRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per EBS volume where Encrypted == false.

func (AWSEBSUnencryptedRule) ID 

func (r AWSEBSUnencryptedRule) ID() string

func (AWSEBSUnencryptedRule) Name 

func (r AWSEBSUnencryptedRule) Name() string

type AWSEC2LowCPURule 

type AWSEC2LowCPURule struct{}

AWSEC2LowCPURule flags running EC2 instances whose 30-day average CPU utilisation is below the threshold, indicating the instance is likely overprovisioned for its actual workload.

Instances with AvgCPUPercent == 0 are skipped: 0 means CloudWatch data was unavailable (non-fatal collection failure), not that CPU is truly zero.

Instances with MonthlyCostUSD == 0 are skipped: 0 means Cost Explorer data was unavailable; savings cannot be estimated without a known cost baseline.

func (AWSEC2LowCPURule) Evaluate 

func (r AWSEC2LowCPURule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one Finding per running instance whose AvgCPUPercent is greater than 0 (data available), below ec2LowCPUThresholdPercent, and whose MonthlyCostUSD is greater than 0 (cost data available from Cost Explorer).

func (AWSEC2LowCPURule) ID 

func (r AWSEC2LowCPURule) ID() string

func (AWSEC2LowCPURule) Name 

func (r AWSEC2LowCPURule) Name() string

type AWSEC2NoSavingsPlanRule 

type AWSEC2NoSavingsPlanRule struct{}

AWSEC2NoSavingsPlanRule flags running EC2 instances in regions where there is no Savings Plan coverage (CoveredCostUSD == 0 for the instance's region).

This rule is distinct from AWSSavingsPlanUnderutilizedRule, which fires when an existing Savings Plan is underutilized (coverage < 60%). This rule fires when the region has no Savings Plan coverage at all — the instance is fully on-demand with no discount applied.

Instances with MonthlyCostUSD == 0 are skipped: cost data from Cost Explorer was unavailable and savings cannot be estimated reliably.

func (AWSEC2NoSavingsPlanRule) Evaluate 

func (r AWSEC2NoSavingsPlanRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per running EC2 instance whose region has no Savings Plan coverage (CoveredCostUSD == 0) and whose monthly cost is known from Cost Explorer (MonthlyCostUSD > 0).

func (AWSEC2NoSavingsPlanRule) ID 

func (r AWSEC2NoSavingsPlanRule) ID() string

func (AWSEC2NoSavingsPlanRule) Name 

func (r AWSEC2NoSavingsPlanRule) Name() string

type AWSGuardDutyDisabledRule 

type AWSGuardDutyDisabledRule struct{}

AWSGuardDutyDisabledRule flags regions where AWS GuardDuty is not enabled. GuardDuty provides continuous threat detection; disabled regions have no automated detection of reconnaissance, data exfiltration, or compromised credentials.

func (AWSGuardDutyDisabledRule) Evaluate 

func (r AWSGuardDutyDisabledRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per region where GuardDuty is not enabled.

func (AWSGuardDutyDisabledRule) ID 

func (r AWSGuardDutyDisabledRule) ID() string

func (AWSGuardDutyDisabledRule) Name 

func (r AWSGuardDutyDisabledRule) Name() string

type AWSIAMUserWithoutMFARule 

type AWSIAMUserWithoutMFARule struct{}

AWSIAMUserWithoutMFARule flags IAM users that have console access (a login profile) but no MFA device registered. API-only users without a login profile are skipped because they cannot sign in to the console.

func (AWSIAMUserWithoutMFARule) Evaluate 

func (r AWSIAMUserWithoutMFARule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one MEDIUM finding per IAM user that has a console login profile but no MFA device. Users without a login profile are skipped.

func (AWSIAMUserWithoutMFARule) ID 

func (r AWSIAMUserWithoutMFARule) ID() string

func (AWSIAMUserWithoutMFARule) Name 

func (r AWSIAMUserWithoutMFARule) Name() string

type AWSNATLowTrafficRule 

type AWSNATLowTrafficRule struct{}

AWSNATLowTrafficRule flags available NAT Gateways whose total outbound traffic (BytesOutToDestination) is below 1 GB over the lookback period.

A NAT Gateway with negligible traffic is almost certainly idle. The rule fires even when BytesProcessedGB == 0 because 0 bytes genuinely means no traffic passed through — unlike EC2 CPU where 0 means CloudWatch had no data.

func (AWSNATLowTrafficRule) Evaluate 

func (r AWSNATLowTrafficRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one Finding per available NAT Gateway whose BytesProcessedGB is strictly less than natLowTrafficThresholdGB.

func (AWSNATLowTrafficRule) ID 

func (r AWSNATLowTrafficRule) ID() string

func (AWSNATLowTrafficRule) Name 

func (r AWSNATLowTrafficRule) Name() string

type AWSRDSLowCPURule 

type AWSRDSLowCPURule struct{}

AWSRDSLowCPURule flags available RDS instances whose 30-day average CPU utilisation is below the threshold, indicating the instance is likely overprovisioned for its actual workload.

Instances with AvgCPUPercent == 0 are skipped: 0 means CloudWatch data was unavailable, not that CPU is truly zero.

Instances with MonthlyCostUSD == 0 are skipped: savings cannot be estimated without a known cost baseline from Cost Explorer.

func (AWSRDSLowCPURule) Evaluate 

func (r AWSRDSLowCPURule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one Finding per available RDS instance whose AvgCPUPercent is greater than 0, below rdsLowCPUThresholdPercent, and MonthlyCostUSD > 0. Severity is HIGH for CPU < 5% and MEDIUM for 5–10%.

func (AWSRDSLowCPURule) ID 

func (r AWSRDSLowCPURule) ID() string

func (AWSRDSLowCPURule) Name 

func (r AWSRDSLowCPURule) Name() string

type AWSRDSUnencryptedRule 

type AWSRDSUnencryptedRule struct{}

AWSRDSUnencryptedRule flags RDS instances that do not have storage encryption enabled. Unencrypted RDS storage exposes database files, automated backups, and read replicas to unauthorised access at the storage layer.

func (AWSRDSUnencryptedRule) Evaluate 

func (r AWSRDSUnencryptedRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one CRITICAL finding per RDS instance where StorageEncrypted == false. CRITICAL severity reflects the sensitivity of database workloads compared to general EBS volumes.

func (AWSRDSUnencryptedRule) ID 

func (r AWSRDSUnencryptedRule) ID() string

func (AWSRDSUnencryptedRule) Name 

func (r AWSRDSUnencryptedRule) Name() string

type AWSRootAccessKeyExistsRule 

type AWSRootAccessKeyExistsRule struct{}

AWSRootAccessKeyExistsRule flags AWS accounts where the root account has active access keys. Root access keys represent the highest possible security risk: if compromised, the attacker has unrestricted access to the entire account.

func (AWSRootAccessKeyExistsRule) Evaluate 

func (r AWSRootAccessKeyExistsRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one CRITICAL finding when the root account has access keys.

func (AWSRootAccessKeyExistsRule) ID 

func (r AWSRootAccessKeyExistsRule) ID() string

func (AWSRootAccessKeyExistsRule) Name 

func (r AWSRootAccessKeyExistsRule) Name() string

type AWSRootAccountMFADisabledRule 

type AWSRootAccountMFADisabledRule struct{}

AWSRootAccountMFADisabledRule flags AWS accounts where the root account does not have MFA enabled. Without MFA, a compromised root password gives an attacker unrestricted account access with no second factor to stop them.

DataAvailable must be true (GetAccountSummary succeeded) before evaluating MFA status to avoid false positives from collection failures.

func (AWSRootAccountMFADisabledRule) Evaluate 

func (r AWSRootAccountMFADisabledRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one CRITICAL finding when the root account has no MFA.

func (AWSRootAccountMFADisabledRule) ID 

func (r AWSRootAccountMFADisabledRule) ID() string

func (AWSRootAccountMFADisabledRule) Name 

func (r AWSRootAccountMFADisabledRule) Name() string

type AWSS3DefaultEncryptionMissingRule 

type AWSS3DefaultEncryptionMissingRule struct{}

AWSS3DefaultEncryptionMissingRule flags S3 buckets that do not have server-side encryption configured as the default. Without default encryption, objects uploaded without explicit SSE settings are stored in plaintext.

func (AWSS3DefaultEncryptionMissingRule) Evaluate 

func (r AWSS3DefaultEncryptionMissingRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per S3 bucket where DefaultEncryptionEnabled == false.

func (AWSS3DefaultEncryptionMissingRule) ID 

func (r AWSS3DefaultEncryptionMissingRule) ID() string

func (AWSS3DefaultEncryptionMissingRule) Name 

func (r AWSS3DefaultEncryptionMissingRule) Name() string

type AWSS3PublicBucketRule 

type AWSS3PublicBucketRule struct{}

AWSS3PublicBucketRule flags S3 buckets that do not have all four public-access block settings enabled. A public S3 bucket risks unintended data exposure.

func (AWSS3PublicBucketRule) Evaluate 

func (r AWSS3PublicBucketRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per S3 bucket where Public == true. Security rules read ctx.RegionData.Security which is populated by the security collector with account-level data.

func (AWSS3PublicBucketRule) ID 

func (r AWSS3PublicBucketRule) ID() string

func (AWSS3PublicBucketRule) Name 

func (r AWSS3PublicBucketRule) Name() string

type AWSSavingsPlanUnderutilizedRule 

type AWSSavingsPlanUnderutilizedRule struct{}

AWSSavingsPlanUnderutilizedRule flags regions where Savings Plan coverage is below the threshold and the un-covered on-demand spend is material enough to justify action.

One finding is emitted per region entry in RegionData.SavingsPlanCoverage. Severity is HIGH for coverage < 40% and MEDIUM for 40–60%.

func (AWSSavingsPlanUnderutilizedRule) Evaluate 

func (r AWSSavingsPlanUnderutilizedRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one Finding per SavingsPlanCoverage entry that has CoveragePercent < 60 and OnDemandCostUSD > 100.

func (AWSSavingsPlanUnderutilizedRule) ID 

func (r AWSSavingsPlanUnderutilizedRule) ID() string

func (AWSSavingsPlanUnderutilizedRule) Name 

func (r AWSSavingsPlanUnderutilizedRule) Name() string

type AWSSecurityGroupOpenSSHRule 

type AWSSecurityGroupOpenSSHRule struct{}

AWSSecurityGroupOpenSSHRule flags EC2 security groups that allow unrestricted inbound access to remote admin ports (SSH port 22 or RDP port 3389) from the public internet (0.0.0.0/0 or ::/0). Each security group produces at most one finding regardless of how many open rules it contains.

func (AWSSecurityGroupOpenSSHRule) Evaluate 

func (r AWSSecurityGroupOpenSSHRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per security group that exposes SSH (22) or RDP (3389) to the internet. Duplicate matches within the same group are deduplicated so one security group produces exactly one finding.

func (AWSSecurityGroupOpenSSHRule) ID 

func (r AWSSecurityGroupOpenSSHRule) ID() string

func (AWSSecurityGroupOpenSSHRule) Name 

func (r AWSSecurityGroupOpenSSHRule) Name() string

type DefaultRuleRegistry 

type DefaultRuleRegistry struct {
	// contains filtered or unexported fields
}

DefaultRuleRegistry is a simple, ordered, in-memory registry. Rules are evaluated in registration order. Register panics on duplicate rule IDs to catch wiring mistakes at startup.

func NewDefaultRuleRegistry 

func NewDefaultRuleRegistry() *DefaultRuleRegistry

NewDefaultRuleRegistry returns an empty registry ready for rule registration.

func (*DefaultRuleRegistry) All 

func (r *DefaultRuleRegistry) All() []Rule

All returns all registered rules in registration order.

func (*DefaultRuleRegistry) EvaluateAll 

func (r *DefaultRuleRegistry) EvaluateAll(ctx RuleContext) []models.Finding

EvaluateAll runs every registered rule against ctx and returns the merged findings slice. Rules are called sequentially in registration order.

func (*DefaultRuleRegistry) Register 

func (r *DefaultRuleRegistry) Register(rule Rule)

Register adds rule to the registry. Panics if the same ID is registered twice.

type EKSClusterLoggingDisabledRule 

type EKSClusterLoggingDisabledRule struct{}

EKSClusterLoggingDisabledRule fires when no EKS control-plane log types are enabled. Without logging, audit and authentication events cannot be reviewed for anomalies or security incidents.

func (EKSClusterLoggingDisabledRule) Evaluate 

func (r EKSClusterLoggingDisabledRule) Evaluate(ctx RuleContext) []models.Finding

func (EKSClusterLoggingDisabledRule) ID 

func (r EKSClusterLoggingDisabledRule) ID() string

func (EKSClusterLoggingDisabledRule) Name 

func (r EKSClusterLoggingDisabledRule) Name() string

type EKSControlPlaneLoggingDisabledRule 

type EKSControlPlaneLoggingDisabledRule struct{}

EKSControlPlaneLoggingDisabledRule fires when the EKS cluster does not have all required control-plane log types enabled (api, audit, authenticator). A partial or missing logging configuration leaves gaps in security audit trails: authentication events, API calls, and control-plane access are unrecorded.

func (EKSControlPlaneLoggingDisabledRule) Evaluate 

func (r EKSControlPlaneLoggingDisabledRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns a finding when any of api, audit, or authenticator log types are absent from EKSData.LoggingTypes. The finding targets the EKS cluster resource.

func (EKSControlPlaneLoggingDisabledRule) ID 

func (r EKSControlPlaneLoggingDisabledRule) ID() string

func (EKSControlPlaneLoggingDisabledRule) Name 

func (r EKSControlPlaneLoggingDisabledRule) Name() string

type EKSEncryptionDisabledRule 

type EKSEncryptionDisabledRule struct{}

EKSEncryptionDisabledRule fires when the EKS cluster has no encryption configuration, leaving Kubernetes Secrets stored in etcd unencrypted at rest. Without envelope encryption via AWS KMS, a datastore compromise exposes all secrets.

func (EKSEncryptionDisabledRule) Evaluate 

func (r EKSEncryptionDisabledRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns a CRITICAL finding when EKSData.EncryptionEnabled is false.

func (EKSEncryptionDisabledRule) ID 

func (r EKSEncryptionDisabledRule) ID() string

func (EKSEncryptionDisabledRule) Name 

func (r EKSEncryptionDisabledRule) Name() string

type EKSNodeRoleOverpermissiveRule 

type EKSNodeRoleOverpermissiveRule struct{}

EKSNodeRoleOverpermissiveRule fires when the IAM role attached to a node group carries overpermissive policies (AdministratorAccess attached, or an inline policy with Action:"*"). A compromised node can then assume the instance role and perform unrestricted AWS API calls across the account.

func (EKSNodeRoleOverpermissiveRule) Evaluate 

func (r EKSNodeRoleOverpermissiveRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns a CRITICAL finding when EKSData.NodeRolePolicies is non-empty.

func (EKSNodeRoleOverpermissiveRule) ID 

func (r EKSNodeRoleOverpermissiveRule) ID() string

func (EKSNodeRoleOverpermissiveRule) Name 

func (r EKSNodeRoleOverpermissiveRule) Name() string

type EKSOIDCProviderMissingRule 

type EKSOIDCProviderMissingRule struct{}

EKSOIDCProviderMissingRule fires when the EKS cluster has no OIDC provider configured. Without an OIDC provider, IAM Roles for Service Accounts (IRSA) cannot be used, forcing workloads to use EC2 instance role permissions which violate the principle of least privilege.

func (EKSOIDCProviderMissingRule) Evaluate 

func (r EKSOIDCProviderMissingRule) Evaluate(ctx RuleContext) []models.Finding

func (EKSOIDCProviderMissingRule) ID 

func (r EKSOIDCProviderMissingRule) ID() string

func (EKSOIDCProviderMissingRule) Name 

func (r EKSOIDCProviderMissingRule) Name() string

type EKSOIDCProviderNotAssociatedRule 

type EKSOIDCProviderNotAssociatedRule struct{}

EKSOIDCProviderNotAssociatedRule fires when no IAM OIDC provider ARN is associated with the EKS cluster. Without an IAM OIDC provider, workloads cannot use IAM Roles for Service Accounts (IRSA) and must rely on the broader EC2 instance role, violating the principle of least privilege.

func (EKSOIDCProviderNotAssociatedRule) Evaluate 

func (r EKSOIDCProviderNotAssociatedRule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns a HIGH finding when EKSData.OIDCProviderARN is empty.

func (EKSOIDCProviderNotAssociatedRule) ID 

func (r EKSOIDCProviderNotAssociatedRule) ID() string

func (EKSOIDCProviderNotAssociatedRule) Name 

func (r EKSOIDCProviderNotAssociatedRule) Name() string

type EKSPublicEndpointRule 

type EKSPublicEndpointRule struct{}

EKSPublicEndpointRule fires when the EKS cluster API server endpoint is publicly accessible from the internet. Restricting endpoint access to private VPC traffic significantly reduces the control-plane attack surface.

func (EKSPublicEndpointRule) Evaluate 

func (r EKSPublicEndpointRule) Evaluate(ctx RuleContext) []models.Finding

func (EKSPublicEndpointRule) ID 

func (r EKSPublicEndpointRule) ID() string

func (EKSPublicEndpointRule) Name 

func (r EKSPublicEndpointRule) Name() string

type EKSServiceAccountNoIRSARule 

type EKSServiceAccountNoIRSARule struct{}

EKSServiceAccountNoIRSARule fires for each Kubernetes ServiceAccount that lacks the eks.amazonaws.com/role-arn annotation. Without IRSA, the workload running under that ServiceAccount inherits the broad EC2 instance role rather than a dedicated least-privilege IAM role. Scope: cluster-wide; use --exclude-system to skip kube-system findings.

func (EKSServiceAccountNoIRSARule) Evaluate 

func (r EKSServiceAccountNoIRSARule) Evaluate(ctx RuleContext) []models.Finding

Evaluate returns one HIGH finding per ServiceAccount missing the IRSA annotation.

func (EKSServiceAccountNoIRSARule) ID 

func (r EKSServiceAccountNoIRSARule) ID() string

func (EKSServiceAccountNoIRSARule) Name 

func (r EKSServiceAccountNoIRSARule) Name() string

type K8SClusterSingleNodeRule 

type K8SClusterSingleNodeRule struct{}

K8SClusterSingleNodeRule fires when the cluster has exactly one node, indicating no redundancy for workloads.

func (K8SClusterSingleNodeRule) Evaluate 

func (r K8SClusterSingleNodeRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SClusterSingleNodeRule) ID 

func (r K8SClusterSingleNodeRule) ID() string

func (K8SClusterSingleNodeRule) Name 

func (r K8SClusterSingleNodeRule) Name() string

type K8SDefaultServiceAccountUsedRule 

type K8SDefaultServiceAccountUsedRule struct{}

K8SDefaultServiceAccountUsedRule fires for each pod whose spec.serviceAccountName is "default". Using the default ServiceAccount violates the principle of least privilege: workloads inherit any permissions that accumulate on the cluster-scoped default account.

func (K8SDefaultServiceAccountUsedRule) Evaluate 

func (r K8SDefaultServiceAccountUsedRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SDefaultServiceAccountUsedRule) ID 

func (r K8SDefaultServiceAccountUsedRule) ID() string

func (K8SDefaultServiceAccountUsedRule) Name 

func (r K8SDefaultServiceAccountUsedRule) Name() string

type K8SNamespacePSSNotSetRule 

type K8SNamespacePSSNotSetRule struct{}

K8SNamespacePSSNotSetRule fires for each namespace that does not carry the pod-security.kubernetes.io/enforce label. Without this label the namespace has no Pod Security Standards enforcement, and any pod — including privileged ones — can be scheduled into it.

func (K8SNamespacePSSNotSetRule) Evaluate 

func (r K8SNamespacePSSNotSetRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SNamespacePSSNotSetRule) ID 

func (r K8SNamespacePSSNotSetRule) ID() string

func (K8SNamespacePSSNotSetRule) Name 

func (r K8SNamespacePSSNotSetRule) Name() string

type K8SNamespaceWithoutLimitsRule 

type K8SNamespaceWithoutLimitsRule struct{}

K8SNamespaceWithoutLimitsRule fires for each namespace that has no LimitRange object, meaning pods can consume unbounded CPU and memory resources.

func (K8SNamespaceWithoutLimitsRule) Evaluate 

func (r K8SNamespaceWithoutLimitsRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SNamespaceWithoutLimitsRule) ID 

func (r K8SNamespaceWithoutLimitsRule) ID() string

func (K8SNamespaceWithoutLimitsRule) Name 

func (r K8SNamespaceWithoutLimitsRule) Name() string

type K8SNodeOverallocatedRule 

type K8SNodeOverallocatedRule struct{}

K8SNodeOverallocatedRule fires for each node where the allocatable CPU is less than overallocatedCPUThresholdPercent of the node's total CPU capacity.

func (K8SNodeOverallocatedRule) Evaluate 

func (r K8SNodeOverallocatedRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SNodeOverallocatedRule) ID 

func (r K8SNodeOverallocatedRule) ID() string

func (K8SNodeOverallocatedRule) Name 

func (r K8SNodeOverallocatedRule) Name() string

type K8SPSSCapSysAdminRule 

type K8SPSSCapSysAdminRule struct{}

K8SPSSCapSysAdminRule fires for each container that adds the SYS_ADMIN Linux capability. SYS_ADMIN is the broadest Linux capability, providing near-root access and is explicitly prohibited under the PSS restricted profile.

func (K8SPSSCapSysAdminRule) Evaluate 

func (r K8SPSSCapSysAdminRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPSSCapSysAdminRule) ID 

func (r K8SPSSCapSysAdminRule) ID() string

func (K8SPSSCapSysAdminRule) Name 

func (r K8SPSSCapSysAdminRule) Name() string

type K8SPSSHostNetworkRule 

type K8SPSSHostNetworkRule struct{}

K8SPSSHostNetworkRule fires for each pod running with spec.hostNetwork == true. Sharing the host network namespace bypasses network isolation and exposes host network interfaces directly to the container.

func (K8SPSSHostNetworkRule) Evaluate 

func (r K8SPSSHostNetworkRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPSSHostNetworkRule) ID 

func (r K8SPSSHostNetworkRule) ID() string

func (K8SPSSHostNetworkRule) Name 

func (r K8SPSSHostNetworkRule) Name() string

type K8SPSSHostPIDOrIPCRule 

type K8SPSSHostPIDOrIPCRule struct{}

K8SPSSHostPIDOrIPCRule fires for each pod with spec.hostPID == true or spec.hostIPC == true. These settings grant containers access to host-level process and IPC namespaces, enabling privilege escalation and data exfiltration.

func (K8SPSSHostPIDOrIPCRule) Evaluate 

func (r K8SPSSHostPIDOrIPCRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPSSHostPIDOrIPCRule) ID 

func (r K8SPSSHostPIDOrIPCRule) ID() string

func (K8SPSSHostPIDOrIPCRule) Name 

func (r K8SPSSHostPIDOrIPCRule) Name() string

type K8SPSSNoSeccompRule 

type K8SPSSNoSeccompRule struct{}

K8SPSSNoSeccompRule fires for each container whose effective seccomp profile type is not "RuntimeDefault" or "Localhost". An absent or "Unconfined" seccomp profile means no syscall filtering is applied, broadening the attack surface. The effective profile is resolved at collection time (container overrides pod).

func (K8SPSSNoSeccompRule) Evaluate 

func (r K8SPSSNoSeccompRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPSSNoSeccompRule) ID 

func (r K8SPSSNoSeccompRule) ID() string

func (K8SPSSNoSeccompRule) Name 

func (r K8SPSSNoSeccompRule) Name() string

type K8SPSSPrivilegedContainerRule 

type K8SPSSPrivilegedContainerRule struct{}

K8SPSSPrivilegedContainerRule fires for each container running with securityContext.privileged == true. This is a PSS-enforcement-branded check under the Baseline and Restricted Pod Security Standards profiles.

func (K8SPSSPrivilegedContainerRule) Evaluate 

func (r K8SPSSPrivilegedContainerRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPSSPrivilegedContainerRule) ID 

func (r K8SPSSPrivilegedContainerRule) ID() string

func (K8SPSSPrivilegedContainerRule) Name 

func (r K8SPSSPrivilegedContainerRule) Name() string

type K8SPSSRunAsRootRule 

type K8SPSSRunAsRootRule struct{}

K8SPSSRunAsRootRule fires for each container where the effective security context does not prevent root execution: runAsNonRoot is absent or false, or runAsUser is explicitly 0 (root UID). The effective values are resolved at collection time (container overrides pod).

func (K8SPSSRunAsRootRule) Evaluate 

func (r K8SPSSRunAsRootRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPSSRunAsRootRule) ID 

func (r K8SPSSRunAsRootRule) ID() string

func (K8SPSSRunAsRootRule) Name 

func (r K8SPSSRunAsRootRule) Name() string

type K8SPodNoResourceRequestsRule 

type K8SPodNoResourceRequestsRule struct{}

K8SPodNoResourceRequestsRule fires for each container that is missing a CPU or memory resource request. Without requests the scheduler cannot make accurate placement decisions and quality-of-service guarantees are lost.

func (K8SPodNoResourceRequestsRule) Evaluate 

func (r K8SPodNoResourceRequestsRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPodNoResourceRequestsRule) ID 

func (r K8SPodNoResourceRequestsRule) ID() string

func (K8SPodNoResourceRequestsRule) Name 

func (r K8SPodNoResourceRequestsRule) Name() string

type K8SPodSecurityAdmissionNotEnforcedRule 

type K8SPodSecurityAdmissionNotEnforcedRule struct{}

K8SPodSecurityAdmissionNotEnforcedRule fires once when no namespace in the cluster carries the pod-security.kubernetes.io/enforce label. This means Pod Security Admission (PSA) is not enforced anywhere in the cluster, so the Kubernetes API server will not reject non-compliant pods at admission time.

func (K8SPodSecurityAdmissionNotEnforcedRule) Evaluate 

func (r K8SPodSecurityAdmissionNotEnforcedRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPodSecurityAdmissionNotEnforcedRule) ID 

func (r K8SPodSecurityAdmissionNotEnforcedRule) ID() string

func (K8SPodSecurityAdmissionNotEnforcedRule) Name 

func (r K8SPodSecurityAdmissionNotEnforcedRule) Name() string

type K8SPrivilegedContainerRule 

type K8SPrivilegedContainerRule struct{}

K8SPrivilegedContainerRule fires for each container running with securityContext.privileged == true. Privileged containers have full host access and significantly expand the attack surface.

func (K8SPrivilegedContainerRule) Evaluate 

func (r K8SPrivilegedContainerRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SPrivilegedContainerRule) ID 

func (r K8SPrivilegedContainerRule) ID() string

func (K8SPrivilegedContainerRule) Name 

func (r K8SPrivilegedContainerRule) Name() string

type K8SServiceAccountTokenAutomountRule 

type K8SServiceAccountTokenAutomountRule struct{}

K8SServiceAccountTokenAutomountRule fires for each ServiceAccount whose automountServiceAccountToken field is not explicitly set to false. By default Kubernetes mounts the token into every pod that uses the ServiceAccount, giving any compromised container access to the Kubernetes API.

func (K8SServiceAccountTokenAutomountRule) Evaluate 

func (r K8SServiceAccountTokenAutomountRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SServiceAccountTokenAutomountRule) ID 

func (r K8SServiceAccountTokenAutomountRule) ID() string

func (K8SServiceAccountTokenAutomountRule) Name 

func (r K8SServiceAccountTokenAutomountRule) Name() string

type K8SServicePublicLoadBalancerRule 

type K8SServicePublicLoadBalancerRule struct{}

K8SServicePublicLoadBalancerRule fires for each Service of type LoadBalancer that does NOT carry the AWS internal load-balancer annotation.

func (K8SServicePublicLoadBalancerRule) Evaluate 

func (r K8SServicePublicLoadBalancerRule) Evaluate(ctx RuleContext) []models.Finding

func (K8SServicePublicLoadBalancerRule) ID 

func (r K8SServicePublicLoadBalancerRule) ID() string

func (K8SServicePublicLoadBalancerRule) Name 

func (r K8SServicePublicLoadBalancerRule) Name() string

type Rule 

type Rule interface {
	// ID returns the unique, stable identifier for this rule (e.g. "EC2_LOW_CPU").
	ID() string

	// Name returns a short human-readable rule name.
	Name() string

	// Evaluate inspects the provided context and returns zero or more findings.
	// An empty slice means no issue was detected.
	Evaluate(ctx RuleContext) []models.Finding
}

Rule is a single deterministic waste-detection rule. Rules must be stateless and safe to call concurrently. They must never call the AWS SDK, LLM, or any external service.

type RuleContext 

type RuleContext struct {
	// AccountID is the AWS account being evaluated.
	AccountID string

	// Profile is the AWS profile name for this evaluation run.
	Profile string

	// RegionData holds all resources collected from the target region.
	RegionData *models.AWSRegionData

	// CostSummary is the account-level Cost Explorer data, shared across
	// all regional evaluations. May be nil if collection failed.
	CostSummary *models.AWSCostSummary

	// Policy holds the active PolicyConfig for threshold overrides. May be nil
	// when no policy file is loaded; rules must treat nil as "use defaults".
	Policy *policy.PolicyConfig

	// ClusterData holds Kubernetes cluster inventory for K8s rule evaluation.
	// Nil when running AWS audits; K8s rules must check for nil before use.
	ClusterData *models.KubernetesClusterData
}

RuleContext carries all collected data for a single region and profile. It is the sole input to Rule.Evaluate and must contain everything a rule needs; rules must never make network calls or read external state.

type RuleRegistry 

type RuleRegistry interface {
	// Register adds a rule to the registry. Panics on duplicate ID.
	Register(rule Rule)

	// All returns all registered rules in registration order.
	All() []Rule

	// EvaluateAll runs every registered rule against ctx and merges results.
	EvaluateAll(ctx RuleContext) []models.Finding
}

RuleRegistry manages the set of active rules and drives evaluation.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.