policy

Documentation

Overview

Package policy is the Rego policy engine for `disco check`: local-store resources are handed to a prepared Rego query, which binds `data.disco.deny` to a set of finding objects.

Bring your own policies (Conftest AWS, regula, in-house bundles) via `--rules`. Curated first-party compliance packs (NIST 800-53, CIS, PCI-DSS, Well-Architected) are future work, not yet bundled.

Index

• Constants
• func AvailablePacks() []string
• func LoadPacks(names []string) (map[string]string, error)
• func RulesSHA256(paths []string, modules map[string]string) (string, error)
• type Engine
  • func NewEngine(_ context.Context, paths []string, modules map[string]string) (*Engine, error)
  • func (e *Engine) Evaluate(ctx context.Context, resources []store.Resource) ([]Finding, error)
• type Finding

Constants

const InputContractVersion = "1"

InputContractVersion identifies the input.* document shape handed to Rego policies. Bump on any breaking field-name/type change so BYO rules can pin against a known contract via `input.contractVersion == "1"` instead of failing silently on rename. Stamped into every resource input.

Functions

func AvailablePacks

func AvailablePacks() []string

AvailablePacks returns the names of bundled packs in stable order. Each entry maps to a subdirectory of internal/policy/ embedded via packsFS. Curated packs (full WAF, CIS, NIST 800-53, PCI-DSS, ISO 27001) are future work, not yet bundled.

func LoadPacks

func LoadPacks(names []string) (map[string]string, error)

LoadPacks reads the named packs and returns merged module sources keyed by "<pack>/<filename>" so compile errors point to the original .rego file. Unknown pack names error with the available-packs list.

func RulesSHA256

func RulesSHA256(paths []string, modules map[string]string) (string, error)

RulesSHA256 returns a deterministic hex-encoded sha256 over every .rego file under paths (files or directories, recursive) plus every in-memory module in modules. Hashed as a NUL-delimited `name\x00body\x00...` concatenation sorted by name, so any rule add/remove/edit perturbs it. Used as SARIF rule-pack provenance so attestations can prove which ruleset produced findings.

Module names normalize to a stable shape: filesystem paths become absolute then repo-relative via filepath.Clean; embedded pack entries (already keyed `<pack>/<file>`) round-trip unchanged. Empty input yields the sha256 of the empty string ("e3b0c4...").

Types

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

Engine wraps a compiled Rego module set and the parsed deny-query body. Build once per scan, evaluate per resource — compilation amortises across the loop. Uses the lower-level `ast` + `topdown` packages directly rather than `rego` to avoid pulling `internal/compiler/wasm` (~780 KB precompiled blob) into the binary; disco only ever evaluates against topdown.

func NewEngine

func NewEngine(_ context.Context, paths []string, modules map[string]string) (*Engine, error)

NewEngine compiles the Rego modules under paths (files or directories, recursive) AND any in-memory modules into a single compiler. Either argument may be empty — passing both empty yields an engine evaluating against an empty policy set (useful for smoke tests). Used by `disco check` to compose `--rules <dir>` with `--packs aws-waf` in one pass.

func (*Engine) Evaluate

func (e *Engine) Evaluate(ctx context.Context, resources []store.Resource) ([]Finding, error)

Evaluate runs the prepared query against each resource and aggregates every emitted Finding. Resource attributes are decoded from AttributesJSON so policies can address fields directly without parsing.

type Finding

type Finding struct {
	ID          string            `json:"id"`
	Severity    string            `json:"severity"`
	Message     string            `json:"message"`
	ResourceID  string            `json:"resourceId"`
	Provider    string            `json:"provider,omitempty"`
	Type        string            `json:"type,omitempty"`
	Name        string            `json:"name,omitempty"`
	Region      string            `json:"region,omitempty"`
	Tags        map[string]string `json:"tags,omitempty"`
	Category    string            `json:"category,omitempty"`
	Remediation string            `json:"remediation,omitempty"`
	RefURL      string            `json:"refUrl,omitempty"`
}

Finding is the slim, JSON-friendly shape produced by the engine. Field names match the Rego object keys callers must emit.