GCP Rego files - CIS v8 Control 7: Vulnerability Management - #315
GCP Rego files - CIS v8 Control 7: Vulnerability Management#315alishapulva wants to merge 7 commits into
Conversation
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
All checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 61b6bbcbf3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # Security Command Center findings should be prioritised using severity, exploitability, asset context, and defined remediation SLAs. | ||
| # The remediation backlog must be reviewed monthly, or more frequently, and review outcomes must result in remediation, approved deferral, or formally accepted risk. | ||
| # Exceptions must include an approver, justification, expiry date, and follow-up action. | ||
| related_resources: |
There was a problem hiding this comment.
When this policy is loaded by OPA, this bare related_resources: line is parsed as Rego before the package declaration rather than as metadata, so the control cannot be parsed and any bundle/load that includes it will fail before evaluation. The surrounding metadata lines are all comments, so this line needs the same # prefix.
Useful? React with 👍 / 👎.
| deferrals_properly_managed if { | ||
| count(input.deferrals) == 0 |
There was a problem hiding this comment.
For a compliant OS patch run with no deferrals recorded, callers commonly omit the optional deferrals field rather than sending an empty array. In that case count(input.deferrals) is undefined, so neither branch of deferrals_properly_managed matches and the policy incorrectly fails even though the output path already treats the field as [] via get_array. Use the same fallback here before counting/iterating.
Useful? React with 👍 / 👎.
| "has_authenticated_scan_evidence": has_authenticated_scan_evidence, | ||
| "has_unauthenticated_scan_evidence": has_unauthenticated_scan_evidence, |
There was a problem hiding this comment.
When the program is configured but one of the scan-evidence checks is absent, the corresponding boolean rule is undefined rather than false; referencing it directly in the details object makes the whole result := output rule undefined, so callers get the generic default “Evaluation failed” response instead of the specific failure message below. Define false defaults for these rules or materialize explicit booleans before adding them to details.
Useful? React with 👍 / 👎.
1 participant
Summary
Adds GCP Rego policy files for CIS v8 Control 7 (Vulnerability Management), covering safeguards 7.1–7.7.
Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
These policies extend AutoAudit's engine to evaluate GCP environments against CIS v8 Control 7, adding coverage for vulnerability management safeguards that weren't previously implemented.
Testing Done
These policies haven't yet been tested against sample GCP data or validated with opa eval/opa test.
Security Considerations
No security impact, as these are read-only compliance evaluation policies.
Breaking Changes
Rollback Plan
Checklist