From 971d6d0d8700ed794624dce1e20f45367fbda0eb Mon Sep 17 00:00:00 2001 From: Benjamin Chouraqui Date: Tue, 24 Jun 2025 15:07:52 +0200 Subject: [PATCH 1/7] feat: added kics as a single-sourced repo Refs: K9VULN-5661 --- .gitignore | 6 ++++ .../iac_scanning/_index.md | 28 +++++++++++++++++++ .../iac_scanning/iac_scanning_rules/_index.md | 0 .../iac_scanning_rules/terraform/_index.md | 0 .../terraform/aws/_index.md | 0 .../terraform/azure/_index.md | 0 .../terraform/gcp/_index.md | 0 .../py/build/configurations/pull_config.yaml | 13 +++++++++ .../configurations/pull_config_preview.yaml | 13 +++++++++ 9 files changed, 60 insertions(+) create mode 100644 content/en/security/cloud_security_management/iac_scanning/_index.md create mode 100644 content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/_index.md create mode 100644 content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/_index.md create mode 100644 content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/aws/_index.md create mode 100644 content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/azure/_index.md create mode 100644 content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/gcp/_index.md diff --git a/.gitignore b/.gitignore index d5a291805bc98..878438268b0ef 100644 --- a/.gitignore +++ b/.gitignore @@ -127,6 +127,12 @@ content/en/code_analysis/static_analysis_rules/_index.md content/en/security/code_security/static_analysis/static_analysis_rules/* !content/en/security/code_security/static_analysis/static_analysis_rules/_index.md +# IaC Kics Rules +content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/** +!content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/*/ +!content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/*/*/ +!content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/**/_index.md + # Let's keep these so we don't accidentally re-add them to repo content/en/continuous_integration/static_analysis/github_actions.md content/en/continuous_integration/static_analysis/circleci_orbs.md diff --git a/content/en/security/cloud_security_management/iac_scanning/_index.md b/content/en/security/cloud_security_management/iac_scanning/_index.md new file mode 100644 index 0000000000000..c557a9619040e --- /dev/null +++ b/content/en/security/cloud_security_management/iac_scanning/_index.md @@ -0,0 +1,28 @@ +--- +title: IaC Scanning +further_reading: + - link: "/security/cloud_security_management/setup/iac_scanning" + tag: "Documentation" + text: "Setting up IaC Scanning" + - link: "https://www.datadoghq.com/blog/iac-scanning-tools/" + tag: "Blog" + text: "Building on open source IaC scanning tools with Datadog" +--- + +{{< callout url="https://www.datadoghq.com/product-preview/iac-security/" >}} + Static Infrastructure as Code (IaC) scanning is in Preview. To request access, complete the form. +{{< /callout >}} + +Static Infrastructure as Code (IaC) scanning integrates with version control systems, such as GitHub, to detect misconfigurations in cloud resources defined by Terraform. The scanning results are displayed in two primary locations: within pull requests during code modifications and on the **Findings** page within Cloud Security. + +
Static IaC scanning supports GitHub for version control and Terraform for infrastructure as code.
+ +{{< img src="security/csm/iac_scanning_explorer3.png" alt="Cloud Security Findings page displaying detected misconfigurations in cloud resources" width="100%">}} + +When you click on a finding, the side panel reveals additional details, including a short description of the IaC rule related to the finding and a preview of the offending code. + +{{< img src="security/csm/iac_scanning_finding_2.png" alt="Finding side panel highlighting undefined EBS volume encryption in Terraform code." width="100%">}} + +## Further reading + +{{< partial name="whats-next/whats-next.html" >}} \ No newline at end of file diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/_index.md b/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/_index.md new file mode 100644 index 0000000000000..e69de29bb2d1d diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/_index.md b/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/_index.md new file mode 100644 index 0000000000000..e69de29bb2d1d diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/aws/_index.md b/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/aws/_index.md new file mode 100644 index 0000000000000..e69de29bb2d1d diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/azure/_index.md b/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/azure/_index.md new file mode 100644 index 0000000000000..e69de29bb2d1d diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/gcp/_index.md b/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/gcp/_index.md new file mode 100644 index 0000000000000..e69de29bb2d1d diff --git a/local/bin/py/build/configurations/pull_config.yaml b/local/bin/py/build/configurations/pull_config.yaml index cdd82d1adfa71..e9105e705669f 100644 --- a/local/bin/py/build/configurations/pull_config.yaml +++ b/local/bin/py/build/configurations/pull_config.yaml @@ -621,3 +621,16 @@ dependencies: ["https://github.com/DataDog/dd-trace-rb/blob/release/docs/legacy/Compatibility-v1.md"] title: (Legacy) Ruby Compatibility Requirements + - repo_name: kics + contents: + - action: pull-and-push-folder + branch: benjamin.chouraqui/write-script-to-generate-markdown-files + globs: + - documentation/rules/**/**/*.md + options: + dest_dir: '/security/cloud_security_management/iac_scanning/iac_scanning_rules/' + path_to_remove: 'documentation/rules' + front_matters: + dependencies: ["https://github.com/DataDog/kics/blob/4a03fdb28eaa41cb1735b9eaa34afb911579088a/documentation/frontmatter.yaml"] + title: DataDog IaC Kics Rules + diff --git a/local/bin/py/build/configurations/pull_config_preview.yaml b/local/bin/py/build/configurations/pull_config_preview.yaml index 93c48d903f17a..f15424e33a3a3 100644 --- a/local/bin/py/build/configurations/pull_config_preview.yaml +++ b/local/bin/py/build/configurations/pull_config_preview.yaml @@ -620,3 +620,16 @@ front_matters: dependencies: ["https://github.com/DataDog/dd-trace-rb/blob/release/docs/legacy/Compatibility-v1.md"] title: (Legacy) Ruby Compatibility Requirements + + - repo_name: kics + contents: + - action: pull-and-push-folder + branch: benjamin.chouraqui/write-script-to-generate-markdown-files + globs: + - documentation/rules/**/**/*.md + options: + dest_dir: '/security/cloud_security_management/iac_scanning/iac_scanning_rules/' + path_to_remove: 'documentation/rules' + front_matters: + dependencies: ["https://github.com/DataDog/kics/blob/4a03fdb28eaa41cb1735b9eaa34afb911579088a/documentation/frontmatter.yaml"] + title: DataDog IaC Kics Rules From 4ff04e5eaf555ee6bb9c2eabbcf53067c76b05b6 Mon Sep 17 00:00:00 2001 From: Benjamin Chouraqui Date: Tue, 24 Jun 2025 15:20:25 +0200 Subject: [PATCH 2/7] style: moved the files to the right place Refs: K9VULN-5661 --- .gitignore | 8 +++--- .../iac_scanning/_index.md | 28 ------------------- .../iac_security_rules}/_index.md | 0 .../iac_security_rules}/terraform/_index.md | 0 .../terraform/aws/_index.md | 0 .../terraform/azure/_index.md | 0 .../terraform/gcp/_index.md | 0 7 files changed, 4 insertions(+), 32 deletions(-) delete mode 100644 content/en/security/cloud_security_management/iac_scanning/_index.md rename content/en/security/{cloud_security_management/iac_scanning/iac_scanning_rules => code_security/iac_security/iac_security_rules}/_index.md (100%) rename content/en/security/{cloud_security_management/iac_scanning/iac_scanning_rules => code_security/iac_security/iac_security_rules}/terraform/_index.md (100%) rename content/en/security/{cloud_security_management/iac_scanning/iac_scanning_rules => code_security/iac_security/iac_security_rules}/terraform/aws/_index.md (100%) rename content/en/security/{cloud_security_management/iac_scanning/iac_scanning_rules => code_security/iac_security/iac_security_rules}/terraform/azure/_index.md (100%) rename content/en/security/{cloud_security_management/iac_scanning/iac_scanning_rules => code_security/iac_security/iac_security_rules}/terraform/gcp/_index.md (100%) diff --git a/.gitignore b/.gitignore index 878438268b0ef..69d6343c203c0 100644 --- a/.gitignore +++ b/.gitignore @@ -128,10 +128,10 @@ content/en/security/code_security/static_analysis/static_analysis_rules/* !content/en/security/code_security/static_analysis/static_analysis_rules/_index.md # IaC Kics Rules -content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/** -!content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/*/ -!content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/*/*/ -!content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/**/_index.md +content/en/security/code_security/iac_security/iac_security_rules/** +!content/en/security/code_security/iac_security/iac_security_rules/*/ +!content/en/security/code_security/iac_security/iac_security_rules/*/*/ +!content/en/security/code_security/iac_security/iac_security_rules/**/_index.md # Let's keep these so we don't accidentally re-add them to repo content/en/continuous_integration/static_analysis/github_actions.md diff --git a/content/en/security/cloud_security_management/iac_scanning/_index.md b/content/en/security/cloud_security_management/iac_scanning/_index.md deleted file mode 100644 index c557a9619040e..0000000000000 --- a/content/en/security/cloud_security_management/iac_scanning/_index.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: IaC Scanning -further_reading: - - link: "/security/cloud_security_management/setup/iac_scanning" - tag: "Documentation" - text: "Setting up IaC Scanning" - - link: "https://www.datadoghq.com/blog/iac-scanning-tools/" - tag: "Blog" - text: "Building on open source IaC scanning tools with Datadog" ---- - -{{< callout url="https://www.datadoghq.com/product-preview/iac-security/" >}} - Static Infrastructure as Code (IaC) scanning is in Preview. To request access, complete the form. -{{< /callout >}} - -Static Infrastructure as Code (IaC) scanning integrates with version control systems, such as GitHub, to detect misconfigurations in cloud resources defined by Terraform. The scanning results are displayed in two primary locations: within pull requests during code modifications and on the **Findings** page within Cloud Security. - -
Static IaC scanning supports GitHub for version control and Terraform for infrastructure as code.
- -{{< img src="security/csm/iac_scanning_explorer3.png" alt="Cloud Security Findings page displaying detected misconfigurations in cloud resources" width="100%">}} - -When you click on a finding, the side panel reveals additional details, including a short description of the IaC rule related to the finding and a preview of the offending code. - -{{< img src="security/csm/iac_scanning_finding_2.png" alt="Finding side panel highlighting undefined EBS volume encryption in Terraform code." width="100%">}} - -## Further reading - -{{< partial name="whats-next/whats-next.html" >}} \ No newline at end of file diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/_index.md similarity index 100% rename from content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/_index.md rename to content/en/security/code_security/iac_security/iac_security_rules/_index.md diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/_index.md similarity index 100% rename from content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/_index.md rename to content/en/security/code_security/iac_security/iac_security_rules/terraform/_index.md diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/aws/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/aws/_index.md similarity index 100% rename from content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/aws/_index.md rename to content/en/security/code_security/iac_security/iac_security_rules/terraform/aws/_index.md diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/azure/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/azure/_index.md similarity index 100% rename from content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/azure/_index.md rename to content/en/security/code_security/iac_security/iac_security_rules/terraform/azure/_index.md diff --git a/content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/gcp/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/gcp/_index.md similarity index 100% rename from content/en/security/cloud_security_management/iac_scanning/iac_scanning_rules/terraform/gcp/_index.md rename to content/en/security/code_security/iac_security/iac_security_rules/terraform/gcp/_index.md From 830e4f78ee0d7bd29487353e1fc6bd45d2bff5dd Mon Sep 17 00:00:00 2001 From: Benjamin Chouraqui Date: Tue, 24 Jun 2025 19:02:35 +0200 Subject: [PATCH 3/7] style: moved the IaC files to the new place thy're supposed to be Also added them to the menu Refs: K9VULN-5661 --- .gitignore | 6 ++---- config/_default/menus/main.en.yaml | 5 +++++ .../iac_security/iac_security_rules/terraform/_index.md | 0 .../iac_security/iac_security_rules/terraform/aws/_index.md | 0 .../iac_security_rules/terraform/azure/_index.md | 0 .../iac_security/iac_security_rules/terraform/gcp/_index.md | 0 go.mod | 2 +- go.sum | 4 ++-- local/bin/py/build/configurations/pull_config.yaml | 4 ++-- local/bin/py/build/configurations/pull_config_preview.yaml | 4 ++-- 10 files changed, 14 insertions(+), 11 deletions(-) delete mode 100644 content/en/security/code_security/iac_security/iac_security_rules/terraform/_index.md delete mode 100644 content/en/security/code_security/iac_security/iac_security_rules/terraform/aws/_index.md delete mode 100644 content/en/security/code_security/iac_security/iac_security_rules/terraform/azure/_index.md delete mode 100644 content/en/security/code_security/iac_security/iac_security_rules/terraform/gcp/_index.md diff --git a/.gitignore b/.gitignore index 69d6343c203c0..d2c5424f20ce5 100644 --- a/.gitignore +++ b/.gitignore @@ -128,10 +128,8 @@ content/en/security/code_security/static_analysis/static_analysis_rules/* !content/en/security/code_security/static_analysis/static_analysis_rules/_index.md # IaC Kics Rules -content/en/security/code_security/iac_security/iac_security_rules/** -!content/en/security/code_security/iac_security/iac_security_rules/*/ -!content/en/security/code_security/iac_security/iac_security_rules/*/*/ -!content/en/security/code_security/iac_security/iac_security_rules/**/_index.md +content/en/security/code_security/iac_security/iac_security_rules/* +!content/en/security/code_security/iac_security/iac_security_rules/_index.md # Let's keep these so we don't accidentally re-add them to repo content/en/continuous_integration/static_analysis/github_actions.md diff --git a/config/_default/menus/main.en.yaml b/config/_default/menus/main.en.yaml index 4861d2e058a20..6e4347c79709d 100644 --- a/config/_default/menus/main.en.yaml +++ b/config/_default/menus/main.en.yaml @@ -6946,6 +6946,11 @@ menu: url: /security/code_security/iac_security/exclusions/ parent: code_security_iac_security weight: 100001 + - name: Rules + identifier: code_security_iac_security_rules + url: /security/code_security/iac_security/iac_security_rules/ + parent: code_security_iac_security + weight: 100002 - name: Developer Tool Integrations identifier: dev_tool_int url: /security/code_security/dev_tool_int/ diff --git a/content/en/security/code_security/iac_security/iac_security_rules/terraform/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/_index.md deleted file mode 100644 index e69de29bb2d1d..0000000000000 diff --git a/content/en/security/code_security/iac_security/iac_security_rules/terraform/aws/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/aws/_index.md deleted file mode 100644 index e69de29bb2d1d..0000000000000 diff --git a/content/en/security/code_security/iac_security/iac_security_rules/terraform/azure/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/azure/_index.md deleted file mode 100644 index e69de29bb2d1d..0000000000000 diff --git a/content/en/security/code_security/iac_security/iac_security_rules/terraform/gcp/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/terraform/gcp/_index.md deleted file mode 100644 index e69de29bb2d1d..0000000000000 diff --git a/go.mod b/go.mod index 011f55d2102a5..e7d45b1083458 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.14 require ( github.com/DataDog/websites-modules v1.4.235 // indirect - github.com/DataDog/websites-sources v0.0.0-20250606082516-6e5a26ff9d0e // indirect + github.com/DataDog/websites-sources v0.0.0-20250623110041-abe36d54e0a9 // indirect ) // replace github.com/DataDog/websites-modules => /Users/lisiane.turlure/guac/websites-modules diff --git a/go.sum b/go.sum index 08bad025832ea..bc2a9a9a2f3e5 100644 --- a/go.sum +++ b/go.sum @@ -1,4 +1,4 @@ github.com/DataDog/websites-modules v1.4.235 h1:4mHFdC2YH3w9zdxYuqShgr7Z8rgHPppxWFMKwM32GFU= github.com/DataDog/websites-modules v1.4.235/go.mod h1:CcQxAmCXoiFr3hNw6Q+1si65C3uOP1gB+7aX4S3h+CQ= -github.com/DataDog/websites-sources v0.0.0-20250606082516-6e5a26ff9d0e h1:F4Khh33ikLmXpHrBaz4vgoBusJhjQGVn/iavRxGsXiU= -github.com/DataDog/websites-sources v0.0.0-20250606082516-6e5a26ff9d0e/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs= +github.com/DataDog/websites-sources v0.0.0-20250623110041-abe36d54e0a9 h1:SnmbIKBA0iKvyyBh7j3PdgOLS45DgAreBJBMBT2qPJQ= +github.com/DataDog/websites-sources v0.0.0-20250623110041-abe36d54e0a9/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs= diff --git a/local/bin/py/build/configurations/pull_config.yaml b/local/bin/py/build/configurations/pull_config.yaml index e9105e705669f..76388f4b47ca5 100644 --- a/local/bin/py/build/configurations/pull_config.yaml +++ b/local/bin/py/build/configurations/pull_config.yaml @@ -628,8 +628,8 @@ globs: - documentation/rules/**/**/*.md options: - dest_dir: '/security/cloud_security_management/iac_scanning/iac_scanning_rules/' - path_to_remove: 'documentation/rules' + dest_dir: '/security/code_security/iac_security/iac_security_rules/' + path_to_remove: 'documentation/' front_matters: dependencies: ["https://github.com/DataDog/kics/blob/4a03fdb28eaa41cb1735b9eaa34afb911579088a/documentation/frontmatter.yaml"] title: DataDog IaC Kics Rules diff --git a/local/bin/py/build/configurations/pull_config_preview.yaml b/local/bin/py/build/configurations/pull_config_preview.yaml index f15424e33a3a3..20c1024a007b2 100644 --- a/local/bin/py/build/configurations/pull_config_preview.yaml +++ b/local/bin/py/build/configurations/pull_config_preview.yaml @@ -628,8 +628,8 @@ globs: - documentation/rules/**/**/*.md options: - dest_dir: '/security/cloud_security_management/iac_scanning/iac_scanning_rules/' - path_to_remove: 'documentation/rules' + dest_dir: '/security/code_security/iac_security/iac_security_rules/' + path_to_remove: 'documentation/' front_matters: dependencies: ["https://github.com/DataDog/kics/blob/4a03fdb28eaa41cb1735b9eaa34afb911579088a/documentation/frontmatter.yaml"] title: DataDog IaC Kics Rules From c7dc458a58c4182861b152f71cec4a9577beb82b Mon Sep 17 00:00:00 2001 From: Benjamin Chouraqui Date: Thu, 26 Jun 2025 12:18:33 +0200 Subject: [PATCH 4/7] feat: added filters on the IaC rules page Refs: K9VULN-5661, K9VULN-5662 --- .../iac_security/iac_security_rules/_index.md | 50 +++ go.mod | 2 +- go.sum | 4 +- layouts/iac_security/list.html | 406 ++++++++++++++++++ 4 files changed, 459 insertions(+), 3 deletions(-) create mode 100644 layouts/iac_security/list.html diff --git a/content/en/security/code_security/iac_security/iac_security_rules/_index.md b/content/en/security/code_security/iac_security/iac_security_rules/_index.md index e69de29bb2d1d..6538dfb6d37ec 100644 --- a/content/en/security/code_security/iac_security/iac_security_rules/_index.md +++ b/content/en/security/code_security/iac_security/iac_security_rules/_index.md @@ -0,0 +1,50 @@ +--- +title: IaC Rules +description: View rules for multiple languages for Static Code Analysis. +aliases: +- /continuous_integration/static_analysis/rules +- /static_analysis/rules +- /code_analysis/static_analysis_rules +- /security/code_security/static_analysis_rules +is_beta: false +type: iac_security + +cascade: + modal: + title: Try this rule and analyze your code with Datadog Code Security + top_box: + title: How to use this rule + steps: + - Create a static-analysis.datadog.yml with the content above at the root of your repository + - Use our free IDE Plugins or add Code Security scans to your CI pipelines + - Get feedback on your code + footer: For more information, please read the Code Security documentation + footer: + text: Use Datadog Code Security to catch code issues at every step of your development process + link: + name: Datadog Code Security + url: https://www.datadoghq.com/product/code-security/ + + banner: + title: "Seamless integrations. Try Datadog Code Security" + link: + name: Datadog Code Security + url: https://www.datadoghq.com/product/code-security/ + +further_reading: + - link: "/security/code_security/" + tag: "Documentation" + text: "Learn about Datadog Code Security" +--- + +{{% site-region region="gov" %}} +
+ Code Security is not available for the {{< region-param key="dd_site_name" >}} site. +
+{{% /site-region %}} + +## Overview + +Datadog Static Code Analysis provides out-of-the-box rules to help detect security vulnerabilities, bugs, and maintainability issues in your codebase. For more information, see the [Setup documentation][1]. + +[1]: /security/code_security/static_analysis/setup/ diff --git a/go.mod b/go.mod index e7d45b1083458..d7e4448886fb9 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.14 require ( github.com/DataDog/websites-modules v1.4.235 // indirect - github.com/DataDog/websites-sources v0.0.0-20250623110041-abe36d54e0a9 // indirect + github.com/DataDog/websites-sources v0.0.0-20250625141626-f25b35e87032 // indirect ) // replace github.com/DataDog/websites-modules => /Users/lisiane.turlure/guac/websites-modules diff --git a/go.sum b/go.sum index bc2a9a9a2f3e5..e4a5d9fcc3190 100644 --- a/go.sum +++ b/go.sum @@ -1,4 +1,4 @@ github.com/DataDog/websites-modules v1.4.235 h1:4mHFdC2YH3w9zdxYuqShgr7Z8rgHPppxWFMKwM32GFU= github.com/DataDog/websites-modules v1.4.235/go.mod h1:CcQxAmCXoiFr3hNw6Q+1si65C3uOP1gB+7aX4S3h+CQ= -github.com/DataDog/websites-sources v0.0.0-20250623110041-abe36d54e0a9 h1:SnmbIKBA0iKvyyBh7j3PdgOLS45DgAreBJBMBT2qPJQ= -github.com/DataDog/websites-sources v0.0.0-20250623110041-abe36d54e0a9/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs= +github.com/DataDog/websites-sources v0.0.0-20250625141626-f25b35e87032 h1:LFmm+r+X6KmYvAmp6/vjg3J3rqvF/gRoL1QXcj8L/ds= +github.com/DataDog/websites-sources v0.0.0-20250625141626-f25b35e87032/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs= diff --git a/layouts/iac_security/list.html b/layouts/iac_security/list.html new file mode 100644 index 0000000000000..a43e65849f8eb --- /dev/null +++ b/layouts/iac_security/list.html @@ -0,0 +1,406 @@ +{{ define "main" }} + {{ $dot := . }} + + + {{ $list := sort .Pages }} + + +
+
+

{{ .Title }}

+
+
+ {{ partial "breadcrumbs.html" . }} +
+
+ + {{ partial "translate_status_banner/translate_status_banner.html" . }} + {{ .Content }} + + {{ $products := slice }} + {{ $ruleset_params := .Params }} + {{ $pad := newScratch }} + + + {{ range ($list.GroupByParam "group_id") }} + {{ range .Pages }} + {{ $pad.Set "cloud_providers" ( union ($pad.Get "cloud_providers") (slice (( .Params.meta.cloud_provider ))) ) }} + {{ end }} + {{ end }} + + {{ $valid_clouds := $pad.Get "cloud_providers" }} +
+ {{/* DATA TABLE */}} +
+
+ {{ range $list.GroupByParam "group_id" }} + {{ $group_id := .Key }} + {{ $ruleset_title := index (index $ruleset_params.rulesets .Key) "title"}} + {{ $ruleset_description := index (index $ruleset_params.rulesets .Key) "description"}} +
+
+
+ {{printf "Ruleset ID: %s" .Key}} + {{$ruleset_description | markdownify}} +
+
+ {{ range .Pages }} + {{ $rule_cloud_provider := ( .Params.meta.cloud_provider ) }} + {{/* + build a string with rule's lookup info for filtering and searching against + */}} + {{ $rule_id := index (split .Params.meta.name "/") 1}} + {{ $filter_info := (printf "%s,%s,%s,%s" .Params.meta.cloud_provider .Params.meta.category .Params.meta.severity .Params.meta.cloud_provider) }} + {{ $rule_info := (replaceRE "(`|')" "" (delimit (slice $filter_info ($rule_id|lower) ($ruleset_description|lower) $ruleset_title .Params.group_id .Title ) ";")) }} +
+
+ {{ $int_logo := partial "integrations-logo.html" (dict "context" $dot "basename" $rule_cloud_provider "variant" "avatar") }} + {{ if $int_logo }} + {{$int_logo}} + {{ end }} + {{.Title}} +
+
+ {{ $rule_id }} +
>
+
+
+ + {{/* + build object with unique values for filter dropdowns (.filter-selection-container) + e.g: + filters: { + Cloud_Provider: [], + Category: [], + Severity: {} + } + */}} + {{ $pad.SetInMap "filters" "Cloud_Providers" (union (index ($pad.Get "filters") "Cloud_Providers") (slice .Params.meta.cloud_provider)) }} + {{ $pad.SetInMap "filters" "Categories" (union (index ($pad.Get "filters") "Categories") (slice .Params.meta.category)) }} + {{ $pad.SetInMap "filters" "Severities" (merge (index ($pad.Get "filters") "Severities") (dict (string .Params.meta.severity) .Params.meta.severity)) }} + {{/* + build object of arrays with unique cloud provider for each ruleset header (.ruleset-header ) + cloudProvidersByRuleset: { + rulesetID: [], + ... + } + */}} + {{ $pad.SetInMap "cloudProviderByRuleSet" $group_id (union (index ($pad.Get "cloudProviderByRuleSet") $group_id) (slice $rule_cloud_provider)) }} + {{ end }} +
+
+ + {{/* RULESET-HEADER - Keep here. scratch pad for cloudProviderByRuleSet needs to build first */}} + +
+ {{ end }} + {{/* hook into the app lifecycle. $watch for 'filteredRulesets' to change and update the 'showEmptyResultsMsg' property */}} +
+ +
+
+
+ {{/* NAV - Keep here. scratch pad for filters need to form first */}} + +
+ +

Further Reading

+ {{ partial "whats-next/whats-next.html" .}} +{{ end }} From 1133f720c0a66e7f896682fc777994c99b4f0e63 Mon Sep 17 00:00:00 2001 From: Benjamin Chouraqui Date: Fri, 27 Jun 2025 11:18:32 +0200 Subject: [PATCH 5/7] style: added names to the rules Refs: K9VULN-5661 --- go.mod | 2 +- go.sum | 4 ++-- layouts/iac_security/list.html | 26 +++++++++++++++----------- 3 files changed, 18 insertions(+), 14 deletions(-) diff --git a/go.mod b/go.mod index d7e4448886fb9..2faa10b892a3d 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.14 require ( github.com/DataDog/websites-modules v1.4.235 // indirect - github.com/DataDog/websites-sources v0.0.0-20250625141626-f25b35e87032 // indirect + github.com/DataDog/websites-sources v0.0.0-20250627063252-5189fcf5174c // indirect ) // replace github.com/DataDog/websites-modules => /Users/lisiane.turlure/guac/websites-modules diff --git a/go.sum b/go.sum index e4a5d9fcc3190..3e604bb1a9935 100644 --- a/go.sum +++ b/go.sum @@ -1,4 +1,4 @@ github.com/DataDog/websites-modules v1.4.235 h1:4mHFdC2YH3w9zdxYuqShgr7Z8rgHPppxWFMKwM32GFU= github.com/DataDog/websites-modules v1.4.235/go.mod h1:CcQxAmCXoiFr3hNw6Q+1si65C3uOP1gB+7aX4S3h+CQ= -github.com/DataDog/websites-sources v0.0.0-20250625141626-f25b35e87032 h1:LFmm+r+X6KmYvAmp6/vjg3J3rqvF/gRoL1QXcj8L/ds= -github.com/DataDog/websites-sources v0.0.0-20250625141626-f25b35e87032/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs= +github.com/DataDog/websites-sources v0.0.0-20250627063252-5189fcf5174c h1:0sl+TXCkfytaHeNgpWt46d87mMeRVC+CE3Rtfp0e2vc= +github.com/DataDog/websites-sources v0.0.0-20250627063252-5189fcf5174c/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs= diff --git a/layouts/iac_security/list.html b/layouts/iac_security/list.html index a43e65849f8eb..8ce31f4d7db33 100644 --- a/layouts/iac_security/list.html +++ b/layouts/iac_security/list.html @@ -232,21 +232,25 @@

{{ .Title }}

{{ $filter_info := (printf "%s,%s,%s,%s" .Params.meta.cloud_provider .Params.meta.category .Params.meta.severity .Params.meta.cloud_provider) }} {{ $rule_info := (replaceRE "(`|')" "" (delimit (slice $filter_info ($rule_id|lower) ($ruleset_description|lower) $ruleset_title .Params.group_id .Title ) ";")) }}
-
- {{ $int_logo := partial "integrations-logo.html" (dict "context" $dot "basename" $rule_cloud_provider "variant" "avatar") }} - {{ if $int_logo }} - {{$int_logo}} - {{ end }} - {{.Title}} -
-
- {{ $rule_id }} -
>
+
+
+ {{ $int_logo := partial "integrations-logo.html" (dict "context" $dot "basename" $rule_cloud_provider "variant" "avatar") }} + {{ if $int_logo }} + {{$int_logo}} + {{ end }} + {{.Params.meta.display_name}} +
+
+ + {{ $rule_id }} +
>
+ +
From 6057c302095b24db43344191e64774162112c0c1 Mon Sep 17 00:00:00 2001 From: Benjamin Chouraqui Date: Fri, 27 Jun 2025 14:34:21 +0200 Subject: [PATCH 6/7] refactor: changed branch to pull from to main Refs: K9VULN-5661 --- local/bin/py/build/configurations/pull_config.yaml | 2 +- local/bin/py/build/configurations/pull_config_preview.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/local/bin/py/build/configurations/pull_config.yaml b/local/bin/py/build/configurations/pull_config.yaml index 76388f4b47ca5..581b765b850bc 100644 --- a/local/bin/py/build/configurations/pull_config.yaml +++ b/local/bin/py/build/configurations/pull_config.yaml @@ -624,7 +624,7 @@ - repo_name: kics contents: - action: pull-and-push-folder - branch: benjamin.chouraqui/write-script-to-generate-markdown-files + branch: main globs: - documentation/rules/**/**/*.md options: diff --git a/local/bin/py/build/configurations/pull_config_preview.yaml b/local/bin/py/build/configurations/pull_config_preview.yaml index 20c1024a007b2..2c5d54a165141 100644 --- a/local/bin/py/build/configurations/pull_config_preview.yaml +++ b/local/bin/py/build/configurations/pull_config_preview.yaml @@ -624,7 +624,7 @@ - repo_name: kics contents: - action: pull-and-push-folder - branch: benjamin.chouraqui/write-script-to-generate-markdown-files + branch: main globs: - documentation/rules/**/**/*.md options: From 54326f4971b4e7264600acec7f186a338a22bd99 Mon Sep 17 00:00:00 2001 From: Benjamin Chouraqui Date: Fri, 27 Jun 2025 14:39:40 +0200 Subject: [PATCH 7/7] resetting go files --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2faa10b892a3d..011f55d2102a5 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.14 require ( github.com/DataDog/websites-modules v1.4.235 // indirect - github.com/DataDog/websites-sources v0.0.0-20250627063252-5189fcf5174c // indirect + github.com/DataDog/websites-sources v0.0.0-20250606082516-6e5a26ff9d0e // indirect ) // replace github.com/DataDog/websites-modules => /Users/lisiane.turlure/guac/websites-modules diff --git a/go.sum b/go.sum index 3e604bb1a9935..08bad025832ea 100644 --- a/go.sum +++ b/go.sum @@ -1,4 +1,4 @@ github.com/DataDog/websites-modules v1.4.235 h1:4mHFdC2YH3w9zdxYuqShgr7Z8rgHPppxWFMKwM32GFU= github.com/DataDog/websites-modules v1.4.235/go.mod h1:CcQxAmCXoiFr3hNw6Q+1si65C3uOP1gB+7aX4S3h+CQ= -github.com/DataDog/websites-sources v0.0.0-20250627063252-5189fcf5174c h1:0sl+TXCkfytaHeNgpWt46d87mMeRVC+CE3Rtfp0e2vc= -github.com/DataDog/websites-sources v0.0.0-20250627063252-5189fcf5174c/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs= +github.com/DataDog/websites-sources v0.0.0-20250606082516-6e5a26ff9d0e h1:F4Khh33ikLmXpHrBaz4vgoBusJhjQGVn/iavRxGsXiU= +github.com/DataDog/websites-sources v0.0.0-20250606082516-6e5a26ff9d0e/go.mod h1:RvGhXV0uQC6Ocs+n84QyL97kows6vg6VG5ZLQMHw4Fs=