@candidpartners/snitch-utils

Matter Compliance - Snitch Utilities

This repo is now located on OneFirm Github at: https://github.com/McK-Internal/matter-compliance-snitch-utils

The snitch-utils package contains a set of common utilities that make it easier to author custom compliance rules

Usage

To install:

npm i @candidpartners/snitch-utils

Key exports:

• Rule utils

  import { isRule } from '@candidpartners/snitch-utils';
  
  const rule = {
    name: 'aws_my_rule',
    uuid: 'abc-123',
    docs: { description: 'My rule does something good' },
    groupName: 'myGroup',
    terraformType: 'aws_s3_resource',
    terraform: ({plan}) => {
      // ...
    }
  };
  
  isRule(rule); // true
  

• Terraform
  • TerraformPlan
    • Class wrappers for the terraform plan with a number of convenience functions for accessing resources
  • TerraformGraph
    • Used to build an in-memory graph of all resources in the terraform to evaluate relationships and inheritance
• Policy Analyzer
  • IAMPolicy
    • Class wrapper for an IAM Policy that provides evaluation of actions
  • PolicyStatement
    • Class wrapper for an individual policy statement

Development

snitch-core is a library used in numerous final products. As such, please use the Logger debug module to output debug information.

The src/lib/logger module will return the debugger prefixed like mce:utils.

Conditionally enable debug logging by setting DEBUG environment variable value.

When DEBUG is set to mce:*, mce:cli:* or mce:cli:terraform the snitch-cli ora terminal spinner is disabled and terraform cli output is written to process.stdout, otherwise terraform cli output is silenced, and the ora terminal spinner is enabled.

Example DEBUG values:

• * - enable all debug logging.
• mce:* - enable debug logging for all Matter Compliance packages.
• mce:cli - enable debug logging for only the snitch-cli Matter Compliance package modules which import Logger.
• mce:cli:terraform - enable debug logging for only the snitch-cli Matter Compliance package Terraform cli output.
• mce:cli:* - enable debug logging for all snitch-cli Matter Compliance package modules which extend Logger.
• mce:core:* - enable debug logging for the snitch-core Matter Compliance package modules which extend Logger.
• mce:rules:* - enable debug logging for the snitch-rules Matter Compliance package modules which extend Logger.
• mce:utils:* - enable debug logging for the snitch-utils Matter Compliance package modules which extend Logger.

Usage:

import type { ILogger } from '../logger';
import { Logger } from '../logger';

const iLogger = { namespace: 'terraform-plan' } as ILogger;
const logger = Logger(iLogger);
...
logger.debug('some useful information');

Action Allow Star Resource repository

Update the action-allow-star-resource.json repository with generation-action-list. Manually scan for acceptable modifications