gombocai/orl repository overview

docker run -rm -v ./rules:/workspace orl:latest rules pull --channel default

docker run -rm -v ./rules:/rules -v ./code:/workspace orl:latest -rulespace /rules .

# rule.orl
type: Rule
version: v1
metadata:
  name: Some Unique Name
  priority: 0 # lower = executed first
  description: |
    Long description

  # Optional
  required_contexts:
    - "variables" # Skip the rule if no variables are defined

spec:
  language: terraform # the IaC language this can fix
  audit_language: ast # The parser to use to understand the IaC.  Only "ast" is supported

  # optional
  variables:
    - "foo.bar" # the "bar" variable in the "foo" variables namespace needs to be defined or the rule is skipped

  # optional
  # Collects all object across the entire workspace (all files)
  # {{ }} is the expr template language
  # This needs to be valid for the `audit_language`
  collect: |
    - name: logging_buckets
      audit: {{ aResource("aws_s3_bucket_logging_bucket", anAttribute("bucket")) }}

  # required
  # find objects that need to be fixed
  audit: |
    {{ aResource("aws_s3_bucket", aMissingBlock("logging")) }}

  # optional
  # skip the finding based on expr
  # In this example collect all the bucket strings, and check them to see if they are the name of the finding
  skip_finding: 'collect(collections, "logging-rules.*.bucket") | hasSubString( finding.name )'

  # List of commands to execute per finding
  # commands are
  #  audit - throw an error.  value is the text
  #  replace - replace the finding with value
  #  insert_before - insert value before the finding
  #  insert_after - insert value after the finding
  remediation:
    - command: audit
      value: "{{ finding.name }}"

# vars.orl
type: Variables
version: v1
metadata:
  name: foo # This is the namespace where the variable live
data:
  bar: "baz" # All variables are defined here as strings