-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* wip aws-s3 * progress * s3 consumer done * Update components/consumers/aws-s3/main.go Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update components/consumers/aws-s3/main.go Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update components/consumers/aws-s3/main.go Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * lint * fix trigger happy reviewdog change --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
- Loading branch information
1 parent
ea29151
commit 44b6e54
Showing
8 changed files
with
314 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| subinclude( | ||
| "//build/defs:buildkit", | ||
| "//build/defs:dracon", | ||
| ) | ||
|
|
||
| go_binary( | ||
| name = "aws-s3", | ||
| srcs = [ | ||
| "main.go", | ||
| ], | ||
| static = True, | ||
| deps = [ | ||
| "//api/proto/v1", | ||
| "//components/consumers", | ||
| "//pkg/enumtransformers", | ||
| "//third_party/go/github.com/aws/aws-sdk-go", | ||
| ], | ||
| ) | ||
|
|
||
| buildkit_distroless_image( | ||
| name = "image", | ||
| srcs = [":aws-s3"], | ||
| ) | ||
|
|
||
| dracon_component( | ||
| name = "aws-s3", | ||
| images = [ | ||
| ":image", | ||
| ], | ||
| task = "task.yaml", | ||
| visibility = ["//examples/pipelines/..."], | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| # DO NOT EDIT. Code generated by: | ||
| # github.com/ocurity/dracon//build/tools/kustomize-component-generator. | ||
|
|
||
| apiVersion: kustomize.config.k8s.io/v1alpha1 | ||
| kind: Component | ||
| resources: | ||
| - task.yaml | ||
| patches: | ||
| # Add the Task to the Tekton Pipeline. | ||
| - patch: | | ||
| apiVersion: tekton.dev/v1beta1 | ||
| kind: Pipeline | ||
| metadata: | ||
| name: unused | ||
| spec: | ||
| workspaces: | ||
| - name: source-code-ws | ||
| tasks: | ||
| - name: consumer-aws-s3 | ||
| taskRef: | ||
| name: consumer-aws-s3 | ||
| workspaces: | ||
| - name: source-code-ws | ||
| workspace: source-code-ws | ||
| params: | ||
| - name: consumer-aws-s3-access-key-id | ||
| value: $(params.consumer-aws-s3-access-key-id) | ||
| - name: consumer-aws-s3-secret-access-key | ||
| value: $(params.consumer-aws-s3-secret-access-key) | ||
| - name: consumer-aws-s3-bucket-name | ||
| value: $(params.consumer-aws-s3-bucket-name) | ||
| - name: consumer-aws-s3-bucket-region | ||
| value: $(params.consumer-aws-s3-bucket-region) | ||
| params: | ||
| - name: consumer-aws-s3-access-key-id | ||
| type: string | ||
| - name: consumer-aws-s3-secret-access-key | ||
| type: string | ||
| - name: consumer-aws-s3-bucket-name | ||
| type: string | ||
| - name: consumer-aws-s3-bucket-region | ||
| type: string | ||
| target: | ||
| kind: Pipeline | ||
| # Add anchors to Task. | ||
| - patch: | | ||
| apiVersion: tekton.dev/v1beta1 | ||
| kind: Task | ||
| metadata: | ||
| name: consumer-aws-s3 | ||
| labels: | ||
| v1.dracon.ocurity.com/component: consumer | ||
| spec: | ||
| params: | ||
| - name: anchors | ||
| type: array | ||
| description: A list of tasks that this task depends on using their anchors. | ||
| default: [] | ||
| results: | ||
| - name: anchor | ||
| description: An anchor to allow other tasks to depend on this task. | ||
| steps: | ||
| - name: anchor | ||
| image: docker.io/busybox:1.35.0 | ||
| script: echo "$(context.task.name)" > "$(results.anchor.path)" | ||
| target: | ||
| kind: Task | ||
| name: consumer-aws-s3 | ||
| # If we have an enricher-aggregator task in the pipeline (added by the | ||
| # enricher-aggregator component), make the consumer depend on the completion of | ||
| # it. | ||
| - patch: | | ||
| apiVersion: tekton.dev/v1beta1 | ||
| kind: Pipeline | ||
| metadata: | ||
| name: unused | ||
| spec: | ||
| tasks: | ||
| - name: consumer-aws-s3 | ||
| params: | ||
| - name: anchors | ||
| value: | ||
| - $(tasks.enricher-aggregator.results.anchor) | ||
| target: | ||
| kind: Pipeline | ||
| annotationSelector: v1.dracon.ocurity.com/has-enricher-aggregator=true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| // Package main of the aws-s3 consumer implements a simple consumer for | ||
| // uploading dracon results to the S3 bucket passed as an argument | ||
| // the consumer expects the environment variables | ||
| // AWS_ACCESS_KEY_ID | ||
| // AWS_SECRET_ACCESS_KEY | ||
| // to be set | ||
| package main | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "encoding/json" | ||
| "flag" | ||
| "fmt" | ||
| "log" | ||
|
|
||
| "github.com/aws/aws-sdk-go/aws" | ||
| "github.com/aws/aws-sdk-go/aws/session" | ||
| "github.com/aws/aws-sdk-go/service/s3/s3manager" | ||
|
|
||
| "github.com/ocurity/dracon/components/consumers" | ||
| ) | ||
|
|
||
| var ( | ||
| bucket string | ||
| region string | ||
| ) | ||
|
|
||
| func main() { | ||
| flag.StringVar(&bucket, "bucket", "", "s3 bucket name") | ||
| flag.StringVar(®ion, "region", "", "s3 bucket region") | ||
| if err := consumers.ParseFlags(); err != nil { | ||
| log.Fatal(err) | ||
| } | ||
| if consumers.Raw { | ||
| responses, err := consumers.LoadToolResponse() | ||
| if err != nil { | ||
| log.Fatal("could not load raw results, file malformed: ", err) | ||
| } | ||
| s3Data, err := json.Marshal(responses) | ||
| if err != nil { | ||
| log.Fatal("could not marshal results, err:", err) | ||
| } | ||
| filename := fmt.Sprintf("ocurity scan %s-%s", responses[0].GetScanInfo().GetScanUuid(), responses[0].GetToolName()) | ||
| sendToS3(filename, bucket, region, s3Data) | ||
| } else { | ||
| responses, err := consumers.LoadEnrichedToolResponse() | ||
| if err != nil { | ||
| log.Fatal("could not load enriched results, file malformed: ", err) | ||
| } | ||
| filename := fmt.Sprintf("ocurity scan %s-%s", responses[0].OriginalResults.GetScanInfo().GetScanUuid(), responses[0].OriginalResults.GetToolName()) | ||
| s3Data, err := json.Marshal(responses) | ||
| if err != nil { | ||
| log.Fatal("could not marshal results, err:", err) | ||
| } | ||
| sendToS3(filename, bucket, region, s3Data) | ||
| } | ||
| } | ||
|
|
||
| func sendToS3(filename, bucket, region string, data []byte) { | ||
| sess, err := session.NewSession(&aws.Config{ | ||
| Region: aws.String(region), | ||
| }, | ||
| ) | ||
| if err != nil { | ||
| log.Fatalf("Unable to acquire AWS session in region %s, check your credentials", region) | ||
| } | ||
| uploader := s3manager.NewUploader(sess) | ||
| _, err = uploader.Upload(&s3manager.UploadInput{ | ||
| Bucket: aws.String(bucket), | ||
| Key: aws.String(filename), | ||
| Body: bytes.NewReader(data), | ||
| }) | ||
| if err != nil { | ||
| log.Fatalf("Unable to upload %q to %q, %v", filename, bucket, err) | ||
| } | ||
|
|
||
| fmt.Printf("Successfully uploaded %q to %q\n", filename, bucket) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| --- | ||
| apiVersion: tekton.dev/v1beta1 | ||
| kind: Task | ||
| metadata: | ||
| name: consumer-aws-s3 | ||
| labels: | ||
| v1.dracon.ocurity.com/component: consumer | ||
| spec: | ||
| volumes: | ||
| - name: scratch | ||
| emptyDir: {} | ||
| params: | ||
| - name: consumer-aws-s3-access-key-id | ||
| type: string | ||
| - name: consumer-aws-s3-secret-access-key | ||
| type: string | ||
| - name: consumer-aws-s3-bucket-name | ||
| type: string | ||
| - name: consumer-aws-s3-bucket-region | ||
| type: string | ||
| workspaces: | ||
| - name: source-code-ws | ||
| description: The workspace containing the source-code to scan. | ||
| steps: | ||
| - name: run-consumer | ||
| imagePullPolicy: IfNotPresent | ||
| image: ghcr.io/ocurity/dracon/components/consumers/aws-s3/image:latest | ||
| env: | ||
| - name: AWS_ACCESS_KEY_ID | ||
| value: "$(params.consumer-aws-s3-access-key-id)" | ||
| - name: AWS_SECRET_ACCESS_KEY | ||
| value: "$(params.consumer-aws-s3-secret-access-key)" | ||
| command: ["/app/components/consumers/aws-s3/aws-s3"] | ||
| args: | ||
| [ | ||
| "-in", | ||
| "$(workspaces.source-code-ws.path)/.dracon/enrichers/", | ||
| "-bucket", | ||
| "$(params.consumer-aws-s3-bucket-name)", | ||
| "-region", | ||
| "$(params.consumer-aws-s3-bucket-region)", | ||
| ] | ||
| volumeMounts: | ||
| - mountPath: /scratch | ||
| name: scratch |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| go_module( | ||
| name = "aws-sdk-go", | ||
| install = [ | ||
| ".", | ||
| "aws", | ||
| "aws/arn", | ||
| "aws/auth/bearer", | ||
| "aws/awserr", | ||
| "aws/awsutil", | ||
| "aws/client", | ||
| "aws/client/metadata", | ||
| "aws/corehandlers", | ||
| "aws/credentials", | ||
| "aws/credentials/ec2rolecreds", | ||
| "aws/credentials/endpointcreds", | ||
| "aws/credentials/processcreds", | ||
| "aws/credentials/ssocreds", | ||
| "aws/credentials/stscreds", | ||
| "aws/csm", | ||
| "aws/defaults", | ||
| "aws/ec2metadata", | ||
| "aws/endpoints", | ||
| "aws/request", | ||
| "aws/session", | ||
| "aws/signer/v4", | ||
| "internal/ini", | ||
| "internal/s3shared", | ||
| "internal/s3shared/arn", | ||
| "internal/s3shared/s3err", | ||
| "internal/sdkio", | ||
| "internal/sdkmath", | ||
| "internal/sdkrand", | ||
| "internal/sdkuri", | ||
| "internal/shareddefaults", | ||
| "internal/strings", | ||
| "internal/sync/singleflight", | ||
| "private/checksum", | ||
| "private/protocol", | ||
| "private/protocol/eventstream", | ||
| "private/protocol/eventstream/eventstreamapi", | ||
| "private/protocol/json/jsonutil", | ||
| "private/protocol/jsonrpc", | ||
| "private/protocol/query", | ||
| "private/protocol/query/queryutil", | ||
| "private/protocol/rest", | ||
| "private/protocol/restjson", | ||
| "private/protocol/restxml", | ||
| "private/protocol/xml/xmlutil", | ||
| "service/s3", | ||
| "service/s3/s3iface", | ||
| "service/s3/s3manager", | ||
| "service/sso", | ||
| "service/sso/ssoiface", | ||
| "service/ssooidc", | ||
| "service/sts", | ||
| "service/sts/stsiface", | ||
| ], | ||
| module = "github.com/aws/aws-sdk-go", | ||
| version = "v1.45.24", | ||
| visibility = ["PUBLIC"], | ||
| deps = ["//third_party/go/github.com/jmespath/go-jmespath"], | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| go_module( | ||
| name = "go-jmespath", | ||
| module = "github.com/jmespath/go-jmespath", | ||
| version = "v0.4.0", | ||
| visibility = ["PUBLIC"], | ||
| ) |