@sagentix-inc/evidence-collector 0.3.0 → 0.3.1

package/README.md

@@ -68,7 +68,7 @@ Either apply `iac/cloudflare/evidence-role` in your own account (it creates an a
 | Account | Zero Trust Read | Gateway rules, device posture rules |
 | Account | Workers R2 Storage Read | r2.dev public access per bucket |
 
-The names are Cloudflare's API names, matched per endpoint against `x-api-token-group` in Cloudflare's OpenAPI document (github.com/cloudflare/api-schemas). Two are not fully confirmed. Zero Trust Read: the OpenAPI names no group for `GET /accounts/{id}/gateway/rules` or `/devices/posture`. Account API Tokens Read: the OpenAPI names it, but the permissions reference page does not list it. If a group is missing, its checks come back `skipped`, never `pass`.
+The names are Cloudflare's API names, matched per endpoint against `x-api-token-group` in Cloudflare's OpenAPI document (github.com/cloudflare/api-schemas). Two are not fully confirmed. Zero Trust Read: the OpenAPI names no group for `GET /accounts/{id}/gateway/rules` or `/devices/posture`. Account API Tokens Read: the permissions reference page does not list it, but the API reference page for `GET /accounts/{id}/tokens` names it under Accepted Permissions (read 2026-10-29), as the OpenAPI does. If a group is missing, its checks come back `skipped`, never `pass`.
 
 Store the token as the CI secret `CLOUDFLARE_API_TOKEN_READONLY`.
 

package/THIRD_PARTY_NOTICES.md

@@ -5,7 +5,7 @@ The collector runs these programs as separate processes, or reads their output.
 ## Prowler
 
 - Project: https://github.com/prowler-cloud/prowler
-- Version: 5.45.0 (git tag `5.45.0`, commit bffc8844c1c9a3666e37a2ada4ee05f62e1446b0; PyPI `prowler==5.45.0`)
+- Version: 5.47.0 (git tag `5.47.0`, commit 555a4cc469907e26ef007eb79af2b6cb4bddd6c6; PyPI `prowler==5.47.0`)
 - Licence: Apache License 2.0
 - Copyright: Copyright @ 2024 Toni de la Fuente (as stated in Prowler's LICENSE file)
 - Used for: the `prowler` source (`src/sources/prowler.ts`) runs the `prowler` command or reads its OCSF output. `apps/sos-app/src/data/checks/prowler_<provider>.json` holds Prowler check ids, check titles (`CheckTitle`), severities and the FedRAMP 20x KSI and NIST SP 800-53 mappings, all read from that release by `apps/sos-app/scripts/build_prowler_catalog.py`.
@@ -13,7 +13,7 @@ The collector runs these programs as separate processes, or reads their output.
 - Texts copied: `apps/sos-app/src/data/guidance/prowler_remediation_<provider>.json` holds, for each check in that provider's catalogue, Prowler's own `Risk` and `Remediation` texts (`Recommendation.Text` and `Url`, and `Code.CLI`, `Terraform`, `NativeIaC`, `Other`) from the same release, written by the same script. They are Prowler's work under the Apache License 2.0, shipped unmodified with this attribution and a `notice` line in each file; empty fields become null and each field is cut at 4,000 characters. sos-app shows them in its per-control guides.
 - Prowler ships no NOTICE file at this tag.
 
-The licence text, as distributed with Prowler 5.45.0:
+The licence text, as distributed with Prowler 5.47.0:
 
 ```text
                                 Apache License
@@ -264,13 +264,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ## Trivy
 
 - Project: https://github.com/aquasecurity/trivy
-- Version: 0.75.0 (git tag `v0.75.0`, commit 591e9799316a602e703f0b484f6c6d7b234ec8f3)
+- Version: 0.76.0 (git tag `v0.76.0`, commit 531360e5d2a88e732373f1614ba99a38738538b8)
 - Licence: Apache License 2.0
 - Copyright: Copyright 2019-2020 Aqua Security Software Ltd. (as stated in Trivy's NOTICE file; the LICENSE appendix keeps the template line `Copyright [yyyy] [name of copyright owner]`)
 - Used for: the runner image bundles `trivy` so a job can write the JSON report (`--format json`) that the `trivy` source (`src/sources/trivy.ts`) reads. `apps/sos-app/src/data/checks/trivy.json` names the checks.
-- Built from source: the runner image fetches the tag `v0.75.0` (commit 591e9799316a602e703f0b484f6c6d7b234ec8f3) and compiles it with Go 1.27.3 (see Go below), raising modules to the floors in `collector/runner/go-module-fixes.txt`. Changes: none to the project's own source; `go.mod` and `go.sum` move only where a floor applies.
+- Built from source: the runner image fetches the tag `v0.76.0` (commit 531360e5d2a88e732373f1614ba99a38738538b8) and compiles it with Go 1.27.3 (see Go below), raising modules to the floors in `collector/runner/go-module-fixes.txt`. Changes: none to the project's own source; `go.mod` and `go.sum` move only where a floor applies.
 
-The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `v0.75.0` differs only in its appendix template. Trivy ships this NOTICE file at the tag, reproduced as distributed:
+The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `v0.76.0` differs only in its appendix template. Trivy ships this NOTICE file at the tag, reproduced as distributed:
 
 ```text
 Trivy
@@ -329,14 +329,14 @@ The licence terms (sections 1 to 9 and the end of terms) are identical, word for
 ## Open Policy Agent (OPA)
 
 - Project: https://github.com/open-policy-agent/opa
-- Version: 1.21.1 (git tag `v1.21.1`, commit 2a109e54103370d2ef288782ef3cb4c8a37902b2)
+- Version: 1.21.2 (git tag `v1.21.2`, commit 3f7474e6b3c631821d8aac25ca444f7e75a56483)
 - Licence: Apache License 2.0
 - Copyright: none stated; the LICENSE appendix keeps the template line `Copyright {yyyy} {name of copyright owner}`
 - Used for: ScubaGoggles evaluates its Rego baselines with the bundled `opa`, and the `cloudflare` source (`src/sources/cloudflare/opa.ts`) runs `opa eval` over `iac/policy/cloudflare` when given `--tofu-state`.
-- Built from source: the runner image fetches the tag `v1.21.1` (commit 2a109e54103370d2ef288782ef3cb4c8a37902b2) and compiles it with Go 1.27.3 (see Go below), raising modules to the floors in `collector/runner/go-module-fixes.txt`. Changes: none to the project's own source; `go.mod` and `go.sum` move only where a floor applies.
+- Built from source: the runner image fetches the tag `v1.21.2` (commit 3f7474e6b3c631821d8aac25ca444f7e75a56483) and compiles it with Go 1.27.3 (see Go below), raising modules to the floors in `collector/runner/go-module-fixes.txt`. Changes: none to the project's own source; `go.mod` and `go.sum` move only where a floor applies.
 - OPA ships no NOTICE file at this tag.
 
-The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `v1.21.1` differs only in its appendix template.
+The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `v1.21.2` differs only in its appendix template.
 
 ## ScubaGoggles
 
@@ -549,14 +549,14 @@ For further information, please contact The MITRE Corporation, Contracts Managem
 ## Kubescape
 
 - Project: https://github.com/kubescape/kubescape (CNCF)
-- Version: 4.0.15 (git tag `v4.0.15`, commit 16cfe102f11551a6455fe9bf8e37d7083da90484)
+- Version: 4.0.16 (git tag `v4.0.16`, commit d0ea07bcd9d7ab1640dcd6527d0e68a34f10da0e)
 - Licence: Apache License 2.0
 - Copyright: none stated; the LICENSE appendix keeps the template line `Copyright [yyyy] [name of copyright owner]`
 - Used for: the runner image bundles `kubescape` so a job can write the JSON report (`--format json`) that the `kubescape` source (`src/sources/kubescape.ts`) reads. It runs offline from `/opt/kubescape/artifacts` (the regolibrary files below), with its version check off (`KS_SKIP_UPDATE_CHECK=true`).
-- Built from source: the runner image fetches the tag `v4.0.15` (commit 16cfe102f11551a6455fe9bf8e37d7083da90484) and compiles it with Go 1.27.3 (see Go below), raising modules to the floors in `collector/runner/go-module-fixes.txt`. Changes: none to the project's own source; `go.mod` and `go.sum` move only where a floor applies.
+- Built from source: the runner image fetches the tag `v4.0.16` (commit d0ea07bcd9d7ab1640dcd6527d0e68a34f10da0e) and compiles it with Go 1.27.3 (see Go below), raising modules to the floors in `collector/runner/go-module-fixes.txt`. Changes: none to the project's own source; `go.mod` and `go.sum` move only where a floor applies.
 - Kubescape ships no NOTICE file at this tag.
 
-The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `v4.0.15` differs only in leading white space and its appendix template.
+The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `v4.0.16` differs only in leading white space and its appendix template.
 
 ## Kubescape regolibrary
 
@@ -573,12 +573,12 @@ The licence terms (sections 1 to 9 and the end of terms) are identical, word for
 ## Checkov
 
 - Project: https://github.com/bridgecrewio/checkov
-- Version: 3.3.27 (git tag `3.3.27`, commit 22ba0d2077cd3a09fc1547ae80be9ffe4e471e6c; PyPI `checkov==3.3.27`)
+- Version: 3.3.29 (git tag `3.3.29`, commit e40023ab262c7c8b7b0a8f0975072b42d1b601f9; PyPI `checkov==3.3.29`)
 - Licence: Apache License 2.0
 - Copyright: Copyright 2019 Palo Alto Networks (as stated in Checkov's LICENSE appendix)
 - Used for: the runner image installs Checkov in `/opt/checkov` so a job can write the JSON report (`-o json`) that the `checkov` source (`src/sources/checkov.ts`) reads, with `BC_SKIP_MAPPING=TRUE` and `CKV_SKIP_PACKAGE_UPDATE_CHECK=true` so it fetches neither Prisma Cloud's mapping nor PyPI's latest version. `apps/sos-app/src/data/checks/checkov.json` names 55 Checkov check ids, each checked to exist at that tag by `apps/sos-app/scripts/build_checkov_catalog.py`; its titles and its control mapping are Sagentix's own words, not Checkov's.
-- Downloaded from: https://files.pythonhosted.org/packages/26/ec/0042c3eecc84f394867554efdb25425b0b84f690997de512924850009c71/checkov-3.3.27-py3-none-any.whl (SHA-256 f162b1fee91e204cc5891baa7e3dc1775fe9843dd11a0809986b9bce806528a2, the digest PyPI lists for that file). Its Python dependencies come from PyPI at install time, unpinned, as Prowler's do.
+- Downloaded from: https://files.pythonhosted.org/packages/63/4a/26ecbf2abac34993b7dba06379c6b8a03f078323856a917ed47370610a67/checkov-3.3.29-py3-none-any.whl (SHA-256 9a8b3918788faf8e18b181d826d284744b22b9d99c53cf1b67a2e84f0596796f, the digest PyPI lists for that file). Its Python dependencies come from PyPI at install time, unpinned, as Prowler's do.
 - Changes: none
 - Checkov ships no NOTICE file at this tag.
 
-The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `3.3.27` differs only in leading white space and its appendix, which carries the copyright line above.
+The licence terms (sections 1 to 9 and the end of terms) are identical, word for word, to the Apache License 2.0 text reproduced under Prowler above; the file at `3.3.29` differs only in leading white space and its appendix, which carries the copyright line above.

package/apps/sos-app/src/data/checks/aws.json

@@ -127,8 +127,8 @@
   },
   {
    "id": "aws.access_analyzer_enabled",
-   "title": "IAM Access Analyzer has an active analyzer in the region",
-   "scope": "Each region given; the analyzer's findings are not read.",
+   "title": "IAM Access Analyzer has an active external-access analyzer in the region",
+   "scope": "Each region given; an ACTIVE analyzer of type ACCOUNT or ORGANIZATION (external access) passes, an unused-access or internal-access analyzer alone does not; the analyzer's findings are not read.",
    "evidenceType": "Configuration"
   },
   {

package/apps/sos-app/src/data/checks/checkov.json

@@ -6,10 +6,10 @@
  ],
  "engine": {
   "name": "Checkov",
-  "version": "3.3.27",
-  "tag": "3.3.27",
-  "commit": "22ba0d2077cd3a09fc1547ae80be9ffe4e471e6c",
-  "tarballSha256": "8404798c2257fede6d169bde4be9beaba9dc6f6b597cc9098145dfd8b0738042",
+  "version": "3.3.29",
+  "tag": "3.3.29",
+  "commit": "e40023ab262c7c8b7b0a8f0975072b42d1b601f9",
+  "tarballSha256": "23f236b9793b00c7911efdb0bf814a594ab9b4048c298a63b4f3f76ebb134cc4",
   "licence": "Apache-2.0",
   "url": "https://github.com/bridgecrewio/checkov"
  },
@@ -17,331 +17,331 @@
   {
    "id": "checkov.ckv_aws_1",
    "title": "CKV_AWS_1: IAM policy documents grant no full '*:*' administrative privileges",
-   "scope": "Checkov 3.3.27 check CKV_AWS_1 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_1 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_103",
    "title": "CKV_AWS_103: Load balancer listeners use TLS 1.2 or later",
-   "scope": "Checkov 3.3.27 check CKV_AWS_103 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_103 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_145",
    "title": "CKV_AWS_145: S3 buckets are encrypted with KMS by default",
-   "scope": "Checkov 3.3.27 check CKV_AWS_145 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_145 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_158",
    "title": "CKV_AWS_158: CloudWatch log groups are encrypted with KMS",
-   "scope": "Checkov 3.3.27 check CKV_AWS_158 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_158 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_16",
    "title": "CKV_AWS_16: RDS instances are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_17",
    "title": "CKV_AWS_17: RDS instances are not publicly accessible",
-   "scope": "Checkov 3.3.27 check CKV_AWS_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public endpoint. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public endpoint. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_18",
    "title": "CKV_AWS_18: S3 buckets have access logging",
-   "scope": "Checkov 3.3.27 check CKV_AWS_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_19",
    "title": "CKV_AWS_19: S3 buckets have server-side encryption",
-   "scope": "Checkov 3.3.27 check CKV_AWS_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_2",
    "title": "CKV_AWS_2: Application load balancers listen on HTTPS",
-   "scope": "Checkov 3.3.27 check CKV_AWS_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_20",
    "title": "CKV_AWS_20: S3 buckets do not grant READ to everyone",
-   "scope": "Checkov 3.3.27 check CKV_AWS_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public read. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public read. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_24",
    "title": "CKV_AWS_24: Security groups do not allow SSH (22) from 0.0.0.0/0",
-   "scope": "Checkov 3.3.27 check CKV_AWS_24 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_24 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_25",
    "title": "CKV_AWS_25: Security groups do not allow RDP (3389) from 0.0.0.0/0",
-   "scope": "Checkov 3.3.27 check CKV_AWS_25 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_25 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_26",
    "title": "CKV_AWS_26: SNS topics are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_26 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_26 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_27",
    "title": "CKV_AWS_27: SQS queues are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_27 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_27 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_3",
    "title": "CKV_AWS_3: EBS volumes are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_338",
    "title": "CKV_AWS_338: CloudWatch log groups keep logs for at least one year",
-   "scope": "Checkov 3.3.27 check CKV_AWS_338 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit record retention. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_338 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit record retention. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_35",
    "title": "CKV_AWS_35: CloudTrail logs are encrypted at rest with KMS",
-   "scope": "Checkov 3.3.27 check CKV_AWS_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs are encrypted and protected. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs are encrypted and protected. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_36",
    "title": "CKV_AWS_36: CloudTrail log file validation is enabled",
-   "scope": "Checkov 3.3.27 check CKV_AWS_36 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs carry a cryptographic integrity check. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_36 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs carry a cryptographic integrity check. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_41",
    "title": "CKV_AWS_41: No hard-coded AWS access key in the provider block",
-   "scope": "Checkov 3.3.27 check CKV_AWS_41 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_41 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_45",
    "title": "CKV_AWS_45: No hard-coded secret in Lambda environment variables",
-   "scope": "Checkov 3.3.27 check CKV_AWS_45 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_45 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_46",
    "title": "CKV_AWS_46: No hard-coded secret in EC2 user data",
-   "scope": "Checkov 3.3.27 check CKV_AWS_46 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_46 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_53",
    "title": "CKV_AWS_53: S3 public access block: block public ACLs",
-   "scope": "Checkov 3.3.27 check CKV_AWS_53 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_53 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_54",
    "title": "CKV_AWS_54: S3 public access block: block public policy",
-   "scope": "Checkov 3.3.27 check CKV_AWS_54 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_54 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_55",
    "title": "CKV_AWS_55: S3 public access block: ignore public ACLs",
-   "scope": "Checkov 3.3.27 check CKV_AWS_55 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_55 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_56",
    "title": "CKV_AWS_56: S3 public access block: restrict public buckets",
-   "scope": "Checkov 3.3.27 check CKV_AWS_56 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_56 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_57",
    "title": "CKV_AWS_57: S3 buckets do not grant WRITE to everyone",
-   "scope": "Checkov 3.3.27 check CKV_AWS_57 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public write. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_57 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public write. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_62",
    "title": "CKV_AWS_62: IAM policies grant no full '*:*' administrative privileges",
-   "scope": "Checkov 3.3.27 check CKV_AWS_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_63",
    "title": "CKV_AWS_63: IAM policy documents allow no '*' action",
-   "scope": "Checkov 3.3.27 check CKV_AWS_63 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard action. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_63 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard action. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_64",
    "title": "CKV_AWS_64: Redshift clusters are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_64 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_64 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_67",
    "title": "CKV_AWS_67: CloudTrail is enabled in all regions",
-   "scope": "Checkov 3.3.27 check CKV_AWS_67 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; account activity is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_67 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; account activity is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_7",
    "title": "CKV_AWS_7: Customer-managed KMS keys rotate",
-   "scope": "Checkov 3.3.27 check CKV_AWS_7 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_7 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_8",
    "title": "CKV_AWS_8: Launch configurations and instances encrypt their EBS volumes",
-   "scope": "Checkov 3.3.27 check CKV_AWS_8 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_8 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_84",
    "title": "CKV_AWS_84: Elasticsearch/OpenSearch domains have logging enabled",
-   "scope": "Checkov 3.3.27 check CKV_AWS_84 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_84 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_10",
    "title": "CKV_AZURE_10: Network security groups restrict SSH from the internet",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_10 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_10 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_2",
    "title": "CKV_AZURE_2: Azure managed disks are encrypted",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_3",
    "title": "CKV_AZURE_3: Azure storage accounts accept HTTPS only",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_33",
    "title": "CKV_AZURE_33: Azure queue storage logs read, write and delete requests",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_33 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_33 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_44",
    "title": "CKV_AZURE_44: Azure storage accounts require the latest TLS version",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_44 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_44 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_59",
    "title": "CKV_AZURE_59: Azure storage accounts disallow public access",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_59 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_59 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_9",
    "title": "CKV_AZURE_9: Network security groups restrict RDP from the internet",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_9 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_9 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_docker_3",
    "title": "CKV_DOCKER_3: Dockerfiles create and use a non-root user",
-   "scope": "Checkov 3.3.27 check CKV_DOCKER_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_DOCKER_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_2",
    "title": "CKV_GCP_2: Compute firewall ingress does not allow unrestricted SSH",
-   "scope": "Checkov 3.3.27 check CKV_GCP_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_28",
    "title": "CKV_GCP_28: Cloud Storage buckets are not anonymously or publicly accessible",
-   "scope": "Checkov 3.3.27 check CKV_GCP_28 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_28 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_3",
    "title": "CKV_GCP_3: Compute firewall ingress does not allow unrestricted RDP",
-   "scope": "Checkov 3.3.27 check CKV_GCP_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_43",
    "title": "CKV_GCP_43: Cloud KMS keys rotate within 90 days",
-   "scope": "Checkov 3.3.27 check CKV_GCP_43 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_43 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_6",
    "title": "CKV_GCP_6: Cloud SQL instances require SSL for incoming connections",
-   "scope": "Checkov 3.3.27 check CKV_GCP_6 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_6 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_62",
    "title": "CKV_GCP_62: Cloud Storage buckets log access",
-   "scope": "Checkov 3.3.27 check CKV_GCP_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_16",
    "title": "CKV_K8S_16: Kubernetes containers are not privileged",
-   "scope": "Checkov 3.3.27 check CKV_K8S_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; container isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; container isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_17",
    "title": "CKV_K8S_17: Kubernetes containers do not share the host PID namespace",
-   "scope": "Checkov 3.3.27 check CKV_K8S_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_18",
    "title": "CKV_K8S_18: Kubernetes containers do not share the host IPC namespace",
-   "scope": "Checkov 3.3.27 check CKV_K8S_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_19",
    "title": "CKV_K8S_19: Kubernetes containers do not share the host network namespace",
-   "scope": "Checkov 3.3.27 check CKV_K8S_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; network isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; network isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_20",
    "title": "CKV_K8S_20: Kubernetes containers do not allow privilege escalation",
-   "scope": "Checkov 3.3.27 check CKV_K8S_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no setuid escalation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no setuid escalation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_22",
    "title": "CKV_K8S_22: Kubernetes containers use a read-only root filesystem",
-   "scope": "Checkov 3.3.27 check CKV_K8S_22 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; a change needs a redeployment, not an edit in place. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_22 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; a change needs a redeployment, not an edit in place. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_23",
    "title": "CKV_K8S_23: Kubernetes containers do not run as root",
-   "scope": "Checkov 3.3.27 check CKV_K8S_23 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_23 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_35",
    "title": "CKV_K8S_35: Kubernetes secrets are mounted as files, not environment variables",
-   "scope": "Checkov 3.3.27 check CKV_K8S_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; authenticators protected. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; authenticators protected. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {

package/apps/sos-app/src/data/checks/kubescape.json

@@ -6,7 +6,7 @@
  ],
  "engine": {
   "name": "Kubescape",
-  "version": "4.0.15",
+  "version": "4.0.16",
   "licence": "Apache-2.0",
   "rules": {
    "repo": "kubescape/regolibrary",