s1-shift-left-cli 0.4.0__py3-none-any.whl

s1_cns_cli/s1graph/bicep/image_referencer/provider/azure.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from s1_cns_cli.s1graph.bicep.image_referencer.base_provider import BaseBicepProvider
+from s1_cns_cli.s1graph.common.util.data_structures_utils import find_in_dict
+from s1_cns_cli.s1graph.common.util.type_forcers import force_list
+
+if TYPE_CHECKING:
+    from networkx import DiGraph
+
+
+class AzureBicepProvider(BaseBicepProvider):
+    def __init__(self, graph_connector: DiGraph) -> None:
+        super().__init__(
+            graph_connector=graph_connector,
+            supported_resource_types=SUPPORTED_AZURE_IMAGE_RESOURCE_TYPES,
+        )
+
+
+def extract_images_from_azurerm_batch_pool(resource: dict[str, Any]) -> list[str]:
+    image_names: list[str] = []
+
+    containers = find_in_dict(
+        input_dict=resource,
+        key_path="properties/virtualMachineConfiguration/containerConfiguration/containerImageNames",
+    )
+    if isinstance(containers, list):
+        image_names.extend(container for container in containers if isinstance(container, str))
+
+    return image_names
+
+
+def extract_images_from_azurerm_container_group(resource: dict[str, Any]) -> list[str]:
+    image_names: list[str] = []
+
+    properties = resource.get("properties")
+    if properties and isinstance(properties, dict):
+        containers = properties.get("containers")
+        if containers:
+            for container in force_list(containers):
+                name = find_in_dict(input_dict=container, key_path="properties/image")
+                if name and isinstance(name, str):
+                    image_names.append(name)
+        containers = properties.get("initContainers")
+        if containers:
+            for container in force_list(containers):
+                name = find_in_dict(input_dict=container, key_path="properties/image")
+                if name and isinstance(name, str):
+                    image_names.append(name)
+
+    return image_names
+
+
+def extract_images_from_azurerm_web_app(resource: dict[str, Any]) -> list[str]:
+    image_names: list[str] = []
+
+    containers = find_in_dict(input_dict=resource, key_path="properties/template/containers")
+    if containers:
+        for container in force_list(containers):
+            name = container.get("image")
+            if name and isinstance(name, str):
+                image_names.append(name)
+
+    return image_names
+
+
+# needs to be at the bottom to add the defined functions
+SUPPORTED_AZURE_IMAGE_RESOURCE_TYPES = {
+    "Microsoft.App/containerApps": extract_images_from_azurerm_web_app,
+    "Microsoft.Batch/batchAccounts/pools": extract_images_from_azurerm_batch_pool,
+    "Microsoft.ContainerInstance/containerGroups": extract_images_from_azurerm_container_group,
+    "Microsoft.Web/containerApps": extract_images_from_azurerm_web_app,
+}

s1_cns_cli/s1graph/bicep/parser.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import logging
+import os
+from collections.abc import Collection
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from pycep import BicepParser
+
+if TYPE_CHECKING:
+    from pycep.typing import BicepJson
+
+
+class Parser:
+    def __init__(self) -> None:
+        self.bicep_parser = BicepParser(add_line_numbers=True)
+
+    def parse(self, file_path: Path) -> tuple[BicepJson, list[tuple[int, str]]] | tuple[None, None]:
+        try:
+            content = file_path.read_text()
+            template = self.bicep_parser.parse(text=content)
+        except Exception:
+            logging.debug(f"[bicep] Couldn't parse {file_path}", exc_info=True)
+            return None, None
+
+        file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))]
+
+        return template, file_lines
+
+    def get_files_definitions(
+        self, file_paths: "Collection[Path]"
+    ) -> tuple[dict[Path, BicepJson], dict[Path, list[tuple[int, str]]], list[str]]:
+        logging.info(f"[bicep] start to parse {len(file_paths)} files")
+
+        definitions: dict[Path, BicepJson] = {}
+        definitions_raw: dict[Path, list[tuple[int, str]]] = {}
+        parsing_errors: list[str] = []
+
+        for file_path in file_paths:
+            template, file_lines = self.parse(file_path)
+            if template and file_lines:
+                definitions[file_path] = template
+                definitions_raw[file_path] = file_lines
+            else:
+                parsing_errors.append(os.path.normpath(file_path.absolute()))
+
+        logging.info(f"[bicep] successfully parsed {len(definitions)} files")
+
+        return definitions, definitions_raw, parsing_errors

s1_cns_cli/s1graph/bicep/runner.py

@@ -0,0 +1,281 @@
+from __future__ import annotations
+
+import os
+import logging
+from pathlib import Path
+from typing import cast, Type, TYPE_CHECKING, Any
+
+from s1_cns_cli.s1graph.bicep.graph_builder.context_definitions import build_definitions_context
+from s1_cns_cli.s1graph.bicep.checks.param.registry import registry as param_registry
+from s1_cns_cli.s1graph.bicep.checks.resource.registry import registry as resource_registry
+from s1_cns_cli.s1graph.bicep.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions
+from s1_cns_cli.s1graph.bicep.graph_builder.local_graph import BicepLocalGraph
+from s1_cns_cli.s1graph.bicep.graph_manager import BicepGraphManager
+from s1_cns_cli.s1graph.bicep.image_referencer.manager import BicepImageReferencerManager
+from s1_cns_cli.s1graph.bicep.parser import Parser
+from s1_cns_cli.s1graph.bicep.utils import clean_file_path, get_scannable_file_paths
+from s1_cns_cli.s1graph.common.checks_infra.registry import get_graph_checks_registry
+
+from s1_cns_cli.s1graph.common.typing import LibraryGraphConnector
+from s1_cns_cli.s1graph.common.graph.graph_builder import CustomAttributes
+from s1_cns_cli.s1graph.common.graph.graph_builder.consts import GraphSource
+from s1_cns_cli.s1graph.common.images.image_referencer import ImageReferencerMixin
+from s1_cns_cli.s1graph.common.output.extra_resource import ExtraResource
+from s1_cns_cli.s1graph.common.output.graph_record import GraphRecord
+from s1_cns_cli.s1graph.common.output.record import Record
+from s1_cns_cli.s1graph.common.output.report import Report
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.common.runners.base_runner import BaseRunner, SENTINELONE_CNS_CREATE_GRAPH
+from s1_cns_cli.s1graph.common.typing import _CheckResult
+from s1_cns_cli.s1graph.common.util.secrets import omit_secret_value_from_checks
+from s1_cns_cli.s1graph.common.util.suppression import collect_suppressions_for_report
+from s1_cns_cli.s1graph.runner_filter import RunnerFilter
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.checks.base_check_registry import BaseCheckRegistry
+    from s1_cns_cli.s1graph.common.checks_infra.registry import Registry
+    from s1_cns_cli.s1graph.common.graph.checks_infra.registry import BaseRegistry
+    from s1_cns_cli.s1graph.common.images.image_referencer import Image
+    from networkx import DiGraph
+    from pycep.typing import BicepJson
+    from typing_extensions import Literal
+
+
+class Runner(ImageReferencerMixin[None], BaseRunner[BicepGraphManager]):
+    check_type = CheckType.BICEP  # noqa: CCE003  # a static attribute
+
+    block_type_registries: 'dict[Literal["parameters", "resources"], BaseCheckRegistry]' = {  # noqa: CCE003  # a static attribute
+        "parameters": param_registry,
+        "resources": resource_registry,
+    }
+
+    def __init__(
+        self,
+        db_connector: LibraryGraphConnector | None = None,
+        source: str = GraphSource.BICEP,
+        graph_class: Type[BicepLocalGraph] = BicepLocalGraph,
+        graph_manager: BicepGraphManager | None = None,
+        external_registries: list[BaseRegistry] | None = None
+    ) -> None:
+        super().__init__(file_extensions=['.bicep'])
+        db_connector = db_connector or self.db_connector
+        self.external_registries = external_registries if external_registries else []
+        self.graph_class = graph_class
+        self.graph_manager: BicepGraphManager = (
+            graph_manager if graph_manager else BicepGraphManager(source=source, db_connector=db_connector)
+        )
+        self.graph_registry: Registry = get_graph_checks_registry(self.check_type)
+
+        self.context: dict[str, dict[str, Any]] = {}
+        self.definitions: dict[Path, BicepJson] = {}  # type:ignore[assignment]  # need to check, how to support subclass differences
+        self.definitions_raw: dict[Path, list[tuple[int, str]]] = {}    # type:ignore[assignment]
+        self.root_folder: str | Path | None = None
+
+    def run(
+        self,
+        root_folder: str | Path | None,
+        external_checks_dir: list[str] | None = None,
+        files: list[str] | None = None,
+        runner_filter: RunnerFilter | None = None,
+        collect_skip_comments: bool = True,
+    ) -> Report | list[Report]:
+        runner_filter = runner_filter or RunnerFilter()
+        if not runner_filter.show_progress_bar:
+            self.pbar.turn_off_progress_bar()
+
+        report = Report(Runner.check_type)
+        self.root_folder = root_folder
+
+        if not self.context or not self.definitions:
+            file_paths = get_scannable_file_paths(
+                root_folder=root_folder, files=files, excluded_paths=runner_filter.excluded_paths
+            )
+
+            if not file_paths:
+                return report
+
+            self.definitions, self.definitions_raw, parsing_errors = Parser().get_files_definitions(file_paths)
+
+            report.add_parsing_errors(parsing_errors)
+
+            if external_checks_dir:
+                for directory in external_checks_dir:
+                    resource_registry.load_external_checks(directory)
+
+                    if SENTINELONE_CNS_CREATE_GRAPH:
+                        self.graph_registry.load_external_checks(directory)
+
+            self.context = build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw)
+
+            if SENTINELONE_CNS_CREATE_GRAPH:
+                logging.info("Creating Bicep graph")
+                local_graph = self.graph_manager.build_graph_from_definitions(self.definitions)
+                logging.info("Successfully created Bicep graph")
+
+                self.graph_manager.save_graph(local_graph)
+                self.definitions, self.breadcrumbs = convert_graph_vertices_to_tf_definitions(
+                    vertices=local_graph.vertices, root_folder=root_folder
+                )
+
+        self.pbar.initiate(len(self.definitions))
+
+        # run Python checks
+        self.add_python_check_results(report=report, runner_filter=runner_filter, root_folder=root_folder)
+
+        # run graph checks
+        if SENTINELONE_CNS_CREATE_GRAPH:
+            self.add_graph_check_results(report=report, runner_filter=runner_filter)
+
+        if runner_filter.run_image_referencer:
+            if files:
+                # 'root_folder' shouldn't be empty to remove the whole path later and only leave the shortened form
+                root_folder = os.path.split(os.path.commonprefix(files))[0]
+
+            image_report = self.check_container_image_references(
+                graph_connector=self.graph_manager.get_reader_endpoint(),
+                root_path=root_folder,
+                runner_filter=runner_filter,
+            )
+
+            if image_report:
+                # due too many tests failing only return a list, if there is an image report
+                return [report, image_report]
+
+        return report
+
+    def set_definitions_raw(self, definitions_raw: dict[Path, list[tuple[int, str]]]) -> None:
+        self.definitions_raw = definitions_raw
+
+    def add_python_check_results(
+        self, report: Report, runner_filter: RunnerFilter, root_folder: str | Path | None
+    ) -> None:
+        """Adds Python check results to given report"""
+
+        for file_path, definition in self.definitions.items():
+            self.pbar.set_additional_data({'Current File Scanned': os.path.relpath(file_path, root_folder)})
+            for block_type, registry in Runner.block_type_registries.items():
+                block_type_confs = definition.get(block_type)
+                if block_type_confs:
+                    for name, conf in block_type_confs.items():
+                        results = registry.scan(
+                            scanned_file=str(file_path),
+                            entity={name: conf},
+                            skipped_checks=[],
+                            runner_filter=runner_filter
+                        )
+
+                        if results:
+                            file_code_lines = self.definitions_raw[file_path]
+                            start_line = conf["__start_line__"]
+                            end_line = conf["__end_line__"]
+
+                            cleaned_path = clean_file_path(file_path)
+                            resource_id = f"{conf['type']}.{name}"
+                            report.add_resource(f"{cleaned_path}:{resource_id}")
+
+                            suppressions = collect_suppressions_for_report(
+                                code_lines=file_code_lines[start_line - 1 : end_line]
+                            )
+
+                            for check, check_result in results.items():
+                                if check.id in suppressions.keys():
+                                    check_result = suppressions[check.id]
+                                elif check.bc_id and check.bc_id in suppressions.keys():
+                                    check_result = suppressions[check.bc_id]
+
+                                censored_code_lines = omit_secret_value_from_checks(
+                                    check=check,
+                                    check_result=check_result,
+                                    entity_code_lines=file_code_lines[start_line - 1 : end_line],
+                                    entity_config=conf,
+                                    resource_attributes_to_omit=runner_filter.resource_attr_to_omit
+                                )
+
+                                record = Record(
+                                    check_id=check.id,
+                                    bc_check_id=check.bc_id,
+                                    check_name=check.name,
+                                    check_result=check_result,
+                                    code_block=censored_code_lines,
+                                    file_path=self.extract_file_path_from_abs_path(cleaned_path),
+                                    file_line_range=[start_line, end_line],
+                                    resource=resource_id,
+                                    check_class=check.__class__.__module__,
+                                    file_abs_path=str(file_path.absolute()),
+                                    evaluations=None,
+                                    severity=check.severity,
+                                )
+                                record.set_guideline(check.guideline)
+                                report.add_record(record=record)
+                        elif conf.get("existing") is False:
+                            # resources without checks, but not existing ones
+
+                            cleaned_path = clean_file_path(file_path)
+                            resource_id = f"{conf['type']}.{name}"
+                            report.extra_resources.add(
+                                ExtraResource(
+                                    file_abs_path=str(file_path.absolute()),
+                                    file_path=self.extract_file_path_from_abs_path(cleaned_path),
+                                    resource=resource_id,
+                                )
+                            )
+            self.pbar.update()
+        self.pbar.close()
+
+    def extract_file_path_from_abs_path(self, path: Path) -> str:
+        return f"/{os.path.relpath(path, self.root_folder)}"
+
+    def add_graph_check_results(self, report: Report, runner_filter: RunnerFilter) -> None:
+        """Adds YAML check results to given report"""
+
+        checks_results = self.run_graph_checks_results(runner_filter, self.check_type)
+
+        for check, check_results in checks_results.items():
+            for check_result in check_results:
+                entity = check_result["entity"]
+                entity_file_path = Path(entity[CustomAttributes.FILE_PATH])
+
+                clean_check_result: _CheckResult = {
+                    "result": check_result["result"],
+                    "evaluated_keys": check_result["evaluated_keys"],
+                }
+
+                file_code_lines = self.definitions_raw[entity_file_path]
+                start_line = entity["__start_line__"]
+                end_line = cast("int", entity["__end_line__"])
+
+                record = Record(
+                    check_id=check.id,
+                    bc_check_id=check.bc_id,
+                    check_name=check.name,
+                    check_result=clean_check_result,
+                    code_block=file_code_lines[start_line - 1 : end_line],
+                    file_path=self.extract_file_path_from_abs_path(clean_file_path(entity_file_path)),
+                    file_line_range=[start_line, end_line],
+                    resource=entity[CustomAttributes.ID],
+                    check_class=check.__class__.__module__,
+                    file_abs_path=str(entity_file_path.absolute()),
+                    evaluations=None,
+                    severity=check.severity,
+                )
+                if self.breadcrumbs:
+                    breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource)
+                    if breadcrumb:
+                        record = GraphRecord(record, breadcrumb)
+                record.set_guideline(check.guideline)
+                report.add_record(record=record)
+
+    def extract_images(
+        self,
+        graph_connector: DiGraph | None = None,
+        definitions: None = None,
+        definitions_raw: dict[str, list[tuple[int, str]]] | None = None,
+    ) -> list[Image]:
+        if not graph_connector:
+            # should not happen
+            return []
+
+        manager = BicepImageReferencerManager(graph_connector=graph_connector)
+        images = manager.extract_images_from_resources()
+
+        return images

s1_cns_cli/s1graph/bicep/utils.py

@@ -0,0 +1,113 @@
+from __future__ import annotations
+
+import logging
+import os
+import re
+from collections.abc import Collection
+from pathlib import Path
+from typing import Any, TYPE_CHECKING
+
+from s1_cns_cli.s1graph.common.runners.base_runner import filter_ignored_paths
+from s1_cns_cli.s1graph.runner_filter import RunnerFilter
+from s1_cns_cli.s1graph.bicep.parser import Parser
+
+if TYPE_CHECKING:
+    from pycep.typing import BicepJson
+
+
+BICEP_POSSIBLE_ENDINGS = [".bicep"]
+BICEP_START_LINE = "__start_line__"
+BICEP_END_LINE = "__end_line__"
+
+
+def get_scannable_file_paths(
+    root_folder: str | Path | None = None, files: list[str] | None = None, excluded_paths: list[str] | None = None
+) -> set[Path]:
+    """Finds Bicep files"""
+
+    file_paths: set[Path] = set()
+
+    if root_folder:
+        root_path = Path(root_folder)
+        file_paths = {file_path for file_path in root_path.rglob("*.bicep") if file_path.is_file()}
+
+        if excluded_paths:
+            compiled = [re.compile(p.replace(".terraform", r"\.terraform")) for p in excluded_paths]
+            file_paths = {
+                file_path for file_path in file_paths if not any(pattern.search(str(file_path)) for pattern in compiled)
+            }
+    if files:
+        for file in files:
+            if file.endswith(".bicep"):
+                file_paths.add(Path(file))
+
+    return file_paths
+
+
+def clean_file_path(file_path: Path) -> Path:
+    path_parts = [part for part in file_path.parts if part not in (".", "..")]
+
+    return Path(*path_parts)
+
+
+def get_folder_definitions(
+    root_folder: str, excluded_paths: list[str] | None
+) -> tuple[dict[Path, BicepJson], dict[Path, list[tuple[int, str]]], list[str]]:
+    files_list: set[Path] = set()
+    for root, d_names, f_names in os.walk(root_folder):
+        filter_ignored_paths(root_folder, root, d_names, excluded_paths)
+        filter_ignored_paths(root_folder, root, f_names, excluded_paths)
+        for file in f_names:
+            file_ending = os.path.splitext(file)[1]
+            if file_ending in BICEP_POSSIBLE_ENDINGS:
+                full_path = os.path.join(root, file)
+                files_list.add(Path(full_path))
+    parser = Parser()
+
+    return parser.get_files_definitions(files_list)
+
+
+def create_definitions(
+    root_folder: str,
+    files: "Collection[Path] | None" = None,
+    runner_filter: RunnerFilter | None = None,
+) -> tuple[dict[Path, BicepJson], dict[Path, list[tuple[int, str]]]]:
+    definitions: dict[Path, BicepJson] = {}
+    definitions_raw: dict[Path, list[tuple[int, str]]] = {}
+    parsing_errors: list[str] = []
+    runner_filter = runner_filter or RunnerFilter()
+
+    if files:
+        parser = Parser()
+        definitions, definitions_raw, parsing_errors = parser.get_files_definitions(file_paths=files)
+
+    if root_folder:
+        definitions, definitions_raw, parsing_errors = get_folder_definitions(root_folder, runner_filter.excluded_paths)
+
+    if parsing_errors:
+        logging.warning(f"[bicep] found errors while parsing definitions: {parsing_errors}")
+
+    return definitions, definitions_raw
+
+
+def adjust_value(element_name: str, value: Any) -> Any:
+    """Adjusts the value, if the 'element_name' references a nested key
+
+    Ex:
+    element_name = publicKey.keyData
+    value = {"keyData": "key-data", "path": "path"}
+
+    returns new_value = "key-data"
+    """
+
+    if "." in element_name and isinstance(value, dict):
+        key_parts = element_name.split(".")
+        new_value = value.get(key_parts[1])
+
+        if new_value is None:
+            # couldn't find key in in value object
+            return None
+
+        return adjust_value(".".join(key_parts[1:]), new_value)
+
+    return value

s1_cns_cli/s1graph/bitbucket/__init__.py

@@ -0,0 +1 @@
+from s1_cns_cli.s1graph.bitbucket.checks import *  # noqa

s1_cns_cli/s1graph/bitbucket/base_bitbucket_configuration_check.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+from abc import abstractmethod
+from collections.abc import Iterable
+from typing import TYPE_CHECKING, Any
+
+from s1_cns_cli.s1graph.bitbucket.registry import registry
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.models.enums import CheckCategories, CheckResult
+
+
+class BaseBitbucketCheck(BaseCheck):
+    def __init__(
+        self,
+        name: str,
+        id: str,
+        categories: Iterable[CheckCategories],
+        supported_entities: Iterable[str],
+        block_type: str,
+        path: str | None = None,
+        guideline: str | None = None,
+    ):
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_entities=supported_entities,
+            block_type=block_type,
+            guideline=guideline,
+        )
+        self.path = path
+        registry.register(self)
+
+    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]] | None:  # type:ignore[override]  # multi_signature decorator is problematic
+        self.entity_type = entity_type
+
+        return self.scan_conf(conf)
+
+    @abstractmethod
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]] | None:
+        pass

s1_cns_cli/s1graph/bitbucket/checks/__init__.py

@@ -0,0 +1,4 @@
+from pathlib import Path
+
+modules = Path(__file__).parent.glob("*.py")
+__all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"]

s1_cns_cli/s1graph/bitbucket/checks/merge_requests_approvals.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.bitbucket.base_bitbucket_configuration_check import BaseBitbucketCheck
+from s1_cns_cli.s1graph.bitbucket.schemas.branch_restrictions import schema as branch_restrictions_schema
+from s1_cns_cli.s1graph.common.models.enums import CheckCategories, CheckResult
+from s1_cns_cli.s1graph.json_doc.enums import BlockType
+
+
+class MergeRequestRequiresApproval(BaseBitbucketCheck):
+    def __init__(self) -> None:
+        name = "Merge requests should require at least 2 approvals"
+        id = "CKV_BITBUCKET_1"
+        categories = (CheckCategories.SUPPLY_CHAIN,)
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_entities=("*",),
+            block_type=BlockType.DOCUMENT
+        )
+
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]] | None:
+        if branch_restrictions_schema.validate(conf):
+            for value in conf.get("values", []):
+                if value.get('kind', '') == 'require_approvals_to_merge':
+                    if value.get('value', 0) >= 2:
+                        return CheckResult.PASSED, conf
+            return CheckResult.FAILED, conf
+
+        return None
+
+
+check = MergeRequestRequiresApproval()

s1_cns_cli/s1graph/bitbucket/dal.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import logging
+import os
+from typing import Any
+
+import requests
+
+from s1_cns_cli.s1graph.common.runners.base_runner import strtobool
+from s1_cns_cli.s1graph.common.vcs.base_vcs_dal import BaseVCSDAL
+
+
+class Bitbucket(BaseVCSDAL):
+    def setup_conf_dir(self) -> None:
+        """
+            discover parameters from execution context of sentinelone-cns and determine the directory to save temporal files of vcs configuration
+        """
+        bitbucket_conf_dir_name = os.getenv('CKV_BITBUCKET_CONF_DIR_NAME', 'bitbucket_conf')
+        self.bitbucket_conf_dir_path = os.path.join(os.getcwd(), bitbucket_conf_dir_name)
+        self.bitbucket_branch_restrictions_file_path = os.path.join(self.bitbucket_conf_dir_path,
+                                                                    "branch_restrictions.json")
+
+    def discover(self) -> None:
+        """
+            discover parameters from execution context of sentinelone-cns. usually from env variable
+        """
+        server_host = os.getenv('CI_SERVER_URL', "https://api.bitbucket.org/")
+        self.api_url = f'{server_host}2.0'
+        self.graphql_api_url = f"{server_host}api/graphql"
+
+        self.token = os.getenv('APP_PASSWORD', '')
+
+        self.current_repository = os.getenv('BITBUCKET_REPO_FULL_NAME', '')
+        self.current_branch = os.getenv('BITBUCKET_BRANCH', '')
+        self.default_branch_cache = {}
+        self.username = os.getenv('BITBUCKET_USERNAME', '')
+
+    def _request(self, endpoint: str, allowed_status_codes: list[int]) -> dict[str, Any] | None:
+        if not self.token:
+            return None
+        url_endpoint = f"{self.api_url}/{endpoint}"
+        try:
+            s = requests.Session()
+            s.auth = (self.username, self.token)
+            request = s.get(url_endpoint)
+            if request.status_code in allowed_status_codes:
+                data: "dict[str, Any]" = request.json()
+                if isinstance(data, dict) and 'errors' in data.keys():
+                    return None
+                return data
+            else:
+                request.raise_for_status()
+        except Exception:
+            logging.debug(f"Query failed to run by returning code of {url_endpoint}", exc_info=True)
+
+        return None
+
+    def _headers(self) -> dict[str, Any]:
+        # not needed here
+        return {}
+
+    def get_branch_restrictions(self) -> dict[str, Any] | None:
+        if self.current_repository:
+            branch_restrictions = self._request(endpoint=f"repositories/{self.current_repository}/branch-restrictions",
+                                                allowed_status_codes=[200])
+            return branch_restrictions
+        logging.debug("Environment variable BITBUCKET_REPO_FULL_NAME was not set. Cannot fetch branch restrictions.")
+        return None
+
+    def persist_branch_restrictions(self) -> None:
+        branch_restrictions = self.get_branch_restrictions()
+
+        if branch_restrictions:
+            BaseVCSDAL.persist(path=self.bitbucket_branch_restrictions_file_path, conf=branch_restrictions)
+
+    def persist_all_confs(self) -> None:
+        if strtobool(os.getenv("CKV_BITBUCKET_CONFIG_FETCH_DATA", "True")):
+            self.persist_branch_restrictions()