s1-shift-left-cli 0.4.0__py3-none-any.whl

s1_cns_cli/s1graph/common/s1cns/bc_source.py

@@ -0,0 +1,50 @@
+from dataclasses import dataclass
+
+
+class SourceType:
+    __slots__ = ("name", "upload_results", "report_contributor_metrics")
+
+    def __init__(self, name: str, upload_results: bool, report_contributor_metrics: bool = False):
+        self.name = name
+        self.upload_results = upload_results
+        self.report_contributor_metrics = report_contributor_metrics
+
+
+@dataclass
+class BCSourceType:
+    VSCODE = 'vscode'
+    JETBRAINS = 'jetbrains'
+    CLI = 'cli'
+    KUBERNETES_WORKLOADS = 'kubernetesWorkloads'
+    GITHUB_ACTIONS = 'githubActions'
+    CODEBUILD = 'codebuild'
+    JENKINS = 'jenkins'
+    ADMISSION_CONTROLLER = 'admissionController'
+    CIRCLECI = 'circleci'
+    DISABLED = 'disabled'  # use this as a placeholder for generic no-upload logic
+
+
+SourceTypes = {
+    BCSourceType.VSCODE: SourceType(BCSourceType.VSCODE, False),
+    BCSourceType.JETBRAINS: SourceType(BCSourceType.JETBRAINS, False),
+    BCSourceType.CLI: SourceType(BCSourceType.CLI, True),
+    BCSourceType.KUBERNETES_WORKLOADS: SourceType(BCSourceType.KUBERNETES_WORKLOADS, True),
+    BCSourceType.DISABLED: SourceType(BCSourceType.VSCODE, False),
+    BCSourceType.GITHUB_ACTIONS: SourceType(BCSourceType.GITHUB_ACTIONS, True, report_contributor_metrics=True),
+    BCSourceType.CODEBUILD: SourceType(BCSourceType.CODEBUILD, True, report_contributor_metrics=True),
+    BCSourceType.JENKINS: SourceType(BCSourceType.JENKINS, True, report_contributor_metrics=True),
+    BCSourceType.CIRCLECI: SourceType(BCSourceType.CIRCLECI, True, report_contributor_metrics=True),
+    BCSourceType.ADMISSION_CONTROLLER: SourceType(BCSourceType.ADMISSION_CONTROLLER, False)
+}
+
+
+IDEsSourceTypes = {BCSourceType.VSCODE, BCSourceType.JETBRAINS}
+
+
+def get_source_type(source: str) -> SourceType:
+    # helper method to get the source type with a default - using dict.get is ugly; you have to do:
+    # SourceTypes.get(xyz, SourceTypes[BCSourceType.Disabled])
+    if source in SourceTypes:
+        return SourceTypes[source]
+    else:
+        return SourceTypes[BCSourceType.CLI]

s1_cns_cli/s1graph/common/s1cns/check_type.py

@@ -0,0 +1,37 @@
+from dataclasses import dataclass
+
+
+@dataclass
+class CheckType:
+    ANSIBLE = "ansible"
+    ARGO_WORKFLOWS = "argo_workflows"
+    ARM = "arm"
+    AZURE_PIPELINES = "azure_pipelines"
+    BICEP = "bicep"
+    BITBUCKET_PIPELINES = "bitbucket_pipelines"
+    CIRCLECI_PIPELINES = "circleci_pipelines"
+    CLOUDFORMATION = "cloudformation"
+    DOCKERFILE = "dockerfile"
+    GITHUB_CONFIGURATION = "github_configuration"
+    GITHUB_ACTIONS = "github_actions"
+    GITLAB_CONFIGURATION = "gitlab_configuration"
+    GITLAB_CI = "gitlab_ci"
+    BITBUCKET_CONFIGURATION = "bitbucket_configuration"
+    HELM = "helm"
+    JSON = "json"
+    YAML = "yaml"
+    KUBERNETES = "kubernetes"
+    KUSTOMIZE = "kustomize"
+    OPENAPI = "openapi"
+    SCA_PACKAGE = "sca_package"
+    SCA_IMAGE = "sca_image"
+    SECRETS = "secrets"
+    SERVERLESS = "serverless"
+    TERRAFORM = "terraform"
+    TERRAFORM_JSON = "terraform_json"
+    TERRAFORM_PLAN = "terraform_plan"
+    POLICY_3D = "3d_policy"
+
+
+# needs to be at the end
+s1_cns_runners = [value for attr, value in CheckType.__dict__.items() if not attr.startswith("__")]

s1_cns_cli/s1graph/common/s1cns/code_categories.py

@@ -0,0 +1,55 @@
+from enum import Enum
+from typing import Dict, List, Union
+
+from s1_cns_cli.s1graph.common.s1cns.severities import Severity, BcSeverities, Severities
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+
+
+class CodeCategoryType(str, Enum):
+    IAC = "IAC"
+    VULNERABILITIES = "VULNERABILITIES"
+    SECRETS = "SECRETS"
+    LICENSES = "LICENSES"
+    BUILD_INTEGRITY = "BUILD_INTEGRITY"
+
+
+CodeCategoryMapping: Dict[str, Union[CodeCategoryType, List[CodeCategoryType]]] = {
+    CheckType.ANSIBLE: CodeCategoryType.IAC,
+    CheckType.ARGO_WORKFLOWS: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.ARM: CodeCategoryType.IAC,
+    CheckType.AZURE_PIPELINES: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.BICEP: CodeCategoryType.IAC,
+    CheckType.BITBUCKET_PIPELINES: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.CIRCLECI_PIPELINES: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.CLOUDFORMATION: CodeCategoryType.IAC,
+    CheckType.DOCKERFILE: CodeCategoryType.IAC,
+    CheckType.GITHUB_CONFIGURATION: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.GITHUB_ACTIONS: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.GITLAB_CONFIGURATION: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.GITLAB_CI: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.BITBUCKET_CONFIGURATION: CodeCategoryType.BUILD_INTEGRITY,
+    CheckType.HELM: CodeCategoryType.IAC,
+    CheckType.JSON: CodeCategoryType.IAC,
+    CheckType.YAML: CodeCategoryType.IAC,
+    CheckType.KUBERNETES: CodeCategoryType.IAC,
+    CheckType.KUSTOMIZE: CodeCategoryType.IAC,
+    CheckType.OPENAPI: CodeCategoryType.IAC,
+    CheckType.SCA_PACKAGE: [CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES],
+    CheckType.SCA_IMAGE: [CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES],
+    CheckType.SECRETS: CodeCategoryType.SECRETS,
+    CheckType.SERVERLESS: CodeCategoryType.IAC,
+    CheckType.TERRAFORM: CodeCategoryType.IAC,
+    CheckType.TERRAFORM_JSON: CodeCategoryType.IAC,
+    CheckType.TERRAFORM_PLAN: CodeCategoryType.IAC,
+    CheckType.POLICY_3D: CodeCategoryType.IAC
+}
+
+
+class CodeCategoryConfiguration:
+    def __init__(self, category: str, soft_fail_threshold: Severity, hard_fail_threshold: Severity):
+        self.category = category
+        self.soft_fail_threshold = soft_fail_threshold
+        self.hard_fail_threshold = hard_fail_threshold
+
+    def is_global_soft_fail(self) -> bool:
+        return self.hard_fail_threshold == Severities[BcSeverities.OFF]

s1_cns_cli/s1graph/common/s1cns/integration_features/__init__.py

@@ -0,0 +1 @@
+from s1_cns_cli.s1graph.common.s1cns.integration_features.features import *  # noqa

s1_cns_cli/s1graph/common/s1cns/integration_features/base_integration_feature.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from typing import TYPE_CHECKING
+
+from s1_cns_cli.s1graph.common.s1cns.integration_features.integration_feature_registry import integration_feature_registry
+
+if TYPE_CHECKING:
+    from argparse import Namespace
+    from s1_cns_cli.s1graph.common.s1cns.platform_integration import BcPlatformIntegration
+    from s1_cns_cli.s1graph.common.output.report import Report
+    from s1_cns_cli.s1graph.common.typing import _BaseRunner
+
+
+class BaseIntegrationFeature(ABC):
+    def __init__(self, bc_integration: BcPlatformIntegration, order: int) -> None:
+        self.bc_integration = bc_integration
+        self.order = order
+        integration_feature_registry.register(self)
+        self.integration_feature_failures = False
+        self.config: Namespace | None = None  # is set during pre_scan()
+
+    @abstractmethod
+    def is_valid(self) -> bool:
+        raise NotImplementedError()
+
+    @abstractmethod
+    def pre_scan(self) -> None:
+        """Runs before any runners"""
+        pass
+
+    @abstractmethod
+    def pre_runner(self, runner: _BaseRunner) -> None:
+        """Runs before each runner"""
+        pass
+
+    @abstractmethod
+    def post_runner(self, scan_reports: Report) -> None:
+        """Runs after each runner completes"""
+        pass
+
+    @abstractmethod
+    def post_scan(self, merged_reports: list[Report]) -> Report | None:
+        """Runs after all runners complete"""
+        pass

s1_cns_cli/s1graph/common/s1cns/integration_features/features/__init__.py

@@ -0,0 +1,4 @@
+from os.path import dirname, basename, isfile, join
+import glob
+modules = glob.glob(join(dirname(__file__), "*.py"))
+__all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith('__init__.py')]

s1_cns_cli/s1graph/common/s1cns/integration_features/features/custom_policies_integration.py

@@ -0,0 +1,136 @@
+from __future__ import annotations
+
+import json
+import logging
+import re
+from collections import defaultdict
+from copy import deepcopy
+from typing import TYPE_CHECKING, Any, List
+
+from s1_cns_cli.s1graph.common.s1cns.integration_features.base_integration_feature import BaseIntegrationFeature
+from s1_cns_cli.s1graph.common.s1cns.platform_integration import bc_integration
+from s1_cns_cli.s1graph.common.s1cns.severities import Severities
+from s1_cns_cli.s1graph.common.checks_infra.checks_parser import GraphCheckParser
+from s1_cns_cli.s1graph.common.checks_infra.registry import Registry, get_graph_checks_registry
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.s1cns.platform_integration import BcPlatformIntegration
+    from s1_cns_cli.s1graph.common.output.record import Record
+    from s1_cns_cli.s1graph.common.output.report import Report
+    from s1_cns_cli.s1graph.common.typing import _BaseRunner
+
+# service-provider::service-name::data-type-name
+CFN_RESOURCE_TYPE_IDENTIFIER = re.compile(r"^[a-zA-Z0-9]+::[a-zA-Z0-9]+::[a-zA-Z0-9]+$")
+
+
+class CustomPoliciesIntegration(BaseIntegrationFeature):
+    def __init__(self, bc_integration: BcPlatformIntegration) -> None:
+        super().__init__(bc_integration=bc_integration, order=1)  # must be after policy metadata and before suppression integration
+        self.platform_policy_parser = GraphCheckParser()
+        self.bc_cloned_checks: dict[str, list[dict[str, Any]]] = defaultdict(list)
+        self.policy_level_suppression: List[str] = []
+
+    @property
+    def policies_url(self) -> str:
+        return f"{self.bc_integration.api_url}/api/v1/policies/table/data"
+
+    def is_valid(self) -> bool:
+        return (
+            self.bc_integration.is_integration_configured()
+            and not self.bc_integration.skip_download
+            and not self.integration_feature_failures
+        )
+
+    def pre_scan(self) -> None:
+        try:
+            if not self.bc_integration.customer_run_config_response:
+                logging.debug('In the pre-scan for custom policies, but nothing was fetched from the platform')
+                self.integration_feature_failures = True
+                return
+
+            policies = self.bc_integration.customer_run_config_response.get('customPolicies')
+            for policy in policies:
+                try:
+                    logging.debug(f"Loading policy id: {policy.get('id')}")
+                    converted_check = self._convert_raw_check(policy)
+                    source_incident_id = policy.get('sourceIncidentId')
+                    if source_incident_id:
+                        policy['severity'] = Severities[policy['severity']]
+                        self.bc_cloned_checks[source_incident_id].append(policy)
+                        continue
+                    resource_types = Registry._get_resource_types(converted_check['metadata'])
+                    check = self.platform_policy_parser.parse_raw_check(converted_check, resources_types=resource_types)
+                    check.severity = Severities[policy['severity']]
+                    check.bc_id = check.id
+                    if check.frameworks:
+                        for f in check.frameworks:
+                            if f.lower() == "cloudformation":
+                                get_graph_checks_registry("cloudformation").checks.append(check)
+                            elif f.lower() == "terraform":
+                                get_graph_checks_registry("terraform").checks.append(check)
+                            elif f.lower() == "kubernetes":
+                                get_graph_checks_registry("kubernetes").checks.append(check)
+                    elif re.match(CFN_RESOURCE_TYPE_IDENTIFIER, check.resource_types[0]):
+                        get_graph_checks_registry("cloudformation").checks.append(check)
+                    else:
+                        get_graph_checks_registry("terraform").checks.append(check)
+                except Exception:
+                    logging.debug(f"Failed to load policy id: {policy.get('id')}", exc_info=True)
+            logging.debug(f'Found {len(policies)} custom policies from the platform.')
+        except Exception:
+            self.integration_feature_failures = True
+            logging.debug("Scanning without applying custom policies from the platform.", exc_info=True)
+
+    @staticmethod
+    def _convert_raw_check(policy: dict[str, Any]) -> dict[str, Any]:
+        metadata = {
+            'id': policy['id'],
+            'name': policy['title'],
+            'category': policy['category'],
+            'frameworks': policy.get('frameworks', [])
+        }
+        check = {
+            'metadata': metadata,
+            'definition': json.loads(policy['codescanner'])
+        }
+        return check
+
+    def post_runner(self, scan_report: Report) -> None:
+        if self.bc_cloned_checks:
+            scan_report.failed_checks = self.extend_records_with_cloned_policies(scan_report.failed_checks)
+            scan_report.passed_checks = self.extend_records_with_cloned_policies(scan_report.passed_checks)
+            scan_report.skipped_checks = self.extend_records_with_cloned_policies(scan_report.skipped_checks)
+
+    def extend_records_with_cloned_policies(self, records: list[Record]) -> list[Record]:
+        bc_check_ids = [record.bc_check_id for record in records]
+        for idx, bc_check_id in enumerate(bc_check_ids):
+            cloned_policies = self.bc_cloned_checks.get(bc_check_id, [])  # type:ignore[arg-type]  # bc_check_id can be None
+            logging.debug('Cloned policies to be deep copied:')
+            logging.debug(cloned_policies)
+            logging.debug('From origin policy:')
+            logging.debug(records[idx].get_unique_string())
+            for cloned_policy in cloned_policies:
+                new_record = deepcopy(records[idx])
+                new_record.check_id = cloned_policy['id']
+                new_record.bc_check_id = cloned_policy['id']
+                new_record.guideline = cloned_policy['guideline']
+                new_record.severity = cloned_policy['severity']
+                new_record.check_name = cloned_policy['title']
+                records.append(new_record)
+        policy_level_suppression_check_ids = self.convert_suppression_ids_to_bc_check_ids()
+        records = [record for record in records if record.bc_check_id not in policy_level_suppression_check_ids]  # Filter out policy level suppressions after cloned policy is added
+        return records
+
+    def convert_suppression_ids_to_bc_check_ids(self) -> List[str]:
+        return ["_".join(policy.split('_')[:-1]) for policy in self.policy_level_suppression]
+
+    def pre_runner(self, runner: _BaseRunner) -> None:
+        # not used
+        pass
+
+    def post_scan(self, merged_reports: list[Report]) -> None:
+        # not used
+        pass
+
+
+integration = CustomPoliciesIntegration(bc_integration)

s1_cns_cli/s1graph/common/s1cns/integration_features/features/fixes_integration.py

@@ -0,0 +1,142 @@
+from __future__ import annotations
+
+import json
+import logging
+from collections.abc import Iterable
+from itertools import groupby
+from typing import TYPE_CHECKING, Any
+
+from s1_cns_cli.s1graph.common.s1cns.integration_features.base_integration_feature import BaseIntegrationFeature
+from s1_cns_cli.s1graph.common.s1cns.integration_features.features.policy_metadata_integration import integration as metadata_integration
+from s1_cns_cli.s1graph.common.s1cns.platform_integration import bc_integration
+from s1_cns_cli.s1graph.common.util.data_structures_utils import merge_dicts
+from s1_cns_cli.s1graph.common.util.http_utils import extract_error_message, get_default_post_headers
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.s1cns.platform_integration import BcPlatformIntegration
+    from s1_cns_cli.s1graph.common.output.record import Record
+    from s1_cns_cli.s1graph.common.output.report import Report
+    from s1_cns_cli.s1graph.common.typing import _BaseRunner
+
+SUPPORTED_FIX_FRAMEWORKS = ['terraform', 'cloudformation']
+
+
+class FixesIntegration(BaseIntegrationFeature):
+    def __init__(self, bc_integration: BcPlatformIntegration) -> None:
+        super().__init__(bc_integration=bc_integration, order=10)
+
+    @property
+    def fixes_url(self) -> str:
+        return f"{self.bc_integration.api_url}/api/v1/fixes/s1cns"
+
+    def is_valid(self) -> bool:
+        return (
+            self.bc_integration.is_integration_configured()
+            and not self.bc_integration.skip_fixes
+            and not self.integration_feature_failures
+        )
+
+    def post_runner(self, scan_report: Report) -> None:
+        try:
+            if scan_report.check_type not in SUPPORTED_FIX_FRAMEWORKS:
+                return
+            self._get_platform_fixes(scan_report)
+        except Exception:
+            self.integration_feature_failures = True
+            logging.debug("Fixes will not be applied.", exc_info=True)
+
+    def _get_platform_fixes(self, scan_report: Report) -> None:
+
+        # We might want to convert this to one call for all results (all files), but then we would also have to deal
+        # with repo size issues. Because the primary use case for this at the moment is VSCode integration, which
+        # runs one file at a time, this can wait.
+
+        sorted_by_file = sorted(scan_report.failed_checks, key=lambda c: c.file_abs_path)
+        for file, sorted_failed_checks in groupby(sorted_by_file, key=lambda c: c.file_abs_path):
+            failed_checks = [fc for fc in sorted_failed_checks if fc.check_id in metadata_integration.check_metadata]
+            if not failed_checks:
+                continue
+            with open(file, 'r') as reader:
+                file_contents = reader.read()
+
+            fixes = self._get_fixes_for_file(scan_report.check_type, file, file_contents, failed_checks)
+            if not fixes:
+                continue
+            all_fixes = fixes['fixes']
+
+            # a mapping of (s1cns_check_id, resource_id) to the failed check Record object for lookup later
+            # guaranteed to map to exactly one record
+            failed_check_by_check_resource: dict[tuple[str, str], Record] = {
+                k: list(v)[0] for k, v in groupby(failed_checks, key=lambda c: (c.check_id, c.resource))
+            }
+
+            for fix in all_fixes:
+                ckv_id = metadata_integration.get_ckv_id_from_bc_id(fix['policyId'])
+                if not ckv_id:
+                    logging.debug(f"BC ID {fix['policyId']} has no SentinelOneCns ID - might be a cloned policy")
+                    ckv_id = fix.get('policyId', '')
+
+                failed_check = failed_check_by_check_resource.get((ckv_id, fix['resourceId']))  # type:ignore[arg-type]  # ckv_id is not None here
+                if not failed_check:
+                    logging.warning(f'Could not find the corresponding failed check for the fix for ID {ckv_id} and resource {fix["resourceId"]}')
+                    continue
+                failed_check.fixed_definition = fix['fixedDefinition']
+
+    def _get_fixes_for_file(
+        self, check_type: str, filename: str, file_contents: str, failed_checks: Iterable[Record]
+    ) -> dict[str, Any] | None:
+        if not self.bc_integration.bc_source:
+            logging.error("Source was not set")
+            return None
+
+        errors = list(map(lambda c: {
+            'resourceId': c.resource,
+            'policyId': metadata_integration.get_bc_id(c.check_id) or c.check_id,
+            'startLine': c.file_line_range[0],
+            'endLine': c.file_line_range[1]
+        }, failed_checks))
+
+        payload = {
+            'filePath': filename,
+            'fileContent': file_contents,
+            'framework': check_type,
+            'errors': errors
+        }
+
+        headers = merge_dicts(
+            get_default_post_headers(self.bc_integration.bc_source, self.bc_integration.bc_source_version),
+            {"Authorization": self.bc_integration.get_auth_token()}
+        )
+
+        if not self.bc_integration.http:
+            raise AttributeError("HTTP manager was not correctly created")
+
+        request = self.bc_integration.http.request("POST", self.fixes_url, headers=headers, body=json.dumps(payload))  # type:ignore[no-untyped-call]
+
+        if request.status != 200:
+            error_message = extract_error_message(request)
+            logging.error(f'Get fixes request for file {filename} failed with response code {request.status}: {error_message} - skipping fixes for this file')
+            return None
+
+        logging.debug(f'Response from fixes API: {request.data}')
+
+        fixes: list[dict[str, Any]] = json.loads(request.data) if request.data else None
+        if not fixes or not isinstance(fixes, list):
+            logging.warning(f'Unexpected fixes API response for file {filename}; skipping fixes for this file')
+            return None
+        return fixes[0]
+
+    def pre_scan(self) -> None:
+        # not used
+        pass
+
+    def pre_runner(self, runner: _BaseRunner) -> None:
+        # not used
+        pass
+
+    def post_scan(self, merged_reports: list[Report]) -> None:
+        # not used
+        pass
+
+
+integration = FixesIntegration(bc_integration)

s1_cns_cli/s1graph/common/s1cns/integration_features/features/licensing_integration.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, List, cast
+
+from s1_cns_cli.s1graph.common.s1cns.code_categories import CodeCategoryMapping, CodeCategoryType
+from s1_cns_cli.s1graph.common.s1cns.integration_features.base_integration_feature import BaseIntegrationFeature
+from s1_cns_cli.s1graph.common.s1cns.licensing import CategoryToSubscriptionMapping, CustomerSubscription, \
+    open_source_categories
+from s1_cns_cli.s1graph.common.s1cns.platform_integration import bc_integration
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.s1cns.platform_integration import BcPlatformIntegration
+    from s1_cns_cli.s1graph.common.output.report import Report
+    from s1_cns_cli.s1graph.common.typing import _BaseRunner
+
+
+LICENSE_KEY = 'platformLicense'
+MODULES_KEY = 'modules'
+
+
+class LicensingIntegration(BaseIntegrationFeature):
+    def __init__(self, bc_integration: BcPlatformIntegration) -> None:
+        super().__init__(bc_integration=bc_integration, order=6)
+        self.enabled_modules: List[CustomerSubscription] = []
+        self.open_source_only: bool = True
+
+    @property
+    def billing_plan(self) -> None:
+        # Deprecated, already calculated in the BE into the enabled_modules list
+        return None
+
+    def is_valid(self) -> bool:
+        # We will always use this integration to determine what runs or not
+        return True
+
+    def pre_scan(self) -> None:
+        if not self.bc_integration.bc_api_key:
+            logging.debug('Running without API key, so only open source runners will be enabled')
+            self.open_source_only = True
+        elif not self.bc_integration.customer_run_config_response:
+            logging.debug('Customer run config response does not exist, but there is an API key, so there may be some integration issue. Proceeding with open source runners.')
+            self.open_source_only = True
+        else:
+            logging.debug('Found customer run config and using it for licensing')
+            license_details = self.bc_integration.customer_run_config_response.get(LICENSE_KEY)
+            logging.debug(f'User license details: {license_details}')
+
+            self.open_source_only = False
+            # the API will return True for all modules if they are on resource mode, so we don't actually need the billing plan explicitly here
+            self.enabled_modules = [CustomerSubscription(m) for m, e in license_details.get(MODULES_KEY).items() if e]
+
+    def is_runner_valid(self, runner_check_type: str) -> bool:
+        logging.debug(f'Checking if {runner_check_type} is valid for license')
+        if self.open_source_only:
+            enabled = CodeCategoryMapping[runner_check_type] in open_source_categories  # new secrets are disabled, but the runner is valid
+            logging.debug(f'Open source mode - the runner is {"en" if enabled else "dis"}abled')
+        else:
+            sub_type = LicensingIntegration.get_subscription_for_runner(runner_check_type)
+            enabled = sub_type in self.enabled_modules
+            logging.debug(f'Customer mode - the {sub_type} subscription is {"en" if enabled else "dis"}abled')
+
+        return enabled
+
+    def should_run_image_referencer(self) -> bool:
+        return not self.open_source_only and CustomerSubscription.SCA in self.enabled_modules
+
+    @staticmethod
+    def get_subscription_for_runner(runner_check_type: str) -> CustomerSubscription:
+        if 'sca_' in runner_check_type:
+            # SCA runners currently have two CodeCategoryTypes
+            return CustomerSubscription.SCA
+        else:
+            return CategoryToSubscriptionMapping[cast(CodeCategoryType, CodeCategoryMapping[runner_check_type])]
+
+    def post_runner(self, scan_report: Report) -> None:
+        pass
+
+    def pre_runner(self, runner: _BaseRunner) -> None:
+        pass
+
+    def post_scan(self, merged_reports: list[Report]) -> None:
+        # not used
+        pass
+
+
+integration = LicensingIntegration(bc_integration)

s1_cns_cli/s1graph/common/s1cns/integration_features/features/policies_3d_integration.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+import json
+import logging
+from typing import TYPE_CHECKING, Any
+
+from s1_cns_cli.s1graph.common.s1cns.integration_features.base_integration_feature import BaseIntegrationFeature
+from s1_cns_cli.s1graph.common.s1cns.platform_integration import bc_integration
+from s1_cns_cli.s1graph.policies_3d.checks_parser import Policy3dParser
+from s1_cns_cli.s1graph.policies_3d.runner import Policy3dRunner
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.s1cns.platform_integration import BcPlatformIntegration
+    from s1_cns_cli.s1graph.common.output.report import Report
+    from s1_cns_cli.s1graph.common.typing import _BaseRunner
+
+
+class Policies3DIntegration(BaseIntegrationFeature):
+    def __init__(self, bc_integration: BcPlatformIntegration) -> None:
+        super().__init__(bc_integration=bc_integration, order=11)
+        self.platform_policy_parser = Policy3dParser()
+
+    def is_valid(self) -> bool:
+        return (
+            self.bc_integration.is_integration_configured()
+            and not self.bc_integration.skip_download
+            and not self.integration_feature_failures
+        )
+
+    def should_run_image_referencer(self) -> bool:
+        return True
+
+    def pre_scan(self) -> None:
+        # not used
+        pass
+
+    def pre_runner(self, runner: _BaseRunner) -> None:
+        # not used
+        pass
+
+    def post_runner(self, scan_report: Report) -> None:
+        # not used
+        pass
+
+    @staticmethod
+    def _convert_raw_check(policy: dict[str, Any]) -> dict[str, Any]:
+        metadata = {
+            'id': policy['id'],
+            'name': policy['title'],
+            'category': policy['category'],
+            'guideline': policy['guideline'],
+            'severity': policy['severity']
+        }
+        check = {
+            'metadata': metadata,
+            'definition': json.loads(policy['codescanner'])
+        }
+        return check
+
+    def post_scan(self, scan_reports: list[Report]) -> Report | None:
+        try:
+            if not self.bc_integration.customer_run_config_response:
+                logging.debug('In the post scan for 3d policies, but nothing was fetched from the platform')
+                self.integration_feature_failures = True
+                return None
+
+            policies = self.bc_integration.customer_run_config_response.get('Policies3D')
+            logging.debug(f'Got {len(policies)} 3d policies from the platform.')
+            if not policies:
+                return None
+
+            runner = Policy3dRunner()
+            report = runner.run_v2(raw_checks=policies, scan_reports=scan_reports)
+            return report
+
+        except Exception as e:
+            self.integration_feature_failures = True
+            logging.debug(f'Scanning without applying 3d policies from the platform.\n{e}')
+            return None
+
+
+integration = Policies3DIntegration(bc_integration)