s1-shift-left-cli 0.4.0__py3-none-any.whl

s1_cns_cli/s1graph/ansible/checks/base_ansible_task_value_check.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+from abc import abstractmethod
+from collections.abc import Iterable
+from typing import TYPE_CHECKING, Any
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_check import BaseAnsibleTaskCheck
+from s1_cns_cli.s1graph.common.models.consts import ANY_VALUE
+from s1_cns_cli.s1graph.common.models.enums import CheckResult
+from s1_cns_cli.s1graph.common.util.data_structures_utils import find_in_dict
+from s1_cns_cli.s1graph.yaml_doc.enums import BlockType
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.models.enums import CheckCategories
+
+
+class BaseAnsibleTaskValueCheck(BaseAnsibleTaskCheck):
+    def __init__(
+        self,
+        name: str,
+        id: str,
+        categories: Iterable[CheckCategories],
+        supported_modules: Iterable[str],
+        guideline: str | None = None,
+        path: str | None = None,
+        missing_block_result: CheckResult = CheckResult.FAILED,
+    ) -> None:
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_modules=supported_modules,
+            block_type=BlockType.ARRAY,
+            guideline=guideline,
+            path=path,
+        )
+        self.missing_block_result = missing_block_result
+
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
+        inspected_key = self.get_inspected_key()
+        expected_values = self.get_expected_values()
+
+        value = find_in_dict(conf, inspected_key)
+
+        if value is None:
+            return self.missing_block_result, self.entity_conf
+        if ANY_VALUE in expected_values:
+            return CheckResult.PASSED, self.entity_conf
+        if value in expected_values:
+            return CheckResult.PASSED, self.entity_conf
+        # quite often string values are case-insensitive
+        if isinstance(value, str) and value.lower() in [exp.lower() for exp in expected_values if isinstance(exp, str)]:
+            return CheckResult.PASSED, self.entity_conf
+
+        return CheckResult.FAILED, self.entity_conf
+
+    @abstractmethod
+    def get_inspected_key(self) -> str:
+        """
+        :return: JSONPath syntax path of the checked attribute
+        """
+        raise NotImplementedError()
+
+    def get_expected_values(self) -> list[Any]:
+        """
+        Override the method with the list of acceptable values if the check has more than one possible expected value, given
+        the inspected key
+        :return: List of expected values, defaults to a list of the expected value
+        """
+        return [self.get_expected_value()]
+
+    def get_expected_value(self) -> Any:
+        """
+        Returns the default expected value, governed by provider best practices
+        """
+        return True
+
+    def get_evaluated_keys(self) -> list[str]:
+        return [self.get_inspected_key()]

s1_cns_cli/s1graph/ansible/checks/graph_checks/BlockErrorHandling.yaml

@@ -0,0 +1,10 @@
+metadata:
+  id: "CKV2_ANSIBLE_3"
+  name: "Ensure block is handling task errors properly"
+  category: "BACKUP_AND_RECOVERY"
+definition:
+  cond_type: attribute
+  resource_types:
+    - block
+  attribute: rescue
+  operator: exists

s1_cns_cli/s1graph/ansible/checks/graph_checks/DnfDisableGpgCheck.yaml

@@ -0,0 +1,12 @@
+metadata:
+  id: "CKV2_ANSIBLE_4"
+  name: "Ensure that packages with untrusted or missing GPG signatures are not used by dnf"
+  category: "GENERAL_SECURITY"
+definition:
+  cond_type: attribute
+  resource_types:
+    - tasks.ansible.builtin.dnf
+    - tasks.dnf
+  attribute: disable_gpg_check
+  operator: not_equals
+  value: true

s1_cns_cli/s1graph/ansible/checks/graph_checks/DnfSslVerify.yaml

@@ -0,0 +1,12 @@
+metadata:
+  id: "CKV2_ANSIBLE_5"
+  name: "Ensure that SSL validation isn't disabled with dnf"
+  category: "GENERAL_SECURITY"
+definition:
+  cond_type: attribute
+  resource_types:
+    - tasks.ansible.builtin.dnf
+    - tasks.dnf
+  attribute: sslverify
+  operator: not_equals
+  value: false

s1_cns_cli/s1graph/ansible/checks/graph_checks/DnfValidateCerts.yaml

@@ -0,0 +1,12 @@
+metadata:
+  id: "CKV2_ANSIBLE_6"
+  name: "Ensure that certificate validation isn't disabled with dnf"
+  category: "GENERAL_SECURITY"
+definition:
+  cond_type: attribute
+  resource_types:
+    - tasks.ansible.builtin.dnf
+    - tasks.dnf
+  attribute: validate_certs
+  operator: not_equals
+  value: false

s1_cns_cli/s1graph/ansible/checks/graph_checks/GetUrlHttpsOnly.yaml

@@ -0,0 +1,12 @@
+metadata:
+  id: "CKV2_ANSIBLE_2"
+  name: "Ensure that HTTPS url is used with get_url"
+  category: "NETWORKING"
+definition:
+  cond_type: attribute
+  resource_types:
+    - tasks.ansible.builtin.get_url
+    - tasks.get_url
+  attribute: url
+  operator: starting_with
+  value: "https://"

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoHTTP.yaml

@@ -0,0 +1,17 @@
+metadata:
+  id: "CKV_PAN_2"
+  name: "Ensure plain-text management HTTP is not enabled for an Interface Management Profile"
+  category: "NETWORKING"
+definition:
+  or:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_management_profile
+    attribute: http
+    operator: not_exists
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_management_profile
+    attribute: http
+    operator: not_equals
+    value: true

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoTelnet.yaml

@@ -0,0 +1,17 @@
+metadata:
+  id: "CKV_PAN_3"
+  name: "Ensure plain-text management Telnet is not enabled for an Interface Management Profile"
+  category: "NETWORKING"
+definition:
+  or:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_management_profile
+    attribute: telnet
+    operator: not_exists
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_management_profile
+    attribute: telnet
+    operator: not_equals
+    value: true

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosPolicyDescription.yaml

@@ -0,0 +1,16 @@
+metadata:
+  id: "CKV_PAN_8"
+  name: "Ensure description is populated within security policies"
+  category: "NETWORKING"
+definition:
+  and:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: description
+    operator: exists
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: description
+    operator: is_not_empty

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosPolicyLogForwarding.yaml

@@ -0,0 +1,16 @@
+metadata:
+  id: "CKV_PAN_9"
+  name: "Ensure a Log Forwarding Profile is selected for each security policy rule"
+  category: "NETWORKING"
+definition:
+  and:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: log_setting
+    operator: exists
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: log_setting
+    operator: is_not_empty

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosPolicyLoggingEnabled.yaml

@@ -0,0 +1,12 @@
+metadata:
+  id: "CKV_PAN_10"
+  name: "Ensure logging at session end is enabled within security policies"
+  category: "NETWORKING"
+definition:
+  # Logging config flag "log_end" is not specified, defaults to true, which is a pass
+  cond_type: attribute
+  resource_types:
+    - tasks.paloaltonetworks.panos.panos_security_rule
+  attribute: log_end
+  operator: not_equals
+  value: false

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosPolicyNoApplicationAny.yaml

@@ -0,0 +1,22 @@
+metadata:
+  id: "CKV_PAN_5"
+  name: "Ensure security rules do not have 'application' set to 'any'"
+  category: "NETWORKING"
+definition:
+  and:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: application
+    operator: exists
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: application
+    operator: is_not_empty
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: application
+    operator: not_equals_ignore_case
+    value: 'any'

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosPolicyNoDSRI.yaml

@@ -0,0 +1,17 @@
+metadata:
+  id: "CKV_PAN_4"
+  name: "Ensure DSRI is not enabled within security policies"
+  category: "NETWORKING"
+definition:
+  or:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: disable_server_response_inspection
+    operator: equals
+    value: false
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: disable_server_response_inspection
+    operator: not_exists # Default value is false which passes the check

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosPolicyNoServiceAny.yaml

@@ -0,0 +1,22 @@
+metadata:
+  id: "CKV_PAN_6"
+  name: "Ensure security rules do not have 'service' set to 'any'"
+  category: "NETWORKING"
+definition:
+  and:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: service
+    operator: exists
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: service
+    operator: is_not_empty
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_security_rule
+    attribute: service
+    operator: not_equals_ignore_case
+    value: 'any'

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosPolicyNoSrcAnyDstAny.yaml

@@ -0,0 +1,40 @@
+metadata:
+  id: "CKV_PAN_7"
+  name: "Ensure security rules do not have 'source_ip' and 'destination_ip' both containing values of 'any'"
+  category: "NETWORKING"
+definition:
+  or:
+  - and:
+    - cond_type: attribute
+      resource_types:
+        - tasks.paloaltonetworks.panos.panos_security_rule
+      attribute: source_ip
+      operator: exists
+    - cond_type: attribute
+      resource_types:
+        - tasks.paloaltonetworks.panos.panos_security_rule
+      attribute: source_ip
+      operator: is_not_empty
+    - cond_type: attribute
+      resource_types:
+        - tasks.paloaltonetworks.panos.panos_security_rule
+      attribute: source_ip
+      operator: not_equals_ignore_case
+      value: 'any'
+  - and:
+    - cond_type: attribute
+      resource_types:
+        - tasks.paloaltonetworks.panos.panos_security_rule
+      attribute: destination_ip
+      operator: exists
+    - cond_type: attribute
+      resource_types:
+        - tasks.paloaltonetworks.panos.panos_security_rule
+      attribute: destination_ip
+      operator: is_not_empty
+    - cond_type: attribute
+      resource_types:
+        - tasks.paloaltonetworks.panos.panos_security_rule
+      attribute: destination_ip
+      operator: not_equals_ignore_case
+      value: 'any'

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosZoneProtectionProfile.yaml

@@ -0,0 +1,16 @@
+metadata:
+  id: "CKV_PAN_14"
+  name: "Ensure a Zone Protection Profile is defined within Security Zones"
+  category: "NETWORKING"
+definition:
+  and:
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_zone
+    attribute: zone_profile
+    operator: exists
+  - cond_type: attribute
+    resource_types:
+      - tasks.paloaltonetworks.panos.panos_zone
+    attribute: zone_profile
+    operator: is_not_empty

s1_cns_cli/s1graph/ansible/checks/graph_checks/PanosZoneUserIDIncludeACL.yaml

@@ -0,0 +1,31 @@
+metadata:
+  id: "CKV_PAN_15"
+  name: "Ensure an Include ACL is defined for a Zone when User-ID is enabled"
+  category: "NETWORKING"
+definition:
+  or:
+      # If User-ID is enabled, also check for a non-empty Include ACL
+      - and:
+            - cond_type: attribute
+              resource_types:
+                - tasks.paloaltonetworks.panos.panos_zone
+              attribute: enable_userid
+              operator: equals
+              value: true
+            - cond_type: attribute
+              resource_types:
+                - tasks.paloaltonetworks.panos.panos_zone
+              attribute: include_acl
+              operator: exists
+            - cond_type: attribute
+              resource_types:
+                - tasks.paloaltonetworks.panos.panos_zone
+              attribute: include_acl
+              operator: is_not_empty
+
+      # Or if User-ID is not enabled, there is no need to check for an Include ACL
+      - cond_type: attribute
+        resource_types:
+          - tasks.paloaltonetworks.panos.panos_zone
+        attribute: enable_userid
+        operator: not_exists

s1_cns_cli/s1graph/ansible/checks/graph_checks/UriHttpsOnly.yaml

@@ -0,0 +1,12 @@
+metadata:
+  id: "CKV2_ANSIBLE_1"
+  name: "Ensure that HTTPS url is used with uri"
+  category: "NETWORKING"
+definition:
+  cond_type: attribute
+  resource_types:
+    - tasks.ansible.builtin.uri
+    - tasks.uri
+  attribute: url
+  operator: starting_with
+  value: "https://"

s1_cns_cli/s1graph/ansible/checks/registry.py

@@ -0,0 +1,4 @@
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.yaml_doc.base_registry import Registry
+
+registry = Registry(CheckType.ANSIBLE)

s1_cns_cli/s1graph/ansible/checks/task/__init__.py

@@ -0,0 +1,2 @@
+from s1_cns_cli.s1graph.ansible.checks.task.aws import *  # noqa
+from s1_cns_cli.s1graph.ansible.checks.task.builtin import *  # noqa

s1_cns_cli/s1graph/ansible/checks/task/aws/EC2EBSOptimized.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class EC2EBSOptimized(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure that EC2 is EBS optimized"
+        id = "CKV_AWS_135"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.GENERAL_SECURITY,),
+            supported_modules=("amazon.aws.ec2_instance", "ec2_instance"),
+        )
+
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
+        if not conf.get("image_id") and not conf.get("image"):
+            # if 'image_id' or 'image' are not set, then an already running instance is targeted
+            return CheckResult.UNKNOWN, self.entity_conf
+
+        return super().scan_conf(conf=conf)
+
+    def get_inspected_key(self) -> str:
+        return "ebs_optimized"
+
+
+check = EC2EBSOptimized()

s1_cns_cli/s1graph/ansible/checks/task/aws/EC2PublicIP.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class EC2PublicIP(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "EC2 instance should not have public IP."
+        id = "CKV_AWS_88"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.NETWORKING,),
+            supported_modules=("amazon.aws.ec2_instance", "ec2_instance"),
+        )
+
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
+        if not conf.get("image_id") and not conf.get("image"):
+            # if 'image_id' or 'image' are not set, then an already running instance is targeted
+            return CheckResult.UNKNOWN, self.entity_conf
+
+        return super().scan_conf(conf=conf)
+
+    def get_inspected_key(self) -> str:
+        return "network/assign_public_ip"
+
+    def get_expected_value(self) -> Any:
+        return False
+
+
+check = EC2PublicIP()

s1_cns_cli/s1graph/ansible/checks/task/aws/__init__.py

@@ -0,0 +1,4 @@
+from pathlib import Path
+
+modules = Path(__file__).parent.glob("*.py")
+__all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"]

s1_cns_cli/s1graph/ansible/checks/task/builtin/AptAllowUnauthenticated.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class AptAllowUnauthenticated(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure that packages with untrusted or missing signatures are not used"
+        id = "CKV_ANSIBLE_5"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.GENERAL_SECURITY,),
+            supported_modules=("ansible.builtin.apt", "apt"),
+            missing_block_result=CheckResult.PASSED,
+        )
+
+    def get_expected_value(self) -> Any:
+        return False
+
+    def get_inspected_key(self) -> str:
+        return "allow_unauthenticated"
+
+
+check = AptAllowUnauthenticated()

s1_cns_cli/s1graph/ansible/checks/task/builtin/AptForce.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class AptForce(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state"
+        id = "CKV_ANSIBLE_6"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.GENERAL_SECURITY,),
+            supported_modules=("ansible.builtin.apt", "apt"),
+            missing_block_result=CheckResult.PASSED,
+        )
+
+    def get_expected_value(self) -> Any:
+        return False
+
+    def get_inspected_key(self) -> str:
+        return "force"
+
+
+check = AptForce()

s1_cns_cli/s1graph/ansible/checks/task/builtin/GetUrlValidateCerts.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class GetUrlValidateCerts(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure that certificate validation isn't disabled with get_url"
+        id = "CKV_ANSIBLE_2"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.GENERAL_SECURITY,),
+            supported_modules=("ansible.builtin.get_url", "get_url"),
+            missing_block_result=CheckResult.PASSED,
+        )
+
+    def get_inspected_key(self) -> str:
+        return "validate_certs"
+
+
+check = GetUrlValidateCerts()

s1_cns_cli/s1graph/ansible/checks/task/builtin/UriValidateCerts.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class UriValidateCerts(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure that certificate validation isn't disabled with uri"
+        id = "CKV_ANSIBLE_1"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.GENERAL_SECURITY,),
+            supported_modules=("ansible.builtin.uri", "uri"),
+            missing_block_result=CheckResult.PASSED,
+        )
+
+    def get_inspected_key(self) -> str:
+        return "validate_certs"
+
+
+check = UriValidateCerts()

s1_cns_cli/s1graph/ansible/checks/task/builtin/YumSslVerify.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class YumSslVerify(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure that SSL validation isn't disabled with yum"
+        id = "CKV_ANSIBLE_4"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.GENERAL_SECURITY,),
+            supported_modules=("ansible.builtin.yum", "yum"),
+            missing_block_result=CheckResult.PASSED,
+        )
+
+    def get_inspected_key(self) -> str:
+        return "sslverify"
+
+
+check = YumSslVerify()

s1_cns_cli/s1graph/ansible/checks/task/builtin/YumValidateCerts.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from s1_cns_cli.s1graph.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+
+
+class YumValidateCerts(BaseAnsibleTaskValueCheck):
+    def __init__(self) -> None:
+        name = "Ensure that certificate validation isn't disabled with yum"
+        id = "CKV_ANSIBLE_3"
+        super().__init__(
+            name=name,
+            id=id,
+            categories=(CheckCategories.GENERAL_SECURITY,),
+            supported_modules=("ansible.builtin.yum", "yum"),
+            missing_block_result=CheckResult.PASSED,
+        )
+
+    def get_inspected_key(self) -> str:
+        return "validate_certs"
+
+
+check = YumValidateCerts()

s1_cns_cli/s1graph/ansible/checks/task/builtin/__init__.py

@@ -0,0 +1,4 @@
+from pathlib import Path
+
+modules = Path(__file__).parent.glob("*.py")
+__all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"]

s1_cns_cli/s1graph/ansible/graph_builder/graph_components/resource_types.py

@@ -0,0 +1,10 @@
+from enum import Enum
+
+
+class ResourceType(str, Enum):
+    BLOCK = "block"
+    TASKS = "tasks"
+
+    def __str__(self) -> str:
+        # needed, because of a Python 3.11 change
+        return self.value