s1-shift-left-cli 0.4.0__py3-none-any.whl

s1_cns_cli/s1graph/secrets/scan_git_history.py

@@ -0,0 +1,247 @@
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import platform
+from typing import TYPE_CHECKING, Optional, List, Tuple
+
+from s1_cns_cli.s1graph.common.util.stopit import ThreadingTimeout, SignalTimeout, TimeoutException
+from s1_cns_cli.s1graph.common.util.decorators import time_it
+from s1_cns_cli.s1graph.common.parallelizer.parallel_runner import parallel_runner
+from detect_secrets.core import scan
+
+from s1_cns_cli.s1graph.secrets.git_history_store import GitHistorySecretStore, RawStore, RENAME_STR, FILE_RESULTS_STR
+from s1_cns_cli.s1graph.secrets.git_types import Commit, CommitMetadata, GIT_HISTORY_NOT_BEEN_REMOVED, PROHIBITED_FILES
+
+if TYPE_CHECKING:
+    from detect_secrets import SecretsCollection
+
+os.environ["GIT_PYTHON_REFRESH"] = "quiet"
+try:
+    from git import Repo, Tree  # type: ignore
+
+    git_import_error = None
+except ImportError as e:
+    git_import_error = e
+
+MIN_SPLIT = 100
+FILES_TO_IGNORE_IN_GIT_HISTORY = ('.md',) + PROHIBITED_FILES
+
+
+class GitHistoryScanner:
+    commits_count = 0  # noqa: CCE003
+
+    def __init__(self, root_folder: str, secrets: SecretsCollection,
+                 history_store: Optional[GitHistorySecretStore] = None, timeout: int = 43200):
+        """
+        root_folder: Is necessary for initializing the Repo to read from
+        secrets: An object which will be filled with secrets during the run of the secrets scan
+        history_store: A helper objects which will be field during the run, to map between found secrets and commits.
+            is not used afterwards for outside-of-class work
+        """
+        self.root_folder = root_folder
+        self.secrets = secrets
+        self.timeout = timeout
+        # in case we start from mid-history (git) we want to continue from where we've been
+        self.history_store: GitHistorySecretStore = history_store or GitHistorySecretStore()
+        self.raw_store: List[RawStore] = []
+        self.repo: Repo
+
+    def scan_history(self, last_commit_scanned: Optional[str] = '') -> bool:
+        """return true if the scan finished without timeout"""
+        is_repo_set = self.set_repo()  # for mocking purposes in testing
+        if not is_repo_set:
+            logging.info("Couldn't set git repo. Cannot proceed with git history scan.")
+            return False
+        timeout_class = ThreadingTimeout if platform.system() == 'Windows' else SignalTimeout
+        # mark the scan to finish within the timeout
+        with timeout_class(self.timeout) as to_ctx_mgr:
+            scanned = self._scan_history(last_commit_scanned)
+            self._create_secret_collection()
+        if to_ctx_mgr.state == to_ctx_mgr.TIMED_OUT:
+            logging.info(f"timeout reached ({self.timeout}), stopping scan.")
+            return False
+        # else: everything was OK
+        return scanned
+
+    def _scan_history(self, last_commit_scanned: Optional[str] = '') -> bool:
+        commits_diff: List[Commit] = []
+        if not last_commit_scanned:
+            first_commit_diff = self._get_first_commit()
+            if first_commit_diff:
+                commits_diff.append(self._get_first_commit())
+        commits_diff.extend(self._get_commits_diff(last_commit_sha=last_commit_scanned))
+        logging.info(f"[_scan_history] got {len(commits_diff)} files diffs in {self.commits_count} commits")
+        if self.commits_count > MIN_SPLIT:
+            logging.info("[_scan_history] starting parallel scan")
+            self._run_scan_parallel(commits_diff)
+        else:
+            logging.info("[_scan_history] starting single scan")
+            self.raw_store.extend(self._run_scan_one_bulk(commits_diff))
+
+        if not self.raw_store:  # scanned nothing
+            return False
+
+        self._process_raw_store()
+        return True
+
+    def _process_raw_store(self) -> None:
+        for raw_res in self.raw_store:
+            res_type = raw_res.get('type')
+            if res_type == FILE_RESULTS_STR:
+                self.history_store.set_secret_map(raw_res.get('file_results', []), raw_res.get('file_name', ''),
+                                                  raw_res['commit'])
+            elif res_type == RENAME_STR:
+                self.history_store.handle_renamed_file(raw_res.get('rename_from', ''), raw_res.get('rename_to', ''),
+                                                       raw_res['commit'])
+
+    def _create_secret_collection(self) -> None:
+        # run over the entire history store and create the secret collection
+        for secrets_data in self.history_store.secrets_by_file_value_type.values():
+            for secret_data in secrets_data:
+                removed = secret_data["removed_commit_hash"] if secret_data[
+                    "removed_commit_hash"] else GIT_HISTORY_NOT_BEEN_REMOVED
+                key = f'{secret_data["added_commit_hash"]}_{removed}_{secret_data["potential_secret"].filename}'
+                self.secrets[key].add(secret_data["potential_secret"])
+        logging.info(f"Created secret collection for {len(self.history_store.secrets_by_file_value_type)} secrets")
+
+    def set_repo(self, root_folder: str | None = None) -> bool:
+        if not root_folder:
+            root_folder = self.root_folder
+        if git_import_error is not None:
+            logging.warning(f"Unable to load git module (is the git executable available?) {git_import_error}")
+            return False
+        try:
+            self.repo = Repo(root_folder)
+            return True
+        except Exception as e:
+            logging.error(f"Folder {root_folder} is not a GIT project {e}")
+            return False
+
+    def _get_commits_diff(self, last_commit_sha: Optional[str] = None) -> List[Commit]:
+        """
+        :param: last_commit_sha = is the last commit we have already scanned. in case it exist the function will
+        return the commits from the revision of param to the current head
+        """
+        logging.info("[_get_commits_diff] started")
+        if last_commit_sha:
+            curr_rev = self.repo.head.commit.hexsha
+            commits = list(self.repo.iter_commits(last_commit_sha + '..' + curr_rev))
+        else:
+            commits = list(self.repo.iter_commits(self.repo.active_branch))
+        GitHistoryScanner.commits_count = len(commits)
+        commits_diff: List[Commit] = []
+        for previous_commit_idx in range(GitHistoryScanner.commits_count - 1, 0, -1):
+            try:
+                current_commit_idx = previous_commit_idx - 1
+                current_commit_hash = commits[current_commit_idx].hexsha
+                committed_datetime: str = commits[current_commit_idx].committed_datetime.isoformat()
+                committer: str = commits[current_commit_idx].committer.name or ''
+                git_diff = commits[previous_commit_idx].diff(current_commit_hash, create_patch=True)
+                curr_diff: Commit = Commit(
+                    metadata=CommitMetadata(
+                        commit_hash=current_commit_hash,
+                        committer=committer,
+                        committed_datetime=committed_datetime
+                    )
+                )
+                for file_diff in git_diff:
+                    file_name = file_diff.a_path if file_diff.a_path else file_diff.b_path
+                    if file_name.endswith(FILES_TO_IGNORE_IN_GIT_HISTORY):
+                        continue
+                    file_path = os.path.join(self.root_folder, file_name)
+
+                    if file_diff.renamed_file:
+                        logging.debug(f"File was renamed from {file_diff.rename_from} to {file_diff.rename_to}")
+                        curr_diff.rename_file(
+                            file_path=file_path,
+                            prev_filename=file_diff.rename_from,
+                            new_filename=file_diff.rename_to
+                        )
+                        continue
+
+                    elif file_diff.deleted_file:
+                        logging.debug(f"File {file_diff.a_path} was deleted")
+
+                    base_diff_format = f'diff --git {self.root_folder}/{file_diff.a_path} {self.root_folder}/{file_diff.b_path}' \
+                                       f'\nindex 0000..0000 0000\n--- {self.root_folder}/{file_diff.a_path}\n+++ {self.root_folder}/{file_diff.b_path}\n'
+                    curr_diff.add_file(filename=file_path, commit_diff=base_diff_format + file_diff.diff.decode('utf-8'))
+                if not curr_diff.is_empty():
+                    commits_diff.append(curr_diff)
+            except TimeoutException:
+                logging.error(f"stopped while getting commits diff, iteration: {previous_commit_idx}")
+                return []
+            except Exception as err:
+                logging.warning(f"got error while getting commits diff, iteration: {previous_commit_idx}, error: {err}")
+                continue
+        logging.info("[_get_commits_diff] ended")
+        return commits_diff
+
+    def _run_scan_parallel(self, commits_diff: List[Commit]) -> None:
+        results = parallel_runner.run_function(GitHistoryScanner._run_scan_one_bulk, commits_diff)
+
+        for result in results:
+            if result:
+                self.raw_store.extend(result)
+
+    @staticmethod
+    def _run_scan_one_bulk(commits_diff: List[Commit] | Commit) -> List[RawStore]:
+        scanned_file_count = 0
+        results: List[RawStore] = []
+        # parallel runner can make the list flat, so I can get here dict instead of list
+        if isinstance(commits_diff, Commit):
+            results, scanned_file_count = GitHistoryScanner._run_scan_one_commit(commits_diff)
+        elif isinstance(commits_diff, list):
+            for commit in commits_diff:
+                cur_results, curr_count = GitHistoryScanner._run_scan_one_commit(commit)
+                scanned_file_count += curr_count
+                results.extend(cur_results)
+        logging.debug(f"Scanned {scanned_file_count} git history files")
+        return results
+
+    @staticmethod
+    def _run_scan_one_commit(commit: Commit) -> Tuple[List[RawStore], int]:
+        results: List[RawStore] = []
+        scanned_file_count = 0
+        commit_hash = commit.metadata.commit_hash
+        for file_name, file_diff in commit.files.items():
+            file_results = [*scan.scan_diff(file_diff)]
+            if file_results:
+                logging.debug(
+                    f"Found {len(file_results)} secrets in file path {file_name} in commit {commit_hash}")
+                results.append(RawStore(file_results=file_results, file_name=file_name, commit=commit,
+                                        type=FILE_RESULTS_STR, rename_from='', rename_to=''))
+        for _, details in commit.renamed_files.items():
+            rename_from = details['rename_from']
+            rename_to = details['rename_to']
+            results.append(RawStore(file_results=[], file_name='', commit=commit, type=RENAME_STR,
+                                    rename_from=rename_from, rename_to=rename_to))
+            scanned_file_count += 1
+        return results, scanned_file_count
+
+    @time_it
+    def _get_first_commit(self) -> Commit:
+        first_commit_sha = self.repo.git.log('--format=%H', '--max-parents=0', 'HEAD').split()[0]
+        first_commit = self.repo.commit(first_commit_sha)
+        empty_tree_sha = bytes.fromhex(hashlib.sha1(b'tree 0\0').hexdigest())  # nosec
+        empty_tree = Tree(self.repo, empty_tree_sha)
+        git_diff = empty_tree.diff(first_commit, create_patch=True)
+
+        first_commit_diff: Commit = Commit(
+            metadata=CommitMetadata(
+                commit_hash=first_commit.hexsha,
+                committer=first_commit.committer.name or '',
+                committed_datetime=first_commit.committed_datetime.isoformat()
+            )
+        )
+
+        for file_diff in git_diff:
+            file_name = file_diff.b_path
+            if file_name.endswith(FILES_TO_IGNORE_IN_GIT_HISTORY):
+                continue
+            file_path = os.path.join(self.root_folder, file_name)
+            base_diff_format = f"--- ''\n+++ {file_path}\n"
+            full_diff_format = base_diff_format + file_diff.diff.decode('utf-8')
+            first_commit_diff.add_file(filename=file_path, commit_diff=full_diff_format)
+        return first_commit_diff

s1_cns_cli/s1graph/secrets/utils.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+import os
+import re
+from collections.abc import Iterable
+
+from s1_cns_cli.s1graph.common.runners.base_runner import ignored_directories, safe_remove
+from s1_cns_cli.s1graph.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR
+
+EXCLUDED_PATHS = [*ignored_directories, DEFAULT_EXTERNAL_MODULES_DIR, ".idea", ".git", "venv"]
+
+
+def filter_excluded_paths(
+    root_dir: str,
+    names: list[str] | list[os.DirEntry[str]],
+    excluded_paths: Iterable[str] | None,
+) -> None:
+    """Special build of s1_cns_cli.s1graph.common.runners.base_runner.filter_ignored_paths for Secrets scanning"""
+
+    # support for the --skip-path flag
+    if excluded_paths:
+        compiled = []
+        for p in excluded_paths:
+            try:
+                compiled.append(re.compile(p.replace(".terraform", r"\.terraform")))
+            except re.error:
+                # do not add compiled paths that aren't regexes
+                continue
+        for entry in list(names):
+            path = entry.name if isinstance(entry, os.DirEntry) else entry
+            full_path = os.path.join(root_dir, path)
+            if any(pattern.search(full_path) for pattern in compiled) or any(p in full_path for p in excluded_paths):
+                safe_remove(names, entry)
+
+    # support for our own excluded paths list
+    for entry in list(names):
+        path = entry.name if isinstance(entry, os.DirEntry) else entry
+        if path in EXCLUDED_PATHS:
+            safe_remove(names, entry)

s1_cns_cli/s1graph/serverless/__init__.py

@@ -0,0 +1 @@
+from s1_cns_cli.s1graph.serverless.checks.function import *  # noqa

s1_cns_cli/s1graph/serverless/base_registry.py

@@ -0,0 +1,36 @@
+from collections.abc import Mapping
+from dataclasses import dataclass
+
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.common.checks.base_check_registry import BaseCheckRegistry
+
+
+@dataclass
+class EntityDetails:
+    provider_type: str
+    data: Mapping
+
+
+class ServerlessRegistry(BaseCheckRegistry):
+    def __init__(self):
+        super().__init__(CheckType.SERVERLESS)
+
+    def extract_entity_details(self, entity: EntityDetails):
+        return f"serverless_{entity.provider_type}", entity.data
+
+    def scan(self, scanned_file, entity, skipped_checks, runner_filter):
+        entity_type, entity_configuration = self.extract_entity_details(entity)
+        results = {}
+        checks = self.get_checks(entity_type)
+        for check in checks:
+            skip_info = {}
+            if skipped_checks:
+                if check.id in [x['id'] for x in skipped_checks]:
+                    skip_info = [x for x in skipped_checks if x['id'] == check.id][0]
+
+            if runner_filter.should_run_check(check, report_type=CheckType.SERVERLESS):
+                self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file))
+                result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
+                                   entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)
+                results[check] = result
+        return results

s1_cns_cli/s1graph/serverless/checks/__init__.py

@@ -0,0 +1,7 @@
+from s1_cns_cli.s1graph.serverless.checks.complete import *  # noqa
+from s1_cns_cli.s1graph.serverless.checks.custom import *  # noqa
+from s1_cns_cli.s1graph.serverless.checks.function import *  # noqa
+from s1_cns_cli.s1graph.serverless.checks.layer import *  # noqa
+from s1_cns_cli.s1graph.serverless.checks.package import *  # noqa
+from s1_cns_cli.s1graph.serverless.checks.provider import *  # noqa
+from s1_cns_cli.s1graph.serverless.checks.service import *  # noqa

s1_cns_cli/s1graph/serverless/checks/base_function_check.py

@@ -0,0 +1,4 @@
+# NOTE: Leaving this around for backwards compatibility. Usage of the checks/function/base_function_check.py
+#       version is preferred
+# noinspection PyUnresolvedReferences
+from s1_cns_cli.s1graph.serverless.checks.function.base_function_check import BaseFunctionCheck  # noqa

s1_cns_cli/s1graph/serverless/checks/complete/base_complete_check.py

@@ -0,0 +1,18 @@
+from abc import abstractmethod
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.serverless.checks.complete.registry import complete_registry
+
+
+class BaseCompleteCheck(BaseCheck):
+    def __init__(self, name, id, categories, supported_entities, guideline=None):
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,
+                         block_type="serverless", guideline=guideline)
+        complete_registry.register(self)
+
+    def scan_entity_conf(self, conf, entity_type):
+        return self.scan_complete_conf(conf)
+
+    @abstractmethod
+    def scan_complete_conf(self, conf):
+        raise NotImplementedError()

s1_cns_cli/s1graph/serverless/checks/complete/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.serverless.base_registry import ServerlessRegistry
+
+complete_registry = ServerlessRegistry()

s1_cns_cli/s1graph/serverless/checks/custom/base_custom_check.py

@@ -0,0 +1,18 @@
+from abc import abstractmethod
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.serverless.checks.custom.registry import custom_registry
+
+
+class BaseCustomCheck(BaseCheck):
+    def __init__(self, name, id, categories, supported_entities, guideline=None):
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,
+                         block_type="serverless", guideline=guideline)
+        custom_registry.register(self)
+
+    def scan_entity_conf(self, conf, entity_type):
+        return self.scan_custom_conf(conf)
+
+    @abstractmethod
+    def scan_custom_conf(self, conf):
+        raise NotImplementedError()

s1_cns_cli/s1graph/serverless/checks/custom/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.serverless.base_registry import ServerlessRegistry
+
+custom_registry = ServerlessRegistry()

s1_cns_cli/s1graph/serverless/checks/function/__init__.py

@@ -0,0 +1 @@
+from s1_cns_cli.s1graph.serverless.checks.function.aws import *  # noqa

s1_cns_cli/s1graph/serverless/checks/function/aws/AWSCredentials.py

@@ -0,0 +1,32 @@
+import re
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+from s1_cns_cli.s1graph.serverless.checks.function.base_function_check import BaseFunctionCheck
+from s1_cns_cli.s1graph.common.models.consts import access_key_pattern, secret_key_pattern
+from s1_cns_cli.s1graph.serverless.parsers.parser import ENVIRONMENT_TOKEN
+
+
+class AWSCredentials(BaseFunctionCheck):
+
+    def __init__(self):
+        name = "Ensure no hard coded AWS access key and secret key exists in provider"
+        id = "CKV_AWS_41"
+        supported_entities = ['serverless_aws']
+        categories = [CheckCategories.SECRETS]
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities)
+
+    def scan_function_conf(self, conf):
+        """
+        see: https://www.terraform.io/docs/providers/aws/index.html#static-credentials
+        """
+        result = CheckResult.PASSED
+        if conf.get(ENVIRONMENT_TOKEN) and isinstance(conf[ENVIRONMENT_TOKEN], dict):
+            env_variables_strings = {key: value for key, value in conf.get(ENVIRONMENT_TOKEN).items() if
+                                     isinstance(value, str)}
+            for idx, env_var_value in enumerate(env_variables_strings.values()):
+                if any([re.match(access_key_pattern, env_var_value), re.match(secret_key_pattern, env_var_value)]):
+                    conf[f'{self.id}_secret_{idx}'] = env_var_value
+                    result = CheckResult.FAILED
+        return result
+
+
+check = AWSCredentials()

s1_cns_cli/s1graph/serverless/checks/function/aws/AdminPolicyDocument.py

@@ -0,0 +1,30 @@
+from s1_cns_cli.s1graph.serverless.checks.function.base_function_check import BaseFunctionCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+from s1_cns_cli.s1graph.serverless.parsers.parser import IAM_ROLE_STATEMENTS_TOKEN
+
+
+class AdminPolicyDocument(BaseFunctionCheck):
+    def __init__(self) -> None:
+        name = "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created"
+        id = "CKV_AWS_1"
+        supported_entities = ('serverless_aws',)
+        categories = (CheckCategories.IAM,)
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities)
+
+    def scan_function_conf(self, conf):
+        """
+        validates iam policy document
+        https://learn.hashicorp.com/terraform/aws/iam-policy
+        :param conf: aws_kms_key configuration
+        :return: <CheckResult>
+        """
+        statements = conf.get(IAM_ROLE_STATEMENTS_TOKEN)
+        if statements and isinstance(statements, list):
+            for statement in statements:
+                if 'Action' in statement and statement.get('Effect') == 'Allow' and '*' in statement['Action'] \
+                        and '*' in statement['Resource']:
+                    return CheckResult.FAILED
+        return CheckResult.PASSED
+
+
+check = AdminPolicyDocument()

s1_cns_cli/s1graph/serverless/checks/function/aws/StarActionPolicyDocument.py

@@ -0,0 +1,33 @@
+from s1_cns_cli.s1graph.serverless.checks.function.base_function_check import BaseFunctionCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckResult, CheckCategories
+from s1_cns_cli.s1graph.serverless.parsers.parser import IAM_ROLE_STATEMENTS_TOKEN
+
+
+class StarActionPolicyDocument(BaseFunctionCheck):
+    def __init__(self):
+        name = "Ensure no IAM policies documents allow \"*\" as a statement's actions"
+        id = "CKV_AWS_49"
+        supported_entities = ['serverless_aws']
+        categories = [CheckCategories.IAM]
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities)
+
+    def scan_function_conf(self, conf):
+        """
+        validates iam policy document
+         https://learn.hashicorp.com/terraform/aws/iam-policy
+        :param conf: aws_kms_key configuration
+        :return: <CheckResult>
+        """
+        key = IAM_ROLE_STATEMENTS_TOKEN
+        statements = conf.get(key)
+        if not statements:
+            return CheckResult.PASSED
+        for statement in statements:
+            if not isinstance(statement, dict):
+                return CheckResult.UNKNOWN
+            if 'Action' in statement and '*' in statement['Action'] and statement.get('Effect') == 'Allow':
+                return CheckResult.FAILED
+        return CheckResult.PASSED
+
+
+check = StarActionPolicyDocument()

s1_cns_cli/s1graph/serverless/checks/function/aws/__init__.py

@@ -0,0 +1,5 @@
+from os.path import dirname, basename, isfile, join
+import glob
+
+modules = glob.glob(join(dirname(__file__), "*.py"))
+__all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")]

s1_cns_cli/s1graph/serverless/checks/function/base_function_check.py

@@ -0,0 +1,29 @@
+from abc import abstractmethod
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.common.multi_signature import multi_signature
+from s1_cns_cli.s1graph.serverless.checks.function.registry import function_registry
+
+
+class BaseFunctionCheck(BaseCheck):
+    def __init__(self, name, id, categories, supported_entities, guideline=None):
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,
+                         block_type="serverless", guideline=guideline)
+        function_registry.register(self)
+
+    def scan_entity_conf(self, conf, entity_type):
+        return self.scan_function_conf(conf, entity_type)
+
+    @multi_signature()
+    @abstractmethod
+    def scan_function_conf(self, conf, entity_type):
+        raise NotImplementedError()
+
+    @classmethod
+    @scan_function_conf.add_signature(args=["self", "conf"])
+    def _scan_function_conf_self_conf(cls, wrapped):
+        def wrapper(self, conf, entity_type=None):
+            # keep default argument for entity_type so old codescanner, that doesn't set it, will work.
+            return wrapped(self, conf)
+
+        return wrapper

s1_cns_cli/s1graph/serverless/checks/function/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.serverless.base_registry import ServerlessRegistry
+
+function_registry = ServerlessRegistry()

s1_cns_cli/s1graph/serverless/checks/layer/base_layer_check.py

@@ -0,0 +1,18 @@
+from abc import abstractmethod
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.serverless.checks.layer.registry import layer_registry
+
+
+class BaseLayerCheck(BaseCheck):
+    def __init__(self, name, id, categories, supported_entities, guideline=None):
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,
+                         block_type="serverless", guideline=guideline)
+        layer_registry.register(self)
+
+    def scan_entity_conf(self, conf, entity_type):
+        return self.scan_layer_conf(conf)
+
+    @abstractmethod
+    def scan_layer_conf(self, conf):
+        raise NotImplementedError()

s1_cns_cli/s1graph/serverless/checks/layer/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.serverless.base_registry import ServerlessRegistry
+
+layer_registry = ServerlessRegistry()

s1_cns_cli/s1graph/serverless/checks/package/base_package_check.py

@@ -0,0 +1,18 @@
+from abc import abstractmethod
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.serverless.checks.package.registry import package_registry
+
+
+class BasePackageCheck(BaseCheck):
+    def __init__(self, name, id, categories, supported_entities, guideline=None):
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,
+                         block_type="serverless", guideline=guideline)
+        package_registry.register(self)
+
+    def scan_entity_conf(self, conf, entity_type):
+        return self.scan_package_conf(conf)
+
+    @abstractmethod
+    def scan_package_conf(self, conf):
+        raise NotImplementedError()

s1_cns_cli/s1graph/serverless/checks/package/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.serverless.base_registry import ServerlessRegistry
+
+package_registry = ServerlessRegistry()

s1_cns_cli/s1graph/serverless/checks/plugin/base_plugin_check.py

@@ -0,0 +1,19 @@
+from abc import abstractmethod
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.serverless.checks.plugin.registry import plugin_registry
+
+
+class BasePluginCheck(BaseCheck):
+    def __init__(self, name, id, categories, supported_entities, guideline=None):
+        super().__init__(name=name, id=id, categories=categories,
+                         supported_entities=supported_entities,
+                         block_type="serverless", guideline=guideline)
+        plugin_registry.register(self)
+
+    def scan_entity_conf(self, conf, entity_type):
+        return self.scan_plugin_list(conf)
+
+    @abstractmethod
+    def scan_plugin_list(self, plugin_list):
+        raise NotImplementedError()

s1_cns_cli/s1graph/serverless/checks/plugin/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.serverless.base_registry import ServerlessRegistry
+
+plugin_registry = ServerlessRegistry()

s1_cns_cli/s1graph/serverless/checks/provider/base_provider_check.py

@@ -0,0 +1,18 @@
+from abc import abstractmethod
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.serverless.checks.provider.registry import provider_registry
+
+
+class BaseProviderCheck(BaseCheck):
+    def __init__(self, name, id, categories, supported_entities, guideline=None):
+        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,
+                         block_type="serverless", guideline=guideline)
+        provider_registry.register(self)
+
+    def scan_entity_conf(self, conf, entity_type):
+        return self.scan_provider_conf(conf)
+
+    @abstractmethod
+    def scan_provider_conf(self, conf):
+        raise NotImplementedError()

s1_cns_cli/s1graph/serverless/checks/provider/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.serverless.base_registry import ServerlessRegistry
+
+provider_registry = ServerlessRegistry()