search

ShiftLeftSecurity / sast-scan

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.
https://discord.gg/DCNxzaeUpd
Apache License 2.0
789 stars 110 forks source link

opa support in scan #288

Open prabhu opened 3 years ago

prabhu commented 3 years ago

Let's add support for opa and rego to support interesting things

xortim commented 3 years ago

Preferably against the plan file :)

prabhu commented 3 years ago

@xortim could you kindly elaborate? Which plan file are you thinking to use with opa?

xortim commented 3 years ago

Sorry about the nebulous comment. I'd love to have my terraform plan file scanned using fugue/regula or accurics/terrascan. I'm currently using terrascan separately since there's a comprehensive best set of rules, but regula is natively compatible with OPA, not just the Rego policy language. Meaning, regula uses Rego and OPA itself to normalize the input, whereas terrascan normalizes using their tool to accomplish a similar task.

prabhu commented 3 years ago

@xortim interesting! I looked at terrascan sometime back and wasn't that impressed so stuck with checkov. Is it working better than checkov in your tests?