{ "security": { "encryption_at_rest": { "severity": "HIGH", "resources": ["aws_s3_bucket", "aws_rds_instance"], "condition": "encryption.enabled == true" } }, "cost": { "instance_right_sizing": { "severity": "MEDIUM", "condition": "instance_type NOT IN ['t2.micro', 't3.micro']", "recommendation": "Consider using smaller instance types" } } } } class OrganizationSpecificRules: def __init__(self): self.company_standards = { "tagging_policy": ["Environment", "Owner", "Project"], "security_groups": {"max_open_ports": 3}, "backup_policy": {"retention_days": 30} } def validate_compliance(self, iac_template): return ( self.check_tagging(iac_template) and self.check_security(iac_template) and self.check_backup(iac_template) ) def check_tagging(self, template): # タグがすべて含まれているか tags = template.get("tags", {}) required = self.company_standards["tagging_policy"] return all(tag in tags for tag in required) def check_security(self, template): # 開放ポート数が許容内か ports = template.get("open_ports", []) return len(ports) <= self.company_standards["security_groups"]["max_open_ports"] def check_backup(self, template): # バックアップの保持期間確認 retention = template.get("backup", {}).get("retention_days", 0) return retention >= self.company_standards["backup_policy"]["retention_days"] カスタムルールの定義 固有のベストプラクティス IaC Analyzerで問題の検出→Q Developerに渡して 改善コードを自動生成するなどセルフヒーリングもアリ
yosimitu
bluesmoon
holman
tammyeverts
sferik
garrettdimon
marcduiker
destraynor
jeffersonlam
wjessup
smashingmag
afnizarnur
dougneiner
