chore: generate AWS compliance specs based on checks

.github/workflows/verify.yaml

@@ -0,0 +1,44 @@
+name: Verify Docs and Specs
+
+on:
+  pull_request:
+  merge_group:
+
+env:
+  GO_VERSION: "1.24"
+
+jobs:
+  verify-docs:
+    name: Verify Docs
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - run: |
+          make docs
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Run 'make docs' and push it"
+            exit 1
+          fi
+
+  verify-specs:
+    name: Verify Specs
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Generate specification files
+        run: |
+          make genspec
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Run 'make genspec' and push it"
+            exit 1
+          fi

Makefile

@@ -93,3 +93,8 @@ push-bundle: create-bundle
 		$$REPO \
 		 --artifact-type application/vnd.cncf.openpolicyagent.config.v1+json \
 		"$(BUNDLE_FILE):application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip"
+
+.PHONY: genspec
+# Generate specification files
+genspec:
+	go run ./cmd/genspec

cmd/genspec/main.go

@@ -0,0 +1,97 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/samber/lo"
+	"gopkg.in/yaml.v3"
+
+	"github.com/aquasecurity/trivy-checks/pkg/rego/metadata"
+	"github.com/aquasecurity/trivy/pkg/iac/framework"
+	iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
+)
+
+const complianceDirPath = "pkg/compliance/"
+
+var specs = map[framework.Framework]*iacTypes.Spec{
+	framework.CIS_AWS_1_2: {
+		ID:          "aws-cis-1.2",
+		Title:       "AWS CIS Foundations v1.2",
+		Description: "AWS CIS Foundations",
+		Version:     "1.2",
+		Platform:    "aws",
+		Type:        "cis",
+		RelatedResources: []string{
+			"https://www.cisecurity.org/benchmark/amazon_web_services",
+		},
+	},
+	framework.CIS_AWS_1_4: {
+		ID:          "aws-cis-1.4",
+		Title:       "AWS CIS Foundations v1.4",
+		Description: "AWS CIS Foundations",
+		Version:     "1.4",
+		Platform:    "aws",
+		Type:        "cis",
+		RelatedResources: []string{
+			"https://www.cisecurity.org/benchmark/amazon_web_services",
+		},
+	},
+}
+
+func main() {
+	frameworks := make([]framework.Framework, 0, len(specs))
+	for f := range specs {
+		frameworks = append(frameworks, f)
+	}
+
+	for _, meta := range lo.Must(metadata.LoadDefaultChecksMetadata()) {
+		for f, controlIDs := range meta.Frameworks() {
+			if f == "default" {
+				continue
+			}
+
+			ff := framework.Framework(f)
+			spec, exists := specs[ff]
+			if !exists {
+				log.Printf("Unknown framework: %s", f)
+				continue
+			}
+
+			for _, id := range controlIDs {
+				spec.Controls = append(spec.Controls, iacTypes.Control{
+					ID:          id,
+					Name:        lo.LastOrEmpty(meta.Aliases()),
+					Description: meta.Title,
+					Severity:    iacTypes.Severity(meta.Severity()),
+					Checks:      []iacTypes.SpecCheck{{ID: meta.ID()}},
+				})
+			}
+		}
+	}
+
+	for _, spec := range specs {
+		sort.Slice(spec.Controls, func(i, j int) bool {
+			return strings.Compare(spec.Controls[i].ID, spec.Controls[j].ID) < 0
+		})
+	}
+
+	for _, c := range specs {
+		lo.Must0(writeCompliance(c, complianceDirPath))
+	}
+}
+
+func writeCompliance(spec *iacTypes.Spec, path string) error {
+	file, err := os.Create(filepath.Join(path, fmt.Sprintf("%s.yaml", spec.ID)))
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	encoder := yaml.NewEncoder(file)
+	encoder.SetIndent(2)
+	return encoder.Encode(iacTypes.ComplianceSpec{Spec: *spec})
+}