aquasecurity / aquasecurity/cloudsploit
Have cloudsploit target a list of resources
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
We're currently considering deploying Cloudsploit in our GCP setup. In addition to full-org scans, we see some cases where we'd like Cloudsploit to only scan certain parts of our infrastructure, so that we get feedback very quickly. The pattern-based matching doesn't lend it self well to this use case due to the internal organization of these resources in GCP.
Is it at all technically feasible to have cloudsploit only target a subset of GCP resources via a specified list?
Happy to help with implementation over Christmas / in the new year
I imagine it would be something like:
```sh
cloudsploit --target project/xxx/run/xxx/service/xxx/...
--target project/yyy/gke/yyy/cluster
--target project/zzz/pubsub/zzz/topic/zzz
--target ...
```
Contributor guide
Research direction
Start with the Cloudsploit CLI entry point and the existing pattern-based resource matching used for GCP scans. Determine whether repeated --target arguments can select the listed project, service, cluster, and topic resources, then verify that a scan is limited to exactly those targets. The issue names no files or tests, so the relevant implementation and validation paths must first be located.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gcp, javascript
- Domain
- cli, cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100