aquasecurity / aquasecurity/cloudsploit

Have cloudsploit target a list of resources

Open
#1,731 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

We're currently considering deploying Cloudsploit in our GCP setup. In addition to full-org scans, we see some cases where we'd like Cloudsploit to only scan certain parts of our infrastructure, so that we get feedback very quickly. The pattern-based matching doesn't lend it self well to this use case due to the internal organization of these resources in GCP.

Is it at all technically feasible to have cloudsploit only target a subset of GCP resources via a specified list?

Happy to help with implementation over Christmas / in the new year

I imagine it would be something like:

```sh
cloudsploit --target project/xxx/run/xxx/service/xxx/...
--target project/yyy/gke/yyy/cluster
--target project/zzz/pubsub/zzz/topic/zzz
--target ...
```

Contributor guide

Open the contributing guide

Research direction

Start with the Cloudsploit CLI entry point and the existing pattern-based resource matching used for GCP scans. Determine whether repeated --target arguments can select the listed project, service, cluster, and topic resources, then verify that a scan is limited to exactly those targets. The issue names no files or tests, so the relevant implementation and validation paths must first be located.

Written by the indexing model from the issue text.

Assessment

Tech stack
gcp, javascript
Domain
cli, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.