Queries metadata improvements

[roi-orca]

Hi,
Recently I had a chance of investigating kics queries structure and metadata while fixing a few anomalies and descriptions.
It made me realize we might want to extend our metadata in order to provide better results to kics users

Extend description data -

1. descriptionText attribute contain in some of the queries both general description and recommendation/remediation on how to fix the issue in the relevant platform. I would like to separate them into different attributes, for example -

{
  "id": "de77cd9f-0e8b-46cc-b4a4-b6b436838642",
  "queryName": "CloudFront Logging Disabled",
  "severity": "MEDIUM",
  "category": "Observability",
  "descriptionText": "AWS Cloudfront distributions must have logging enabled, which means the attribute 'DistributionConfig.Logging' must be defined",
  "descriptionUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/logging-and-monitoring.html",
  "platform": "CloudFormation",
  "descriptionID": "3254d6d0",
  "cloudProvider": "aws"
}

To

{
  "id": "de77cd9f-0e8b-46cc-b4a4-b6b436838642",
  "queryName": "CloudFront Logging Disabled",
  "severity": "MEDIUM",
  "category": "Observability",
  "descriptionText": "AWS Cloudfront distributions must have logging enabled",
  "recommendation": "The attribute 'DistributionConfig.Logging' must be defined",
  "descriptionUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/logging-and-monitoring.html",
  "platform": "CloudFormation",
  "descriptionID": "3254d6d0",
  "cloudProvider": "aws"
}

Adding general tags
2. Adding tags to the query metadata based on reserved keywords that can be set in an automated way (from file path, file name, query name, and other attributes)
For example:

{
  "id": "de77cd9f-0e8b-46cc-b4a4-b6b436838642",
  "queryName": "CloudFront Logging Disabled",
  "severity": "MEDIUM",
  "category": "Observability",
  "descriptionText": "AWS Cloudfront distributions must have logging enabled, which means the attribute 'DistributionConfig.Logging' must be defined",
  "descriptionUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/logging-and-monitoring.html",
  "platform": "CloudFormation",
  "descriptionID": "3254d6d0",
  "cloudProvider": "aws",
  "tags": ["cloudfront", "logging", "monitoring", "aws", "observability"]
}

[nunoocx]

Hi @roi-orca
this is also a nice idea!

About remediation, this is certainly something we could have.
Although the effort to cover all queries is huge, we could start somewhere.

The tags can be automated as you mention, and/or added by hand afterwards.
What would be, in your opinion, some use case scenarios for these tags?

Thanks

[roi-orca]

Hi @nunoocx, thanks for your response!

Absolutely, the effort is huge but some of them already have the remediation cover in the descriptionText so we can start from there and continue with the rest afterwards. Also we will need to add the remediation to the different outputs supported by kics.

tags can be helpful for management and filtering the queries in the documentation for example. Customer could search for all queries that are related to "logging" or perhaps "s3" in an easy way.

What do you think? I can split it to 2 different feature requests if needed

[nunoocx]

Yes, please, create the 2 feature requests with all the info you think relevant :)
Thanks so much!