#!/bin/bash
# Pre-commit security hook
echo "Running security checks..."

# Check for secrets
if git diff --cached | grep -E "(password|secret|key).*[:=]" ; then
    echo "ERROR: Potential secrets detected in commit"
    exit 1
fi

# Run SAST scan on changed files
sast_tool scan --files $(git diff --name-only --cached)
if [ $? -ne 0 ]; then
    echo "ERROR: SAST scan failed"
    exit 1
fi

echo "Security checks passed"
exit 0

# Example CI pipeline with security checks
name: Build and Security Scan
on: [push, pull_request]
jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      # Static analysis
      - name: Run SAST scan
        run: |
          sonar-scanner -Dsonar.projectKey=${{ env.PROJECT_KEY }}
          
      # Dependency scanning
      - name: Scan dependencies
        run: |
          dependency-check --scan . --format JSON --out reports/
          
      # Container scanning (if applicable)
      - name: Build and scan container
        if: ${{ contains(github.ref, 'main') }}
        run: |
          docker build -t myapp:${{ github.sha }} .
          trivy image myapp:${{ github.sha }}

# Example deployment pipeline with security gates
deploy-staging:
  needs: [security-scan]
  runs-on: ubuntu-latest
  steps:
    - name: Verify security scan results
      run: |
        # Check that security scan didn't find critical vulnerabilities
        if [ -f "security-results.json" ]; then
          critical_vulns=$(jq '.vulnerabilities[] | select(.severity=="critical") | length' security-results.json)
          if [ "$critical_vulns" -gt 0 ]; then
            echo "Critical vulnerabilities found, deployment blocked"
            exit 1
          fi
        fi
        
    - name: Deploy to staging
      run: |
        # Deploy application
        kubectl apply -f deployment.yaml

# Example terraform configuration with security considerations
resource "aws_instance" "web_server" {
  ami           = var.ami_id
  instance_type = var.instance_type
  
  # Security configurations
  vpc_security_group_ids = [aws_security_group.web_sg.id]
  iam_instance_profile   = aws_iam_instance_profile.ec2_profile.name
  
  # Security tags
  tags = {
    Name        = "web-server"
    Environment = var.environment
    Security    = "high"
  }
  
  # Block public access
  associate_public_ip_address = false
  
  # Root block device encryption
  root_block_device {
    encrypted = true
  }
}

# Security group with restricted access
resource "aws_security_group" "web_sg" {
  name_prefix = "web-sg-"
  description = "Security group for web servers"
  vpc_id      = var.vpc_id

  # Only allow necessary ports
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = var.allowed_cidrs
  }

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = var.allowed_cidrs
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

#!/bin/bash
# IaC security validation script
echo "Validating infrastructure code security..."

# Check Terraform code with Checkov
checkov -d . --framework terraform --output junitxml > checkov-report.xml

# Check for critical issues
critical_issues=$(grep -c "severity=\"critical\"" checkov-report.xml)
if [ $critical_issues -gt 0 ]; then
    echo "Critical security issues found in infrastructure code"
    cat checkov-report.xml
    exit 1
fi

echo "Infrastructure code validation passed"

# Example Dockerfile with security considerations
FROM node:18-alpine

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001

# Set working directory
WORKDIR /app

# Copy package files first for better caching
COPY package*.json ./
RUN npm ci --only=production

# Copy application code
COPY . .

# Change ownership to non-root user
RUN chown -R nodejs:nodejs /app
USER nodejs

# Expose port
EXPOSE 3000

# Run application
CMD ["npm", "start"]

#!/bin/bash
# Container security scanning script
IMAGE_NAME=$1
TAG=$2

echo "Scanning container image: $IMAGE_NAME:$TAG"

# Run Trivy scan
trivy image --format json --output trivy-results.json $IMAGE_NAME:$TAG

# Check for critical vulnerabilities
critical_count=$(jq '[.Results[] | .Vulnerabilities[] | select(.Severity=="CRITICAL")] | length' trivy-results.json)

if [ $critical_count -gt 0 ]; then
    echo "Critical vulnerabilities found:"
    jq -r '.Results[] | .Vulnerabilities[] | select(.Severity=="CRITICAL") | "\(.PkgName):\(.InstalledVersion) - \(.Title)"' trivy-results.json
    exit 1
fi

echo "Container image scan passed"

# Example vulnerability management workflow
name: Vulnerability Management
on:
  schedule:
    - cron: '0 2 * * *'  # Run daily at 2 AM
  workflow_dispatch:

jobs:
  vulnerability-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        
      - name: Run comprehensive security scan
        run: |
          # Run SAST scan
          sonar-scanner
          
          # Run SCA scan
          snyk test
          
          # Run DAST scan (if applicable)
          zap-cli quick-scan http://staging.example.com
          
      - name: Parse and categorize results
        run: |
          python scripts/process-security-results.py
          
      - name: Create/update issues
        uses: actions/create-issue@v3
        with:
          title: Security Vulnerability Found
          body: |
            Security vulnerability detected in ${{ github.repository }}
            Severity: Critical
            Details: See security report
          labels: security, bug

# Example incident response automation script
import os
import json
import requests
from datetime import datetime

def create_incident_alert(vulnerability_data):
    """Create automated incident alert"""
    webhook_url = os.getenv('SECURITY_WEBHOOK_URL')
    
    alert_payload = {
        'timestamp': datetime.utcnow().isoformat(),
        'severity': vulnerability_data['severity'],
        'component': vulnerability_data['component'],
        'description': vulnerability_data['description'],
        'cvss_score': vulnerability_data['cvss_score'],
        'affected_repositories': vulnerability_data['repositories']
    }
    
    response = requests.post(webhook_url, json=alert_payload)
    return response.status_code == 200

def escalate_incident(incident_id):
    """Automatically escalate incidents based on severity"""
    if incident_data['severity'] >= 9.0:  # Critical CVSS score
        # Send to security team
        notify_team('security-team', f'CRITICAL vulnerability found: {incident_id}')
        # Send to management
        notify_team('management', f'CRITICAL security incident: {incident_id}')
        # Trigger emergency response
        trigger_emergency_response(incident_id)

# Integration with security tools
def integrate_with_sast_tool():
    """Integrate with SAST tool for automated analysis"""
    # Example integration with SonarQube
    sonar_url = os.getenv('SONAR_URL')
    project_key = os.getenv('SONAR_PROJECT_KEY')
    
    # Get security issues
    issues_response = requests.get(
        f'{sonar_url}/api/issues/search',
        params={'componentKeys': project_key, 'severities': 'CRITICAL,BLOCKER'}
    )
    
    critical_issues = issues_response.json()['issues']
    
    for issue in critical_issues:
        # Create automated ticket
        create_ticket_for_issue(issue)
        
        # Notify responsible team
        notify_team(issue['author'], f'Security issue found: {issue["message"]}')

if __name__ == '__main__':
    # Run automated security checks
    integrate_with_sast_tool()

#!/bin/bash
# Automated compliance checking script
echo "Starting compliance check..."

# Check for compliance with security standards
COMPLIANCE_STANDARD="SOC2"
REPORT_FILE="compliance-report-$(date +%Y%m%d).json"

# Run compliance checking tools
docker run --rm \
  -v $(pwd):/src \
  -e COMPLIANCE_STANDARD=$COMPLIANCE_STANDARD \
  compliance-checker:latest \
  --report-format json \
  --output /src/$REPORT_FILE

# Parse compliance results
NON_COMPLIANT_COUNT=$(jq '.findings | map(select(.status != "PASS")) | length' $REPORT_FILE)

if [ $NON_COMPLIANT_COUNT -gt 0 ]; then
    echo "Non-compliant items found: $NON_COMPLIANT_COUNT"
    jq '.findings[] | select(.status != "PASS") | {control: .control, status: .status, description: .description}' $REPORT_FILE
    exit 1
fi

echo "Compliance check passed"

# Example Open Policy Agent policy for Kubernetes
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: ns-must-have-gk
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
  parameters:
    labels: ["gatekeeper"]
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
  name: repo-is-openpolicyagent
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    repos: ["openpolicyagent"]

# Example multi-stage security pipeline
name: Secure CI/CD Pipeline
on: [push, pull_request]

jobs:
  # Stage 1: Code Analysis
  code-analysis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: SAST Scan
        run: |
          sonar-scanner
      - name: Dependency Scan
        run: |
          dependency-check --scan . --format JSON --out reports/
      - name: Secrets Scan
        run: |
          trufflehog git . --only-verified

  # Stage 2: Build and Test Security
  build-security:
    needs: code-analysis
    runs-on: ubuntu-latest
    steps:
      - name: Build Container
        run: |
          docker build -t myapp:${{ github.sha }} .
      - name: Container Security Scan
        run: |
          trivy image myapp:${{ github.sha }}

  # Stage 3: Infrastructure Security
  infra-security:
    needs: build-security
    runs-on: ubuntu-latest
    steps:
      - name: IaC Security Scan
        run: |
          checkov -d . --framework terraform
      - name: Infrastructure Validation
        run: |
          terraform plan -out=tfplan
          terraform show -json tfplan | jq .

  # Stage 4: Deployment Security
  deploy-security:
    needs: [code-analysis, build-security, infra-security]
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to Staging
        run: |
          kubectl apply -f deployment.yaml
      - name: Runtime Security Check
        run: |
          # Check running pods for security issues
          kubectl get pods -o json | jq '.items[] | select(.spec.securityContext.runAsNonRoot != true)'

#!/bin/bash
# Security quality gate script
echo "Running security quality gates..."

# Initialize counters
CRITICAL_VULNS=0
HIGH_VULNS=0
MEDIUM_VULNS=0

# Function to check SAST results
check_sast_results() {
    if [ -f "sonar-report.json" ]; then
        CRITICAL_SAST=$(jq '.issues | map(select(.severity=="CRITICAL")) | length' sonar-report.json)
        HIGH_SAST=$(jq '.issues | map(select(.severity=="HIGH")) | length' sonar-report.json)
        MEDIUM_SAST=$(jq '.issues | map(select(.severity=="MAJOR")) | length' sonar-report.json)
        
        ((CRITICAL_VULNS += CRITICAL_SAST))
        ((HIGH_VULNS += HIGH_SAST))
        ((MEDIUM_VULNS += MEDIUM_SAST))
    fi
}

# Function to check SCA results
check_sca_results() {
    if [ -f "sca-report.json" ]; then
        CRITICAL_SCA=$(jq '[.vulnerabilities[] | select(.severity=="critical")] | length' sca-report.json)
        HIGH_SCA=$(jq '[.vulnerabilities[] | select(.severity=="high")] | length' sca-report.json)
        MEDIUM_SCA=$(jq '[.vulnerabilities[] | select(.severity=="medium")] | length' sca-report.json)
        
        ((CRITICAL_VULNS += CRITICAL_SCA))
        ((HIGH_VULNS += HIGH_SCA))
        ((MEDIUM_VULNS += MEDIUM_SCA))
    fi
}

# Run checks
check_sast_results
check_sca_results

# Apply quality gates
echo "Security Results - Critical: $CRITICAL_VULNS, High: $HIGH_VULNS, Medium: $MEDIUM_VULNS"

# Critical vulnerabilities block deployment
if [ $CRITICAL_VULNS -gt 0 ]; then
    echo "CRITICAL vulnerabilities found, deployment blocked"
    exit 1
fi

# High vulnerabilities may block based on configuration
MAX_HIGH_VULNS_ALLOWED=5
if [ $HIGH_VULNS -gt $MAX_HIGH_VULNS_ALLOWED ]; then
    echo "Too many HIGH vulnerabilities ($HIGH_VULNS > $MAX_HIGH_VULNS_ALLOWED), deployment blocked"
    exit 1
fi

echo "Security quality gates passed"

# Example SAST tool integration in CI/CD
name: SAST Security Scan
on: [push, pull_request]

jobs:
  sast-scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        language: ['java', 'javascript', 'python']
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      
      # Initialize CodeQL
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ matrix.language }}
      
      # Autobuild for compiled languages
      - name: Autobuild
        if: matrix.language == 'java'
        uses: github/codeql-action/autobuild@v2
      
      # Perform analysis
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
        
      # Additional SAST tools
      - name: Run SonarQube Analysis
        if: matrix.language == 'java'
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          sonar-scanner \
            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }} \
            -Dsonar.sources=src \
            -Dsonar.java.binaries=target/classes \
            -Dsonar.host.url=https://sonarcloud.io \
            -Dsonar.organization=${{ github.repository_owner }}

# Example container security pipeline
name: Container Security Pipeline
on:
  push:
    branches: [ main ]
    paths: [ 'Dockerfile', '**/Dockerfile' ]

jobs:
  container-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      # Build container
      - name: Build Container
        run: |
          docker build -t myapp:${{ github.sha }} .
          docker tag myapp:${{ github.sha }} myapp:latest
      
      # Scan with multiple tools
      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Scan with Grype
        run: |
          docker run --rm \
            -v $(pwd):/work \
            -w /work \
            anchore/grype:latest \
            myapp:${{ github.sha }} \
            -o json > grype-results.json
      
      # Parse results and apply policy
      - name: Check Results Against Policy
        run: |
          # Check for critical vulnerabilities
          CRITICAL=$(jq '[.matches[] | select(.vulnerability.severity=="critical")] | length' grype-results.json)
          if [ $CRITICAL -gt 0 ]; then
            echo "Critical vulnerabilities found: $CRITICAL"
            jq -r '.matches[] | select(.vulnerability.severity=="critical") | "\(.artifact.name):\(.artifact.version) - \(.vulnerability.id)"' grype-results.json
            exit 1
          fi
          
          # Check for high vulnerabilities
          HIGH=$(jq '[.matches[] | select(.vulnerability.severity=="high")] | length' grype-results.json)
          MAX_ALLOWED=5
          if [ $HIGH -gt $MAX_ALLOWED ]; then
            echo "Too many high vulnerabilities: $HIGH (max: $MAX_ALLOWED)"
            exit 1
          fi

# Example security metrics collection
import time
import json
import requests
from prometheus_client import Counter, Histogram, start_http_server

# Define security metrics
SECURITY_FINDINGS_TOTAL = Counter(
    'security_findings_total',
    'Total security findings by severity',
    ['severity', 'tool', 'repository']
)

SECURITY_SCAN_DURATION = Histogram(
    'security_scan_duration_seconds',
    'Time spent on security scans',
    ['tool', 'repository']
)

def collect_security_metrics():
    """Collect and report security metrics"""
    while True:
        # Collect metrics from security tools
        metrics = get_security_tool_metrics()
        
        for metric in metrics:
            SECURITY_FINDINGS_TOTAL.labels(
                severity=metric['severity'],
                tool=metric['tool'],
                repository=metric['repository']
            ).inc(metric['count'])
            
            SECURITY_SCAN_DURATION.labels(
                tool=metric['tool'],
                repository=metric['repository']
            ).observe(metric['duration'])
        
        time.sleep(300)  # Collect every 5 minutes

def get_security_tool_metrics():
    """Get metrics from various security tools"""
    metrics = []
    
    # Get SonarQube metrics
    sonar_metrics = get_sonarqube_metrics()
    metrics.extend(sonar_metrics)
    
    # Get SCA tool metrics
    sca_metrics = get_sca_metrics()
    metrics.extend(sca_metrics)
    
    # Get infrastructure security metrics
    infra_metrics = get_infra_security_metrics()
    metrics.extend(infra_metrics)
    
    return metrics

if __name__ == '__main__':
    start_http_server(8000)  # Start metrics server
    collect_security_metrics()

#!/bin/bash
# Automated security dashboard update script
echo "Updating security dashboard..."

# Collect security data from various tools
DATA_DIR="security-data/$(date +%Y%m%d-%H%M%S)"
mkdir -p $DATA_DIR

# Collect SAST data
if [ -f "sonar-report.json" ]; then
    cp sonar-report.json $DATA_DIR/sast.json
fi

# Collect SCA data
if [ -f "sca-report.json" ]; then
    cp sca-report.json $DATA_DIR/sca.json
fi

# Collect container scan data
if [ -f "trivy-results.json" ]; then
    cp trivy-results.json $DATA_DIR/container.json
fi

# Generate summary report
cat << EOF > $DATA_DIR/summary.json
{
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "sast": {
    "critical": $(jq '.issues | map(select(.severity=="CRITICAL")) | length' $DATA_DIR/sast.json 2>/dev/null || echo 0),
    "high": $(jq '.issues | map(select(.severity=="HIGH")) | length' $DATA_DIR/sast.json 2>/dev/null || echo 0),
    "medium": $(jq '.issues | map(select(.severity=="MAJOR")) | length' $DATA_DIR/sast.json 2>/dev/null || echo 0)
  },
  "sca": {
    "critical": $(jq '[.vulnerabilities[] | select(.severity=="critical")] | length' $DATA_DIR/sca.json 2>/dev/null || echo 0),
    "high": $(jq '[.vulnerabilities[] | select(.severity=="high")] | length' $DATA_DIR/sca.json 2>/dev/null || echo 0),
    "medium": $(jq '[.vulnerabilities[] | select(.severity=="medium")] | length' $DATA_DIR/sca.json 2>/dev/null || echo 0)
  },
  "container": {
    "critical": $(jq '[.Results[].Vulnerabilities[] | select(.Severity=="CRITICAL")] | length' $DATA_DIR/container.json 2>/dev/null || echo 0),
    "high": $(jq '[.Results[].Vulnerabilities[] | select(.Severity=="HIGH")] | length' $DATA_DIR/container.json 2>/dev/null || echo 0)
  }
}
EOF

# Upload to security dashboard
curl -X POST \
  -H "Content-Type: application/json" \
  -d @$DATA_DIR/summary.json \
  $SECURITY_DASHBOARD_URL

echo "Security dashboard updated successfully"

# Example API-based integration with security tools
import requests
import json
from typing import Dict, List

class SecurityToolIntegration:
    def __init__(self, api_base_url: str, api_token: str):
        self.api_base_url = api_base_url
        self.headers = {
            'Authorization': f'Bearer {api_token}',
            'Content-Type': 'application/json'
        }
    
    def submit_scan_request(self, project_id: str, branch: str) -> str:
        """Submit a security scan request"""
        payload = {
            'projectId': project_id,
            'branch': branch,
            'scanType': 'full'
        }
        
        response = requests.post(
            f'{self.api_base_url}/api/scans',
            headers=self.headers,
            json=payload
        )
        
        if response.status_code == 200:
            return response.json()['scanId']
        else:
            raise Exception(f"Failed to submit scan: {response.text}")
    
    def get_scan_results(self, scan_id: str) -> Dict:
        """Retrieve scan results"""
        response = requests.get(
            f'{self.api_base_url}/api/scans/{scan_id}',
            headers=self.headers
        )
        
        if response.status_code == 200:
            return response.json()
        else:
            raise Exception(f"Failed to get scan results: {response.text}")
    
    def has_critical_vulnerabilities(self, results: Dict) -> bool:
        """Check if scan results have critical vulnerabilities"""
        for finding in results.get('findings', []):
            if finding.get('severity') == 'CRITICAL':
                return True
        return False

# Usage example
def integrate_with_security_platform():
    """Integrate with security platform API"""
    security_api = SecurityToolIntegration(
        api_base_url=os.getenv('SECURITY_API_URL'),
        api_token=os.getenv('SECURITY_API_TOKEN')
    )
    
    # Submit scan
    scan_id = security_api.submit_scan_request(
        project_id='my-project',
        branch='main'
    )
    
    # Poll for results
    max_attempts = 30
    for attempt in range(max_attempts):
        results = security_api.get_scan_results(scan_id)
        
        if results['status'] == 'completed':
            # Check for critical vulnerabilities
            if security_api.has_critical_vulnerabilities(results):
                print("Critical vulnerabilities found, blocking deployment")
                return False
            else:
                print("Security scan passed")
                return True
        
        time.sleep(10)  # Wait 10 seconds between polls
    
    print("Security scan timeout")
    return False

#!/bin/bash
# Example CLI-based security tool integration
SECURITY_TOOLS_DIR="/opt/security-tools"

# Function to run SAST scan
run_sast_scan() {
    local project_dir="$1"
    local output_format="${2:-json}"
    
    echo "Running SAST scan on $project_dir..."
    
    # Example with SonarQube Scanner
    sonar-scanner \
        -Dsonar.projectBaseDir="$project_dir" \
        -Dsonar.sources=. \
        -Dsonar.java.binaries=target/classes \
        -Dsonar.login="$SONAR_TOKEN" \
        -Dsonar.host.url="$SONAR_URL" \
        -Dsonar.scm.disabled=true \
        -Dsonar.showProfiling=true
    
    return $?
}

# Function to run dependency scan
run_dependency_scan() {
    local project_dir="$1"
    
    echo "Running dependency scan on $project_dir..."
    
    # Example with OWASP Dependency Check
    dependency-check \
        --scan "$project_dir" \
        --format JSON \
        --out "$project_dir/reports/" \
        --enableRetired \
        --enableExperimental \
        --failOnCVSS 7 \
        --suppression suppression.xml
    
    return $?
}

# Function to run container scan
run_container_scan() {
    local image_name="$1"
    
    echo "Running container scan for $image_name..."
    
    # Example with Trivy
    trivy image \
        --severity CRITICAL,HIGH \
        --exit-code 1 \
        --format json \
        --output "trivy-results.json" \
        "$image_name"
    
    return $?
}

# Main security pipeline function
run_security_pipeline() {
    local project_dir="${1:-.}"
    local image_name="$2"
    
    echo "Starting security pipeline..."
    
    # Run SAST scan
    if ! run_sast_scan "$project_dir"; then
        echo "SAST scan failed"
        exit 1
    fi
    
    # Run dependency scan
    if ! run_dependency_scan "$project_dir"; then
        echo "Dependency scan failed"
        exit 1
    fi
    
    # Run container scan if image provided
    if [ -n "$image_name" ]; then
        if ! run_container_scan "$image_name"; then
            echo "Container scan failed"
            exit 1
        fi
    fi
    
    echo "Security pipeline completed successfully"
}

# Execute if run directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    run_security_pipeline "$@"
fi

# Example security policy automation with Open Policy Agent
package security_policy

# Define critical vulnerability threshold
critical_threshold = 0

# Define high vulnerability threshold
high_threshold = 5

# Policy to check for critical vulnerabilities
deny_critical_vulns[msg] {
    input.vulnerabilities[_].severity == "CRITICAL"
    msg := "Critical vulnerability detected, deployment blocked"
}

# Policy to check for excessive high vulnerabilities
deny_excessive_high_vulns[msg] {
    high_vulns = [vuln | input.vulnerabilities[_] with input as {"severity": "HIGH"}]
    count(high_vulns) > high_threshold
    msg := sprintf("Too many high vulnerabilities (%d > %d), deployment blocked", [count(high_vulns), high_threshold])
}

# Policy for secure configuration
deny_insecure_config[msg] {
    input.config.allow_root_login == true
    msg := "Root login is not allowed"
}

# Policy for secure network configuration
deny_insecure_network[msg] {
    input.network.security_groups[_].allow_all_traffic == true
    msg := "Allow all traffic is not permitted"
}

#!/bin/bash
# Automated policy enforcement script
POLICY_DIR="/etc/security-policies"
POLICY_ENGINE="opa"

# Function to validate infrastructure code against policies
validate_infrastructure_code() {
    local code_file="$1"
    local policy_file="$2"
    
    echo "Validating $code_file against $policy_file..."
    
    # Run OPA validation
    opa eval \
        -i "$code_file" \
        -d "$policy_file" \
        "data.security_policy.deny" \
        --format=json
    
    local exit_code=$?
    
    if [ $exit_code -eq 0 ]; then
        # Check if there are any violations
        violations=$(opa eval -i "$code_file" -d "$policy_file" "data.security_policy.deny" --format=json | jq -r '.result | length')
        if [ $violations -gt 0 ]; then
            echo "Policy violations found:"
            opa eval -i "$code_file" -d "$policy_file" "data.security_policy.deny" --format=json | jq -r '.result[].expressions[0].value'
            return 1
        fi
    else
        echo "Policy evaluation failed"
        return 1
    fi
    
    return 0
}

# Function to enforce security policies
enforce_security_policies() {
    local target_directory="$1"
    
    echo "Enforcing security policies in $target_directory..."
    
    # Validate all Terraform files
    find "$target_directory" -name "*.tf" -print0 | while IFS= read -r -d '' tf_file; do
        if ! validate_infrastructure_code "$tf_file" "$POLICY_DIR/terraform.rego"; then
            echo "Terraform file validation failed: $tf_file"
            exit 1
        fi
    done
    
    # Validate all Kubernetes YAML files
    find "$target_directory" -name "*.yaml" -o -name "*.yml" -print0 | while IFS= read -r -d '' yaml_file; do
        if ! validate_infrastructure_code "$yaml_file" "$POLICY_DIR/kubernetes.rego"; then
            echo "Kubernetes file validation failed: $yaml_file"
            exit 1
        fi
    done
    
    echo "Security policy enforcement completed successfully"
}

# Main execution
if [ $# -eq 0 ]; then
    echo "Usage: $0 <directory_to_validate>"
    exit 1
fi

enforce_security_policies "$1"