Repository navigation
Conversation
The steampipe composite installs a checksum-verified binary and pinned plugins, runs one SQL query with the ambient credentials and writes the JSON result. drift.py compares aws_tagging_resource rows with the org register: live resources missing required tags (untagged), live resources whose ARN name matches no register identifier (unmanaged) and register records whose identifier matches no live ARN (orphaned); records with no stated identifier are reported as unmatchable rather than orphaned. To make that match possible, inventory records gain an identifier: the cloud-side name stated in the plan (bucket, function_name, name, ...) or template (BucketName, FunctionName, ...), null when apply time generates it. asset-drift.yml assumes a read-only OIDC role, queries the account, downloads and verifies the register release, runs the comparison, keeps the evidence 90 days and maintains one tracking issue per account. The IAM policy for the role is documented; mods such as steampipe-mod-aws-tags now run under Powerpipe and are noted rather than wired. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #117. Stacked on #166 (
issue-116-asset-register) forassets.json; retarget once that merges.Deviation from the issue
Since Steampipe 1.0 the benchmark runner (
steampipe check) lives in Powerpipe, so runningsteampipe-mod-aws-tagswould add a second binary and a mod checkout. The mandatory-tag control that mod implements is one query overaws_tagging_resource, so this PR runs that query directly and documents the mods (AWS, GCP, Azure) as the Powerpipe route. Say the word if the mod should be wired anyway.What
.github/actions/steampipe: pinned Steampipe2.4.7verified against the publishedchecksums.txt, plugins by version (aws@1.34.0),steampipe query --output jsonwith the ambient credentials; emptyqueryinstalls only. Update checks and telemetry off. Outputsrow-count,output-file.drift.py(stdlib, next to the composite):--live rows.json --register assets.json --account ID --required-tags ...→drift.jsonand a report with the<!-- asset-drift -->marker: untagged, unmanaged, orphaned, unmatchable and managed lists, one warning annotation per finding, outputs the three counts. Account filtering keeps live rows of that account and register records of that account or with no account.inventory.py(from Asset inventory and tag-grouped diagram from plan and synth output (#115) #165) gainsidentifier: the cloud-side name stated in the plan (bucket,function_name,identifier,cluster_identifier,cluster_name,table_name,repository_name,domain_name,name) or template (BucketName,FunctionName,RoleName, ...), null when generated at apply time. Schema and docs updated; the feat: inventory — asset inventory and tag-grouped diagram from plan/synth output (PR/CI) #115 suite asserts it.asset-drift.yml(workflow_call): inputs from the issue plusissueandactions-ref.aws-oidc-auth→ account id → steampipe query →gh release download asset-register-<ref>from this repo withSHA256SUMScheck →drift.py→ artefactasset-drift-<account>withretention-days: 90→ per-account tracking issue ("Asset drift: account ") opened, updated or closed. Caller grantsid-token: write,contents: read,issues: write.tag:GetResources,tag:GetTagKeys,tag:GetTagValues,sts:GetCallerIdentity) indocs/oidc-trust-policies.md;steampiperow indocs/approved-actions.md; README rows and section with the egress hosts and the GCP/Azure notes. Thedocs/egress-allowlist.mdrow waits for feat(#83): harden-runner block mode with per-job egress allowlists #139 like the other stacks.Asset Driftjob: the composite installs the binary and the aws plugin (no credentials, no query), then the drift fixtures run.Tests
tests/asset-drift/run.sh: recordedaws_tagging_resourcerows (two accounts) and a register fixture; exact untagged (with missing keys), unmanaged, orphaned, unmatchable and managed sets for one account, counts without the filter,--required-tags owner, report heading and rows, annotations, outputs, usage error. Steampipe install, plugin install and the query JSON shape were verified locally with 2.4.7.Deferred
🤖 Generated with Claude Code
https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF