DR readiness: checkov policy pack and dr-check-tofu reusable workflow (#93)

[ms280690]

Closes #93. Stacked on #141 (issue-6-iac-scan) for the checkov composite; retarget to main once that merges.

What

• policies/dr/checks.txt: the seven AWS checks from the issue plus CKV_GCP_78, CKV_GCP_14, CKV_AZURE_206, CKV_AZURE_94, CKV_AZURE_102, CKV_AZURE_129, CKV_AZURE_136, CKV_AZURE_230, CKV_AZURE_111 (all present in checkov 3.3.27). One id per line with a comment, parsed with grep -oE '^[A-Z_0-9]+' so docs: DR readiness — checklist, RTO/RPO tiers, and suppression conventions #95 can diff it against the checklist.
• policies/dr/spk_dr_{1..4}.yaml graph policies: SPK_DR_1 RDS instance or cluster connected to an aws_backup_selection, SPK_DR_2 EFS connected, SPK_DR_3 DynamoDB connected or point_in_time_recovery.enabled, SPK_DR_4 every backup plan rule has lifecycle.delete_after and a copy_action. The connection policies carry a resource_type filter, because checkov's connection check otherwise also reports on the selection (a selection covering only EFS would fail the RDS rule).
• checkov composite (feat(#6): IaC misconfiguration scan reusable workflow — checkov #141 file): new inputs checks (--check), external-checks-dir, include-passed (drops --quiet, which otherwise removes skipped checks from the JSON) and output results-json; gate.sh unchanged.
• dr-report.py (stdlib): groups failed checks by resource with the check name, checkov's guideline link and a remediation snippet per id, lists checkov:skip comments without a reason (check_result.suppress_comment empty or No comment provided) with a warning each, writes the <!-- dr-check --> comment and the step summary, outputs failed-count, resource-count, unreasoned-skips.
• dr-check-tofu.yml: inputs from the issue plus comment and actions-ref. Advisory run (all ids, fail-on-severity: none, include-passed), report, one updating PR comment (fork PRs skipped), artefact, then the strict run with strict-checks and fail-on-severity: high. plan-json switches to the terraform_plan framework on the plan's directory; policies-ref sparse-checks-out policies/dr from another ref.
• README row and "DR Check (checkov policy pack)" section. CI DR Check job: composite on the compliant fixture (0 findings), the test suite, composite on the non-compliant fixture (11 findings) and the report over it.

Tests

tests/dr-check/run.sh runs real checkov over the fixtures: the compliant stack (versioned and replicated buckets, Multi-AZ RDS with retention, PITR table, ElastiCache snapshots, EFS, KMS-encrypted vault, plan with lifecycle and copy, selection covering RDS and EFS) yields zero findings; the non-compliant stack yields exactly one finding per control (11) and records two skips; dr-report.py output is checked for the heading, grouping, ids, remediation, guideline links, the unreasoned skip listed and the reasoned one not, outputs and the clean heading.

Deferred

• Run against a Sparkgeo Terramate repo with RDS and S3 after merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF