Repository navigation
Conversation
…ss-check Add docs/dr-checklist.md: the three tiers (A 1 h RTO / 15 min RPO, B 24 h / 24 h, C rebuilt from code), a control and minimum tier for every id in policies/dr, the strict-checks list per tier, the two suppression reasons (tier or exception issue) and the manual controls with the evidence to record. The compliant pass fixture moves to docs/examples/dr/aws/main.tf with a comment per resource naming the checks it satisfies, so there is one copy that both documents and tests the pack. tests/dr-check/run.sh now scans every docs/examples/dr/* directory and fails on any finding, and diffs the ids in the checklist table against checks.txt and the SPK_DR_* policies so the two cannot drift. CI's dr-check job points at the example. README and CONTRIBUTING link the checklist. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| CHECKLIST="${ROOT}/docs/dr-checklist.md" | ||
| [ -f "${CHECKLIST}" ] || fail "${CHECKLIST} missing" | ||
| policy_ids="$({ grep -oE '^[A-Z_0-9]+' "${POLICIES}/checks.txt"; grep -hoE 'SPK_DR_[0-9]+' "${POLICIES}"/spk_dr_*.yaml; } | sort -u)" | ||
| doc_ids="$(grep -oE '^\| `[A-Z_0-9]+` \|' "${CHECKLIST}" | grep -oE '[A-Z_0-9]+' | sort -u)" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #95. Stacked on #172 (
issue-93-dr-check); retarget tomainonce that merges.What
docs/dr-checklist.md: the three tiers (A 1 h RTO / 15 min RPO, B 24 h / 24 h, C rebuilt from code), a control, resource and minimum tier for every id inpolicies/dr(16 checkov ids plusSPK_DR_1–SPK_DR_4), thestrict-checkslist per tier, the two suppression reasons (Tier C, ...orexception #<issue>, ...from the docs: findings — finding-to-SLA mapping and exception template #81 form) and the manual controls with the evidence to record in the consuming repository's README.docs/examples/dr/aws/main.tf: the compliant pass fixture moved here with a comment per resource naming the checks it satisfies. One copy both documents and tests the pack.tests/dr-check/run.sh: scans everydocs/examples/dr/*directory and fails on any finding; diffs the ids in the checklist table againstchecks.txtand theSPK_DR_*policies so the two cannot drift. The CIdr-checkjob runs this script and points its composite step at the example.Not in this PR
Resourcecolumn and the PR comment's remediation text give the attribute to set).NagSuppressionsmapping: they arrive with feat: DR readiness — cdk-nag resilience rules for AWS CDK (PR/CI) #94 (dr-check-cdk.yml).Testing
tests/dr-check/run.shgreen locally with checkov 3.3.27: example scans clean, checklist ids match the policies, fail fixture still produces the 11 expected findings and 2 skips.🤖 Generated with Claude Code
https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF