allowed:list

The allowed:list analyser checks if values in a list or map match against a list of allowed values. It can also enforce required values and flag deprecated values.

Configuration

Field	Type	Required	Description
allowed	[]string	No	List of allowed values
required	[]string	No	List of values that must be present
deprecated	[]string	No	List of deprecated values to flag
exclude-keys	[]string	No	For map inputs, keys to exclude from validation
ignore	[]string	No	List of values to ignore during validation
package-match	string	No	If set, treats values as packages and matches package names
key	string	No	For map inputs, uses the value here to lookup the map
not-strict	boolean	No	When false (default), any value not in the allowed list will fail

Common fields

Field	Description	Required	Default
name	The name of the policy - this is the yaml key in the config file when defining the policy.	Yes	-
description	The description of the policy - if specified, it will be used as the heading for the policy in the output.	No	""
input	The input for the policy - used to select the fact plugin to use.	Yes	-
severity	The severity of the policy when breached (low, normal, high, critical)	No	normal
breach-format	The breach template for the policy. The table below shows the available fields.	No	Empty breach template
remediation	The remediation for the policy. The table below shows the available fields.	No	Empty remediation

Breach template

WARNING

TODO: Add information on how to use go template variables.

Field	Description	Required	Default
type	The type of breach.	Yes	""
key-label	The label for the key.	No	""
key	The key.	No	""
value-label	The label for the value.	No	""
value	The value.	No	""

Remediation

Field	Description	Required	Default
plugin	The plugin to use for remediation.	No	"command"
msg	The message to display when remediation completes successfully.	No	"remediation successful"
...	Any fields required by the plugin.	No	-

Supported Input Formats

• FormatListString: Validates each string in the list
• FormatMapString: Validates each value in the map
• FormatMapListString: Validates each string in the lists contained in the map

Example Usage