feat: add full bucket data collection#1
Conversation
|
Warning Review limit reached
More reviews will be available in 1 minute. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis PR implements a complete AWS S3 compliance plugin that collects S3 bucket configurations, evaluates bucket policies against configured compliance rules, and reports evidence through the compliance framework. The plugin resolves AWS regions, fetches bucket metadata across accounts/regions, generates policy evidence via a reusable evaluation pipeline, and returns status with error aggregation. ChangesAWS S3 Compliance Plugin Implementation
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/util_test.go`:
- Around line 14-19: The test TestSHA256HexIsStable only checks non-empty and
repeatable output; update it to assert a known, precomputed SHA-256 hex for the
input "bucket-policy": compute the expected digest (as a constant named e.g.
expected) and replace the current if-check with an assertion that first ==
expected (and still ensure second == first), referencing the SHA256Hex function
and TestSHA256HexIsStable to locate the test to change.
In `@main.go`:
- Line 49: Replace the unbounded context created with context.Background() in
Eval with a bounded context (e.g., ctx, cancel :=
context.WithTimeout(parentCtxOrBackground, ExternalCallTimeout)) and use that
ctx for all external calls (AWS SDK calls and submitEvidence); defer cancel()
immediately after creating the context. Update the same pattern for other
external call blocks referenced (lines 94-122) so every external dependency call
uses the bounded ctx; introduce a configurable ExternalCallTimeout constant or
parameter if not present and ensure submitEvidence and AWS client calls accept
the new ctx.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6da0826c-219a-43fe-84aa-6e348f2ea49e
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (12)
.gitignoreMakefilego.modinternal/bucket_apis.gointernal/buckets.gointernal/buckets_test.gointernal/evidence.gointernal/policy_evaluation.gointernal/util.gointernal/util_test.gomain.gomain_test.go
| func TestSHA256HexIsStable(t *testing.T) { | ||
| first := SHA256Hex("bucket-policy") | ||
| second := SHA256Hex("bucket-policy") | ||
| if first == "" || first != second { | ||
| t.Fatalf("SHA256Hex() produced unstable output: %q vs %q", first, second) | ||
| } |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial | ⚡ Quick win
Assert a known digest, not just stability.
Line 17 only verifies non-empty + repeatable output. A deterministic but incorrect implementation would still pass. Add an expected hash assertion for "bucket-policy".
Suggested test update
func TestSHA256HexIsStable(t *testing.T) {
first := SHA256Hex("bucket-policy")
second := SHA256Hex("bucket-policy")
if first == "" || first != second {
t.Fatalf("SHA256Hex() produced unstable output: %q vs %q", first, second)
}
+ if first != "d1089f92b307de96f56fbe535f90f2af70e763353a5f5bfde33935f54f06454f" {
+ t.Fatalf("SHA256Hex() unexpected digest: %q", first)
+ }
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| func TestSHA256HexIsStable(t *testing.T) { | |
| first := SHA256Hex("bucket-policy") | |
| second := SHA256Hex("bucket-policy") | |
| if first == "" || first != second { | |
| t.Fatalf("SHA256Hex() produced unstable output: %q vs %q", first, second) | |
| } | |
| func TestSHA256HexIsStable(t *testing.T) { | |
| first := SHA256Hex("bucket-policy") | |
| second := SHA256Hex("bucket-policy") | |
| if first == "" || first != second { | |
| t.Fatalf("SHA256Hex() produced unstable output: %q vs %q", first, second) | |
| } | |
| if first != "d1089f92b307de96f56fbe535f90f2af70e763353a5f5bfde33935f54f06454f" { | |
| t.Fatalf("SHA256Hex() unexpected digest: %q", first) | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@internal/util_test.go` around lines 14 - 19, The test TestSHA256HexIsStable
only checks non-empty and repeatable output; update it to assert a known,
precomputed SHA-256 hex for the input "bucket-policy": compute the expected
digest (as a constant named e.g. expected) and replace the current if-check with
an assertion that first == expected (and still ensure second == first),
referencing the SHA256Hex function and TestSHA256HexIsStable to locate the test
to change.
1 participant
Summary by CodeRabbit
Release Notes
New Features
Tests