Collections

Collections are simple in concept, and open up use cases that cannot be done in any other way; however, their usage can hide intent so use them sparingly. Collections are audits that run against the entire workspace prior to audits for findings. They have the same query behavior as an audit, but are made available in the template context in the collections object as named keys. They can then be used in the audit query, to skip findings, or even to provide values to remediation steps.

Here is an example:

type: Rule
version: v1
...
spec:
  # Collect all azurerm_cosmosdb_account that have a geo_location block.
  # `collections.geo_locations` will be an array of all named matches of
  # the below audit query.
  collect:
    - name: geo_locations
      audit: |
        {{ aResource("azurerm_cosmosdb_account", aBlock("geo_location")) }}

  # Find all azurerm_cosmosdb_account that have automatic_failover_enabled not set to true
  audit: |
    {{ aResource("azurerm_cosmosdb_account", anAttributeValueNotEq("automatic_failover_enabled", "true")) }}

  # Skip findings where there can be no failover because there is only a single location.
  # See the section on Templating for more details.
  skip_finding: |
      let geo_locations = filter(flatten(collect(collections, "geo_locations.*")), { #.name == finding.name }) ?? [];
      len(geo_locations) < 2