Variables

Variables provide useful context in that they allow rules behavior to be generalized. The Variables objects (type: Variables) are loaded into variables context and namespaced by the metadata.name. Multiple files can have the same namespaces, in which case they are merged with the one having the higher priority overwriting the lower priority ones (last one wins).

The Variable type object is used to create named variable spaces:

type: Variables
version: v1
metadata:
  name: config # variable namespace
  priority: 5
data:
  # Can be accessed via `{{ vars.config.ENV }}`
  ENV: staging

Use in Rules

Variables are referenced using the vars context in the collect, audit, and remediation[].value templates of a Rule (i.e., {{ vars.<variable namespace>.<variable name> }}).

type: Rule
version: v1
...
spec:
  ...
  remediation:
    - command: replace
      path: body
      value:
        {{ vars.lms_key.arn }}

Loading variables

Variables need to be explicitly loaded via the --vars option.