Rules

What is a Rule?

In Gomboc, a rule is the executable unit that:

• Finds issues in the Code

• Applies a concrete fix to the code

Rules are implemented in ORL and stored in the Gomboc Rules Service.

The data model has three key objects:

1. Rule A rule-like object with:

   • name - unique internal identifier

   • shortName - display name

   • annotations - key/value tags (e.g., provider, framework, risk)

   • metadata - extra details (for ORL rules: priority, language, etc.)

   • body / data - the ORL rule itself (audit + remediation logic)

2. Classification Arbitrary groupings of rules (e.g., “Encryption at Rest”) Classifications are how we:

   • Group rules into higher-level concepts (policies & frameworks)

   • Tag rules with framework mappings and other metadata

3. Channel A named saved search that returns a set of rules.

   • Example: <tenant-id>/default, or <tenant-id>/ruleset/hardening

   • Gomboc workspaces/scans refer to channels to decide which rules to run

Publish Rules

Learn here how to publish custom rules.

Browsing Rules

The Advanced tab displays the individual rules that make up a policy. This is useful for understanding the granular checks that Gomboc performs.

Rule Information

Each rule in the Advanced view shows:

Field	Description
Severity	The severity level of the rule (Low, Medium, High, Critical)
Risk	The risk level if the rule is violated
Rule	The full rule name and description
Rule ID	A unique identifier for the rule (e.g., gomboc-ai/api_key_authentication_for_hashicorp__aws-resources-aws_appsync_graphql_api)
Provider / Resource	The infrastructure stack this rule applies to

Expanding Rules

Click on any rule row to expand it and view:

• Code Sample: A fixed code example specific to that rule

• Resource: The exact resource type the code applies to

The expandable rows allow you to quickly review multiple rules and their corresponding remediation code.

Example Rule Structure