github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-12 05:58:26 +00:00
Code Issues Projects Releases Wiki Activity

fix(rules): correct indentation

Browse Source 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Leonardo Grasso 2021-02-18 17:39:18 +01:00 committed by poiana
parent 37a6caae12
commit 85db1aa997
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
rules/falco_rules.yaml
View File

@ -1724,10 +1724,10 @@
container.image.repository endswith /prometheus-node-exporter or
container.image.repository endswith /image-inspector))
#602401143452.dkr.ecr is official AWS EKS registry. AWS has different ECR repo per region
#602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy
#602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/kube-proxy
#For this reason we use two macro to match all regions
# 602401143452.dkr.ecr is official AWS EKS registry. AWS has different ECR repo per region
# 602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy
# 602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/kube-proxy
# For this reason we use two macro to match all regions
- macro: allowed_aws_eks_registry_root
condition: >
(container.image.repository startswith "602401143452.dkr.ecr")
@ -1737,6 +1737,7 @@
(allowed_aws_eks_registry_root and
(container.image.repository endswith ".amazonaws.com/amazon-k8s-cni" or
container.image.repository endswith ".amazonaws.com/eks/kube-proxy"))
- macro: aws_eks_image_sensitive_mount
condition: >
(allowed_aws_eks_registry_root and container.image.repository endswith ".amazonaws.com/amazon-k8s-cni")