Compliance as Code

Implement compliance policies as code for version control and automation:

# compliance-policies.py

from typing import Dict, List
import yaml

class CompliancePolicy:
    def __init__(self, policy_file: str):
        with open(policy_file, 'r') as f:
            self.policies = yaml.safe_load(f)
    
    def evaluate(self, scan_results: Dict) -> Dict:
        """Evaluate scan results against policies"""
        evaluation = {
            'passed': [],
            'failed': [],
            'warnings': []
        }
        
        for policy in self.policies['policies']:
            result = self.evaluate_policy(policy, scan_results)
            
            if result['status'] == 'pass':
                evaluation['passed'].append(result)
            elif result['status'] == 'fail':
                evaluation['failed'].append(result)
            else:
                evaluation['warnings'].append(result)
        
        return evaluation
    
    def evaluate_policy(self, policy: Dict, scan_results: Dict) -> Dict:
        """Evaluate a single policy"""
        policy_id = policy['id']
        policy_type = policy['type']
        
        if policy_type == 'vulnerability_threshold':
            return self.evaluate_vulnerability_threshold(policy, scan_results)
        elif policy_type == 'configuration_check':
            return self.evaluate_configuration_check(policy, scan_results)
        elif policy_type == 'compliance_framework':
            return self.evaluate_framework_compliance(policy, scan_results)
        
        return {'status': 'unknown', 'policy_id': policy_id}

# Example policy file
compliance_policy_yaml = """
version: "1.0"
policies:
  - id: "no-critical-vulns"
    type: "vulnerability_threshold"
    severity: "critical"
    threshold: 0
    enforcement: "mandatory"
    
  - id: "max-high-vulns"
    type: "vulnerability_threshold"
    severity: "high"
    threshold: 5
    enforcement: "warning"
    
  - id: "no-root-user"
    type: "configuration_check"
    check: "runs_as_root"
    expected: false
    enforcement: "mandatory"
    
  - id: "pci-compliance"
    type: "compliance_framework"
    framework: "pci_dss"
    required_score: 1.0
    enforcement: "mandatory"
    
  - id: "image-signing"
    type: "configuration_check"
    check: "image_signed"
    expected: true
    enforcement: "mandatory"
    
exceptions:
  - policy_id: "no-critical-vulns"
    image_pattern: "legacy-app:*"
    expiry: "2024-12-31"
    reason: "Legacy application, migration planned"
"""

Container security compliance requires comprehensive scanning, reporting, and remediation capabilities. By leveraging both Trivy and Snyk with automated workflows and detailed reporting, organizations can maintain compliance while enabling rapid container deployments. The next chapter explores strategies for effective vulnerability remediation in containerized environments.## Vulnerability Remediation Strategies

Discovering vulnerabilities through scanning is only the first step in container security. The real challenge lies in efficiently remediating these vulnerabilities without disrupting application functionality or development velocity. This chapter explores comprehensive remediation strategies, from quick fixes to long-term architectural improvements, providing practical approaches for addressing vulnerabilities detected by Trivy and Snyk in production environments.